rapp-playwright/workplans/RAPP-PLAYWRIGHT-WP-0003-service-package.md

id	type	title	domain	repo	topic_slug	status	flavor	owner	depends_on	created	updated	reuse_check	state_hub_workstream_id
RAPP-PLAYWRIGHT-WP-0003	workplan	Implement the reproducible browser service and Railiance package	infotech	rapp-playwright	stack	finished	implementation	codex	RAPP-PLAYWRIGHT-WP-0002	2026-10-13	2026-10-13	Use upstream Playwright/Chromium and existing consumer patterns; build only the missing provider integration.	8e662d81-cdcb-5d8c-9222-1faaa92fc307

Service and package implementation

Entry: WP-0002 contract reviewed. Exit: reproducible package and supported agent path pass local integration and negative-case checks; live availability remains unverified until WP-0004.

Package compatible Playwright and Chromium

id: RAPP-PLAYWRIGHT-WP-0003-T01
status: done
priority: high
state_hub_task_id: "227bec3f-1de8-5d8d-9dfd-b4eb5a836ae6"

Pin compatible client/server/browser versions, OS dependencies and build inputs. Implement the chosen runtime, health and launch preflight; record browser version and release identity. Follow current Railiance package/declaration schemas and publish an immutable image with a verifiable digest when the build is ready.

Acceptance: clean build launches Chromium against the fixture, version mismatch fails clearly, image identity is reproducible and build/run instructions work.

Implement the agent path and artifact retrieval

id: RAPP-PLAYWRIGHT-WP-0003-T02
status: done
priority: high
state_hub_task_id: "3f935c96-b4be-5f2d-b3de-d9b11d1fcfab"

Implement the contract's supported client or CLI path, preflight, run lifecycle, result format and artifact retrieval. Deliver the standalone trial fixture and documented command, including consumer dev-server reachability and required setup. Reuse native Playwright APIs where they already solve the need.

Acceptance: a fresh client runs the fixture, captures both viewports and keyboard evidence, retrieves receipts/artifacts and gets distinct non-success outcomes for setup failures and deliberately failing UI assertions.

Enforce isolation, limits and cleanup

id: RAPP-PLAYWRIGHT-WP-0003-T03
status: done
priority: high
state_hub_task_id: "e504c3f0-47ee-5822-86d9-c0bd8bd63b02"

Implement per-run browser/profile and artifact boundaries, access control, target policy, bounded concurrency/time/resources, cancellation and abandoned-run reaping. Use established credential custody if the contract requires credentials.

Acceptance: execute cross-run cookie/storage/artifact access attempts, over-limit submissions, timeout/cancel/disconnect and crash cases. Show denied access, diagnosable outcomes and no leaked browser processes or retained sensitive state.

Prepare managed deployment and operations

id: RAPP-PLAYWRIGHT-WP-0003-T04
status: done
priority: high
state_hub_task_id: "dccce465-f948-50d5-874d-d22dcbbc42cc"

Author the rapp declaration and deployment resources for the selected runtime, with private access, resource limits, image digest, probes, network policy, artifact lifecycle and owner bindings. Document capacity, upgrades, rollback and operator diagnostics. Validate against current Railiance schemas and render tools.

Acceptance: package validation and rendering pass; installation, smoke and rollback commands are reviewable. Readiness reflects only evidence obtained; local build success does not imply deployed service availability.

Execution evidence — 2026-10-13

T02, T03 and T04 passed: client/real-browser path, isolation/cleanup negatives, managed declaration, immutable rendering and client-side Kubernetes validation. See verification and retained logs and independent final-image trial.

At the initial implementation checkpoint T01 remained wait. The final image builds and launches, but its required OCI publication failed at Forgejo blob PUT with HTTP 499/500. Remote digest inspection returns manifest unknown. Candidate local index is sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441. Platform handoff e77247e5-ce25-4711-a64f-af81a9f7cbb1 carries this blocker. Resume by resolving registry delivery with its owner, pushing the tested image, and reading back the immutable remote digest. Do not mark this plan finished or advertise an installable release before that proof.

Publication fix completed — 2026-10-13

The founder requested resolving publication. Forgejo logs show unexpected EOF at 60 seconds; Traefik used its default request-read deadline. The approved fix is cluster source commit bad08fd712bded4aefe011d2cdad1f50ade8c43e, raising the shared HTTPS read budget to a bounded 600 seconds through a k3s HelmChartConfig. Generation 2 is Ready with the exact argument and HTTPS/authentication probes pass. The original tested image published successfully at 18:15:17Z. Remote OCI index bytes hash to the exact tested digest, and railiance01 pulled the image and confirmed its config identity. T01 is done and this plan is finished. See the publication report. Cluster execution is tracked by RCLUSTER-WP-0016. Remaining managed activation and discovery work already have live records in WP-0004; no such work is closed by publication.