coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Use isolated native Windows browser for attended WSL login
All checks were successful
CCR intake gate / gate (push) Successful in 2m15s
Details
CI Smoke / host-smoke (push) Successful in 1s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1abf1-7e95-7141-87c9-ee78332bf790
This commit is contained in:
codex 2026-11-06 19:53:07 +01:00
parent de06f49037
commit 8519459e6f
4 changed files with 285 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

43
docs/evidence/2026-11-06-operator-browser-native-windows.json Normal file
View file

@ -0,0 +1,43 @@
{
"schema": "railiance-platform.operator-browser-native-windows.v1",
"prepared_at": "2026-11-06T18:49:12.290563+00:00",
"trigger_workplan": "railiance-apps/RAPPS-WP-0014-T03",
"problem": "Founder reports WSL Chrome password/OTP delay, tab/close failures and random wrong controls. Same real-launcher X11/software probe remains unreliable; native Windows Edge disposable-profile probe is founder-confirmed responsive.",
"user_native_windows_verdict": "Everything works normally",
"windows_acl_setup": "Use numeric current-user SID with icacls and verify protected owner-only DACL before browser creation. Set-Acl attempted domain-name translation and failed with a domain trust error; no domain/account setting changed.",
"native_profile": "unique private Windows temporary folder; normal browser profile never selected",
"url_transport": "Authorization URL to PowerShell worker uses stdin, not worker argv/encoded script or a handoff file. Edge receives initial authorization URL as its browser startup argument, as Linux Chromium did. Credential-bearing query keys are refused.",
"native_windows_process_environment": "Clear BAO_TOKEN, VAULT_TOKEN and OPENBAO_TOKEN in child process only",
"callback_allowlist": [
"http://localhost:8250/oidc/callback",
"http://127.0.0.1:8250/oidc/callback"
],
"issuer": "https://kc.coulomb.social",
"wsl_selection": "microsoft in kernel release; fail closed without fallback to shared/default browser",
"non_wsl": "existing pinned Linux Chromium path retained",
"lifecycle": "Owned PID/start-time/executable guards, close after browser exit or 600s, bounded private-profile removal retry",
"tests": {
"operator_unit_cases": 15,
"operator_unit_status": "passed",
"native_fixture": {
"production_guard_refuses_local_fixture": true,
"private_acl_verified_before_launch": true,
"ipv4_and_localhost_redirect_reached": true,
"owned_process_closed": true,
"private_profile_removed": true,
"native_identity_request": false
},
"final_native_windows_credential_query_guard": "passed without browser creation or network request"
},
"sources_sha256": {
"scripts/operator-browser/xdg-open": "a6794d50dbe4131ff2b3fd259365d5f30d467702daf8d8d4f63265bab47e2e51",
"scripts/operator-browser/windows_browser.py": "fd952b6960cac3159e50708e492163fcab8540f7b9d6227e88ce75c5626b2824",
"tests/test_operator_windows_browser.py": "b0e87ff253a978649015ddc80c27ff0478834144db3d0938d229b7edd5cdbcdf"
},
"actual_attended_owner_login_with_new_launcher": "pending",
"scope_limits": [
"No issuer/role/callback registrations, output allowlist, token-helper control, factor policy or credential grants changed",
"No real browser page/profile contents, authorization URL, cookies, token helper, password or OTP read by the agent",
"Underlying WSLg issue is bypassed, not claimed repaired"
]
}