reuse-surface/registry/capabilities/capability.infotech.isolated-login-browser.md

---
id: capability.infotech.isolated-login-browser
name: Isolated Login Browser
summary: >-
  Headed empty-profile Chromium for one attended login. It uses the Chromium
  binary pinned by coulomb-social Playwright 1.62.1 (revision 1234, Chrome for
  Testing 151.0.7922.34) and a new user-data directory. It is not the Windows
  default browser and not the rapp-playwright headless service.
owner: reuse-surface
status: draft
domain: infotech
tags:
  - attended-login
  - browser
  - chromium
  - empty-profile
  - playwright
maturity:
  discovery:
    current: D2
    target: D3
    confidence: medium
    rationale: >
      The boundary is one visible login page in a fresh profile. The remote
      headless browser is a neighboring capability and is excluded.
  availability:
    current: A2
    target: A3
    confidence: medium
    rationale: >
      The launcher is source in railiance-platform and calls the already
      installed Playwright Chromium cache. It is not a published installable
      command.
external_evidence:
  completeness:
    level: C1
    confidence: low
    basis: scope_vs_intent_and_consumer_expectations
    satisfied_expectations:
      - A headed Chromium from the coulomb-social Playwright pin can be named and started with a fresh profile.
    broken_expectations:
      - An attended OpenBao login has not completed in this profile.
    out_of_scope_expectations:
      - Headless screenshots, keyboard trials, or a hosted browser service.
      - Credential custody, password entry, or one-time-code handling by the launcher.
  reliability:
    level: R1
    confidence: low
    basis: consumer_quality_signals
    known_reliability_risks:
      - Two earlier login attempts opened the signed-in Windows default browser and timed out before the owner command.
      - The cache binary must match the coulomb-social Playwright pin or the launcher refuses to start.
      - A desktop display is required. There is no Windows-browser fallback.
discovery:
  intent: >
    Give an operator a visible browser with no saved account when a login must
    not reuse the workstation's default browser session.
  includes:
    - Headed Chromium selected from coulomb-social's Playwright browsers pin.
    - A new empty profile for each allowed Keycloak login URL.
    - The local OpenBao OIDC callback on port 8250.
  excludes:
    - The Windows default browser, including Firefox and Edge.
    - rapp-playwright and any remote headless browser.
    - Reading, storing, or typing credentials.
  assumptions:
    - The workstation already has the pinned Chromium in the Playwright cache.
    - DISPLAY or WAYLAND_DISPLAY is available to the login process.
  use_cases:
    - Open the platform-root OpenBao login without an existing disposable-account session.
  research_memos: []
availability:
  current_level: A2
  target_level: A3
  current_artifacts:
    - ../railiance-platform/scripts/operator-browser/cmd.exe
    - ../railiance-platform/scripts/operator-browser/xdg-open
    - ../railiance-platform/scripts/openbao-attended-exec.py
    - ../coulomb-social/scripts/node_modules/playwright-core/browsers.json
  target_artifacts:
    - A small installable command whose only job is the empty-profile login window.
  consumption_modes:
    - informational
    - source adaptation
    - cli
relations:
  depends_on: []
  supports: []
  related_to:
    - capability.infotech.headless-browser
evidence:
  documentation:
    - ../railiance-platform/docs/backup-credential-recovery.md
  tests:
    - ../railiance-platform/tests/test_operator_browser.py
  consumer_feedback:
    - >-
      2026-11-02: the attended OpenBao window was Firefox, the Windows default.
      A later login also opened a Firefox tab because OpenBao calls
      `cmd.exe /c start` on WSL and never reaches xdg-open. The empty profile
      was not used. The login still completed after the old session expired.
  bug_reports: []
  incidents: []
consumer_guidance:
  recommended_for:
    - One attended login that must show the one-time-code page and return to localhost.
  not_recommended_for:
    - Screenshot or keyboard trials. Use capability.infotech.headless-browser.
    - Any flow that should reuse the operator's normal signed-in browser.
  known_limitations:
    - The launcher allowlists only the OpenBao Keycloak callback.
    - Closing the blank proof window is not a completed login.
promotion_history: []
---

# Isolated Login Browser

## Overview

This is the visible browser for a purpose-specific login. It starts the
Chromium binary already installed for coulomb-social's Playwright tests,
with a new empty profile, on the workstation display. The founder sees the
identity page and completes the one-time code.

`capability.infotech.headless-browser` is the remote screenshot service. It
does not show a local login page and cannot receive the OpenBao callback on
`localhost:8250`.

## Assessment notes

### Discovery

The included behavior is one allowlisted Keycloak URL. Saved Windows sessions
and headless trials are outside it.

### Availability

Call `python3 scripts/openbao-attended-exec.py` from railiance-platform. The
wrapper places `scripts/operator-browser` first on `PATH`. On WSL, OpenBao
runs `cmd.exe /c start`, so that directory provides `cmd.exe` for the
allowlisted login URL.

### Completeness

The browser selection and empty profile exist. A finished platform-root login
in that window is still outstanding, so the core use case is not complete.

### Reliability

The attended login still opened a Firefox tab on 2026-11-02 because the
WSL opener never called xdg-open. This entry stays fragile until one real
login completes in the pinned Chromium.