coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Request Custodian coordination of self-service Playwright access

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13690-09e0-7cd1-964b-ec83cdbcd348
This commit is contained in:
codex 2026-10-13 21:31:32 +02:00
parent cea70051d8
commit 1b2f7ead59
3 changed files with 85 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

59
docs/playwright-identity-handoff.md
View file

@ -5,6 +5,65 @@ The user already admitted all identified platform humans and coding agents.
This handoff implements ADR-0006 without inventing registration acceptance,
distributing admin kubeconfigs or broadening other service credentials.
## Custodian coordination request
Requested outcome: **Enable self-service Playwright access for identified platform
humans and coding agents.** The user authorized sending this cross-repository
delivery request on October 13. The Custodian is asked to establish one accountable
coordinator and link the existing implementation tasks and owner requests to a
source-backed delivery task. Platform acceptance remains RPF-WP-0056-T03; the
coordination request must preserve the existing owner responsibilities and evidence.
Sent to `the-custodian` through State Hub on 2026-10-13 at 19:31 UTC:
`1b279bad-a159-43da-8709-1167882e62f8`. Delivery is confirmed; coordinating-owner
acceptance and source task references remain pending in RPF-WP-0056-T06.
Requirements:
1. All identified platform humans and coding agents initially qualify for
`playwright-consumers`. Their existing identity owners establish identities;
no further membership policy decision is needed from the user.
2. A consumer can follow documented onboarding, authenticate, and use one command
to connect and run a UI trial without operator assistance for each use. Include
renewal, actionable failure messages and cleanup. The current setup helper is
an implementation input; a complete single-command experience remains to deliver.
3. Humans use platform login. Each coding agent uses its own registered identity
and governed credential delivery. No shared administrator kubeconfig or shared
workstation SSH identity is part of consumer onboarding.
4. Preserve the existing namespace-scoped permissions and approved target boundary.
Broad initial eligibility does not grant Secrets, pod exec, workload mutation,
other namespaces or additional browsing targets.
5. Provide supported onboarding, renewal and revocation, including how to terminate
active connections and what remains usable until token expiry.
6. A real human and a real coding agent independently complete identity verification,
permission checks and responsive/keyboard browser trials using the supported
consumer instructions. Native wrong-audience, missing-scope, expired/tampered
token and ineligible-identity attempts fail. No administrator impersonation or
synthetic token test substitutes for these acceptance receipts.
7. Platform and rapp-playwright accept the receipts, publish the consumer instructions
and update managed availability/discovery. Completion means the consumer flow
works, not merely that the coordination messages were delivered.
First delivery should finish the prepared scoped port-forward route, including
supported per-caller API transport. Keep the user-facing requirements independent
of this transport so an existing shared platform access mechanism can replace it
later. A new access gateway is not required for this first delivery.
Requested Custodian return: coordinating owner; source workplan/task identifiers;
linked owner tasks and their dependency order; first executable milestone; and any
specific unresolved decision. Registration, custody and transport implementation
gaps should be assigned to owners rather than returned as another membership
approval question. Do not claim owner acceptance until their responses exist.
Existing implementation follow-ups: railiance-cluster
`0c1023ce-86ac-404a-842e-2f7e1a6d90f1`, KeyCape
`85bf4765-35cc-418f-903b-2dba64e8a06b`, NetKingdom
`c6b4dfb0-44d5-4f12-8854-2c38ab6dc454`, ops-bridge
`c367f3a2-ceba-4ec9-b241-b917c47ba11e`, rapp-playwright
`8d1de2a9-5209-4f82-a2cd-80d8c2e07001`.
## Implementation inputs and owner responsibilities
| Owner | Concrete change | Required return |
| --- | --- | --- |
| railiance-cluster | Review and integrate `config/playwright/authentication-config.candidate.yaml` into the K3s API-server configuration | Native config validation, rollout/recovery receipt, preserved existing authentication, real allowed/denied requests |