From 9ebd1ea2839ae56c7bc0a6525a43da30b16758bb Mon Sep 17 00:00:00 2001 From: Labyricorn Date: Mon, 17 Aug 2026 12:03:37 -0700 Subject: [PATCH] docs: record live Twitch concept milestone --- .../live-twitch-concept-achieved/contents.lr | 70 +++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 .labyricorn/devlog/live-twitch-concept-achieved/contents.lr diff --git a/.labyricorn/devlog/live-twitch-concept-achieved/contents.lr b/.labyricorn/devlog/live-twitch-concept-achieved/contents.lr new file mode 100644 index 0000000..bdee26c --- /dev/null +++ b/.labyricorn/devlog/live-twitch-concept-achieved/contents.lr @@ -0,0 +1,70 @@ +_model: devlog-entry +--- +schema_version: 1 +--- +title: Twungeon reaches a live Twitch concept milestone +--- +date: 2026-08-17 +--- +author: Codex and Christopher Chambers +--- +summary: Twungeon moved from a local proof of concept to a live Twitch-connected deployment with broadcaster OAuth, Extension identity sharing, Channel Points resurrection, a focused viewer control panel, and an authenticated spawn button. +--- +tags: implementation, concept validation, deployment, Twitch, Twitch Extension, OAuth, Channel Points, Twurple, Cloudflare, testing +--- +source_commit: df984690cedf84fc58d3eb6e2000d2df567a8d5d +--- +body: + +Twungeon is now running as a live Twitch-connected concept on the +[Labyricorn Twitch channel](https://www.twitch.tv/labyricorn). The deployed +service connects Twurple chat and EventSub to the broadcaster account, verifies +Twitch Extension identity on the server, and serves the Extension through the +public Cloudflare tunnel at `https://twungeon.labyricorn.com`. + +The authentication path required more than supplying a static token. Twungeon +now provides a confidential OAuth authorization-code flow with state +validation, checks that Twitch returned the configured broadcaster and required +scopes, stores access and refresh credentials outside the repository with +restricted permissions, and persists refreshed credentials atomically. The +Extension exchanges its signed Twitch JWT for a short-lived Twungeon session; +the shared Extension secret remains server-side. + +The first setup attempt exposed several integration mismatches. The original +Twitch application had been registered as a public client before the callback +endpoint existed, so live server authorization required a new confidential +application and the exact HTTPS `/oauth/callback` redirect. Enabling identity +linking also made a privacy notice mandatory before the Extension version could +advance. Both requirements are now reflected in the implementation and operator +documentation. + +The first live Extension view rendered the complete broadcast game instead of +a compact control surface. The shared frontend now switches to a controller-only +layout at `/extension`, while `/` remains the full game view used by the stream. +Cloudflare also continued serving an older JavaScript bundle during testing; +static responses now use `Cache-Control: no-store`, and the Extension loads a +versioned script URL to force the current controller code. + +Spawning revealed one final usability gap. Chat `!spawn` was not sufficient for +the broadcaster because a channel owner cannot follow their own channel, and +the Extension offered no direct alternative. The control panel now includes a +**Spawn character** button backed by an authenticated server endpoint. It uses +the verified Twitch viewer ID, applies the normal follower rule, and treats the +configured broadcaster as eligible. The same eligibility correction also +allows broadcaster chat spawning. + +The current deployment reports healthy with the Twitch adapter ready. Viewers +can authorize their identity, spawn from the Extension, and use the movement, +attack, heal, and pass controls for their own character. The configured custom +Channel Points reward drives resurrection through EventSub. The final automated +run passed linting, strict type checking, 24 domain tests, 10 integration and +multi-viewer tests, and the production build. + +This establishes the live interaction concept, but it is not a claim that every +MVP acceptance gate is complete. Broader real-viewer, multi-viewer, usability, +fault-injection, soak, and independent-operator evidence remains to be recorded. +Game state is still intentionally in memory, so restarting the service starts a +new run. + +The live Twitch integration and spawn-control milestone are recorded in +[commit `df984690cedf84fc58d3eb6e2000d2df567a8d5d`](https://git.labyricorn.com/Labyricorn/Twungeon/commit/df984690cedf84fc58d3eb6e2000d2df567a8d5d).