rapp-playwright/SCOPE.md

# Scope — rapp-playwright

As of 2026-10-13, the service, standalone Python client, browser trial and
Railiance package are implemented and verified locally. **Managed Railiance
availability is not established.** Image publication failed and platform admission
has not been confirmed. The founder selected `railiance-platform` as lifecycle
owner; service implementation remains here.

## Implemented and evidenced

- Protocol-v1 bounded HTTP jobs with preflight, submission, status, cancellation,
  terminal receipts and scoped artifact downloads. Python 3.10+ client needs no
  local browser. Playwright 1.64.0 / Chromium 156.0.8078.4 run at the provider.
- Fresh browser process per job and context per viewport, exact origin gate with
  DNS address checks, isolated run capabilities, queue/time/artifact bounds,
  temporary-profile cleanup, restart interruption and one-hour expiry.
- Pinned upstream image and lockfile, non-root/read-only container with Tini,
  real launch readiness, private loopback/RBAC package, resource envelope,
  NetworkPolicy, PVC, immutable rendering and operational instructions.
- Three unit tests, four real-browser integration cases and a separate missing-
  browser negative passed. Independent initial and final-image trials verified
  screenshots, keyboard results, artifact hashes and failure categories. Final
  image restart preserved completed receipt/artifact retrieval.
- Pinned OnCo home-page pilot passed at desktop and narrow widths with skip-link
  keyboard assertions. Evidence was handed to content-explorer; its T04 and
  visual/route acceptance remain consumer-owned.

[Commands, logs, exact image identity and receipts](docs/evidence/2026-10-13-implementation.md)
support these statements. The final local provider was verified at
`http://127.0.0.1:18083` (`rapp-playwright-final`). Example:

```sh
python3 client/rapp_playwright.py --url http://127.0.0.1:18083 trial --out .local/new-trial
```

This is a workstation Docker process, not a stable managed endpoint. Server
artifacts expire; sanitized evidence under `docs/evidence/` is retained.

## Delivery state and remaining work

| Workplan | State and remaining evidence |
| --- | --- |
| WP-0002 | Finished: consumption contract, lifecycle and trial/pilot design |
| WP-0003 | Local implementation complete; T01 waits on OCI publication. Forgejo blob PUT returned HTTP 499/500 and remote manifest inspection returned `manifest unknown`. |
| WP-0004 | T02 provider trial/pilot done. T01 waits on publication and platform admission/access; T03 waits on reuse-surface's maintained/published discovery update. |

The `playwright` namespace is absent. No cluster workload was created. Server
admission, private consumer binding, live target reachability, managed independent
trial, restart/cancellation and cross-version rollback remain unverified.
A local build digest is not a published release. Package validation/rendering
and Kubernetes client dry-run passed; they do not imply server admission.

Existing capability `capability.infotech.headless-browser` was still D3/A2/C2/R2
with source-reuse/planned-provider wording at readback. The owner received actual
local evidence and the usable client path; registry publication is pending.
Open workplan tasks retain blocker messages and exact resume steps.

## Deliberate limits

V1 provides trusted-target Chromium jobs and a finite action/assertion vocabulary.
It does not provide arbitrary scripts, native remote sessions, authenticated
page state, a general browser farm or visual-baseline approval. Chromium's OS
sandbox is disabled; hostile pages and mutually untrusted tenants are unsupported.
Target failures identify the category but not detailed DNS/TLS/HTTP causes.
The OnCo pilot covers the home page, not all consumer routes or accessibility.

See the [timestamped intent assessment](history/2026-10-13-1918-intent-scope-assessment.md)
for the prioritized gaps and their acceptance evidence.