rapp-playwright/SCOPE.md

# Scope — rapp-playwright

As of 2026-10-13 21:42 Europe/Berlin, release 0.1.0 is published and the
**Railiance pilot is deployed, with 1/1 Ready replica and a Bound 2Gi PVC**.
Platform recorded operator-driven browser, permission, cancellation and restart
proof. **Self-service managed availability is not yet established:** real human
and coding-agent authentication and per-caller connectivity remain pending.
Lifecycle ownership is railiance-platform; service implementation remains here.

## Implemented and evidenced

- Protocol-v1 bounded HTTP jobs with preflight, submission, status, cancellation,
  terminal receipts and scoped artifact downloads. Python 3.10+ client needs no
  local browser. Playwright 1.64.0 / Chromium 156.0.8078.4 run at the provider.
- Fresh browser process per job and context per viewport, exact origin gate with
  DNS address checks, isolated run capabilities, queue/time/artifact bounds,
  temporary-profile cleanup, restart interruption and one-hour expiry.
- Pinned upstream image and lockfile, non-root/read-only container with Tini,
  real launch readiness, private loopback/RBAC package, resource envelope,
  NetworkPolicy, PVC, immutable rendering and operational instructions.
- Three unit tests, four real-browser integration cases and a separate missing-
  browser negative passed. Independent initial and final-image trials verified
  screenshots, keyboard results, artifact hashes and failure categories. Final
  image restart preserved completed receipt/artifact retrieval.
- Platform pilot on railiance01 passed 14 responsive/keyboard steps, six negative/health
  checks and same-image restart with four preserved screenshots. Fresh readback
  confirmed Ready, the exact release image, PVC binding and consumer group binding.
  All four retained PNG hashes match original and post-restart download receipts.
  Access used administrator impersonation; this does not prove consumer login.
- Pinned OnCo home-page pilot passed at desktop and narrow widths with skip-link
  keyboard assertions. Evidence was handed to content-explorer; its T04 and
  visual/route acceptance remain consumer-owned.

[Commands, logs, exact image identity and receipts](docs/evidence/2026-10-13-implementation.md)
support these statements. The final local provider was verified at
`http://127.0.0.1:18083` (`rapp-playwright-final`). Example:

```sh
python3 client/rapp_playwright.py --url http://127.0.0.1:18083 trial --out .local/new-trial
```

This is a workstation Docker process, not a stable managed endpoint. Server
artifacts expire; sanitized evidence under `docs/evidence/` is retained.

## Delivery state and remaining work

| Workplan | State and remaining evidence |
| --- | --- |
| WP-0002 | Finished: consumption contract, lifecycle and trial/pilot design |
| WP-0003 | Finished: tested image published at its exact digest and pulled on railiance01; ingress upload deadline fixed. |
| WP-0004 | T02 provider trial/pilot done. T01 awaits actual consumer identity/access and cross-version rollback evidence. T03 has published A5 local-provider discovery; final managed availability update awaits T01. |

Platform admitted and deployed the reviewed package under RPF-WP-0056. The
`playwright-consumers` group is bound to the namespace consumer Role. Initial
eligibility includes all identified platform humans and coding agents; no further
membership decision is needed. Registration, native JWT authentication,
per-caller API transport, renewal/revocation and real consumer receipts are still
open in RPF-WP-0056-T03. Custodian accepted coordination in CUST-WP-0080-T05 (message
`9defa19c-e812-4960-b563-2398688f562a`); concrete identity/transport owner
implementation returns remain pending.

Existing capability `capability.infotech.headless-browser` is now published at
D3/A5/C2/R2 with pinned client/contract/release links and runnable local guidance.
REUSE-WP-0024 completed the local-provider discovery and relevance work. General
managed availability must remain unclaimed until real consumer acceptance.
The published summary still says managed admission is pending; its next update
should distinguish the running operator pilot from incomplete consumer access.

The [owner progress readback](docs/evidence/2026-10-13-owner-progress-readback.json)
retains current cluster/discovery observations and platform runtime receipts.
Platform's [consumer access instructions](https://forgejo.coulomb.social/coulomb/railiance-platform/src/commit/d303c99e3be993ffa989bc9ba3d7b471903858ce/docs/playwright-consumer-access.md)
are prepared but conditional on identity-owner activation. The earlier
[admission review](docs/platform-admission.md) is retained as history; package
admission, deployment and the binding are no longer the outstanding decision.
Actual abrupt-interruption recovery is now verified locally and on the managed
pilot: active/queued jobs become interrupted, partial artifacts disappear, completed
hashes survive, and a fresh trial passes. See [crash evidence](docs/evidence/2026-10-13-crash-recovery.md).
Actual cross-version rollback remains unverified; there is only one released version.

The repeatable [consumer API acceptance command](docs/operations.md#repeatable-consumer-api-acceptance)
now passes six local API checks and refuses release/location mismatches. It is
ready to run through each real consumer connection after Platform activation;
its local receipts do not establish consumer authentication.

## Deliberate limits

V1 provides trusted-target Chromium jobs and a finite action/assertion vocabulary.
It does not provide arbitrary scripts, native remote sessions, authenticated
page state, a general browser farm or visual-baseline approval. Chromium's OS
sandbox is disabled; hostile pages and mutually untrusted tenants are unsupported.
Target failures identify the category but not detailed DNS/TLS/HTTP causes.
The OnCo pilot covers the home page, not all consumer routes or accessibility.

See the [timestamped intent assessment](history/2026-10-13-2231-intent-scope-assessment.md)
for the prioritized gaps and their acceptance evidence.