feat(lab): add isolated Tibia Global login analysis project

[blakinio]

Track B — OTClient to Tibia Global compatibility

This PR is the active implementation lane for Track B otclient-global-login / OTCLIENT-GLOBAL-LOGIN only.

It is not the OTCLIENT-TIBIA-RE official-client reverse-engineering lane and must not take ownership of Track A tasks, PRs, runtime bridge/worldmap work, containers, state directories or mutable paths.

Objective

Prove whether this blakinio/otclient fork can authenticate to and enter official Tibia Global using the repository-owned synology-otclient-01 runner.

Scope

• isolated project under tools/tibia-global-login-lab/**;
• dedicated workflow .github/workflows/tibia-global-login-lab.yml on [otclient, synology];
• task-owned Docker container/volumes/runtime namespace;
• official 15.32 asset materialization through verified changed egress;
• controlled non-OCR HTTP login → one-shot session/character handoff → OTClient game-server/world-entry compatibility experiments;
• credentials/session values are never printed, committed or uploaded.

Repository and research boundary

All material work, decisions, checkpoints, failure classification and next actions for this track stay in blakinio/otclient. Do not search, read, cite, reference or depend on Oteryn repositories/runners/containers for normal continuation. Missing facts are UNKNOWN and must be recovered inside this Track B lane.

Track A official-client-re / OTCLIENT-TIBIA-RE remains independent and owns analysis of the official Linux Tibia client runtime, protocol, structural game state, native actions, worldmap/OTBM evidence and stable bridge.

The two tracks may share synology-otclient-01 only with isolated task-owned container names, volumes, state, displays and loopback ports; no cross-track cleanup or process control is allowed.

Durable state

Current acceptance, live evidence and exact next_action are tracked in:

docs/agents/tasks/active/OTC-20260813-tibia-global-login-lab.md

while this PR remains active. Resolve it from branch feat/OTC-20260813-tibia-global-login-lab and revalidate the live PR head before continuation.

2026-08-14 cross-track oracle correction

Read tools/tibia-global-login-lab/evidence/official-1532-game-login-oracle.md before continuing game-wire experiments. It records the historical exact-SHA Track A oracle and corrects the earlier inference that successful HTTPS use of a full package build string proves the same full string is required on the game socket.

Do not spend another official-service E2E solely on a full-version hypothesis; consume only promoted, non-secret exact-version/wire evidence and compare it with ProtocolGame::sendLoginPacket().

No proprietary Tibia binaries/assets, account credentials, cookies or session keys are committed or uploaded. No OCR/Tesseract is part of the semantic proof path.

2026-08-23 current invocation checkpoint

base_main: cea569af179a40a8abb6cc10c0281e2d9fb91d39
head: fd39cef26b949e44626ea30566544cf6e388a6dd
changed_files: 13
changed_paths_scope: track_b_only
current_package: 15.32.bf29ac
current_official_linux_sha256: ed5469b9fa71349de688f719434d23875f76f28a3ebd08a36d30f7f6da0af6b8
workflow_run: 32655026407
workflow_state_after_two_ordinary_checks: pending
ci: success
track_a_governance: success
secret_bearing_e2e_attempts_this_generation: 1_scheduled
identical_retry_allowed: false

The branch was rebuilt as one current-main child while preserving all unrelated main changes. The workflow now refreshes current assets through WARP, re-verifies the exact-head OTClient binary across container recreation, uses current HTTP package identity 15.32.bf29ac, and does not assume a full build string on the game wire.

The lab workflow path filter no longer includes the task-record path, so a later task-only checkpoint cannot silently schedule a second secret-bearing E2E.

Per the repository anti-stall budget, the exact-head workflow was checked twice while unchanged and remained pending. Do not perform an identical third polling loop in this invocation. The next fresh continuation action is to inspect run 32655026407; if complete, consume its redacted markers/logs. If it repeats structured opcode 0x14, do not retry the same E2E and require a promoted current-build final queue/wire contract before any protocol mutation.

[blakinio]

Closing as superseded for the current OTCLIENT-TIBIA-RE programme. The canonical live path is the official CipSoft Linux client on PR #48; this OTClient-as-game-client lab remains preserved as historical HTTP-login evidence and must not consume the dedicated runner during the official-client phase.

[blakinio]

Coordination correction from the owner, 2026-08-13: this PR is Track B only (otclient-global-login): prove this blakinio/otclient fork can authenticate to and enter official Tibia Global. It must not claim or take over OTCLIENT-TIBIA-RE, which is the separate Track A for reverse engineering the official Linux Tibia client. Both tracks may share synology-otclient-01 only with isolated container/state/display/port namespaces and disjoint owned paths. New work for either track remains repository-only in blakinio/otclient; do not search/read/use Oteryn repositories, runners, containers or state for continuation. The dedicated coordination contract is being added in docs/agents/TIBIA_RESEARCH_TRACKS.md.

[blakinio]

Track B checkpoint (native Linux only): exact head 1d8c3e900e42a48137e5209ee590bd6d7a315f5b adds fixed, non-secret classification for the server login rejection reached by run 31702087216 / job 94453443371 (CLIENT_VERSION_VALUE=1532, PROTOCOL_VERSION_VALUE=1532, client/server lengths 230/148, GAME_LOGIN_ERROR=true). Exact-head run 31702589243 / job 94455122542 is queued on synology-otclient-01 behind the independent Track A run 31702126665. That run has not been cancelled or modified. Next action: inspect the fixed category marker when 31702589243 completes, then continue from that returned category.

[blakinio]

Track B cross-track oracle checkpoint (2026-08-14)

Repository evidence review is now persisted at tools/tibia-global-login-lab/evidence/official-1532-game-login-oracle.md.

Key correction: 15.32.df7b29 is proven as package/HTTPS-login identity, but it is not yet proven to be the version representation serialized by the official game-server login message. The full-version game-wire hypothesis remains UNKNOWN; FULL_CLIENT_VERSION_CALL_FAILED is a real local binding defect only for testing that hypothesis, not a proven root cause of the server-side 0x14 rejection.

Track A exact-SHA evidence (e6c244bd39fe2e0632f6f000efd3147164696efa8e901718668e0442325ff7fe) provides a direct official oracle: workflow run 31652067802, job 94298391194 resolved tibia::authentication::TLoginProtocolMessageHandler::sendLoginMessage to static target 0xcf2ca0 (plus the surrounding login transition path). Track B run 31706716385 already proves the current OTClient first packet reaches the endpoint and returns opcode 0x14.

Decision: before another official-service E2E solely for the full-version hypothesis, obtain/consume a non-secret exact-SHA structural contract from the official sendLoginMessage @ 0xcf2ca0, compare its ordered public fields/types/widths with ProtocolGame::sendLoginPacket(), and patch only the first proven semantic/layout delta. No session/character/payload values are required or permitted in that contract.