diff --git a/docs/graph/capability-graph.mmd b/docs/graph/capability-graph.mmd index b66c008..f806631 100644 --- a/docs/graph/capability-graph.mmd +++ b/docs/graph/capability-graph.mmd @@ -1,9 +1,13 @@ graph LR capability_infotech_headless_browser["capability.infotech.headless-browser
D3 / A5 / C2 / R2"] - capability_registry_register["capability.registry.register
D3 / A4 / C2 / R3"] + capability_infotech_isolated_login_browser["capability.infotech.isolated-login-browser
D3 / A2 / C3 / R2"] + capability_registry_register["capability.registry.register
D3 / A3 / C2 / R3"] capability_registry_validate["capability.registry.validate
D4 / A3 / C3 / R3"] + capability_infotech_isolated_login_browser -->|related_to| capability_infotech_headless_browser capability_registry_register -->|supports| capability_feature_control_evaluate capability_registry_register -->|supports| capability_identity_vocabulary_canonicalize capability_registry_register -->|related_to| capability_registry_validate + capability_registry_register -->|related_to| capability_security_iam_tooling_suite capability_registry_validate -->|depends_on| capability_registry_register capability_registry_validate -->|related_to| capability_registry_register + capability_registry_validate -->|related_to| capability_security_iam_tooling_suite diff --git a/docs/graph/index.html b/docs/graph/index.html index 19366f8..1d0300c 100644 --- a/docs/graph/index.html +++ b/docs/graph/index.html @@ -17,7 +17,7 @@

Generated from entry relations fields. Regenerate with reuse-surface graph.


   
 
 
diff --git a/registry/capabilities/capability.infotech.isolated-login-browser.md b/registry/capabilities/capability.infotech.isolated-login-browser.md
index 9fce5e7..f1e825e 100644
--- a/registry/capabilities/capability.infotech.isolated-login-browser.md
+++ b/registry/capabilities/capability.infotech.isolated-login-browser.md
@@ -1,152 +1,204 @@
 ---
 id: capability.infotech.isolated-login-browser
 name: Isolated Login Browser
-summary: >-
-  Headed empty-profile Chromium for one attended login. It uses the Chromium
-  binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for
-  Testing 151.0.7922.34) and a new user-data directory. It is not the Windows
-  default browser and not the rapp-playwright headless service.
+summary: 'Isolated visible login window: native Windows Edge with a private disposable
+  profile on WSL, pinned Playwright Chromium on non-WSL Linux; operator-only credentials
+  and fixed issuer/callback guards.'
 owner: reuse-surface
-status: draft
+status: reviewed
 domain: infotech
 tags:
-  - attended-login
-  - browser
-  - chromium
-  - empty-profile
-  - playwright
+- attended-login
+- browser
+- chromium
+- empty-profile
+- playwright
+- windows
+- wsl
+- edge
 maturity:
   discovery:
-    current: D2
-    target: D3
-    confidence: medium
-    rationale: >
-      The boundary is one visible login page in a fresh profile. The remote
-      headless browser is a neighboring capability and is excluded.
+    current: D3
+    target: D4
+    confidence: high
+    rationale: Real WSL input failure, Linux probes, native Windows lifecycle and
+      actual attended login were investigated; this is bounded exploration, not systematic
+      browser research.
   availability:
     current: A2
     target: A3
     confidence: medium
-    rationale: >
-      The launcher is source in railiance-platform and calls the already
-      installed Playwright Chromium cache. It is not a published installable
-      command.
+    rationale: Source in railiance-platform selects a native Windows worker on WSL
+      and retains pinned Chromium on non-WSL Linux; no separately packaged CLI.
 external_evidence:
   completeness:
-    level: C1
-    confidence: low
+    level: C3
+    confidence: high
     basis: scope_vs_intent_and_consumer_expectations
     satisfied_expectations:
-      - A headed Chromium from the coulomb-social Playwright pin can be named and started with a fresh profile.
-    broken_expectations:
-      - An attended OpenBao login has not completed in this profile.
+    - Fresh owner-only native Windows profile, guarded issuer/local callback and bounded
+      process/profile cleanup
+    - Actual attended owner login completes, with provider readback/decryption and
+      session revocation
+    - Credential-free native localhost callback lifecycle and 32 platform operator
+      tests pass
+    broken_expectations: []
     out_of_scope_expectations:
-      - Headless screenshots, keyboard trials, or a hosted browser service.
-      - Credential custody, password entry, or one-time-code handling by the launcher.
+    - Headless screenshots, keyboard trials, or a hosted browser service.
+    - Credential custody, password entry, or one-time-code handling by the launcher.
   reliability:
-    level: R1
-    confidence: low
+    level: R2
+    confidence: medium
     basis: consumer_quality_signals
     known_reliability_risks:
-      - Two earlier login attempts opened the signed-in Windows default browser and timed out before the owner command.
-      - The cache binary must match the coulomb-social Playwright pin or the launcher refuses to start.
-      - A desktop display is required. There is no Windows-browser fallback.
+    - Native Windows path has focused lifecycle proof and one successful operating
+      retry, not broad operating history.
+    - WSLg/Chrome input stalled unpredictably even in credential-free probes; the
+      Windows path bypasses it without proving the exact root cause.
+    - Earlier timeout/authentication failure receipts retain unconfirmed session revocation
+      outcomes.
+    - A Windows desktop/Edge installation and WSL interop are required on WSL; non-WSL
+      Linux still depends on the pinned Chromium cache.
+    - User-close or timeout cleanup is bounded; the opener fails closed when the private
+      profile/ACL/worker cannot be established.
 discovery:
-  intent: >
-    Give an operator a visible browser with no saved account when a login must
-    not reuse the workstation's default browser session.
+  intent: 'Give an operator a visible browser with no saved account when a login must
+    not reuse the workstation''s default browser session.
+
+    '
   includes:
-    - Headed Chromium selected from coulomb-social's Playwright browsers pin.
-    - A new empty profile for each allowed Keycloak login URL.
-    - The local OpenBao OIDC callback on port 8250.
+  - Native Windows Edge on WSL, with a fresh owner-only profile for each invocation
+  - Pinned headed Chromium on non-WSL Linux
+  - Fixed Keycloak issuer and approved localhost/127.0.0.1 OpenBao callback on port
+    8250
+  - Owned browser/profile lifecycle cleanup
   excludes:
-    - The Windows default browser, including Firefox and Edge.
-    - rapp-playwright and any remote headless browser.
-    - Reading, storing, or typing credentials.
+  - Shared/default browser profiles and remote headless services
+  - Credential entry/storage by the agent or launcher
+  - Changing issuer, MFA, callback registration, grants or output allowlists
   assumptions:
-    - The workstation already has the pinned Chromium in the Playwright cache.
-    - DISPLAY or WAYLAND_DISPLAY is available to the login process.
+  - Existing attended platform owner lane and allowed issuer/callback
+  - Windows Edge and PowerShell/WSL interop on WSL; pinned Chromium and a display
+    on non-WSL Linux
   use_cases:
-    - Open the platform-root OpenBao login without an existing disposable-account session.
+  - Open the platform-root OpenBao login without an existing disposable-account session.
   research_memos: []
 availability:
   current_level: A2
   target_level: A3
   current_artifacts:
-    - ../railiance-platform/scripts/operator-browser/cmd.exe
-    - ../railiance-platform/scripts/operator-browser/xdg-open
-    - ../railiance-platform/scripts/openbao-attended-exec.py
-    - ../coulomb-social/scripts/node_modules/playwright-core/browsers.json
+  - ../railiance-platform/scripts/operator-browser/cmd.exe
+  - ../railiance-platform/scripts/operator-browser/xdg-open
+  - ../railiance-platform/scripts/openbao-attended-exec.py
+  - ../coulomb-social/scripts/node_modules/playwright-core/browsers.json
+  - ../railiance-platform/scripts/operator-browser/windows_browser.py
   target_artifacts:
-    - A small installable command whose only job is the empty-profile login window.
+  - A small installable command whose only job is the empty-profile login window.
   consumption_modes:
-    - informational
-    - source adaptation
-    - cli
+  - informational
+  - source adaptation
+  - cli
 relations:
   depends_on: []
   supports: []
   related_to:
-    - capability.infotech.headless-browser
+  - capability.infotech.headless-browser
 evidence:
   documentation:
-    - ../railiance-platform/docs/backup-credential-recovery.md
+  - ../railiance-platform/docs/backup-credential-recovery.md
+  - ../railiance-platform/docs/evidence/2026-11-06-operator-browser-native-windows.json
+  - ../railiance-apps/docs/evidence/2026-11-06-vergabe-browser-window-repair.json
   tests:
-    - ../railiance-platform/tests/test_operator_browser.py
+  - ../railiance-platform/tests/test_operator_browser.py
+  - ../railiance-platform/tests/test_operator_windows_browser.py
   consumer_feedback:
-    - >-
-      2026-11-02: the attended OpenBao window was Firefox, the Windows default.
-      A later login also opened a Firefox tab because OpenBao calls
-      `cmd.exe /c start` on WSL and never reaches xdg-open. The empty profile
-      was not used. The login still completed after the old session expired.
-  bug_reports: []
+  - '2026-11-02: the attended OpenBao window was Firefox, the Windows default. A later
+    login also opened a Firefox tab because OpenBao calls `cmd.exe /c start` on WSL
+    and never reaches xdg-open. The empty profile was not used. The login still completed
+    after the old session expired.'
+  - '2026-11-06: founder confirms native Windows controls respond normally; actual
+    contained owner login worked like a charm.'
+  - ../railiance-apps/docs/evidence/2026-11-06-vergabe-attended-provider-success-return.json
+  - ../railiance-apps/docs/evidence/2026-11-06-vergabe-attended-backup-complete-return.json
+  bug_reports:
+  - ../railiance-apps/docs/evidence/2026-11-06-vergabe-browser-window-repair.json
   incidents: []
 consumer_guidance:
   recommended_for:
-    - One attended login that must show the one-time-code page and return to localhost.
+  - One attended login that must show the one-time-code page and return to localhost.
   not_recommended_for:
-    - Screenshot or keyboard trials. Use capability.infotech.headless-browser.
-    - Any flow that should reuse the operator's normal signed-in browser.
+  - Screenshot or keyboard trials. Use capability.infotech.headless-browser.
+  - Any flow that should reuse the operator's normal signed-in browser.
   known_limitations:
-    - The launcher allowlists only the OpenBao Keycloak callback.
-    - Closing the blank proof window is not a completed login.
-promotion_history: []
+  - Only fixed issuer/callback paths are allowed; no shared/default-profile fallback.
+  - The authorization URL is passed to the PowerShell worker via stdin, then appears
+    in the owned browser startup argument; no claim of zero URL visibility in all
+    process arguments.
+  - Agent never handles passwords, OTPs, cookies or token-helper values.
+  - Fixture callback navigation is credential-free; actual founder login success is
+    recorded separately.
+promotion_history:
+- date: '2026-11-06'
+  dimension: discovery
+  from: D2
+  to: D3
+  rationale: Platform 8519459 plus native private-profile/callback/cleanup proof and
+    founder-reported actual contained login in Apps 6947673. Earlier failures retained;
+    narrow scope and limited history.
+  author: codex
+- date: '2026-11-06'
+  dimension: completeness
+  from: C1
+  to: C3
+  rationale: Platform 8519459 plus native private-profile/callback/cleanup proof and
+    founder-reported actual contained login in Apps 6947673. Earlier failures retained;
+    narrow scope and limited history.
+  author: codex
+- date: '2026-11-06'
+  dimension: reliability
+  from: R1
+  to: R2
+  rationale: Platform 8519459 plus native private-profile/callback/cleanup proof and
+    founder-reported actual contained login in Apps 6947673. Earlier failures retained;
+    narrow scope and limited history.
+  author: codex
 ---
 
 # Isolated Login Browser
 
-## Overview
+The runtime implementation is owned by `railiance-platform`; reuse-surface
+provides discovery and the bounded consumption assessment. Platform commit
+`8519459e6fedd1bfb25dc2cdee6372d7252f5d0a` selects native Windows Edge on WSL
+through its existing operator-browser entry. Non-WSL Linux retains the pinned
+Playwright Chromium path. Both use disposable profiles; neither reuses the
+operator's shared browser session.
 
-This is the visible browser for a purpose-specific login. It starts the
-Chromium binary already installed for coulomb-social's Playwright tests,
-with a new empty profile, on the workstation display. The founder sees the
-identity page and completes the one-time code.
+## Current acceptance — 2026-11-06
 
-`capability.infotech.headless-browser` is the remote screenshot service. It
-does not show a local login page and cannot receive the OpenBao callback on
-`localhost:8250`.
+The founder observed wrong/unresponsive controls, stalled tabs and titlebar X
+in WSLg/Chrome, including credential-free probes. Native Windows Edge responded
+normally. The corrected worker uses the current user's numeric SID for a private
+protected profile ACL, guards owned process identity and cleans its own profile.
+It receives the URL through stdin; the browser subsequently receives it as a
+startup argument. Existing issuer/callback, factor, token-helper and output
+controls remain in effect.
 
-## Assessment notes
+The founder's real login then succeeds. The
+[provider receipt](../../../railiance-apps/docs/evidence/2026-11-06-vergabe-attended-provider-success-return.json)
+records Warden exit 0 and session revocation/storage cleanup; the
+[final backup receipt](../../../railiance-apps/docs/evidence/2026-11-06-vergabe-attended-backup-complete-return.json)
+records the completed recovery sequence. Thirty-two platform operator tests and
+a credential-free native callback/process/profile lifecycle fixture are separate
+quality evidence. Older failed attempts retain their unknown outcomes.
 
-### Discovery
+## Consumption boundary
 
-The included behavior is one allowlisted Keycloak URL. Saved Windows sessions
-and headless trials are outside it.
+Use the reviewed `railiance-platform/scripts/openbao-attended-exec.py` lane
+and its operator-browser directory. Do not repurpose the launcher for arbitrary
+URLs, widen callback/issuer guards or run it with a shared profile. Existing
+operation authorization still governs the owner command.
 
-### Availability
-
-Call `python3 scripts/openbao-attended-exec.py` from railiance-platform. The
-wrapper places `scripts/operator-browser` first on `PATH`. On WSL, OpenBao
-runs `cmd.exe /c start`, so that directory provides `cmd.exe` for the
-allowlisted login URL.
-
-### Completeness
-
-The browser selection and empty profile exist. A finished platform-root login
-in that window is still outstanding, so the core use case is not complete.
-
-### Reliability
-
-The attended login still opened a Firefox tab on 2026-11-02 because the
-WSL opener never called xdg-open. This entry stays fragile until one real
-login completes in the pinned Chromium.
+This local attended window is separate from
+`capability.infotech.headless-browser`, the remote screenshot/trial service.
+D3/A2/C3/R2 describes the bounded visible-login core with its documented Windows
+workaround and limited history. It grants no credential or deployment authority.
diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml
index 392a4d9..058c598 100644
--- a/registry/indexes/capabilities.yaml
+++ b/registry/indexes/capabilities.yaml
@@ -1,5 +1,5 @@
 version: 1
-updated: '2026-11-02'
+updated: '2026-11-06'
 domain: helix_forge
 capabilities:
 - id: capability.infotech.headless-browser
@@ -39,14 +39,12 @@ capabilities:
   - container
 - id: capability.infotech.isolated-login-browser
   name: Isolated Login Browser
-  summary: >-
-    Headed empty-profile Chromium for one attended login. It uses the Chromium
-    binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for
-    Testing 151.0.7922.34) and a new user-data directory. It is not the Windows
-    default browser and not the rapp-playwright headless service.
-  vector: D2 / A2 / C1 / R1
+  summary: 'Isolated visible login window: native Windows Edge with a private disposable
+    profile on WSL, pinned Playwright Chromium on non-WSL Linux; operator-only credentials
+    and fixed issuer/callback guards.'
+  vector: D3 / A2 / C3 / R2
   domain: infotech
-  status: draft
+  status: reviewed
   owner: reuse-surface
   path: registry/capabilities/capability.infotech.isolated-login-browser.md
   tags:
@@ -55,6 +53,9 @@ capabilities:
   - chromium
   - empty-profile
   - playwright
+  - windows
+  - wsl
+  - edge
   consumption_modes:
   - informational
   - source adaptation
diff --git a/registry/indexes/federated.yaml b/registry/indexes/federated.yaml
index 90dacb6..56931bd 100644
--- a/registry/indexes/federated.yaml
+++ b/registry/indexes/federated.yaml
@@ -1,7 +1,7 @@
 # Composed federated capability index. Regenerate with:
 # reuse-surface federation compose
 version: 1
-updated: '2026-11-02'
+updated: '2026-11-06'
 domain: helix_forge
 collision_policy: warn
 sources:
@@ -202,7 +202,7 @@ sources:
   count: 1
   index: ../rail-kubernetes/registry/indexes/capabilities.yaml
 - repo: railiance-apps
-  count: 1
+  count: 2
   index: ../railiance-apps/registry/indexes/capabilities.yaml
 - repo: railiance-bootstrap
   count: 1
@@ -1226,30 +1226,6 @@ capabilities:
   - container
   source_repo: reuse-surface
   source_index: ../reuse-surface/registry/indexes/capabilities.yaml
-- id: capability.infotech.isolated-login-browser
-  name: Isolated Login Browser
-  summary: >-
-    Headed empty-profile Chromium for one attended login. It uses the Chromium
-    binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for
-    Testing 151.0.7922.34) and a new user-data directory. It is not the Windows
-    default browser and not the rapp-playwright headless service.
-  vector: D2 / A2 / C1 / R1
-  domain: infotech
-  status: draft
-  owner: reuse-surface
-  path: registry/capabilities/capability.infotech.isolated-login-browser.md
-  tags:
-  - attended-login
-  - browser
-  - chromium
-  - empty-profile
-  - playwright
-  consumption_modes:
-  - informational
-  - source adaptation
-  - cli
-  source_repo: reuse-surface
-  source_index: ../reuse-surface/registry/indexes/capabilities.yaml
 - id: capability.infotech.hub-core-library
   name: Reusable FOS Hub Core Primitives
   summary: Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State
@@ -1269,6 +1245,31 @@ capabilities:
   source_repo: hub-core
   source_url: https://forgejo.coulomb.social/coulomb/hub-core/raw/branch/main/registry/indexes/capabilities.yaml
   source_index: registry/federation/cache/hub-core.yaml
+- id: capability.infotech.isolated-login-browser
+  name: Isolated Login Browser
+  summary: 'Isolated visible login window: native Windows Edge with a private disposable
+    profile on WSL, pinned Playwright Chromium on non-WSL Linux; operator-only credentials
+    and fixed issuer/callback guards.'
+  vector: D3 / A2 / C3 / R2
+  domain: infotech
+  status: reviewed
+  owner: reuse-surface
+  path: registry/capabilities/capability.infotech.isolated-login-browser.md
+  tags:
+  - attended-login
+  - browser
+  - chromium
+  - empty-profile
+  - playwright
+  - windows
+  - wsl
+  - edge
+  consumption_modes:
+  - informational
+  - source adaptation
+  - cli
+  source_repo: reuse-surface
+  source_index: ../reuse-surface/registry/indexes/capabilities.yaml
 - id: capability.infotech.issue-tracking
   name: External issue tracker connector
   summary: CLI and Python adapters for external issue systems.
@@ -1897,9 +1898,34 @@ capabilities:
   - source
   source_repo: rapp-user-engine
   source_index: ../rapp-user-engine/registry/indexes/capabilities.yaml
+- id: capability.railiance.vergabe-attended-recovery
+  name: Attended Vergabe three-store backup and isolated recovery
+  summary: Capture PostgreSQL, media and SQLite coherently, verify encrypted provider
+    readback/decryption, and restore the bound demo-company pilot in isolation.
+  domain: financials
+  status: reviewed
+  owner: railiance-apps
+  tags:
+  - railiance
+  - vergabe
+  - backup
+  - restore
+  - postgresql
+  - sqlite
+  - media
+  - attended
+  - recovery
+  vector: D3 / A2 / C3 / R2
+  path: registry/capabilities/capability.railiance.vergabe-attended-recovery.md
+  consumption_modes:
+  - CLI
+  - source
+  source_repo: railiance-apps
+  source_index: ../railiance-apps/registry/indexes/capabilities.yaml
 - id: capability.railiance.workload-deployment-tooling
   name: Workload release configuration and guards
-  summary: Helm/manifests, exact image pins, application runbooks and rollout/rollback.
+  summary: Application Helm/manifests, exact image bindings, operator guards and bounded
+    recovery runbooks; Forgejo identity extension remains in progress.
   domain: financials
   status: draft
   owner: railiance-apps