rapp-playwright/SCOPE.md

Scope — rapp-playwright

As of 2026-10-13 21:42 Europe/Berlin, release 0.1.0 is published and the Railiance pilot is deployed, with 1/1 Ready replica and a Bound 2Gi PVC. Platform recorded operator-driven browser, permission, cancellation and restart proof. Self-service managed availability is not yet established: real human and coding-agent authentication and per-caller connectivity remain pending. Lifecycle ownership is railiance-platform; service implementation remains here.

Implemented and evidenced

• Protocol-v1 bounded HTTP jobs with preflight, submission, status, cancellation, terminal receipts and scoped artifact downloads. Python 3.10+ client needs no local browser. Playwright 1.64.0 / Chromium 156.0.8078.4 run at the provider.
• Fresh browser process per job and context per viewport, exact origin gate with DNS address checks, isolated run capabilities, queue/time/artifact bounds, temporary-profile cleanup, restart interruption and one-hour expiry.
• Pinned upstream image and lockfile, non-root/read-only container with Tini, real launch readiness, private loopback/RBAC package, resource envelope, NetworkPolicy, PVC, immutable rendering and operational instructions.
• Three unit tests, four real-browser integration cases and a separate missing- browser negative passed. Independent initial and final-image trials verified screenshots, keyboard results, artifact hashes and failure categories. Final image restart preserved completed receipt/artifact retrieval.
• Platform pilot on railiance01 passed 14 responsive/keyboard steps, six negative/health checks and same-image restart with four preserved screenshots. Fresh readback confirmed Ready, the exact release image, PVC binding and consumer group binding. All four retained PNG hashes match original and post-restart download receipts. Access used administrator impersonation; this does not prove consumer login.
• Pinned OnCo home-page pilot passed at desktop and narrow widths with skip-link keyboard assertions. Evidence was handed to content-explorer; its T04 and visual/route acceptance remain consumer-owned.

Commands, logs, exact image identity and receipts support these statements. The final local provider was verified at http://127.0.0.1:18083 (rapp-playwright-final). Example:

python3 client/rapp_playwright.py --url http://127.0.0.1:18083 trial --out .local/new-trial

This is a workstation Docker process, not a stable managed endpoint. Server artifacts expire; sanitized evidence under docs/evidence/ is retained.

Delivery state and remaining work

Workplan	State and remaining evidence
WP-0002	Finished: consumption contract, lifecycle and trial/pilot design
WP-0003	Finished: tested image published at its exact digest and pulled on railiance01; ingress upload deadline fixed.
WP-0004	T02 provider trial/pilot done. T01 awaits actual consumer identity/access and cross-version rollback evidence. T03 has published A5 local-provider discovery; final managed availability update awaits T01.

Platform admitted and deployed the reviewed package under RPF-WP-0056. The playwright-consumers group is bound to the namespace consumer Role. Initial eligibility includes all identified platform humans and coding agents; no further membership decision is needed. Registration, native JWT authentication, per-caller API transport, renewal/revocation and real consumer receipts are still open in RPF-WP-0056-T03. Custodian accepted coordination in CUST-WP-0080-T05 (message 9defa19c-e812-4960-b563-2398688f562a); concrete identity/transport owner implementation returns remain pending.

Existing capability capability.infotech.headless-browser is now published at D3/A5/C2/R2 with pinned client/contract/release links and runnable local guidance. REUSE-WP-0024 completed the local-provider discovery and relevance work. General managed availability must remain unclaimed until real consumer acceptance. The published summary still says managed admission is pending; its next update should distinguish the running operator pilot from incomplete consumer access.

The owner progress readback retains current cluster/discovery observations and platform runtime receipts. Platform's consumer access instructions are prepared but conditional on identity-owner activation. The earlier admission review is retained as history; package admission, deployment and the binding are no longer the outstanding decision. Actual abrupt-interruption recovery is now verified locally and on the managed pilot: active/queued jobs become interrupted, partial artifacts disappear, completed hashes survive, and a fresh trial passes. See crash evidence. Actual cross-version rollback remains unverified; there is only one released version.

The repeatable consumer API acceptance command now passes six local API checks and refuses release/location mismatches. It is ready to run through each real consumer connection after Platform activation; its local receipts do not establish consumer authentication.

Deliberate limits

V1 provides trusted-target Chromium jobs and a finite action/assertion vocabulary. It does not provide arbitrary scripts, native remote sessions, authenticated page state, a general browser farm or visual-baseline approval. Chromium's OS sandbox is disabled; hostile pages and mutually untrusted tenants are unsupported. Target failures identify the category but not detailed DNS/TLS/HTTP causes. The OnCo pilot covers the home page, not all consumer routes or accessibility.

See the timestamped intent assessment for the prioritized gaps and their acceptance evidence.