---
id: RPF-WP-0056
type: workplan
title: "Admit the Playwright pilot and establish scoped consumer group access"
domain: financials
repo: railiance-platform
status: blocked
owner: codex
topic_slug: railiance
created: "2026-10-13"
updated: "2026-10-14"
state_hub_workstream_id: "31933d08-c877-5fda-aff9-6220c3705c92"
---

Incoming owner request: State Hub c82d75f3-3191-410d-a8c8-fd647bf7f3ef,
superseding publication return a282c300-eaef-4cd6-99b0-f4fb255203b3;
consumer RAPP-PLAYWRIGHT-WP-0004-T01. The user selected establishing a group
in this session. Platform owns lifecycle admission; implementation remains in
rapp-playwright. Publication is complete, and must not remain a blocker.

## Review the immutable package and pilot boundary

```task
id: RPF-WP-0056-T01
status: done
priority: high
state_hub_task_id: "648b7b85-2da1-56a6-8a6b-e2f9212095a8"
```

Reviewed rapp-playwright revision 70268154c06cf78c5d9e1f4eb900213ffd436d1b:
declaration, release, workload, admission and operations contract. The published
image is sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441.
Three provider contract/network/proxy tests pass independently in this session.
One Recreate replica requests 100m CPU/256Mi memory, limits 1 CPU/1Gi, and uses
a 2Gi transient artifact PVC with one-hour retention. Non-root, read-only root,
no service-account token, dropped capabilities, loopback listener, denied ingress
and public HTTPS/DNS egress match the proposed trusted-target pilot.
Chromium's OS sandbox is disabled; this is no hostile-page or cross-tenant
isolation acceptance. Initial targets remain the bundled fixture and public
https://onco.cc; no private preview, source import or data-license grant follows.

## Establish and verify the consumer group RBAC boundary

```task
id: RPF-WP-0056-T02
status: done
priority: high
state_hub_task_id: "8e6f124a-8364-5a12-b39f-957f9bb5524d"
```

User requested a group; use exact Kubernetes group `playwright-consumers`.
Platform binding: helm/playwright-consumer-access.yaml, referring to the package's
existing namespace Role `playwright-consumer`. Bootstrap only its reviewed
Namespace and Role, then bind the group. No cluster-wide role, Secret access,
pod execution, workload mutation, credential issuance or group membership grant.
Verify live allowed discovery/port-forward and denied execution/Secrets/foreign
namespace/workload changes, plus nonmember denial. Impersonated authorization
checks prove RBAC only, not actual consumer authentication or connectivity.

## Connect platform identities and prove managed consumer operation

```task
id: RPF-WP-0056-T03
status: wait
priority: high
blocked_on: message-from:railiance-cluster
blocking_reason: "User admitted all identified platform humans and coding agents; their supported Kubernetes authentication/group-mapping route remains unimplemented."
state_hub_task_id: "a82762eb-bb6d-5600-89ca-a81ada2eba9f"
```

The session's initial readback found only built-in/system user/group bindings;
the cluster documentation describes an administrator kubeconfig. A group subject
in RBAC does not create an identity-provider group or convey membership. The user admitted all identified platform humans and coding agents; establish
their existing-owner authentication and group-mapping route,
including expiration/revocation. Do not distribute the admin kubeconfig or infer
that a KeyCape group is already understood by the Kubernetes API.

The immutable pilot is now deployed after fresh capacity, server dry-run and
diff: 1/1 Ready, 2Gi PVC Bound and matching imageID. A real group-identity trial
is still required; administrator impersonation is recorded separately.
Retain screenshots/keyboard receipts, wrong-token/assertion/target negatives,
cancellation and restart/interrupted/completed-artifact recovery. One available
release supports same-image recovery only; cross-version rollback stays unproven.
Keep RAPP-PLAYWRIGHT-WP-0004-T01 open until its owner accepts those receipts.

2026-10-13 owner returns narrow the remaining gap. rapp-playwright `2cb2b654`
and Custodian `2cb2b654e03e64ea28f1b369a89d7eaeb36c26fb` record same-image abrupt
recovery, including the managed SIGKILL trial. That does not prove cross-version
rollback or a real consumer identity. Registration preparation is published in
NetKingdom `276b95f6` (NK-WP-0050-T02 still in progress). Platform acceptance
stays here: the Kubernetes authentication and `playwright-consumers` group
mapping route is still unimplemented. Custody and per-agent delivery remain
`docs/playwright-identity-handoff.md`. No new membership decision is open.


## October 13 native implementation

ADR-0006 records the group decision. Namespace, package Role and Platform binding
are applied on the pinned railiance01 cluster. Thirteen native authorization
checks pass: intended discovery/forwarding is allowed; Secrets, exec, writes,
foreign namespaces, foreign deployment and nonmember access are denied. The
initial verifier's kubectl schema discovery needed unrelated CRD access; using
the native SelfSubjectAccessReview endpoint corrected the verifier without any
permission expansion. Re-run scripts/verify_playwright_access.py with --output.

Fresh capacity before deployment: 3460m/4000m CPU requested, 9472Mi memory
requested and 126Gi free storage. Adding 100m/256Mi plus a 2Gi PVC fits that
scheduling headroom; aggregate CPU/memory limits were already overcommitted.
The declared single-browser limits remain in force. Full package server dry-run
and diff passed and the published immutable image reached Ready.

Initial fixture trial through administrator-impersonated group port-forward
passed desktop/narrow keyboard and screenshot checks. This demonstrates native
RBAC and browser operation; it does not turn the administrative SSH identity
into a generally available consumer authentication route. T03 retains that gap.

## Activate the bounded pilot and verify operator-driven recovery

```task
id: RPF-WP-0056-T04
status: done
priority: high
state_hub_task_id: "223df123-f674-56a3-8727-a03ee42a9d76"
```

The published package is running. Thirteen RBAC checks and six native negative/
health checks pass, including wrong receipt/artifact token, deliberate assertion
failure, bounded cancellation and private-target refusal. Actual Deployment
restart reached Ready with a new pod UID, the same immutable image and the same
PVC; all four completed artifacts were retrieved and their hashes matched.
Evidence: docs/evidence/2026-10-13-playwright-managed/ and
docs/evidence/2026-10-13-playwright-rbac.json. This is same-image recovery, not
cross-version rollback or abrupt-interruption proof. T03 remains open for actual
consumer identity/group mapping and the remaining package-owner acceptance.

Group decision mirrored to State Hub d2426028-0b04-4ea2-b199-d7f9e19e38e6.

## Prepare consumer login delivery and owner activation inputs

```task
id: RPF-WP-0056-T05
status: done
priority: high
state_hub_task_id: "5549e2c0-4939-5d0f-903c-fd85b3e34583"
```

User authorized continuing with identity-owner implementation. Added
scripts/playwright_consumer.py: isolated kubeconfig setup, public-CA/destination
pinning before credential delivery, private KeyCape token-file consumption and
actual SelfSubjectReview plus nine allowed/denied access checks. Verification
refuses modified/impersonating configurations and administrator identities.
Nine focused tests pass, including misuse, file permission, wrong-destination,
expired/wrong-audience token and excessive-permission refusals; installed kubectl
parses the generated configuration. These synthetic tests do not prove native
JWT authentication or live identity access.

config/playwright/ contains the public cluster CA and review candidates for the
native JWT authenticator and public PKCE client. docs/playwright-consumer-access.md
now provides login/setup/verify/forward/trial commands; the exact owner activation
contract is docs/playwright-identity-handoff.md. Existing workstation API tunnel
uses its own SSH actor and is not a general per-consumer transport entitlement.
Dedicated coding-agent registration and governed secret delivery remain pending.

T03 stays wait. KeyCape accepted the public candidate in source only
(2026-10-14, `0e65b962`); no client is registered. Cluster and NetKingdom
activation replies have not arrived, the authenticator candidate has not been
natively validated or activated, and neither a real human nor agent consumer
receipt exists. Do not update provider
managed availability to ready from this preparation. No new membership approval
is required. Evidence: docs/evidence/2026-10-13-playwright-consumer-preparation.json.

## Obtain Custodian coordination of self-service consumer delivery

```task
id: RPF-WP-0056-T06
status: done
priority: high
state_hub_task_id: "ef6c21bc-0048-5b73-976e-130cd9af538d"
```

User authorized forwarding the requirements to the-custodian. The requirements
and requested return are in docs/playwright-identity-handoff.md under Custodian
coordination request. Initial eligibility is already decided: all identified
platform humans and coding agents. Request one coordinator, owner task links,
dependency order and first executable milestone, reusing the existing owner
requests. Platform's live consumer acceptance stays in T03.

Track this task until the Custodian returns a source-backed coordination task and
accountable owner. Message delivery alone does not complete T06 or T03. General
availability requires real human and coding-agent trials and provider acceptance;
no further user membership decision is needed.

Request delivered to the-custodian through State Hub on 2026-10-13 at 19:31 UTC,
message `1b279bad-a159-43da-8709-1167882e62f8`.

Accepted 2026-10-13 at 20:04 UTC, message `f761e801-2111-41f3-af0d-a5411a37ffab`.
Accountable coordinator: the-custodian / custodian-codex. Source task:
CUST-WP-0080-T05, Hub `ed8b909a-23bf-5e5f-b600-e477fbae136b`, published at
Custodian `3a850beb` and refreshed through `f5925c62`. Provider recovery and
the consumer acceptance command are recorded on rapp-playwright `2cb2b654` and
`5b8e7984`. T06 is done because that source-backed coordination return exists.
T03 still owns platform acceptance. Live identity, custody, native authenticator
and per-caller transport are not delivered by this acceptance.