# Platform sign-in — the phone's own player is the account

## overview.md
```yaml
id: platform-sign-in
title: Platform sign-in — the phone's own player is the account
area: client
summary: On a phone the account is the device's Google Play Games or Game Center player: a first launch signs in silently and lands on the title signed in, with no sign-up screens; email accounts are made on the web only and can be signed into anywhere; Steam is a placeholder; the sign-up's tag question is gone.
repo: land-of-lor (game/world, game/director, ci/, site/src/lib/legal.ts, workshop/marketing)
depends_on: ["server-architecture","store-release"]
parked: false
standing: Built and deployed 2026-09-12; the remaining console switches and device checks are Kris's own.
```

## Where this stands (2026-09-13)

Built on 2026-09-12 from the accounts chat and deployed: the platform layer (silent sign-in
at launch, phones sign in only, email sign-up on the web, the tag question gone), the Android
build with the Play Games plugin, the iOS build with Game Center through GodotApplePlugins, and
the director's Steam placeholder and real Game Center verifier — hardened again by the
2026-09-13 security audit, whose chain pin means the certificate must be Apple's. The evening's
console work landed the Play web client id and the Game Center switches; the four review flags
were cleared by the 2026-09-13 board sweep.
**Kris's own:** the rest of `docs/handoff/platform-sign-in.md` Part 2 — TestFlight testers,
the device checks on both phones, and the stores' target-audience answer (both versions are in
`workshop/marketing/store-listing.md`).
No open issues. Past task files (to 2026-09-13): `workshop/historic-docs/epics/platform-sign-in/tasks/`.

## What this is

Kris, 2026-09-12, after the store-release night: *"What I want is the super simple default of
game center just happening when the user first installs, so we can effectively skip the signup
process completely."* And, on the answer that phones should not sign up by email at all:
*"Perfect solution — no email sign up on phones, only sign in."* Two smaller calls in the same
breath: drop the "Play tag" step from sign-up (off by default, an explicit enable on the
Account page), and placeholder code for a Steam PC release. The screens' look is not this
epic's — a Claude Design pass comes after the store accounts.

## The decisions

- **On a phone the platform player is the account.** Android signs in with Google Play
  Games, iOS with Game Center, silently at first launch; the display name is the platform's
  nickname, the character colour a random seed, tag off. No sign-up screens exist on a phone.
- **Email accounts are made on the web only** (`AccountSession.email_signup_offered()`: the
  web, and the Android e2e build for its emulator walk). A phone keeps email *sign-in* for an
  account made on the web — the remembered-logins list and the email form — so a family's
  accounts made by a parent on spellgrove.com work on a shared tablet.
- **One identity per account stays** (server-architecture/021). A Game Center account works
  on every Apple device with that Apple ID and nowhere else; a Play Games account likewise
  on Android; only an email account travels between platforms. Known limit, accepted for the
  first release: a child who starts on the iPad and later gets an Android phone starts again.
  If that matters later, the kid-safe way back is a link code (which collects nothing), not an
  "add an email" step.
- **No OAuth anywhere** — no Sign in with Google or Apple on the web or in the apps. (Apple's
  guideline 4.8 would also require Sign in with Apple beside any Google sign-in on iOS.)
- **After a sign-out (or a deletion) on a phone, the next launch waits for a tap.** A marker
  (`user://signed_out`) stops the silent sign-in; any sign-in clears it. "New Adventurer" on
  the signed-out title runs the platform's own sheet; "I already have an account" opens the
  sign-in view.
- **The under-13 question is answered by the platforms.** The app never asks a child for an
  email or an age: a Play Games profile for a child is parent-approved through Family Link, a
  Game Center player rides the child's Apple ID. The store declarations
  (`workshop/marketing/store-listing.md`) have both answers written out; Kris picks once the
  sign-in is verified on devices.
- **Game Center through GodotApplePlugins** (Kris's call at the plan review): prebuilt, current,
  a GDExtension that needs no engine build — at the cost of iOS 17 as the minimum, which drops
  2017-era iPads. The official godot-ios-plugins has no Godot 4 binaries.
- **The sideload APK is a Gradle build now**, because a Godot v2 Android plugin only rides in
  one; Kris's phone gets the same sign-in the store build has.

## What only Kris can do

The consoles: the Play Games Services configuration (after the first Play upload — it wants
Play's app-signing certificate), the OAuth clients, the numeric game id and the web client id
into the game, the director's env; the App ID's Game Center capability and the App Store
Connect record; then the device checks. `docs/handoff/platform-sign-in.md`, Part 2, in order.

## Non-goals

- Leaderboards, achievements, cloud saves — the integrations are in place for them, not used.
- Restyling the sign-in screens (Claude Design, after the store accounts).
- Apple root-chain validation of the Game Center certificate (host allowlist, validity dates
  and a replay window are in; the chain is a documented limit).
- GodotSteam itself — the director, the protocol and the client seam are there; the plugin
  waits for a PC build.

## deliverables (0)