Implement Channel Points Twungeon MVP

2026-08-17 07:16:13 -07:00
parent 21b845d16e
commit 222cf903f6
33 changed files with 4399 additions and 75 deletions
@@ -0,0 +1,64 @@
+# Testing Twungeon
+
+## Automated gates
+
+From a clean checkout:
+
+```bash
+npm install
+npm run lint
+npm run typecheck
+npm test
+npm run test:integration
+npm run build
+```
+
+`npm test` covers deterministic domain rules and 500 generated floors.
+`npm run test:integration` covers the HTTP/session boundary and independent
+viewer authority. Tests use injected clocks, IDs, random rolls, and synthetic
+Twitch identities; they do not require credentials.
+
+## Local gameplay verification
+
+1. Run `npm run dev` and open `http://localhost:3000`.
+2. Confirm the exact dormant banner appears and no timer runs.
+3. Use **Local viewer login** to spawn and bind a viewer.
+4. Confirm 3 HP, 2 AP, no Guard, a ready heal, and a 25-second phase.
+5. Exercise movement, invalid walls, Attack, Heal, and Pass. Invalid actions
+   must not consume AP.
+6. Open a second browser/private window with a different ID. Confirm both
+   characters share the dungeon but each controller spends only its own AP.
+7. Refresh during a phase. Confirm a snapshot restores the map/log and no
+   command replays.
+8. Run `npm run build && npm start` and repeat the smoke test against the built
+   server.
+
+The local-only endpoints `/api/dev/spawn` and `/api/dev/redemption` exist only while
+`TWITCH_ENABLED` is false.
+
+## Live-channel campaign
+
+After completing `docs/twitch-setup.md`, use two follower accounts and one
+non-follower account. Capture redacted evidence for:
+
+- eligible, ineligible, and duplicate `!spawn` attempts;
+- matching and mismatched Extension identities;
+- independent commands from two viewers;
+- phase expiry and AutoGuard while one viewer is disconnected;
+- death and a configured Channel Points reward redemption from the same user;
+- escape with the Goblin alive, floor revival, and a total-party wipe;
+- refresh/reconnect during a phase and transition; and
+- repeated floors and a short soak session.
+
+Do not record tokens, JWTs, secrets, or complete authorization headers. Use the
+acceptance matrix in `Twungeon_MVP_Acceptance_Test_and_Build_Checklist.md` for
+AT-001 through AT-033 evidence. Automated passing tests do not substitute for
+the clean-operator, live Twitch, first-time-viewer, or concept-validation gates.
+
+## Fault injection
+
+Test each failure separately: expired Extension JWT, wrong channel claim,
+unlinked identity, invalid broadcaster token, missing follower scope, Twitch
+chat disconnect, wrong/duplicate Channel Points redemption, WebSocket interruption, and
+stale run/floor/phase command. Expected behavior is a stable rejection or a
+fresh snapshot without partial game-state mutation.