glass beadian 4a0d398a76 fix: Matrix SSO via dedicated hub appservice (AS register + get_token impersonation) ... The live tuwunel does not offer m.login.jwt (the jwt.* flat config keys were inert), so the JWT broker flow could never work. Pivot: appservice.hub owns the exclusive hub_* namespace on the homeserver; POST /matrix/session now registers @hub_<username> with the as_token and mints a single-use m.login.token via login/get_token (?user_id= impersonation). Optional MATRIX_SSO_HS_TOKEN authenticates inbound appservice transactions, acked by the new MatrixAppserviceController sink. Response shape unchanged.		2026-10-13 15:29:16 +00:00
..
governance-sim.mjs	fix: Matrix SSO via dedicated hub appservice (AS register + get_token impersonation)	2026-10-13 15:29:16 +00:00