88 lines
5 KiB
YAML
88 lines
5 KiB
YAML
project:
|
|
name: Heimdall
|
|
status: active
|
|
phase: service_contract_skeleton
|
|
premise: >
|
|
Build Heimdall as one reusable GameCult auth authority service for OAuth,
|
|
linked identities, local sessions, grants, and capability claims without
|
|
mixing in app-domain audience or product data.
|
|
|
|
objective:
|
|
primary: >
|
|
Create a shared auth authority service that Repixelizer, StreamPixels, and
|
|
future GameCult-hosted experiments can consume.
|
|
current: >
|
|
Lock the Heimdall service boundary, Yggdrasil deployment shape, and app
|
|
integration rules before implementation starts breeding myths.
|
|
|
|
constraints:
|
|
- Heimdall owns auth/control-plane authority; app-domain data stays app-owned by default.
|
|
- Prefer a same-host Heimdall service on Yggdrasil over duplicated per-app provider stacks.
|
|
- Host apps verify signed claims locally for routine guarded routes.
|
|
- App profiles stay thin; the shared architecture note owns the main model.
|
|
- StreamPixels audience and creator data must not be absorbed into a shared auth store.
|
|
|
|
invariants:
|
|
- The map is canonical and slow-changing.
|
|
- Scratch is temporary and disposable.
|
|
- Evidence is durable and distilled; routine activity logs belong in git history and commit messages.
|
|
- Heimdall owns OAuth, local sessions, grants, entitlement refresh, capability evaluation, and audit surfaces.
|
|
- App-domain data stays with the host app unless there is a deliberate, source-grounded reason to share it.
|
|
- Host apps verify signed claims locally and keep resource ownership checks local.
|
|
- StreamPixels can reuse shared auth authority without centralizing streamer-audience data.
|
|
- Persistent state cruft is the same failure class as architecture cruft.
|
|
|
|
data_flow:
|
|
observe:
|
|
- task request
|
|
- shared architecture note
|
|
- app profile bindings
|
|
- current app/runtime seams in Repixelizer and StreamPixels
|
|
- Yggdrasil host topology and nginx/service shape
|
|
process:
|
|
- rehydrate from canonical state
|
|
- choose one bounded architecture or implementation slice
|
|
- keep auth authority and app-domain data boundaries explicit
|
|
- keep routine route auth local after claim verification
|
|
- record only belief-changing evidence
|
|
- commit or backtrack
|
|
cut:
|
|
- reject shared-data creep
|
|
- reject duplicated auth blobs per app
|
|
- reject per-request auth round-trip chatter
|
|
|
|
active_subgoals:
|
|
- Keep the shared architecture explicit and separate from app profiles.
|
|
- Preserve the default boundary that app-domain data remains app-owned.
|
|
- Align the plan to Heimdall as a Yggdrasil-hosted authority service.
|
|
- Define the claim-verification contract that Repixelizer and StreamPixels will consume locally.
|
|
|
|
accepted_design:
|
|
- `docs/architecture.md` is the canonical shared architecture note.
|
|
- `docs/service-contract.md` records the concrete HTTP/JWKS contract of the landed skeleton.
|
|
- `docs/app-profiles/*.md` are thin app bindings, not duplicate brains.
|
|
- Heimdall owns provider OAuth, identity linking, signed local sessions, grants, entitlement refresh, capability evaluation, and audit events.
|
|
- Host apps own their domain data, runtime state, and product-specific resources.
|
|
- Host apps verify signed claims locally for routine route authorization.
|
|
- A shared Heimdall store, if it exists, should hold auth/control-plane truth only.
|
|
- Repixelizer is the first auth-blank hosted-app binding.
|
|
- StreamPixels is the migration case that proves shared authority must not imply audience-data centralization.
|
|
- The first service skeleton is a standalone TypeScript/Fastify app with Ed25519 JWT signing, JWKS discovery, signed OAuth `state`, and app-profile-driven shared capability evaluation.
|
|
|
|
landed_baseline:
|
|
- Shared architecture extracted into its own repo and renamed to Heimdall.
|
|
- Repixelizer and StreamPixels app-profile notes created.
|
|
- Repo-local state, handoff, and compaction scaffolding created.
|
|
- Initial Heimdall service skeleton landed with discovery, JWKS, OAuth start/callback contract surfaces, and claim issuance scaffolding.
|
|
|
|
rejected_paths:
|
|
- name: per_app_auth_copy_paste
|
|
reason: duplicates the same provider/session sludge across every experiment
|
|
- name: per_request_auth_round_trip
|
|
reason: turns shared auth into a noisy bottleneck instead of local claim verification
|
|
- name: shared_user_data_swamp
|
|
reason: reusing auth mechanics does not justify centralizing app-domain audience or product data
|
|
|
|
current_status:
|
|
summary: Heimdall now has a first standalone service skeleton: TypeScript/Fastify runtime, Ed25519 JWT signing, JWKS/discovery exposure, signed OAuth start-state scaffolding, and app-profile-driven claim issuance for Repixelizer and StreamPixels. The key boundary still holds: Heimdall owns auth/control-plane authority and credential custody; app-domain bindings and runtime behavior remain app-owned.
|
|
next_action: Land durable persistence and the first real provider path on top of the skeleton: persisted signing key material, accounts/linked identities/grants, a real provider callback/token exchange slice, and the first end-to-end Repixelizer binding.
|