coulomb/reuse-surface
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record native Windows login proof and attended recovery discovery
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
ci / validate-registry (push) Failing after 2m18s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6.1-sol
Assistant-Session: 01a1abf1-7e95-7141-87c9-ee78332bf790
This commit is contained in:
tegwick 2026-11-06 20:30:43 +01:00
parent 3a97eaeca0
commit 10053721bc
5 changed files with 217 additions and 134 deletions
Download patch file Download diff file Expand all files Collapse all files

6
docs/graph/capability-graph.mmd
View file

@ -1,9 +1,13 @@
graph LR
capability_infotech_headless_browser["capability.infotech.headless-browser<br/>D3 / A5 / C2 / R2"]
capability_registry_register["capability.registry.register<br/>D3 / A4 / C2 / R3"]
capability_infotech_isolated_login_browser["capability.infotech.isolated-login-browser<br/>D3 / A2 / C3 / R2"]
capability_registry_register["capability.registry.register<br/>D3 / A3 / C2 / R3"]
capability_registry_validate["capability.registry.validate<br/>D4 / A3 / C3 / R3"]
capability_infotech_isolated_login_browser -->|related_to| capability_infotech_headless_browser
capability_registry_register -->|supports| capability_feature_control_evaluate
capability_registry_register -->|supports| capability_identity_vocabulary_canonicalize
capability_registry_register -->|related_to| capability_registry_validate
capability_registry_register -->|related_to| capability_security_iam_tooling_suite
capability_registry_validate -->|depends_on| capability_registry_register
capability_registry_validate -->|related_to| capability_registry_register
capability_registry_validate -->|related_to| capability_security_iam_tooling_suite

2
docs/graph/index.html
View file

@ -17,7 +17,7 @@
<p class="legend">Generated from entry <code>relations</code> fields. Regenerate with <code>reuse-surface graph</code>.</p>
<pre class="mermaid" id="graph"></pre>
<script>
document.getElementById('graph').textContent = "graph LR\n capability_infotech_headless_browser[\"capability.infotech.headless-browser<br/>D3 / A5 / C2 / R2\"]\n capability_registry_register[\"capability.registry.register<br/>D3 / A4 / C2 / R3\"]\n capability_registry_validate[\"capability.registry.validate<br/>D4 / A3 / C3 / R3\"]\n capability_registry_register -->|supports| capability_feature_control_evaluate\n capability_registry_register -->|supports| capability_identity_vocabulary_canonicalize\n capability_registry_register -->|related_to| capability_registry_validate\n capability_registry_validate -->|depends_on| capability_registry_register\n capability_registry_validate -->|related_to| capability_registry_register\n";
document.getElementById('graph').textContent = "graph LR\n capability_infotech_headless_browser[\"capability.infotech.headless-browser<br/>D3 / A5 / C2 / R2\"]\n capability_infotech_isolated_login_browser[\"capability.infotech.isolated-login-browser<br/>D3 / A2 / C3 / R2\"]\n capability_registry_register[\"capability.registry.register<br/>D3 / A3 / C2 / R3\"]\n capability_registry_validate[\"capability.registry.validate<br/>D4 / A3 / C3 / R3\"]\n capability_infotech_isolated_login_browser -->|related_to| capability_infotech_headless_browser\n capability_registry_register -->|supports| capability_feature_control_evaluate\n capability_registry_register -->|supports| capability_identity_vocabulary_canonicalize\n capability_registry_register -->|related_to| capability_registry_validate\n capability_registry_register -->|related_to| capability_security_iam_tooling_suite\n capability_registry_validate -->|depends_on| capability_registry_register\n capability_registry_validate -->|related_to| capability_registry_register\n capability_registry_validate -->|related_to| capability_security_iam_tooling_suite\n";
</script>
</body>
</html>

246
registry/capabilities/capability.infotech.isolated-login-browser.md
View file

@ -1,152 +1,204 @@
---
id: capability.infotech.isolated-login-browser
name: Isolated Login Browser
summary: >-
Headed empty-profile Chromium for one attended login. It uses the Chromium
binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for
Testing 151.0.7922.34) and a new user-data directory. It is not the Windows
default browser and not the rapp-playwright headless service.
summary: 'Isolated visible login window: native Windows Edge with a private disposable
profile on WSL, pinned Playwright Chromium on non-WSL Linux; operator-only credentials
and fixed issuer/callback guards.'
owner: reuse-surface
status: draft
status: reviewed
domain: infotech
tags:
- attended-login
- browser
- chromium
- empty-profile
- playwright
- attended-login
- browser
- chromium
- empty-profile
- playwright
- windows
- wsl
- edge
maturity:
discovery:
current: D2
target: D3
confidence: medium
rationale: >
The boundary is one visible login page in a fresh profile. The remote
headless browser is a neighboring capability and is excluded.
current: D3
target: D4
confidence: high
rationale: Real WSL input failure, Linux probes, native Windows lifecycle and
actual attended login were investigated; this is bounded exploration, not systematic
browser research.
availability:
current: A2
target: A3
confidence: medium
rationale: >
The launcher is source in railiance-platform and calls the already
installed Playwright Chromium cache. It is not a published installable
command.
rationale: Source in railiance-platform selects a native Windows worker on WSL
and retains pinned Chromium on non-WSL Linux; no separately packaged CLI.
external_evidence:
completeness:
level: C1
confidence: low
level: C3
confidence: high
basis: scope_vs_intent_and_consumer_expectations
satisfied_expectations:
- A headed Chromium from the coulomb-social Playwright pin can be named and started with a fresh profile.
broken_expectations:
- An attended OpenBao login has not completed in this profile.
- Fresh owner-only native Windows profile, guarded issuer/local callback and bounded
process/profile cleanup
- Actual attended owner login completes, with provider readback/decryption and
session revocation
- Credential-free native localhost callback lifecycle and 32 platform operator
tests pass
broken_expectations: []
out_of_scope_expectations:
- Headless screenshots, keyboard trials, or a hosted browser service.
- Credential custody, password entry, or one-time-code handling by the launcher.
- Headless screenshots, keyboard trials, or a hosted browser service.
- Credential custody, password entry, or one-time-code handling by the launcher.
reliability:
level: R1
confidence: low
level: R2
confidence: medium
basis: consumer_quality_signals
known_reliability_risks:
- Two earlier login attempts opened the signed-in Windows default browser and timed out before the owner command.
- The cache binary must match the coulomb-social Playwright pin or the launcher refuses to start.
- A desktop display is required. There is no Windows-browser fallback.
- Native Windows path has focused lifecycle proof and one successful operating
retry, not broad operating history.
- WSLg/Chrome input stalled unpredictably even in credential-free probes; the
Windows path bypasses it without proving the exact root cause.
- Earlier timeout/authentication failure receipts retain unconfirmed session revocation
outcomes.
- A Windows desktop/Edge installation and WSL interop are required on WSL; non-WSL
Linux still depends on the pinned Chromium cache.
- User-close or timeout cleanup is bounded; the opener fails closed when the private
profile/ACL/worker cannot be established.
discovery:
intent: >
Give an operator a visible browser with no saved account when a login must
not reuse the workstation's default browser session.
intent: 'Give an operator a visible browser with no saved account when a login must
not reuse the workstation''s default browser session.
'
includes:
- Headed Chromium selected from coulomb-social's Playwright browsers pin.
- A new empty profile for each allowed Keycloak login URL.
- The local OpenBao OIDC callback on port 8250.
- Native Windows Edge on WSL, with a fresh owner-only profile for each invocation
- Pinned headed Chromium on non-WSL Linux
- Fixed Keycloak issuer and approved localhost/127.0.0.1 OpenBao callback on port
8250
- Owned browser/profile lifecycle cleanup
excludes:
- The Windows default browser, including Firefox and Edge.
- rapp-playwright and any remote headless browser.
- Reading, storing, or typing credentials.
- Shared/default browser profiles and remote headless services
- Credential entry/storage by the agent or launcher
- Changing issuer, MFA, callback registration, grants or output allowlists
assumptions:
- The workstation already has the pinned Chromium in the Playwright cache.
- DISPLAY or WAYLAND_DISPLAY is available to the login process.
- Existing attended platform owner lane and allowed issuer/callback
- Windows Edge and PowerShell/WSL interop on WSL; pinned Chromium and a display
on non-WSL Linux
use_cases:
- Open the platform-root OpenBao login without an existing disposable-account session.
- Open the platform-root OpenBao login without an existing disposable-account session.
research_memos: []
availability:
current_level: A2
target_level: A3
current_artifacts:
- ../railiance-platform/scripts/operator-browser/cmd.exe
- ../railiance-platform/scripts/operator-browser/xdg-open
- ../railiance-platform/scripts/openbao-attended-exec.py
- ../coulomb-social/scripts/node_modules/playwright-core/browsers.json
- ../railiance-platform/scripts/operator-browser/cmd.exe
- ../railiance-platform/scripts/operator-browser/xdg-open
- ../railiance-platform/scripts/openbao-attended-exec.py
- ../coulomb-social/scripts/node_modules/playwright-core/browsers.json
- ../railiance-platform/scripts/operator-browser/windows_browser.py
target_artifacts:
- A small installable command whose only job is the empty-profile login window.
- A small installable command whose only job is the empty-profile login window.
consumption_modes:
- informational
- source adaptation
- cli
- informational
- source adaptation
- cli
relations:
depends_on: []
supports: []
related_to:
- capability.infotech.headless-browser
- capability.infotech.headless-browser
evidence:
documentation:
- ../railiance-platform/docs/backup-credential-recovery.md
- ../railiance-platform/docs/backup-credential-recovery.md
- ../railiance-platform/docs/evidence/2026-11-06-operator-browser-native-windows.json
- ../railiance-apps/docs/evidence/2026-11-06-vergabe-browser-window-repair.json
tests:
- ../railiance-platform/tests/test_operator_browser.py
- ../railiance-platform/tests/test_operator_browser.py
- ../railiance-platform/tests/test_operator_windows_browser.py
consumer_feedback:
- >-
2026-11-02: the attended OpenBao window was Firefox, the Windows default.
A later login also opened a Firefox tab because OpenBao calls
`cmd.exe /c start` on WSL and never reaches xdg-open. The empty profile
was not used. The login still completed after the old session expired.
bug_reports: []
- '2026-11-02: the attended OpenBao window was Firefox, the Windows default. A later
login also opened a Firefox tab because OpenBao calls `cmd.exe /c start` on WSL
and never reaches xdg-open. The empty profile was not used. The login still completed
after the old session expired.'
- '2026-11-06: founder confirms native Windows controls respond normally; actual
contained owner login worked like a charm.'
- ../railiance-apps/docs/evidence/2026-11-06-vergabe-attended-provider-success-return.json
- ../railiance-apps/docs/evidence/2026-11-06-vergabe-attended-backup-complete-return.json
bug_reports:
- ../railiance-apps/docs/evidence/2026-11-06-vergabe-browser-window-repair.json
incidents: []
consumer_guidance:
recommended_for:
- One attended login that must show the one-time-code page and return to localhost.
- One attended login that must show the one-time-code page and return to localhost.
not_recommended_for:
- Screenshot or keyboard trials. Use capability.infotech.headless-browser.
- Any flow that should reuse the operator's normal signed-in browser.
- Screenshot or keyboard trials. Use capability.infotech.headless-browser.
- Any flow that should reuse the operator's normal signed-in browser.
known_limitations:
- The launcher allowlists only the OpenBao Keycloak callback.
- Closing the blank proof window is not a completed login.
promotion_history: []
- Only fixed issuer/callback paths are allowed; no shared/default-profile fallback.
- The authorization URL is passed to the PowerShell worker via stdin, then appears
in the owned browser startup argument; no claim of zero URL visibility in all
process arguments.
- Agent never handles passwords, OTPs, cookies or token-helper values.
- Fixture callback navigation is credential-free; actual founder login success is
recorded separately.
promotion_history:
- date: '2026-11-06'
dimension: discovery
from: D2
to: D3
rationale: Platform 8519459 plus native private-profile/callback/cleanup proof and
founder-reported actual contained login in Apps 6947673. Earlier failures retained;
narrow scope and limited history.
author: codex
- date: '2026-11-06'
dimension: completeness
from: C1
to: C3
rationale: Platform 8519459 plus native private-profile/callback/cleanup proof and
founder-reported actual contained login in Apps 6947673. Earlier failures retained;
narrow scope and limited history.
author: codex
- date: '2026-11-06'
dimension: reliability
from: R1
to: R2
rationale: Platform 8519459 plus native private-profile/callback/cleanup proof and
founder-reported actual contained login in Apps 6947673. Earlier failures retained;
narrow scope and limited history.
author: codex
---
# Isolated Login Browser
## Overview
The runtime implementation is owned by `railiance-platform`; reuse-surface
provides discovery and the bounded consumption assessment. Platform commit
`8519459e6fedd1bfb25dc2cdee6372d7252f5d0a` selects native Windows Edge on WSL
through its existing operator-browser entry. Non-WSL Linux retains the pinned
Playwright Chromium path. Both use disposable profiles; neither reuses the
operator's shared browser session.
This is the visible browser for a purpose-specific login. It starts the
Chromium binary already installed for coulomb-social's Playwright tests,
with a new empty profile, on the workstation display. The founder sees the
identity page and completes the one-time code.
## Current acceptance — 2026-11-06
`capability.infotech.headless-browser` is the remote screenshot service. It
does not show a local login page and cannot receive the OpenBao callback on
`localhost:8250`.
The founder observed wrong/unresponsive controls, stalled tabs and titlebar X
in WSLg/Chrome, including credential-free probes. Native Windows Edge responded
normally. The corrected worker uses the current user's numeric SID for a private
protected profile ACL, guards owned process identity and cleans its own profile.
It receives the URL through stdin; the browser subsequently receives it as a
startup argument. Existing issuer/callback, factor, token-helper and output
controls remain in effect.
## Assessment notes
The founder's real login then succeeds. The
[provider receipt](../../../railiance-apps/docs/evidence/2026-11-06-vergabe-attended-provider-success-return.json)
records Warden exit 0 and session revocation/storage cleanup; the
[final backup receipt](../../../railiance-apps/docs/evidence/2026-11-06-vergabe-attended-backup-complete-return.json)
records the completed recovery sequence. Thirty-two platform operator tests and
a credential-free native callback/process/profile lifecycle fixture are separate
quality evidence. Older failed attempts retain their unknown outcomes.
### Discovery
## Consumption boundary
The included behavior is one allowlisted Keycloak URL. Saved Windows sessions
and headless trials are outside it.
Use the reviewed `railiance-platform/scripts/openbao-attended-exec.py` lane
and its operator-browser directory. Do not repurpose the launcher for arbitrary
URLs, widen callback/issuer guards or run it with a shared profile. Existing
operation authorization still governs the owner command.
### Availability
Call `python3 scripts/openbao-attended-exec.py` from railiance-platform. The
wrapper places `scripts/operator-browser` first on `PATH`. On WSL, OpenBao
runs `cmd.exe /c start`, so that directory provides `cmd.exe` for the
allowlisted login URL.
### Completeness
The browser selection and empty profile exist. A finished platform-root login
in that window is still outstanding, so the core use case is not complete.
### Reliability
The attended login still opened a Firefox tab on 2026-11-02 because the
WSL opener never called xdg-open. This entry stays fragile until one real
login completes in the pinned Chromium.
This local attended window is separate from
`capability.infotech.headless-browser`, the remote screenshot/trial service.
D3/A2/C3/R2 describes the bounded visible-login core with its documented Windows
workaround and limited history. It grants no credential or deployment authority.

17
registry/indexes/capabilities.yaml
View file

@ -1,5 +1,5 @@
version: 1
updated: '2026-11-02'
updated: '2026-11-06'
domain: helix_forge
capabilities:
- id: capability.infotech.headless-browser
@ -39,14 +39,12 @@ capabilities:
- container
- id: capability.infotech.isolated-login-browser
name: Isolated Login Browser
summary: >-
Headed empty-profile Chromium for one attended login. It uses the Chromium
binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for
Testing 151.0.7922.34) and a new user-data directory. It is not the Windows
default browser and not the rapp-playwright headless service.
vector: D2 / A2 / C1 / R1
summary: 'Isolated visible login window: native Windows Edge with a private disposable
profile on WSL, pinned Playwright Chromium on non-WSL Linux; operator-only credentials
and fixed issuer/callback guards.'
vector: D3 / A2 / C3 / R2
domain: infotech
status: draft
status: reviewed
owner: reuse-surface
path: registry/capabilities/capability.infotech.isolated-login-browser.md
tags:
@ -55,6 +53,9 @@ capabilities:
- chromium
- empty-profile
- playwright
- windows
- wsl
- edge
consumption_modes:
- informational
- source adaptation

80
registry/indexes/federated.yaml
View file

@ -1,7 +1,7 @@
# Composed federated capability index. Regenerate with:
# reuse-surface federation compose
version: 1
updated: '2026-11-02'
updated: '2026-11-06'
domain: helix_forge
collision_policy: warn
sources:
@ -202,7 +202,7 @@ sources:
count: 1
index: ../rail-kubernetes/registry/indexes/capabilities.yaml
- repo: railiance-apps
count: 1
count: 2
index: ../railiance-apps/registry/indexes/capabilities.yaml
- repo: railiance-bootstrap
count: 1
@ -1226,30 +1226,6 @@ capabilities:
- container
source_repo: reuse-surface
source_index: ../reuse-surface/registry/indexes/capabilities.yaml
- id: capability.infotech.isolated-login-browser
name: Isolated Login Browser
summary: >-
Headed empty-profile Chromium for one attended login. It uses the Chromium
binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for
Testing 151.0.7922.34) and a new user-data directory. It is not the Windows
default browser and not the rapp-playwright headless service.
vector: D2 / A2 / C1 / R1
domain: infotech
status: draft
owner: reuse-surface
path: registry/capabilities/capability.infotech.isolated-login-browser.md
tags:
- attended-login
- browser
- chromium
- empty-profile
- playwright
consumption_modes:
- informational
- source adaptation
- cli
source_repo: reuse-surface
source_index: ../reuse-surface/registry/indexes/capabilities.yaml
- id: capability.infotech.hub-core-library
name: Reusable FOS Hub Core Primitives
summary: Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State
@ -1269,6 +1245,31 @@ capabilities:
source_repo: hub-core
source_url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
source_index: registry/federation/cache/hub-core.yaml
- id: capability.infotech.isolated-login-browser
name: Isolated Login Browser
summary: 'Isolated visible login window: native Windows Edge with a private disposable
profile on WSL, pinned Playwright Chromium on non-WSL Linux; operator-only credentials
and fixed issuer/callback guards.'
vector: D3 / A2 / C3 / R2
domain: infotech
status: reviewed
owner: reuse-surface
path: registry/capabilities/capability.infotech.isolated-login-browser.md
tags:
- attended-login
- browser
- chromium
- empty-profile
- playwright
- windows
- wsl
- edge
consumption_modes:
- informational
- source adaptation
- cli
source_repo: reuse-surface
source_index: ../reuse-surface/registry/indexes/capabilities.yaml
- id: capability.infotech.issue-tracking
name: External issue tracker connector
summary: CLI and Python adapters for external issue systems.
@ -1897,9 +1898,34 @@ capabilities:
- source
source_repo: rapp-user-engine
source_index: ../rapp-user-engine/registry/indexes/capabilities.yaml
- id: capability.railiance.vergabe-attended-recovery
name: Attended Vergabe three-store backup and isolated recovery
summary: Capture PostgreSQL, media and SQLite coherently, verify encrypted provider
readback/decryption, and restore the bound demo-company pilot in isolation.
domain: financials
status: reviewed
owner: railiance-apps
tags:
- railiance
- vergabe
- backup
- restore
- postgresql
- sqlite
- media
- attended
- recovery
vector: D3 / A2 / C3 / R2
path: registry/capabilities/capability.railiance.vergabe-attended-recovery.md
consumption_modes:
- CLI
- source
source_repo: railiance-apps
source_index: ../railiance-apps/registry/indexes/capabilities.yaml
- id: capability.railiance.workload-deployment-tooling
name: Workload release configuration and guards
summary: Helm/manifests, exact image pins, application runbooks and rollout/rollback.
summary: Application Helm/manifests, exact image bindings, operator guards and bounded
recovery runbooks; Forgejo identity extension remains in progress.
domain: financials
status: draft
owner: railiance-apps