railiance-platform/docs/playwright-consumer-access.md

# Playwright consumer access

The release 0.1.0 pilot is running in namespace `playwright` on railiance01.
Platform owns its lifecycle and the `playwright-consumers` group binding;
rapp-playwright owns the browser implementation, package Role and client.

The initial membership policy includes all identified platform humans and coding
agents. The group binding is installed and tested. Mapping authenticated platform
identities into that Kubernetes group is still open in RPF-WP-0056-T03; a KeyCape
group alone would not establish Kubernetes access. No administrator kubeconfig
is distributed and no broad `system:authenticated` binding is installed.

## Prepared consumer setup — activation pending

The helper and commands below are ready for owner integration. They are not a
claim that the registrations, JWT authenticator or general consumer transport
are active. The [owner handoff](playwright-identity-handoff.md) lists the remaining
changes and native acceptance checks. No further membership decision is needed.

After owner activation, use a private directory outside any Git worktree and a
new token output path. `keycape` is the identity owner's native CLI:

```sh
install -d -m 700 "$HOME/.local/state/playwright-consumer"
keycape login --issuer https://kc.coulomb.social \
  --client-id playwright-cli --audience playwright-kubernetes \
  --scope 'openid profile groups playwright:connect' \
  --redirect-uri http://127.0.0.1:18764/callback \
  --out "$HOME/.local/state/playwright-consumer/token.json"
```

Registered coding agents instead use `keycape service-token` with their own
Playwright client ID, audience `playwright-kubernetes`, scope `playwright:connect`,
and `--secret-env` naming the variable populated by their governed custody route.
Client registration and delivery are still pending; existing OpenBao/approval
client credentials must not be reused. Tokens expire; authenticate again into a
new private file and generate a new kubeconfig for renewal. There is no refresh
token, secret provisioning or unattended human login in this helper.

From this repository, create the isolated consumer configuration:

```sh
python3 scripts/playwright_consumer.py setup \
  --token-file "$HOME/.local/state/playwright-consumer/token.json" \
  --out "$HOME/.local/state/playwright-consumer/kubeconfig.json"
```

Setup embeds only the public CA, exec helper and token file path. It refuses
overwrites. The helper checks destination and CA before reading a mode-0600
token, then supplies a Kubernetes ExecCredential through kubectl's pipe. Local
claim checks are misuse protection; Kubernetes must verify the JWT signature.
The public CA was read from `playwright/kube-root-ca.crt` on the pinned cluster
UID `a553c742-0115-43d4-99a4-a5ca56fe0786`; its SHA-256 is
`794d3badd7c3743fe66c3671e7f152277f2ac9adddbc5cebe534802432861bd7`.
CA rotation requires a reviewed source update.

The owner-supported API transport must expose the TLS API on
`https://127.0.0.1:16444`. The existing local ops-bridge tunnel is
`k3s-api-railiance01`; its configured actor is workstation-specific and must not
be shared with other users or agents. Each caller needs their own supported
transport identity. With that route active, verify and forward:

```sh
python3 scripts/playwright_consumer.py verify \
  --kubeconfig "$HOME/.local/state/playwright-consumer/kubeconfig.json"
kubectl --kubeconfig "$HOME/.local/state/playwright-consumer/kubeconfig.json" \
  --context playwright -n playwright port-forward deployment/playwright \
  18081:8080 --address 127.0.0.1
```

Verification requires the unmodified generated kubeconfig, reads the actual API
identity using SelfSubjectReview, and checks nine allowed/denied permissions.
It rejects administrator identities and added impersonation settings. Its
value-safe JSON result can be retained as an identity receipt. Run it separately
for a human and a coding agent; then run each browser trial through that caller's
forward. Existing port-forwards must be stopped separately during revocation;
token expiry or client disablement does not prove an established stream closed.

In another terminal, from the existing rapp-playwright checkout:

```sh
python3 client/rapp_playwright.py preflight
python3 client/rapp_playwright.py trial --out .local/first-managed-trial
```

Use a new output directory each time. Keep `run.json` private: it contains the
run capability. Download retained receipts/screenshots before the one-hour
artifact expiry. Current targets are the bundled fixture and public OnCo home
page; additional target admission remains separate from group membership.

## Existing operator evidence

Platform can recheck the native permission boundary without changing grants:

```sh
python3 scripts/verify_playwright_access.py --output /tmp/playwright-rbac.json
```

The verifier uses administrator impersonation solely for authorization checks.
Its success is not consumer-login proof. It checks the cluster UID, exact Role
and group binding, allowed discovery/forwarding and denied exec, Secrets,
workload writes, foreign scope and nonmembers.

October 13 evidence: [RBAC](evidence/2026-10-13-playwright-rbac.json),
[runtime and restart](evidence/2026-10-13-playwright-managed/runtime.json),
[responsive keyboard trial](evidence/2026-10-13-playwright-managed/receipt.json).
Native operator-driven trials passed before and after a same-image restart;
completed screenshots survived with identical hashes. Actual consumer login,
abrupt-interruption recovery and cross-version rollback remain unproven.