Catalog the attended empty-profile login browser.
The headed Playwright Chromium used for a purpose-specific login is a separate capability from the remote headless browser service. Assistant: grok Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd
This commit is contained in:
parent
c4c40b466f
commit
b91229d0de
5 changed files with 229 additions and 3 deletions
|
|
@ -10,6 +10,7 @@
|
|||
| --- | --- | --- | --- | --- |
|
||||
| workplan | ADHOC-2026-10-13 | finished | — | workplans/ADHOC-2026-10-13.md |
|
||||
| workplan | REUSE-WP-ADHOC-2026-10-16 | finished | — | workplans/ADHOC-2026-10-16.md |
|
||||
| workplan | REUSE-WP-ADHOC-2026-11-02 | finished | — | workplans/ADHOC-2026-11-02.md |
|
||||
| workplan | REUSE-WP-0023 | finished | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
|
||||
| workplan | REUSE-WP-0024 | finished | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
|
||||
| workplan | REUSE-WP-0025 | blocked | — | workplans/REUSE-WP-0025-private-source-reader-boundary.md |
|
||||
|
|
@ -17,6 +18,7 @@
|
|||
| task | ADHOC-2026-10-13-T01 | done | — | workplans/ADHOC-2026-10-13.md |
|
||||
| task | ADHOC-2026-10-13-T02 | done | — | workplans/ADHOC-2026-10-13.md |
|
||||
| task | REUSE-WP-ADHOC-2026-10-16-T01 | done | — | workplans/ADHOC-2026-10-16.md |
|
||||
| task | REUSE-WP-ADHOC-2026-11-02-T01 | done | — | workplans/ADHOC-2026-11-02.md |
|
||||
| task | REUSE-WP-0023-T01 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
|
||||
| task | REUSE-WP-0023-T02 | done | — | workplans/REUSE-WP-0023-access-engine-source-rename.md |
|
||||
| task | REUSE-WP-0024-T01 | done | — | workplans/REUSE-WP-0024-browser-discovery-and-provider-evidence.md |
|
||||
|
|
|
|||
|
|
@ -0,0 +1,149 @@
|
|||
---
|
||||
id: capability.infotech.isolated-login-browser
|
||||
name: Isolated Login Browser
|
||||
summary: >-
|
||||
Headed empty-profile Chromium for one attended login. It uses the Chromium
|
||||
binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for
|
||||
Testing 151.0.7922.34) and a new user-data directory. It is not the Windows
|
||||
default browser and not the rapp-playwright headless service.
|
||||
owner: reuse-surface
|
||||
status: draft
|
||||
domain: infotech
|
||||
tags:
|
||||
- attended-login
|
||||
- browser
|
||||
- chromium
|
||||
- empty-profile
|
||||
- playwright
|
||||
maturity:
|
||||
discovery:
|
||||
current: D2
|
||||
target: D3
|
||||
confidence: medium
|
||||
rationale: >
|
||||
The boundary is one visible login page in a fresh profile. The remote
|
||||
headless browser is a neighboring capability and is excluded.
|
||||
availability:
|
||||
current: A2
|
||||
target: A3
|
||||
confidence: medium
|
||||
rationale: >
|
||||
The launcher is source in railiance-platform and calls the already
|
||||
installed Playwright Chromium cache. It is not a published installable
|
||||
command.
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C1
|
||||
confidence: low
|
||||
basis: scope_vs_intent_and_consumer_expectations
|
||||
satisfied_expectations:
|
||||
- A headed Chromium from the coulomb-social Playwright pin can be named and started with a fresh profile.
|
||||
broken_expectations:
|
||||
- An attended OpenBao login has not completed in this profile.
|
||||
out_of_scope_expectations:
|
||||
- Headless screenshots, keyboard trials, or a hosted browser service.
|
||||
- Credential custody, password entry, or one-time-code handling by the launcher.
|
||||
reliability:
|
||||
level: R1
|
||||
confidence: low
|
||||
basis: consumer_quality_signals
|
||||
known_reliability_risks:
|
||||
- Two earlier login attempts opened the signed-in Windows default browser and timed out before the owner command.
|
||||
- The cache binary must match the coulomb-social Playwright pin or the launcher refuses to start.
|
||||
- A desktop display is required. There is no Windows-browser fallback.
|
||||
discovery:
|
||||
intent: >
|
||||
Give an operator a visible browser with no saved account when a login must
|
||||
not reuse the workstation's default browser session.
|
||||
includes:
|
||||
- Headed Chromium selected from coulomb-social's Playwright browsers pin.
|
||||
- A new empty profile for each allowed Keycloak login URL.
|
||||
- The local OpenBao OIDC callback on port 8250.
|
||||
excludes:
|
||||
- The Windows default browser, including Firefox and Edge.
|
||||
- rapp-playwright and any remote headless browser.
|
||||
- Reading, storing, or typing credentials.
|
||||
assumptions:
|
||||
- The workstation already has the pinned Chromium in the Playwright cache.
|
||||
- DISPLAY or WAYLAND_DISPLAY is available to the login process.
|
||||
use_cases:
|
||||
- Open the platform-root OpenBao login without an existing disposable-account session.
|
||||
research_memos: []
|
||||
availability:
|
||||
current_level: A2
|
||||
target_level: A3
|
||||
current_artifacts:
|
||||
- ../railiance-platform/scripts/operator-browser/xdg-open
|
||||
- ../railiance-platform/scripts/openbao-attended-exec.py
|
||||
- ../coulomb-social/scripts/node_modules/playwright-core/browsers.json
|
||||
target_artifacts:
|
||||
- A small installable command whose only job is the empty-profile login window.
|
||||
consumption_modes:
|
||||
- informational
|
||||
- source adaptation
|
||||
- cli
|
||||
relations:
|
||||
depends_on: []
|
||||
supports: []
|
||||
related_to:
|
||||
- capability.infotech.headless-browser
|
||||
evidence:
|
||||
documentation:
|
||||
- ../railiance-platform/docs/backup-credential-recovery.md
|
||||
tests:
|
||||
- ../railiance-platform/tests/test_operator_browser.py
|
||||
consumer_feedback:
|
||||
- >-
|
||||
2026-11-02: the attended OpenBao window was Firefox, the Windows default,
|
||||
after a launcher intended to open Edge. The signed-in session could not
|
||||
be used for platform-root.
|
||||
bug_reports: []
|
||||
incidents: []
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- One attended login that must show the one-time-code page and return to localhost.
|
||||
not_recommended_for:
|
||||
- Screenshot or keyboard trials. Use capability.infotech.headless-browser.
|
||||
- Any flow that should reuse the operator's normal signed-in browser.
|
||||
known_limitations:
|
||||
- The launcher allowlists only the OpenBao Keycloak callback.
|
||||
- Closing the blank proof window is not a completed login.
|
||||
promotion_history: []
|
||||
---
|
||||
|
||||
# Isolated Login Browser
|
||||
|
||||
## Overview
|
||||
|
||||
This is the visible browser for a purpose-specific login. It starts the
|
||||
Chromium binary already installed for coulomb-social's Playwright tests,
|
||||
with a new empty profile, on the workstation display. The founder sees the
|
||||
identity page and completes the one-time code.
|
||||
|
||||
`capability.infotech.headless-browser` is the remote screenshot service. It
|
||||
does not show a local login page and cannot receive the OpenBao callback on
|
||||
`localhost:8250`.
|
||||
|
||||
## Assessment notes
|
||||
|
||||
### Discovery
|
||||
|
||||
The included behavior is one allowlisted Keycloak URL. Saved Windows sessions
|
||||
and headless trials are outside it.
|
||||
|
||||
### Availability
|
||||
|
||||
Call `python3 scripts/openbao-attended-exec.py` from railiance-platform. The
|
||||
wrapper places `scripts/operator-browser` first on `PATH`, so OpenBao's
|
||||
`xdg-open` reaches this launcher.
|
||||
|
||||
### Completeness
|
||||
|
||||
The browser selection and empty profile exist. A finished platform-root login
|
||||
in that window is still outstanding, so the core use case is not complete.
|
||||
|
||||
### Reliability
|
||||
|
||||
The previous Windows opener disappointed the operator by presenting the
|
||||
default Firefox session. This entry stays fragile until one real login
|
||||
completes in the pinned Chromium.
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
version: 1
|
||||
updated: '2026-10-18'
|
||||
updated: '2026-11-02'
|
||||
domain: helix_forge
|
||||
capabilities:
|
||||
- id: capability.infotech.headless-browser
|
||||
|
|
@ -37,6 +37,28 @@ capabilities:
|
|||
- cli
|
||||
- service API
|
||||
- container
|
||||
- id: capability.infotech.isolated-login-browser
|
||||
name: Isolated Login Browser
|
||||
summary: >-
|
||||
Headed empty-profile Chromium for one attended login. It uses the Chromium
|
||||
binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for
|
||||
Testing 151.0.7922.34) and a new user-data directory. It is not the Windows
|
||||
default browser and not the rapp-playwright headless service.
|
||||
vector: D2 / A2 / C1 / R1
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: reuse-surface
|
||||
path: registry/capabilities/capability.infotech.isolated-login-browser.md
|
||||
tags:
|
||||
- attended-login
|
||||
- browser
|
||||
- chromium
|
||||
- empty-profile
|
||||
- playwright
|
||||
consumption_modes:
|
||||
- informational
|
||||
- source adaptation
|
||||
- cli
|
||||
- id: capability.registry.register
|
||||
name: Capability registry and federation
|
||||
summary: Owner Markdown entries, indexes, federation hub and planning queries.
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
# Composed federated capability index. Regenerate with:
|
||||
# reuse-surface federation compose
|
||||
version: 1
|
||||
updated: '2026-10-21'
|
||||
updated: '2026-11-02'
|
||||
domain: helix_forge
|
||||
collision_policy: warn
|
||||
sources:
|
||||
|
|
@ -282,7 +282,7 @@ sources:
|
|||
count: 1
|
||||
index: ../resource-control/registry/indexes/capabilities.yaml
|
||||
- repo: reuse-surface
|
||||
count: 3
|
||||
count: 4
|
||||
index: ../reuse-surface/registry/indexes/capabilities.yaml
|
||||
- repo: risk-nexus
|
||||
count: 1
|
||||
|
|
@ -1226,6 +1226,30 @@ capabilities:
|
|||
- container
|
||||
source_repo: reuse-surface
|
||||
source_index: ../reuse-surface/registry/indexes/capabilities.yaml
|
||||
- id: capability.infotech.isolated-login-browser
|
||||
name: Isolated Login Browser
|
||||
summary: >-
|
||||
Headed empty-profile Chromium for one attended login. It uses the Chromium
|
||||
binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for
|
||||
Testing 151.0.7922.34) and a new user-data directory. It is not the Windows
|
||||
default browser and not the rapp-playwright headless service.
|
||||
vector: D2 / A2 / C1 / R1
|
||||
domain: infotech
|
||||
status: draft
|
||||
owner: reuse-surface
|
||||
path: registry/capabilities/capability.infotech.isolated-login-browser.md
|
||||
tags:
|
||||
- attended-login
|
||||
- browser
|
||||
- chromium
|
||||
- empty-profile
|
||||
- playwright
|
||||
consumption_modes:
|
||||
- informational
|
||||
- source adaptation
|
||||
- cli
|
||||
source_repo: reuse-surface
|
||||
source_index: ../reuse-surface/registry/indexes/capabilities.yaml
|
||||
- id: capability.infotech.hub-core-library
|
||||
name: Reusable FOS Hub Core Primitives
|
||||
summary: Reusable FastAPI, SQLAlchemy, and MCP primitives extracted from the State
|
||||
|
|
|
|||
29
workplans/ADHOC-2026-11-02.md
Normal file
29
workplans/ADHOC-2026-11-02.md
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
---
|
||||
id: REUSE-WP-ADHOC-2026-11-02
|
||||
type: workplan
|
||||
title: "Catalog the attended empty-profile login browser"
|
||||
domain: infotech
|
||||
repo: reuse-surface
|
||||
status: finished
|
||||
owner: codex
|
||||
created: "2026-11-02"
|
||||
updated: "2026-11-02"
|
||||
flavor: implementation
|
||||
---
|
||||
|
||||
## Catalog the attended empty-profile login browser
|
||||
|
||||
```task
|
||||
id: REUSE-WP-ADHOC-2026-11-02-T01
|
||||
status: done
|
||||
priority: medium
|
||||
```
|
||||
|
||||
The Windows default browser opened a signed-in Firefox session during an
|
||||
attended OpenBao login. Catalog the separate headed facility:
|
||||
`capability.infotech.isolated-login-browser`. It points at the coulomb-social
|
||||
Playwright Chromium pin and the railiance-platform empty-profile launcher.
|
||||
It does not replace `capability.infotech.headless-browser`.
|
||||
|
||||
The entry stays draft at D2 / A2 / C1 / R1. A completed platform-root login
|
||||
in that window is still required before a maturity promotion.
|
||||
Loading…
Add table
Add a link
Reference in a new issue