airship-phaser/SITES_TEST.md

ChatGPT Sites portability test

Goal

Deploy the existing Airship Phaser client to ChatGPT Sites without moving game state, identity, multiplayer authority, persistence, or server-side game logic out of Arrowstack.

Sites should act only as a replaceable presentation/runtime surface.

Source

Branch: sites-test

Current build:

• Package manager: npm
• Dev server: npm run dev
• Production build: npm run build
• Build output: Vite dist/
• Client framework: Phaser 3
• Authentication client: Keycloak JS
• Existing API: https://game.arrowstack.dev
• Existing WebSocket server: wss://game.arrowstack.dev

Phase 1 — host the client unchanged

Deploy this existing project with Sites.

Requirements:

1. Preserve the existing Phaser game, assets, controls, game logic, and Vite build.
2. Do not migrate the Go multiplayer server into Sites.
3. Do not add D1, R2, Sites-hosted persistence, or a replacement authentication system.
4. Continue using the existing Arrowstack API and WebSocket endpoints.
5. If Keycloak authentication or multiplayer is blocked by the new Site origin, keep the game usable in its existing solo/fallback mode rather than replacing the integration.
6. Report the exact production Site origin after a successful deployment.
7. Do not weaken CORS or WebSocket origin checks.

Acceptance for Phase 1:

• Vite production build succeeds.
• Phaser canvas loads.
• Existing sprites/assets load.
• Desktop controls work.
• Mobile/touch controls render and accept input.
• Solo gameplay reaches the normal playable state.
• Browser console has no fatal runtime errors caused by Sites hosting.

Phase 2 — reconnect Arrowstack identity and multiplayer

After Sites returns the production origin, configure Arrowstack for that exact origin.

Keycloak client: airship-web

Add the Site origin to the client's allowed web origins and add a valid redirect URI covering the Site URL, including the existing silent-check-sso.html flow.

Airship Go server:

Append the exact Site origin to ALLOWED_ORIGINS. The current server intentionally uses this allowlist for both HTTP CORS and WebSocket CheckOrigin.

Then verify:

• Keycloak check-sso succeeds.
• GET /api/me succeeds with the bearer token.
• POST /api/ws-ticket succeeds.
• wss://game.arrowstack.dev/ws connects using the ticket.
• Multiplayer snapshots arrive.
• Existing authoritative server behavior is unchanged.

Ownership constraint

Do not move durable game state, identity, multiplayer authority, persistence, or server-side rules into ChatGPT Sites as part of this test.

The desired boundary is:

ChatGPT Sites
└── Airship Phaser client
      ├── HTTPS -> game.arrowstack.dev
      └── WSS   -> game.arrowstack.dev

Arrowstack
├── Keycloak identity
├── authoritative game server
├── multiplayer state
├── persistence
└── game rules

The experiment is successful if the Sites frontend can be deleted or replaced without migrating any authoritative state back out of Sites.