Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Heimdall b8b62f10e5 Blank connection targets are refused; pin the app-secret gate on every managed provider ... A connect start naming a connection target already needed the app's own secret, but the gate was pinned for Joystick only and a whitespace or zero-width targetId passed both the start gate and the callback mint. One predicate now serves both; the gate is pinned for twitch, youtube and joystick, and the note for StreamPixels says what its redeem must do. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>		2026-11-08 21:44:30 +00:00
..
app-profiles	Joystick custody needs a creator binding, at start and at the callback	2026-10-19 14:34:24 +02:00
architecture.md	Blank connection targets are refused; pin the app-secret gate on every managed provider	2026-11-08 21:44:30 +00:00
eve-access-plugin.md	Add Eve access plugin and private auth plane	2026-08-22 00:44:57 +02:00
implementation-plan.md	Docs: map managed credential custody, the callback mint and the open follow-ups	2026-10-19 15:49:34 +02:00
joystick-consent-flow.md	Refusal return contract: pin the fragment, carry the attempt id, document it	2026-11-08 13:50:58 +00:00
service-contract.md	Merge heimdall-binds-completion (r2 state binding) into main's link and Google work; gate connect starts that carry a connection	2026-11-05 12:46:05 +00:00
verse-service-contract.md	Docs: startRequiresAppCaller, and Heimdall authenticates while Bifrost issues identity	2026-10-22 18:14:37 +02:00