Implement bounded browser service, consumer evidence and managed package

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a13590-a16f-7f60-be60-fd71627bc99d

docs/content-explorer-pilot.md

@@ -0,0 +1,67 @@
+# Content-explorer pilot
+
+Consumer requirement: `CONTENT-WP-0000-T04`, responsive screenshots and a keyboard
+walkthrough. Baseline SHA: `b594d7433bf4e408b44215e25e5304696d6f840e`, as recorded
+in content-explorer's `research/baseline/ONCO_PIN`.
+
+The first gate is the provider fixture trial: two viewports, Tab/Enter, observed
+focus and counter update, downloaded PNGs and a versioned receipt. It checks the
+service independently of OnCo. It does not complete the consumer task.
+
+The second gate uses a runnable instance of the **pinned** OnCo checkout. Start
+its UI without invoking the corpus/network publication pipeline; document the
+exact launch path and ensure the provider can reach the target. Use its pinned
+page markup to write selectors and keyboard assertions. The consumer retains
+the upstream license/data boundary and decides which captures it may retain.
+
+Candidate routes from the consumer baseline are `/`, `/cancers/`,
+`/cancers/head-and-neck/`, `/query/` and `/graph/`. Capture desktop and narrow
+screens, verify at least one meaningful rendered element, and document a real
+keyboard sequence and its observed result. Keep the pinned-source receipt
+separate from any exploratory run against `https://onco.cc/`, whose revision can
+change. A live website receipt must not be described as proof of the pinned SHA.
+
+Consumer acceptance checklist:
+
+- Run URL and pinned source SHA, target launch command, browser/service versions.
+- Commands, timestamps, run ID, downloaded artifacts and hashes.
+- Viewport dimensions and named page/route for each capture.
+- Keyboard steps with focus and action assertions; any failed step explained.
+- Separate infrastructure and semantic/visual mismatches.
+- Consumer review and task disposition in content-explorer, without automatic
+  closure by the provider.
+
+## Executed home-page pilot — 2026-10-13
+
+Passed run `1e89ce26-fc3c-4eb3-8280-b36800b92efc`, using the pinned SHA above,
+Playwright 1.64.0 / Chromium 156.0.8078.4 in the local Docker provider. The
+original consumer checkout was left untouched. A temporary copy of its existing
+checkout and installed dependencies ran with:
+
+```sh
+NODE_OPTIONS=--max-old-space-size=6144 /tmp/rapp-playwright-onco/node_modules/.bin/next dev --hostname 0.0.0.0 --port 3300
+python3 client/rapp_playwright.py run --spec examples/content-explorer-onco.json --out .local/content-explorer-onco-01
+```
+
+The launch command ran from `/tmp/rapp-playwright-onco`; it did not invoke the
+corpus generation/publication scripts. The provider explicitly allowed
+`http://host.docker.internal:3300` as a private target and used Docker's host
+gateway mapping. This is local connectivity evidence, not a Railiance tunnel.
+
+All 16 steps passed across 1280×800 and 390×844: the home heading matched,
+baseline screenshots were captured, Tab focused `a.skip-link`, Enter navigated
+to `/#main`, and post-keyboard screenshots were captured. Six PNG downloads
+were hashed; duplicate final/keyboard images share hashes. The URL assertion
+proves navigation to the anchor, not a complete accessibility audit.
+
+Retained [receipt](evidence/2026-10-13-content-explorer-pilot/receipt.json),
+[preflight](evidence/2026-10-13-content-explorer-pilot/preflight.json),
+[invocation](evidence/2026-10-13-content-explorer-pilot/invocation.json),
+[desktop baseline](evidence/2026-10-13-content-explorer-pilot/desktop-2-baseline.png),
+[narrow baseline](evidence/2026-10-13-content-explorer-pilot/narrow-2-baseline.png),
+[desktop result](evidence/2026-10-13-content-explorer-pilot/desktop-final.png) and
+[narrow result](evidence/2026-10-13-content-explorer-pilot/narrow-final.png) exclude
+the secret client run handle. These are home-page smoke results. Other routes,
+search, graph interaction and consumer visual acceptance remain unverified.
+The handoff to content-explorer is message
+`621635c9-0a72-4a88-9fd6-2ee1fbddc68f`; its T04 remains consumer-owned.