SITES_TEST.md

@@ -1,89 +0,0 @@
-# ChatGPT Sites portability test
-
-## Goal
-
-Deploy the existing Airship Phaser client to ChatGPT Sites without moving game state, identity, multiplayer authority, persistence, or server-side game logic out of Arrowstack.
-
-Sites should act only as a replaceable presentation/runtime surface.
-
-## Source
-
-Branch: `sites-test`
-
-Current build:
-
-- Package manager: npm
-- Dev server: `npm run dev`
-- Production build: `npm run build`
-- Build output: Vite `dist/`
-- Client framework: Phaser 3
-- Authentication client: Keycloak JS
-- Existing API: `https://game.arrowstack.dev`
-- Existing WebSocket server: `wss://game.arrowstack.dev`
-
-## Phase 1 — host the client unchanged
-
-Deploy this existing project with Sites.
-
-Requirements:
-
-1. Preserve the existing Phaser game, assets, controls, game logic, and Vite build.
-2. Do not migrate the Go multiplayer server into Sites.
-3. Do not add D1, R2, Sites-hosted persistence, or a replacement authentication system.
-4. Continue using the existing Arrowstack API and WebSocket endpoints.
-5. If Keycloak authentication or multiplayer is blocked by the new Site origin, keep the game usable in its existing solo/fallback mode rather than replacing the integration.
-6. Report the exact production Site origin after a successful deployment.
-7. Do not weaken CORS or WebSocket origin checks.
-
-Acceptance for Phase 1:
-
-- Vite production build succeeds.
-- Phaser canvas loads.
-- Existing sprites/assets load.
-- Desktop controls work.
-- Mobile/touch controls render and accept input.
-- Solo gameplay reaches the normal playable state.
-- Browser console has no fatal runtime errors caused by Sites hosting.
-
-## Phase 2 — reconnect Arrowstack identity and multiplayer
-
-After Sites returns the production origin, configure Arrowstack for that exact origin.
-
-Keycloak client: `airship-web`
-
-Add the Site origin to the client's allowed web origins and add a valid redirect URI covering the Site URL, including the existing `silent-check-sso.html` flow.
-
-Airship Go server:
-
-Append the exact Site origin to `ALLOWED_ORIGINS`. The current server intentionally uses this allowlist for both HTTP CORS and WebSocket `CheckOrigin`.
-
-Then verify:
-
-- Keycloak check-sso succeeds.
-- `GET /api/me` succeeds with the bearer token.
-- `POST /api/ws-ticket` succeeds.
-- `wss://game.arrowstack.dev/ws` connects using the ticket.
-- Multiplayer snapshots arrive.
-- Existing authoritative server behavior is unchanged.
-
-## Ownership constraint
-
-Do not move durable game state, identity, multiplayer authority, persistence, or server-side rules into ChatGPT Sites as part of this test.
-
-The desired boundary is:
-
-```text
-ChatGPT Sites
-└── Airship Phaser client
-      ├── HTTPS -> game.arrowstack.dev
-      └── WSS   -> game.arrowstack.dev
-
-Arrowstack
-├── Keycloak identity
-├── authoritative game server
-├── multiplayer state
-├── persistence
-└── game rules
-```
-
-The experiment is successful if the Sites frontend can be deleted or replaced without migrating any authoritative state back out of Sites.