rapp-playwright/docs/evidence/2026-10-13-implementation.md

Implementation verification — 2026-10-13

The bounded service, Python client and managed package are implemented. Local runtime and independent consumption passed. Image publication and managed activation are blocked by external delivery dependencies; neither is claimed.

Machine-readable checks record the candidate image identity, commands, resource observations and handoff IDs.

• make test: syntax/compile checks and 3 unit tests passed.
• make test-integration: 4 real-browser cases passed in 99 seconds under non-root, read-only Docker, dropped capabilities, no-new-privileges, 1 CPU, 1Gi memory and bounded tmpfs. Log.
• The added missing-browser case separately passed: HTTP 503 launch preflight and rejected run admission. Log.
• Build log: final pinned runtime image built successfully.
• Independent trials: initial and final-image consumer trials, keyboard/screenshots and failure cases passed.
• Final-image restart: availability recovered and completed run/artifacts remained retrievable from its retained volume.
• Pinned OnCo pilot: home-page responsive and skip-link evidence passed; content-explorer retains its own acceptance.

The integration suite checks fresh cookie/localStorage state, foreign-token receipt/artifact denial, protocol mismatch, assertion failure, unavailable target, blocked redirect without request leakage, concurrent admission bounds, queued and active cancellation, hard timeout, forced worker crash with no remaining browser process group, subsequent recovery, interrupted persisted work and expiry deletion. Temporary browser profiles and home directories are scoped to the supervised worker and removed after its exit. This is not proof of safety for hostile pages or mutually untrusted tenants; Chromium's OS sandbox is off.

Package schema validation passed against railiance-master with rail-kubernetes references. Digest rendering and Kubernetes client validation passed for all seven objects. No server-side admission success is claimed. The namespace does not exist and no cluster object was created in this session. At the recorded capacity check, railiance01 was Ready with 3460m CPU requested out of 4000m; the package requests 100m and uses Recreate. Recheck before deployment.

Publication and owner dependencies

Three OCI upload attempts encountered final blob PUT failures (HTTP 499, then HTTP 500); smaller layers uploaded. Remote manifest inspection returned manifest unknown. Local image index: sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441. This digest identifies a built image, not an available registry release.

The founder selected railiance-platform lifecycle ownership. Admission request c82d75f3-3191-410d-a8c8-fd647bf7f3ef and the final platform handoff await an owner response. Cluster access binding, live restart and rollback remain WP-0004-T01 work. There is no previous managed release for cross-version rollback.

The reuse-surface handoff asks the owner to publish verified local provider references without claiming managed availability. Readback at 19:18 Europe/Berlin still showed the source-only D3/A2/C2/R2 entry and planned provider; no maintained update was inferred from message delivery. The published discovery readback also returned the planned provider and D3/A2/C2/R2 from the live federated API. WP-0004-T03 remains open. The content-explorer handoff delivers the home-page evidence without closing CONTENT-WP-0000-T04.

The development provider, failed intermediate check container and temporary OnCo server were stopped. The final local provider remains on loopback port 18083 for inspection; it is a workstation process, not a managed endpoint. Server artifacts expire after one hour; the linked safe evidence is retained.