# Casino Partner Integration Checklist

## Staging

- Start with `docs/staging-integration-start-here.md`.
- Use staging base URL `https://staging-games.rougereels.com`.
- Use operator id `bspin-staging`.
- Use staging currency `USD`.
- Confirm the casino callback base URL is `https://podrum.supersport.club:49165/CasinoRougeReelsApi`.
- Confirm Vercel staging has `OPERATOR_SECRET_BSPIN_STAGING`.
- Confirm `GET https://staging-games.rougereels.com/health`.
- Confirm `GET https://staging-games.rougereels.com/ready?operatorId=bspin-staging`.
- Review `docs/casino-demo-package.md` for iframe launch examples, docs package links, wallet callback contract, and staging test evidence list.
- Generate a casino launch token for `bspin-staging`.
- Open a staging iframe URL with `operatorId=bspin-staging`, one enabled game, and the casino launch token.
- Verify the casino-provided balance appears inside the embedded game.
- Place one Dice bet and confirm debit, credit when applicable, rollback behavior, and idempotency evidence.
- Run `docs/postman_collection.json` from top to bottom once the casino callback endpoints are connected.
- Save evidence for one settled round, one identical idempotent retry, one idempotency conflict, and one rolled-back failed round.
- Implement signed callback endpoints for validate session, balance, debit, credit, and rollback.
- Confirm idempotency keys return the original response on repeat requests.
- Confirm insufficient balance returns a stable error without changing balance.

## Optional Local Sandbox

- Use `docs/sandbox-integration-guide.md` only for local/demo testing with the built-in `demo` operator and `sandbox://demo-casino`.
- Do not send the local sandbox guide as the primary casino staging path.
- Use `/sandbox/launch` only for local/demo testing, not for `bspin-staging`.

## Game Launch

- Generate signed launch URL or launch token.
- Include operator id, game type, player session reference, issued timestamp, and signature.
- Open the game client in an iframe or new tab.
- When the player changes casino currency, create a new launch token for the matching operator-currency profile and send `ROUGE_REELS_SWITCH_CURRENCY` to the iframe.
- Confirm the iframe replies with `ROUGE_REELS_SWITCH_CURRENCY_RESULT` and shows the new casino-provided balance, currency, limits, and stake step.

## Wallet

- Treat casino wallet as the only source of truth.
- Choose one active currency for each operator profile, such as `USD` or `uBTC`.
- Send all provider-facing balances and money movements in the configured operator/session currency.
- Create separate operator-currency profiles when the casino wants multiple playable currencies.
- Keep FX conversion inside the casino platform before calling Rouge Reels.
- Never let the game client directly modify balance.
- Use backend-to-backend wallet calls only.
- Confirm the game client displays the casino-provided balance after session validation and after bet settlement.
- Confirm debits happen before result generation and credits happen only after a winning result.
- Confirm rollback refunds a successful debit when settlement fails.
- Reconcile provider records against casino records.

## Audit Evidence

- Capture the `roundId` for a settled round and confirm `/api/bets/{roundId}` returns fairness proof, casino transaction references, and callback audit.
- Capture the `roundId` for a rolled-back round and confirm the dispute packet includes the debit and rollback callback audit.
- Confirm `/api/reconciliation` contains the matching debit, credit, and rollback rows.
- Confirm the operator dashboard shows the same round trail support would use for a casino dispute.

## Go-Live

- Verify enabled games, currency-specific min/max bets, max payout, stake step, and wallet callback behavior.
- Confirm production uses Postgres/Supabase storage, real operator secrets, and HTTPS callback URLs.
- For Bspin production, use operator id `bspin-production`, Vercel secret `OPERATOR_SECRET_BSPIN_PRODUCTION`, and `READINESS_OPERATOR_ID=bspin-production`.
- For Bspin production, store `callback_base_url` as `https://rougereelsapi.bspin.io`; Rouge Reels appends `/wallet/<action>`, so the expected balance callback is `https://rougereelsapi.bspin.io/wallet/balance`.
- Do not store `https://rougereelsapi.bspin.io/wallet/` as `callback_base_url`, because that would produce duplicated paths such as `/wallet/wallet/balance`.
- Set `ADMIN_API_TOKEN` in production and require `Authorization: Bearer <ADMIN_API_TOKEN>` for operational round access.
- Confirm production wallet retry cron uses `CRON_SECRET` and defaults to `READINESS_OPERATOR_ID=bspin-production` when no `operatorId` query parameter is supplied.
- Confirm `GET /ready?operatorId=bspin-production` returns `status: "ready"` without exposing secrets.
- Bspin launch status: legal review is complete, external certification is not required for this launch, and security recheck remains required before real-money traffic.
- Confirm `GET /health` returns `status: "ok"` with `currency: "multi"` and the expected `supportedCurrencies`.
- Review fairness docs and seed reveal process.
- Run duplicate request, timeout, rollback, failed credit, pending credit retry, pending rollback retry, and protected cron tests.
- Confirm support teams can search a round id and see the full dispute trail.
- Complete legal, certification, and jurisdiction review where required.