Document ChatGPT Sites portability test

SITES_TEST.md

@@ -0,0 +1,89 @@
+# ChatGPT Sites portability test
+
+## Goal
+
+Deploy the existing Airship Phaser client to ChatGPT Sites without moving game state, identity, multiplayer authority, persistence, or server-side game logic out of Arrowstack.
+
+Sites should act only as a replaceable presentation/runtime surface.
+
+## Source
+
+Branch: `sites-test`
+
+Current build:
+
+- Package manager: npm
+- Dev server: `npm run dev`
+- Production build: `npm run build`
+- Build output: Vite `dist/`
+- Client framework: Phaser 3
+- Authentication client: Keycloak JS
+- Existing API: `https://game.arrowstack.dev`
+- Existing WebSocket server: `wss://game.arrowstack.dev`
+
+## Phase 1 — host the client unchanged
+
+Deploy this existing project with Sites.
+
+Requirements:
+
+1. Preserve the existing Phaser game, assets, controls, game logic, and Vite build.
+2. Do not migrate the Go multiplayer server into Sites.
+3. Do not add D1, R2, Sites-hosted persistence, or a replacement authentication system.
+4. Continue using the existing Arrowstack API and WebSocket endpoints.
+5. If Keycloak authentication or multiplayer is blocked by the new Site origin, keep the game usable in its existing solo/fallback mode rather than replacing the integration.
+6. Report the exact production Site origin after a successful deployment.
+7. Do not weaken CORS or WebSocket origin checks.
+
+Acceptance for Phase 1:
+
+- Vite production build succeeds.
+- Phaser canvas loads.
+- Existing sprites/assets load.
+- Desktop controls work.
+- Mobile/touch controls render and accept input.
+- Solo gameplay reaches the normal playable state.
+- Browser console has no fatal runtime errors caused by Sites hosting.
+
+## Phase 2 — reconnect Arrowstack identity and multiplayer
+
+After Sites returns the production origin, configure Arrowstack for that exact origin.
+
+Keycloak client: `airship-web`
+
+Add the Site origin to the client's allowed web origins and add a valid redirect URI covering the Site URL, including the existing `silent-check-sso.html` flow.
+
+Airship Go server:
+
+Append the exact Site origin to `ALLOWED_ORIGINS`. The current server intentionally uses this allowlist for both HTTP CORS and WebSocket `CheckOrigin`.
+
+Then verify:
+
+- Keycloak check-sso succeeds.
+- `GET /api/me` succeeds with the bearer token.
+- `POST /api/ws-ticket` succeeds.
+- `wss://game.arrowstack.dev/ws` connects using the ticket.
+- Multiplayer snapshots arrive.
+- Existing authoritative server behavior is unchanged.
+
+## Ownership constraint
+
+Do not move durable game state, identity, multiplayer authority, persistence, or server-side rules into ChatGPT Sites as part of this test.
+
+The desired boundary is:
+
+```text
+ChatGPT Sites
+└── Airship Phaser client
+      ├── HTTPS -> game.arrowstack.dev
+      └── WSS   -> game.arrowstack.dev
+
+Arrowstack
+├── Keycloak identity
+├── authoritative game server
+├── multiplayer state
+├── persistence
+└── game rules
+```
+
+The experiment is successful if the Sites frontend can be deleted or replaced without migrating any authoritative state back out of Sites.