Catalog the attended empty-profile login browser.

The headed Playwright Chromium used for a purpose-specific login is a
separate capability from the remote headless browser service.

Assistant: grok
Assistant-Session: 01a198fa-fd27-7e41-a0a2-57355c3e4efd

registry/capabilities/capability.infotech.isolated-login-browser.md

@@ -0,0 +1,149 @@
+---
+id: capability.infotech.isolated-login-browser
+name: Isolated Login Browser
+summary: >-
+  Headed empty-profile Chromium for one attended login. It uses the Chromium
+  binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for
+  Testing 151.0.7922.34) and a new user-data directory. It is not the Windows
+  default browser and not the rapp-playwright headless service.
+owner: reuse-surface
+status: draft
+domain: infotech
+tags:
+  - attended-login
+  - browser
+  - chromium
+  - empty-profile
+  - playwright
+maturity:
+  discovery:
+    current: D2
+    target: D3
+    confidence: medium
+    rationale: >
+      The boundary is one visible login page in a fresh profile. The remote
+      headless browser is a neighboring capability and is excluded.
+  availability:
+    current: A2
+    target: A3
+    confidence: medium
+    rationale: >
+      The launcher is source in railiance-platform and calls the already
+      installed Playwright Chromium cache. It is not a published installable
+      command.
+external_evidence:
+  completeness:
+    level: C1
+    confidence: low
+    basis: scope_vs_intent_and_consumer_expectations
+    satisfied_expectations:
+      - A headed Chromium from the coulomb-social Playwright pin can be named and started with a fresh profile.
+    broken_expectations:
+      - An attended OpenBao login has not completed in this profile.
+    out_of_scope_expectations:
+      - Headless screenshots, keyboard trials, or a hosted browser service.
+      - Credential custody, password entry, or one-time-code handling by the launcher.
+  reliability:
+    level: R1
+    confidence: low
+    basis: consumer_quality_signals
+    known_reliability_risks:
+      - Two earlier login attempts opened the signed-in Windows default browser and timed out before the owner command.
+      - The cache binary must match the coulomb-social Playwright pin or the launcher refuses to start.
+      - A desktop display is required. There is no Windows-browser fallback.
+discovery:
+  intent: >
+    Give an operator a visible browser with no saved account when a login must
+    not reuse the workstation's default browser session.
+  includes:
+    - Headed Chromium selected from coulomb-social's Playwright browsers pin.
+    - A new empty profile for each allowed Keycloak login URL.
+    - The local OpenBao OIDC callback on port 8250.
+  excludes:
+    - The Windows default browser, including Firefox and Edge.
+    - rapp-playwright and any remote headless browser.
+    - Reading, storing, or typing credentials.
+  assumptions:
+    - The workstation already has the pinned Chromium in the Playwright cache.
+    - DISPLAY or WAYLAND_DISPLAY is available to the login process.
+  use_cases:
+    - Open the platform-root OpenBao login without an existing disposable-account session.
+  research_memos: []
+availability:
+  current_level: A2
+  target_level: A3
+  current_artifacts:
+    - ../railiance-platform/scripts/operator-browser/xdg-open
+    - ../railiance-platform/scripts/openbao-attended-exec.py
+    - ../coulomb-social/scripts/node_modules/playwright-core/browsers.json
+  target_artifacts:
+    - A small installable command whose only job is the empty-profile login window.
+  consumption_modes:
+    - informational
+    - source adaptation
+    - cli
+relations:
+  depends_on: []
+  supports: []
+  related_to:
+    - capability.infotech.headless-browser
+evidence:
+  documentation:
+    - ../railiance-platform/docs/backup-credential-recovery.md
+  tests:
+    - ../railiance-platform/tests/test_operator_browser.py
+  consumer_feedback:
+    - >-
+      2026-11-02: the attended OpenBao window was Firefox, the Windows default,
+      after a launcher intended to open Edge. The signed-in session could not
+      be used for platform-root.
+  bug_reports: []
+  incidents: []
+consumer_guidance:
+  recommended_for:
+    - One attended login that must show the one-time-code page and return to localhost.
+  not_recommended_for:
+    - Screenshot or keyboard trials. Use capability.infotech.headless-browser.
+    - Any flow that should reuse the operator's normal signed-in browser.
+  known_limitations:
+    - The launcher allowlists only the OpenBao Keycloak callback.
+    - Closing the blank proof window is not a completed login.
+promotion_history: []
+---
+
+# Isolated Login Browser
+
+## Overview
+
+This is the visible browser for a purpose-specific login. It starts the
+Chromium binary already installed for coulomb-social's Playwright tests,
+with a new empty profile, on the workstation display. The founder sees the
+identity page and completes the one-time code.
+
+`capability.infotech.headless-browser` is the remote screenshot service. It
+does not show a local login page and cannot receive the OpenBao callback on
+`localhost:8250`.
+
+## Assessment notes
+
+### Discovery
+
+The included behavior is one allowlisted Keycloak URL. Saved Windows sessions
+and headless trials are outside it.
+
+### Availability
+
+Call `python3 scripts/openbao-attended-exec.py` from railiance-platform. The
+wrapper places `scripts/operator-browser` first on `PATH`, so OpenBao's
+`xdg-open` reaches this launcher.
+
+### Completeness
+
+The browser selection and empty profile exist. A finished platform-root login
+in that window is still outstanding, so the core use case is not complete.
+
+### Reliability
+
+The previous Windows opener disappointed the operator by presenting the
+default Firefox session. This entry stays fragile until one real login
+completes in the pinned Chromium.