Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Heimdall d4cd112193 Blank the refresh token in the fallback write only when it is spent ... A provider that keeps its refresh token valid (Twitch) keeps it when the rotation cannot be committed: the marker is left, the token stays, and the next caller after the backoff presents it. Blanking stays for a revoke and for a provider that rotates (the rotate decision now carries consumedRefreshToken). Live-Postgres test for Twitch written first and seen failing; the contract states the rule inline. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>		2026-11-09 10:22:14 +00:00
..
app-profiles	Joystick custody needs a creator binding, at start and at the callback	2026-10-19 14:34:24 +02:00
architecture.md	Docs: the launch hop, the binding cookie and the callback refusals	2026-10-22 20:13:18 +02:00
eve-access-plugin.md	Add Eve access plugin and private auth plane	2026-08-22 00:44:57 +02:00
implementation-plan.md	Docs: map managed credential custody, the callback mint and the open follow-ups	2026-10-19 15:49:34 +02:00
joystick-consent-flow.md	Refusal return contract: pin the fragment, carry the attempt id, document it	2026-11-08 13:50:58 +00:00
service-contract.md	Blank the refresh token in the fallback write only when it is spent	2026-11-09 10:22:14 +00:00
verse-service-contract.md	Docs: startRequiresAppCaller, and Heimdall authenticates while Bifrost issues identity	2026-10-22 18:14:37 +02:00