docs: MVP vertical slice planning doc for client-server wiring

- Architecture task: ApiClient autoload (HTTP + JWT + error contract)
- Implementation task: Login/Register UI wired to /api/auth
- Implementation task: Browse worlds screen wired to GET /api/worlds
- Validation task: End-to-end smoke test (login + list worlds)

backend/alembic/env.py

@@ -8,7 +8,7 @@ from sqlalchemy.ext.asyncio import create_async_engine
 
 from app.config import settings
 from app.database import Base
-from app.models import user, session, world, asset, world_visit  # noqa: F401
+from app.models import user, session, world, asset  # noqa: F401
 
 # this is the Alembic Config object, which provides
 # access to the values within the .ini file in use.

backend/alembic/versions/0001_initial.py

@@ -69,7 +69,8 @@ def upgrade() -> None:
         sa.Column(
             "visibility",
             postgresql.ENUM(
-                "public", "private", "friends_only", name="world_visibility"
+                "public", "private", "friends_only", name="world_visibility",
+                create_type=False,
             ),
             nullable=True,
         ),
@@ -89,7 +90,7 @@ def upgrade() -> None:
             "asset_type",
             postgresql.ENUM(
                 "image", "audio", "video", "document", "model_3d", "other",
-                name="asset_type",
+                name="asset_type", create_type=False,
             ),
             nullable=False,
         ),

backend/alembic/versions/0003_add_discovery_metadata.py

@@ -1,104 +0,0 @@
-"""add discovery metadata to worlds and create world_visits
-
-Revision ID: 0003_add_discovery_metadata
-Revises: 0002_add_date_of_birth_to_users
-Create Date: 2025-01-02 00:00:00.000000
-
-"""
-from typing import Sequence, Union
-
-from alembic import op
-import sqlalchemy as sa
-from sqlalchemy.dialects import postgresql
-
-# revision identifiers, used by Alembic.
-revision: str = "0003_add_discovery_metadata"
-down_revision: Union[str, None] = "0002_add_date_of_birth_to_users"
-branch_labels: Union[str, Sequence[str], None] = None
-depends_on: Union[str, Sequence[str], None] = None
-
-
-def upgrade() -> None:
-    """Add discovery metadata columns to worlds and create world_visits."""
-    # Add discovery metadata columns to worlds.
-    op.add_column(
-        "worlds",
-        sa.Column("category", sa.String(length=100), nullable=True),
-    )
-    op.add_column(
-        "worlds",
-        sa.Column(
-            "tags",
-            postgresql.ARRAY(sa.String()),
-            nullable=True,
-            server_default="{}",
-        ),
-    )
-    op.add_column(
-        "worlds",
-        sa.Column("play_count", sa.Integer(), nullable=False, server_default="0"),
-    )
-    op.add_column(
-        "worlds",
-        sa.Column("last_played_at", sa.DateTime(timezone=True), nullable=True),
-    )
-
-    # B-tree index on category, GIN index on tags.
-    op.create_index(
-        "ix_worlds_category",
-        "worlds",
-        ["category"],
-        unique=False,
-    )
-    op.create_index(
-        "ix_worlds_tags",
-        "worlds",
-        ["tags"],
-        unique=False,
-        postgresql_using="gin",
-    )
-
-    # Create world_visits table.
-    op.create_table(
-        "world_visits",
-        sa.Column("id", sa.Integer(), primary_key=True),
-        sa.Column("world_id", sa.Integer(), nullable=False),
-        sa.Column("user_id", sa.Integer(), nullable=True),
-        sa.Column("anonymous_token", sa.String(length=255), nullable=True),
-        sa.Column(
-            "visited_at",
-            sa.DateTime(timezone=True),
-            server_default=sa.func.now(),
-        ),
-        sa.ForeignKeyConstraint(
-            ["world_id"], ["worlds.id"], ondelete="CASCADE"
-        ),
-        sa.ForeignKeyConstraint(
-            ["user_id"], ["users.id"], ondelete="CASCADE"
-        ),
-    )
-    op.create_index(
-        op.f("ix_world_visits_id"), "world_visits", ["id"], unique=False
-    )
-    op.create_index(
-        "ix_world_visits_world_id_visited_at",
-        "world_visits",
-        ["world_id", "visited_at"],
-        unique=False,
-    )
-
-
-def downgrade() -> None:
-    """Drop world_visits and discovery metadata columns from worlds."""
-    op.drop_index(
-        "ix_world_visits_world_id_visited_at", table_name="world_visits"
-    )
-    op.drop_index(op.f("ix_world_visits_id"), table_name="world_visits")
-    op.drop_table("world_visits")
-
-    op.drop_index("ix_worlds_tags", table_name="worlds")
-    op.drop_index("ix_worlds_category", table_name="worlds")
-    op.drop_column("worlds", "last_played_at")
-    op.drop_column("worlds", "play_count")
-    op.drop_column("worlds", "tags")
-    op.drop_column("worlds", "category")

backend/app/models/__init__.py

@@ -2,6 +2,5 @@ from app.models.user import User
 from app.models.session import Session
 from app.models.world import World
 from app.models.asset import Asset
-from app.models.world_visit import WorldVisit
 
-__all__ = ["User", "Session", "World", "Asset", "WorldVisit"]
+__all__ = ["User", "Session", "World", "Asset"]

backend/app/models/world.py

@@ -1,4 +1,4 @@
-from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey, ARRAY, Index
+from sqlalchemy import Column, Integer, String, Text, DateTime, ForeignKey
 from sqlalchemy.dialects.postgresql import ENUM
 from sqlalchemy.orm import relationship
 from sqlalchemy.sql import func
@@ -27,17 +27,5 @@ class World(Base):
     created_at = Column(DateTime(timezone=True), server_default=func.now())
     updated_at = Column(DateTime(timezone=True), onupdate=func.now())
 
-    # Discovery metadata
-    category = Column(String(100), nullable=True, index=True)
-    tags = Column(ARRAY(String), nullable=True, server_default="{}")
-    play_count = Column(Integer, nullable=False, server_default="0")
-    last_played_at = Column(DateTime(timezone=True), nullable=True)
-
-    # GIN index on tags for efficient tag-based queries
-    __table_args__ = (
-        Index("ix_worlds_tags", "tags", postgresql_using="gin"),
-    )
-
     owner = relationship("User", back_populates="worlds")
     assets = relationship("Asset", back_populates="world", cascade="all, delete-orphan")
-    visits = relationship("WorldVisit", back_populates="world", cascade="all, delete-orphan")

backend/app/models/world_visit.py

@@ -1,26 +0,0 @@
-from sqlalchemy import Column, DateTime, ForeignKey, Index, Integer, String
-from sqlalchemy.orm import relationship
-from sqlalchemy.sql import func
-
-from app.database import Base
-
-
-class WorldVisit(Base):
-    __tablename__ = "world_visits"
-
-    id = Column(Integer, primary_key=True, index=True)
-    world_id = Column(
-        Integer, ForeignKey("worlds.id", ondelete="CASCADE"), nullable=False
-    )
-    user_id = Column(
-        Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=True
-    )
-    anonymous_token = Column(String(255), nullable=True)
-    visited_at = Column(DateTime(timezone=True), server_default=func.now())
-
-    __table_args__ = (
-        Index("ix_world_visits_world_id_visited_at", "world_id", "visited_at"),
-    )
-
-    world = relationship("World", back_populates="visits")
-    user = relationship("User")

backend/docker-compose.yml

@@ -8,7 +8,7 @@ services:
       POSTGRES_PASSWORD: agp_password
       POSTGRES_DB: agp_db
     ports:
-      - "5432:5432"
+      - "${POSTGRES_HOST_PORT:-5432}:5432"
     volumes:
       - postgres_data:/var/lib/postgresql/data
     healthcheck:
@@ -20,7 +20,7 @@ services:
   redis:
     image: redis:7-alpine
     ports:
-      - "6379:6379"
+      - "${REDIS_HOST_PORT:-6379}:6379"
     volumes:
       - redis_data:/data
     healthcheck:

docs/planning/client-server-wiring.md

@@ -0,0 +1,37 @@
+# MVP Vertical Slice: Client-Server Wiring — Plan
+
+## Goal
+Prove the real Godot client and the real backend can talk: **a user can register/log in
+and see a list of worlds from the game client**. Nothing more. Gameplay, join-a-world,
+chat, avatar, Discovery search/tags/trending, Social/Economy/Trust & Safety are all
+explicitly out of scope.
+
+## Verified backend contract (as of this writing)
+- `POST /api/auth/register` — JSON body `{username, email, password, date_of_birth}`.
+  `date_of_birth` is a `YYYY-MM-DD` string. Returns `201 {access_token, token_type}`.
+  Rejects under-18 with `400`.
+- `POST /api/auth/login` — OAuth2 **form-encoded** (`application/x-www-form-urlencoded`)
+  `username` + `password` (this is NOT a JSON endpoint). Returns `{access_token, token_type}`.
+- `GET /api/worlds` — **requires auth** (`CurrentUser`), returns a JSON array of
+  `{id, name, description, visibility, owner_id, created_at}`. There is no unauthenticated
+  public-worlds path, so the worlds list screen can only be shown after login/register.
+- `GET /api/health` — unauthenticated, `{status, app}`.
+- Base URL: uvicorn default `http://127.0.0.1:8000` (must be configurable in the client).
+- CORS is irrelevant to the native Godot `HTTPRequest` client (no browser origin).
+
+## Task breakdown
+| # | Type | Task | Depends on |
+|---|------|------|-----------|
+| 1 | architecture | `ApiClient` autoload: HTTP + JWT storage + error contract | — |
+| 2 | implementation | Main-menu **login** wiring (form-encoded) | 1 |
+| 3 | implementation | Main-menu **register** wiring (JSON + age gate) | 2 |
+| 4 | implementation | **World list** screen consuming `GET /api/worlds` | 2 |
+| 5 | testing | End-to-end headless smoke test + manual verify | 1,3,4 |
+
+## Design decisions captured (resolved in task 1)
+- Token storage: in-memory singleton property for the MVP; a `save_to_disk` seam is left
+  open but not required yet (no re-login on restart in this slice).
+- Error contract: every call returns a discriminated result (`ok`/`error`) so callers
+  never crash on network failure; non-2xx surfaces `{status, detail}` from the backend.
+- Base URL: read from a ProjectSetting, defaulting to `http://127.0.0.1:8000`.
+- Login is form-encoded; register is JSON — the client helper must support both content types.