Publish working development entrypoints and expose remaining Forgejo acceptance
This commit is contained in:
codex
parent
17635cb0a7
commit
cc526baa4d
19 changed files with 1004 additions and 3 deletions
|
|
@ -0,0 +1,43 @@
|
|||
# WP-80 development entrypoint evidence
|
||||
|
||||
This packet supports T33/T37 and completed browser-discovery checkpoint T45.
|
||||
The short runbook is [Working development entrypoints](../../../netkingdom-development.md).
|
||||
|
||||
## Completed discovery correction
|
||||
|
||||
Reuse-surface commit `ed3c900efbe96b931747dee336bf30e92744764f` updates only
|
||||
`registry/capabilities/capability.infotech.headless-browser.md` and its existing
|
||||
index summary. The record now points to the actual supervised managed trial.
|
||||
No capability ID or maturity level changed (D3/A5/C2/R2); no new catalog, browser
|
||||
client or deployment was introduced.
|
||||
|
||||
The owner validator passed all three capability entries with
|
||||
`--fail-on-warnings`. The local browser query returned the updated card, and
|
||||
`hosted-browser-discovery.json` records HTTP 200 and exactly one matching card
|
||||
with the corrected summary. The owner publication receipt records exact primary
|
||||
projection and normal remote publication. Its unrelated brief/work-record
|
||||
changes were preserved. The two postimage files retain exact published sources.
|
||||
|
||||
## Partial flow evidence
|
||||
|
||||
- `playwright-current-preflight.json`: available service, exact versions,
|
||||
release and limits. Actual human/agent runs remain in
|
||||
[the delivery packet](../wp80-build-mode-r1/README.md).
|
||||
- `git-baseline.json`: existing SSH read, 0.629 seconds, and previous ordinary
|
||||
write/publication sample. This alone does not close T44.
|
||||
- `forgejo-cli-result.json`: current owner transport refused retrieval with
|
||||
OpenBao 403 before the Tea/API probe ran. Raw output was discarded. This is a
|
||||
retained failure, not authenticated API acceptance.
|
||||
- `forgejo-route-plan.json` and `forgejo-login-plan.json`: routing metadata
|
||||
identifies Platform custody and the founder-required interactive KeyCape
|
||||
login prerequisite. No credential values are included.
|
||||
- `check_forgejo_cli.py`: isolated verification using installed Tea, not a new
|
||||
Forgejo client. Isolation-only mode passed without an API request. The
|
||||
credentialed path remains unverified because the owner transport refused.
|
||||
- `measurements.json`: bounded samples, command counts and explicit unknowns.
|
||||
No cold-onboarding or comparative performance claim is made.
|
||||
|
||||
T33/T37 remain in progress until the actual Forgejo paths are accepted.
|
||||
T42 still waits on decision `ad88edeb-7c7c-486f-a695-1a7abae5b20c`; no source
|
||||
changes here activate its native proposal. Human sign-in T43 and complete agent
|
||||
Git/API T44 remain open. Repository privatization stays with ORGREF-WP-0002.
|
||||
|
|
@ -0,0 +1,75 @@
|
|||
version: 1
|
||||
updated: '2026-10-18'
|
||||
domain: helix_forge
|
||||
capabilities:
|
||||
- id: capability.infotech.headless-browser
|
||||
name: Headless Browser Automation
|
||||
summary: 'Headless browser automation, screenshots and keyboard trials through rapp-playwright
|
||||
0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Human and coding-agent managed
|
||||
trials passed on 2026-10-18 through the existing supervised workstation connection.
|
||||
Use the documented kubectl port-forward to 127.0.0.1:18081, then the pinned standalone
|
||||
Python client preflight/trial commands. No local browser installation. Independent
|
||||
per-caller managed admission remains pending; availability stays A5. Contract:
|
||||
https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.'
|
||||
vector: D3 / A5 / C2 / R2
|
||||
domain: infotech
|
||||
status: reviewed
|
||||
owner: reuse-surface
|
||||
path: registry/capabilities/capability.infotech.headless-browser.md
|
||||
tags:
|
||||
- headless
|
||||
- browser
|
||||
- automation
|
||||
- playwright
|
||||
- chromium
|
||||
- testing
|
||||
- screenshots
|
||||
- extraction
|
||||
- firefox
|
||||
- webkit
|
||||
- selenium
|
||||
- puppeteer
|
||||
consumption_modes:
|
||||
- informational
|
||||
- source adaptation
|
||||
- JavaScript library
|
||||
- Python library
|
||||
- cli
|
||||
- service API
|
||||
- container
|
||||
- id: capability.registry.register
|
||||
name: Capability registry and federation
|
||||
summary: Owner Markdown entries, indexes, federation hub and planning queries.
|
||||
domain: helix_forge
|
||||
status: draft
|
||||
owner: reuse-surface
|
||||
tags:
|
||||
- registry
|
||||
- governance
|
||||
- meta
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D3 / A3 / C2 / R3
|
||||
path: registry/capabilities/capability.registry.register.md
|
||||
consumption_modes:
|
||||
- library
|
||||
- CLI
|
||||
- id: capability.registry.validate
|
||||
name: Capability registry validation
|
||||
summary: Schema, index consistency and relation checks.
|
||||
domain: helix_forge
|
||||
status: draft
|
||||
owner: reuse-surface
|
||||
tags:
|
||||
- registry
|
||||
- validation
|
||||
- cli
|
||||
- security
|
||||
- netkingdom
|
||||
- framework-reuse
|
||||
vector: D4 / A3 / C3 / R3
|
||||
path: registry/capabilities/capability.registry.validate.md
|
||||
consumption_modes:
|
||||
- library
|
||||
- CLI
|
||||
|
|
@ -0,0 +1,79 @@
|
|||
"""Verify the installed Tea client in a disposable configuration, without tokens in output."""
|
||||
import argparse
|
||||
import csv
|
||||
import io
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import subprocess
|
||||
import tempfile
|
||||
import time
|
||||
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument('--isolation-only', action='store_true')
|
||||
args = parser.parse_args()
|
||||
tea = '/home/worsch/bin/tea'
|
||||
report = {'native_changes': False, 'client': 'installed Tea 0.9.2',
|
||||
'profile': 'existing routed workstation development credential; no independent agent identity claim',
|
||||
'original_tea_configuration_used': False, 'credential_values_emitted': False}
|
||||
secret = os.environ.pop('API_TOKEN', '')
|
||||
with tempfile.TemporaryDirectory(prefix='wp80-tea-proof-') as temporary:
|
||||
os.chmod(temporary, 0o700)
|
||||
environment = dict(os.environ)
|
||||
for key in ['GITEA_SERVER_TOKEN', 'GITEA_SERVER_PASSWORD', 'GITEA_SERVER_USER', 'GITEA_SERVER_URL']:
|
||||
environment.pop(key, None)
|
||||
# Tea documents this child-only configuration location in its own help.
|
||||
environment['XDG_CONFIG_HOME'] = temporary
|
||||
|
||||
def call(arguments):
|
||||
start = time.monotonic()
|
||||
result = subprocess.run([tea, *arguments], cwd=temporary, env=environment,
|
||||
capture_output=True, text=True, timeout=30)
|
||||
return result, round(time.monotonic() - start, 3)
|
||||
|
||||
listing, _ = call(['logins', 'list', '-o', 'csv'])
|
||||
rows = list(csv.DictReader(io.StringIO(listing.stdout)))
|
||||
if listing.returncode or rows:
|
||||
raise SystemExit('Tea configuration isolation failed; no login was written')
|
||||
report['configuration_isolation_verified'] = True
|
||||
if args.isolation_only:
|
||||
report['mode'] = 'configuration-isolation-only; no credential or API request'
|
||||
else:
|
||||
if not secret:
|
||||
raise SystemExit('Use the owner-routed --exec transport; API_TOKEN missing')
|
||||
environment['GITEA_SERVER_TOKEN'] = secret
|
||||
login, seconds = call(['logins', 'add', '--name', 'wp80-current', '--url', 'https://forgejo.coulomb.social'])
|
||||
environment.pop('GITEA_SERVER_TOKEN', None)
|
||||
secret = ''
|
||||
report['login_exit_code'] = login.returncode
|
||||
report['login_seconds'] = seconds
|
||||
if login.returncode == 0:
|
||||
for path in Path(temporary).rglob('*'):
|
||||
if path.is_file():
|
||||
path.chmod(0o600)
|
||||
listing, _ = call(['logins', 'list', '-o', 'csv'])
|
||||
rows = list(csv.DictReader(io.StringIO(listing.stdout)))
|
||||
if listing.returncode or len(rows) != 1 or rows[0].get('URL') != 'https://forgejo.coulomb.social':
|
||||
raise SystemExit('Unexpected current-host configuration; raw output discarded')
|
||||
user = rows[0].get('User', '')
|
||||
if not user or len(user) > 64 or not all(c.isalnum() or c in '._-' for c in user):
|
||||
raise SystemExit('Unexpected identity metadata; raw output discarded')
|
||||
report['api_user'] = user
|
||||
who, seconds = call(['whoami'])
|
||||
report['whoami_exit_code'] = who.returncode
|
||||
report['whoami_seconds'] = seconds
|
||||
report['returned_identity_matches'] = user in who.stdout
|
||||
repo, seconds = call(['repos', '--login', 'wp80-current', '--fields', 'owner,name,permission',
|
||||
'--output', 'csv', 'coulomb/the-custodian'])
|
||||
report['repository_read_exit_code'] = repo.returncode
|
||||
report['repository_read_seconds'] = seconds
|
||||
report['expected_repository_returned'] = 'the-custodian' in repo.stdout and 'coulomb' in repo.stdout
|
||||
report['passed'] = (who.returncode == repo.returncode == 0 and
|
||||
report['returned_identity_matches'] and report['expected_repository_returned'])
|
||||
else:
|
||||
report['passed'] = False
|
||||
report['reason'] = 'Current-host token login failed; raw child output discarded'
|
||||
report['temporary_configuration_removed'] = True
|
||||
print(json.dumps(report, indent=2))
|
||||
if not args.isolation_only and not report.get('passed'):
|
||||
raise SystemExit(1)
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"passed": false,
|
||||
"reason": "Owner-routed transport did not produce the verification report",
|
||||
"closed_error_markers": [
|
||||
"permission denied",
|
||||
"403",
|
||||
"fetch failed",
|
||||
"OpenBao",
|
||||
"denied"
|
||||
],
|
||||
"raw_transport_output_discarded": true,
|
||||
"transport_exit_code": 5,
|
||||
"transport": "Existing warden access --exec owner route; field API_TOKEN, no raw-value fetch"
|
||||
}
|
||||
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"need": "oidc login forgejo admin",
|
||||
"verdict": "founder_required",
|
||||
"organization_posture": "build",
|
||||
"lane_id": "key-cape-oidc-login",
|
||||
"commands": [
|
||||
"warden access key-cape-oidc-login --exec -- <reviewed-command>",
|
||||
"# owner login is contained by warden; do not invoke it separately"
|
||||
],
|
||||
"founder_act": {
|
||||
"kind": "oidc_login",
|
||||
"summary": "Interactive OIDC/MFA login via key-cape",
|
||||
"details": {
|
||||
"lane_id": "key-cape-oidc-login",
|
||||
"auth_method": "browser OIDC via key-cape / Keycloak at auth/netkingdom",
|
||||
"fetch_command": "warden access key-cape-oidc-login --exec -- <reviewed-command>",
|
||||
"desk_hint": "warden desk --from-plan (act=oidc_login); execute only through: warden access key-cape-oidc-login --exec -- <reviewed-command>"
|
||||
}
|
||||
},
|
||||
"reasons": [
|
||||
"login lane requires interactive founder/operator identity act"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"need": "forgejo admin api token",
|
||||
"verdict": "autonomous",
|
||||
"organization_posture": "build",
|
||||
"lane_id": "forgejo-admin-api-token",
|
||||
"commands": [
|
||||
"warden access forgejo-admin-api-token --exec -- <cmd> # high-risk: no raw stdout",
|
||||
"warden access forgejo-admin-api-token --out FILE",
|
||||
"warden access forgejo-admin-api-token --wrap",
|
||||
"# owner fetch (as you): bao kv get -field=API_TOKEN platform/workloads/forgejo/forgejo-admin"
|
||||
],
|
||||
"founder_act": null,
|
||||
"reasons": [
|
||||
"lane is usable under current catalog without founder mechanics"
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"operation": "existing developer Git SSH read",
|
||||
"command": "git -C /home/worsch/the-custodian ls-remote origin refs/heads/main",
|
||||
"exit_code": 0,
|
||||
"seconds": 0.629,
|
||||
"revision": "17635cb0a76e5595ec06421ab7419ae889f6d731",
|
||||
"profile": "existing authenticated workstation developer SSH path",
|
||||
"independent_current_keycape_checks": false,
|
||||
"write_proof": "Normal prior source publication17635cb0; no extra trial branch, commit or mutation needed."
|
||||
}
|
||||
|
|
@ -0,0 +1,337 @@
|
|||
---
|
||||
id: capability.infotech.headless-browser
|
||||
name: Headless Browser Automation
|
||||
summary: >-
|
||||
Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Human and coding-agent managed trials passed on 2026-10-18 through the existing supervised workstation connection. Use the documented kubectl port-forward to 127.0.0.1:18081, then the pinned standalone Python client preflight/trial commands. No local browser installation. Independent per-caller managed admission remains pending; availability stays A5. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md.
|
||||
owner: reuse-surface
|
||||
status: reviewed
|
||||
domain: infotech
|
||||
tags: [headless, browser, automation, playwright, chromium, testing, screenshots, extraction, firefox, webkit, selenium, puppeteer]
|
||||
maturity:
|
||||
discovery:
|
||||
current: D3
|
||||
target: D4
|
||||
confidence: medium
|
||||
rationale: >
|
||||
Inspected four implemented Playwright consumers and separated optional
|
||||
dependencies and plans from usage. No comprehensive alternatives benchmark.
|
||||
availability:
|
||||
current: A5
|
||||
target: A6
|
||||
confidence: medium
|
||||
rationale: >
|
||||
rapp-playwright 0.1.0 is a published immutable container with a versioned
|
||||
HTTP contract and standalone Python client, independently trialled locally.
|
||||
A5 describes deployable container availability, not managed operation (A6).
|
||||
The supervised managed build profile has real human/agent receipts; independent
|
||||
per-caller admission remains pending. Existing A2 source adaptation remains usable;
|
||||
no endpoint uptime or caller browser installation is implied.
|
||||
external_evidence:
|
||||
completeness:
|
||||
level: C2
|
||||
confidence: medium
|
||||
basis: scope_vs_intent_and_consumer_expectations
|
||||
satisfied_expectations:
|
||||
- Identifies implemented consumers, browser engines and source entry points.
|
||||
- Gives a scoped default recommendation and a practical trial procedure.
|
||||
- Published provider client and container have independent fixture screenshots and keyboard receipts.
|
||||
- Actual managed human and coding-agent supported-command trials passed on 2026-10-18 under the stated supervised build profile.
|
||||
broken_expectations:
|
||||
- Independent per-caller managed admission is still pending; the supervised build connection must be established first.
|
||||
- Consumer application acceptance remains the consuming repo's responsibility.
|
||||
out_of_scope_expectations:
|
||||
- Exhaustive estate dependency inventory or comparative browser benchmark.
|
||||
- Browser service implementation or operation by reuse-surface.
|
||||
- Mandatory estate-wide technology policy.
|
||||
reliability:
|
||||
level: R2
|
||||
confidence: medium
|
||||
basis: consumer_quality_signals
|
||||
known_reliability_risks:
|
||||
- Browser binaries and system libraries must match the selected Playwright version.
|
||||
- Existing examples contain application-specific fixtures and assumptions.
|
||||
- Provider fixture receipts do not prove arbitrary target compatibility or independent per-caller identity.
|
||||
- Local provider endpoints are ephemeral; check preflight for each trial.
|
||||
evidence:
|
||||
satisfied_signals:
|
||||
- frontend-patterns navigation-history records a completed Chromium/Firefox experiment.
|
||||
- rapp-playwright independent final-release trial passed 14 steps across desktop and narrow viewports.
|
||||
- Independent provider evidence includes wrong-token, failed assertion and unavailable-service checks.
|
||||
discovery:
|
||||
intent: >
|
||||
Help a worker select and reuse existing headless browser tooling instead of
|
||||
independently introducing another automation stack.
|
||||
includes:
|
||||
- Playwright automation with headless Chromium as the default starting point.
|
||||
- JavaScript UI tests, screenshots and page extraction examples.
|
||||
- Python visual-check example and Firefox experiment evidence.
|
||||
- Published rapp-playwright container, Python client and bounded HTTP fixture trials.
|
||||
excludes:
|
||||
- Browser hosting or workstation provisioning by reuse-surface.
|
||||
- Credential provisioning and permission to automate external targets.
|
||||
- Claims that a dependency declaration or a workplan proves executed browser usage.
|
||||
assumptions:
|
||||
- Source-adaptation consumers install matching browsers; provider clients need only Python 3.10+.
|
||||
- Provider consumers establish an available endpoint and run preflight before a trial.
|
||||
use_cases:
|
||||
- Find which working repos already use a headless browser and where to start reusing it.
|
||||
- Run a local UI assertion and screenshot in a target repo before adopting the tooling.
|
||||
availability:
|
||||
current_level: A5
|
||||
target_level: A6
|
||||
current_artifacts:
|
||||
- forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441
|
||||
- https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
|
||||
- https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/releases/0.1.0.json
|
||||
- ../whynot-design/playwright.config.mjs
|
||||
- ../whynot-design/tests/visual/ui-kit.spec.mjs
|
||||
- ../coulomb-social/scripts/test-usecase-browser.mjs
|
||||
- ../core-hub/scripts/check_console_visual.py
|
||||
- ../frontend-patterns/research/experiments/navigation-history/experiment.mjs
|
||||
target_artifacts:
|
||||
- >-
|
||||
Managed Railiance deployment after platform admission, with consumer
|
||||
independent per-caller access and complete recovery/rollback acceptance; the
|
||||
supervised build pilot already has actual human/agent receipts.
|
||||
consumption_modes: [informational, source adaptation, JavaScript library, Python library, cli, service API, container]
|
||||
relations:
|
||||
depends_on: []
|
||||
supports: []
|
||||
related_to: []
|
||||
evidence:
|
||||
documentation:
|
||||
- https://playwright.dev/docs/browsers
|
||||
- ../frontend-patterns/research/experiments/navigation-history/README.md
|
||||
- ../test-driver/SCOPE.md
|
||||
- ../testdrive-jsui/pyproject.toml
|
||||
- https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md
|
||||
- https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-publication.md
|
||||
- intakes/REUSE-IN-0001-headless-browser-runnable-answer.md
|
||||
tests:
|
||||
- https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-independent-local-consumer.md
|
||||
- docs/evidence/2026-10-13-browser-discovery.md
|
||||
- ../whynot-design/tests/visual/ui-kit.spec.mjs
|
||||
- ../coulomb-social/scripts/test-usecase-browser.mjs
|
||||
- ../core-hub/scripts/check_console_visual.py
|
||||
- ../frontend-patterns/research/experiments/navigation-history/result.json
|
||||
consumer_feedback:
|
||||
- >-
|
||||
2026-10-13 content-explorer, REUSE-IN-0001: published source examples did not
|
||||
provide a verified runnable path for screenshots and keyboard interaction.
|
||||
The false-new plan-check verdict is a registry discovery issue, not evidence
|
||||
that a new browser stack is needed. Browser delivery belongs to the provider.
|
||||
consumer_guidance:
|
||||
recommended_for:
|
||||
- Use Playwright with headless Chromium for a new repo's general UI automation trial.
|
||||
- Reuse whynot-design for JavaScript visual tests and core-hub for Python visual checks.
|
||||
- Reuse coulomb-social for JavaScript browser scripts and frontend-patterns for multi-engine experiments.
|
||||
- >-
|
||||
For bounded screenshot and keyboard jobs, use the published rapp-playwright
|
||||
Python client against an available local provider and run preflight first.
|
||||
Use the immutable container to reproduce the provider; managed Railiance
|
||||
access requires admission and a working tunnel before consumption.
|
||||
not_recommended_for:
|
||||
- Treating this recommendation as an approved mandatory estate standard.
|
||||
- Selecting test-driver as an implemented JavaScript-capable browser engine.
|
||||
- Introducing Selenium or Puppeteer merely because their names match a discovery query.
|
||||
known_limitations:
|
||||
- This is a dated source inspection; run the target-repo trial before claiming adoption success.
|
||||
- Firefox is evidenced in frontend-patterns; WebKit is supported upstream but unverified in this inspection.
|
||||
- Selenium is an optional testdrive-jsui dependency, not verified execution; Puppeteer has no verified example here.
|
||||
- Local provider availability is verified but ephemeral; managed admission and platform operation remain pending.
|
||||
- Provider fixture success does not establish consumer target reachability or application acceptance.
|
||||
promotion_history:
|
||||
- date: "2026-10-13"
|
||||
dimension: availability
|
||||
from: A2
|
||||
to: A5
|
||||
rationale: >-
|
||||
Published immutable rapp-playwright 0.1.0 container, versioned client/contract
|
||||
and independent local release receipts satisfy deployable-container availability.
|
||||
This is not an A6 managed-platform claim. D3, C2 and R2 remain conservative
|
||||
assessments pending broader target and operational evidence.
|
||||
author: codex
|
||||
---
|
||||
|
||||
# Headless Browser Automation
|
||||
|
||||
## Recommendation
|
||||
|
||||
Start with **Playwright controlling headless Chromium** for general browser
|
||||
automation, UI tests, screenshots and JavaScript-rendered page extraction.
|
||||
This follows implemented usage in four working repos. Playwright is the automation
|
||||
library; Chromium is the browser engine. Use `@playwright/test` for a JavaScript
|
||||
test suite, the `playwright` library for standalone JavaScript scripts, or Python
|
||||
`playwright` when the consumer is Python.
|
||||
|
||||
This is a reuse recommendation reviewed against source on **2026-10-13**, not a
|
||||
mandatory estate standard or a benchmark verdict against Selenium/Puppeteer.
|
||||
reuse-surface maintains this discovery record; the example repos maintain their
|
||||
implementations and the upstream Playwright project maintains the library.
|
||||
|
||||
## Service provider and delivery status
|
||||
|
||||
**rapp-playwright 0.1.0 is published and verified as a local container provider.**
|
||||
The current vector is **D3 / A5 / C2 / R2**. A5 means a deployable container under
|
||||
[the maturity standard](../../specs/CapabilityMaturityStandard.md); managed
|
||||
platform operation is A6 and remains **pending Railiance admission**. Source
|
||||
examples remain available at A2. No browser is installed on the caller's machine
|
||||
by discovery or by running the Python client.
|
||||
|
||||
`rapp-playwright` owns the browser service; `railiance-platform` owns managed
|
||||
lifecycle admission. `reuse-surface` owns this record, discovery, consumption
|
||||
guidance and evidence assessment. The
|
||||
[content-explorer intake](../../intakes/REUSE-IN-0001-headless-browser-runnable-answer.md)
|
||||
concerns registry relevance and availability clarity; CONTENT-WP-0000-T04
|
||||
acceptance remains with the consumer.
|
||||
|
||||
### Verified client path
|
||||
|
||||
Only Python 3.10+ is needed by the consumer. Download the single revision-pinned
|
||||
client into a working directory; a sibling checkout is not required:
|
||||
|
||||
```sh
|
||||
curl -fL --output rapp_playwright.py https://forgejo.coulomb.social/coulomb/rapp-playwright/raw/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/client/rapp_playwright.py
|
||||
python3 rapp_playwright.py --url http://127.0.0.1:18083 preflight
|
||||
python3 rapp_playwright.py --url http://127.0.0.1:18083 trial --out trial-01
|
||||
```
|
||||
|
||||
Use a fresh output directory for each run. Port **18083** was verified on this
|
||||
workstation on **2026-10-13**; it is an ephemeral local provider, not a permanent
|
||||
or remotely reachable endpoint. Preflight must report `available: true`, API 1,
|
||||
service 0.1.0, Playwright **1.64.0**, Chromium **156.0.8078.4**, and the expected
|
||||
release/location. Connection failure means the provider or tunnel is unavailable,
|
||||
not that another browser capability is needed. Use the local setup below or the
|
||||
source-adaptation fallback. Repeat `--url` on later status/download commands.
|
||||
|
||||
The fixture trial checks Tab focus, Enter activation and the counter assertion
|
||||
across **1280×800** and **390×844** viewports, then downloads screenshots and a
|
||||
receipt. It does not inspect or accept the consumer's own UI. `run.json` is a
|
||||
private run handle and must not be published. For `trial`/`run`, exit 0 means
|
||||
passed, 2 means UI assertion failed, and 3 means infrastructure/setup or another
|
||||
unsuccessful result; `status` exit 0 only means retrieval succeeded.
|
||||
|
||||
### Reproduce the local provider
|
||||
|
||||
The published release targets **linux/amd64**. With Docker and image pull access,
|
||||
start the immutable container in one terminal, then point the client at port
|
||||
**18081** in another:
|
||||
|
||||
```sh
|
||||
docker run --rm --name rapp-playwright-local --read-only \
|
||||
--tmpfs /tmp:rw,size=512m --shm-size=256m --memory=1g --cpus=1 \
|
||||
--cap-drop ALL --security-opt no-new-privileges \
|
||||
--mount type=volume,src=rapp-playwright-local-data,dst=/data \
|
||||
-p 127.0.0.1:18081:8080 -e HOST=0.0.0.0 \
|
||||
-e EXECUTION_LOCATION=workstation-container \
|
||||
-e RELEASE_ID=sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441 \
|
||||
forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441
|
||||
python3 rapp_playwright.py --url http://127.0.0.1:18081 preflight
|
||||
python3 rapp_playwright.py --url http://127.0.0.1:18081 trial --out trial-local-01
|
||||
```
|
||||
|
||||
This is the provider's documented local setup with the published digest pinned;
|
||||
it was not redeployed by this registry review. Existing independent final-release
|
||||
receipts and the fresh discovery trial use the same digest. The default fixture
|
||||
requires no external target grant. The provider supports trusted/synthetic pages,
|
||||
not hostile-page or mutually untrusted tenant execution.
|
||||
|
||||
### Supervised managed development path — verified 2026-10-18
|
||||
|
||||
The existing private deployment was used by one actual human and one coding
|
||||
agent, each completing 14 keyboard/responsive steps with downloaded screenshots.
|
||||
This build profile uses an existing authenticated workstation connection;
|
||||
independent per-caller identity, transport and final managed admission remain open.
|
||||
Establish that existing connection, then use the same supported provider client:
|
||||
|
||||
```sh
|
||||
kubectl -n playwright port-forward deployment/playwright 18081:8080 --address 127.0.0.1
|
||||
# In another terminal, while the tunnel remains running:
|
||||
python3 rapp_playwright.py preflight
|
||||
python3 rapp_playwright.py trial --out trial-managed-01
|
||||
```
|
||||
|
||||
Both managed trials passed against the deployed release digest already listed
|
||||
above. The client is byte-identical to the pinned published commit.
|
||||
[Human receipt](https://forgejo.coulomb.social/coulomb/the-custodian/src/commit/17635cb0a76e5595ec06421ab7419ae889f6d731/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-human/receipt.json),
|
||||
[agent receipt](https://forgejo.coulomb.social/coulomb/the-custodian/src/commit/17635cb0a76e5595ec06421ab7419ae889f6d731/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/playwright-agent/receipt.json),
|
||||
and [profile/commands](https://forgejo.coulomb.social/coulomb/the-custodian/src/commit/17635cb0a76e5595ec06421ab7419ae889f6d731/docs/changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md)
|
||||
state the exact scope. Use a fresh output directory; keep the run capability
|
||||
private. Do not distribute a kubeconfig or treat this receipt as a broader identity
|
||||
acceptance. Stop the port-forward with Ctrl-C when finished. A remote browser's
|
||||
localhost belongs to the provider. Consumer applications need a
|
||||
provider-reachable, explicitly allowed origin; the browser API tunnel does not
|
||||
forward a workstation app. See the provider contract before running a target
|
||||
scenario.
|
||||
|
||||
### Pinned delivery evidence
|
||||
|
||||
All provider links below are pinned to published commit
|
||||
`8831a05aeba5ce588f3b395ade676dde2a151c5d`:
|
||||
|
||||
- [Consumer contract](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md).
|
||||
- [Release manifest](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/releases/0.1.0.json)
|
||||
and [publication/pull evidence](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-publication.md).
|
||||
- [Independent consumer evidence](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/evidence/2026-10-13-independent-local-consumer.md),
|
||||
including final-release screenshots, keyboard assertions, wrong-token rejection,
|
||||
UI failure and unavailable-service results. These are retained provider-side
|
||||
reports; this review separately verified the fixture path.
|
||||
- [Fresh registry review and trial](../../docs/evidence/2026-10-13-browser-discovery.md).
|
||||
|
||||
## Existing implementations
|
||||
|
||||
Paths in frontmatter are relative to the reuse-surface repository root. The links
|
||||
below work with sibling checkouts. The cited files were clean at these revisions.
|
||||
|
||||
| Repo and inspected revision | What is implemented | Reuse starting point |
|
||||
| --- | --- | --- |
|
||||
| whynot-design — `a79a4d803e9aed13f66d072bf409b6f86000f01f` | Playwright Test, explicitly headless Chromium, screenshot comparisons | [Configuration](../../../whynot-design/playwright.config.mjs), [visual tests](../../../whynot-design/tests/visual/ui-kit.spec.mjs), [dependency/scripts](../../../whynot-design/package.json) |
|
||||
| coulomb-social — `5c32757b987ab1610cdb46a808d56c75f569f581` | JavaScript Playwright scripts launching headless Chromium for browser tests and extraction | [Use-case test](../../../coulomb-social/scripts/test-usecase-browser.mjs), [script dependency](../../../coulomb-social/scripts/package.json) |
|
||||
| core-hub — `a69ad325271485afe284a6db85673dfa30d9d4ad` | Python synchronous Playwright visual checks launching Chromium with the default headless mode | [Visual-check script](../../../core-hub/scripts/check_console_visual.py), [development dependency](../../../core-hub/pyproject.toml) |
|
||||
| frontend-patterns — `047a6a2d314ff5a9d2a87d5bc987d7d84835f682` | Playwright experiments using Chromium and Firefox, with retained execution receipts | [Runner](../../../frontend-patterns/research/experiments/navigation-history/experiment.mjs), [setup and limitations](../../../frontend-patterns/research/experiments/navigation-history/README.md), [result](../../../frontend-patterns/research/experiments/navigation-history/result.json) |
|
||||
|
||||
These are source/retained-receipt observations, not newly executed test results.
|
||||
The frontend-patterns example uses an explicit Chromium binary override; do not
|
||||
copy its workstation paths as a portable browser installation recipe.
|
||||
|
||||
## Alternatives and misleading matches
|
||||
|
||||
- **Selenium:** [testdrive-jsui's optional development dependencies](../../../testdrive-jsui/pyproject.toml)
|
||||
declare it at `701341d7fa520f860245e28eb16d44b767fd116b`. A declaration alone
|
||||
does not establish an implemented or passing browser workflow.
|
||||
- **test-driver:** [SCOPE.md](../../../test-driver/SCOPE.md) at
|
||||
`c3ad06e598057862cf500cbd46c7c8b6f83885ed` explicitly excludes a browser engine,
|
||||
JavaScript execution, screenshots and DOM timing. Historical Playwright plans
|
||||
are not an available implementation.
|
||||
- **Puppeteer:** no verified implementation was found in this inspection. This
|
||||
is not a claim that every working repo has been exhaustively searched.
|
||||
- **Firefox/WebKit:** Playwright supports both upstream. Firefox has retained
|
||||
experiment evidence here; WebKit has no verified local example in this record.
|
||||
|
||||
## Source-adaptation fallback for the consuming worker
|
||||
|
||||
1. Query this checkout with `python3 -m reuse_surface.cli query --keyword browser`
|
||||
from the reuse-surface root, then open this entry. If the CLI is installed,
|
||||
`reuse-surface query --keyword browser` is equivalent.
|
||||
`plan-check --intent "headless browser" --no-llm` ranks this entry first.
|
||||
Its reuse verdict describes relevance; provider preflight determines current
|
||||
runtime availability. Use source adaptation when the provider path is unsuitable.
|
||||
2. Pick the example matching the target repo's language and task. Inspect its
|
||||
fixture/server assumptions before adapting the smallest useful test or script.
|
||||
3. Use the target repo's package manager and lockfile. Select a compatible
|
||||
Playwright version and install its matching Chromium binary. For an installed
|
||||
Node dependency, use `npx playwright install chromium`; for an installed Python
|
||||
dependency, use `python -m playwright install chromium` in its environment.
|
||||
Follow the upstream [browser/system-dependency instructions](https://playwright.dev/docs/browsers)
|
||||
if system libraries are missing. No common estate version is established here.
|
||||
4. Against a local fixture or the target repo's local development server, launch
|
||||
headless Chromium, load one page, assert one meaningful rendered element or
|
||||
interaction, save a screenshot if relevant, and close the browser. Exercise
|
||||
a JavaScript-driven change if JavaScript rendering is the reason for adoption.
|
||||
5. Report the consumer repo, reference example, package/browser versions, exact
|
||||
command, assertion outcome, artifact paths and any setup failure. The trial
|
||||
remains unverified until this evidence exists; installation alone is not success.
|
||||
|
||||
The hosted service reads published repository indexes. A local edit does not
|
||||
by itself make this entry available at `reuse.coulomb.social`; use the local query
|
||||
above for an unpublished trial and verify the hosted entry after publication.
|
||||
|
|
@ -0,0 +1,18 @@
|
|||
{
|
||||
"http_status": 200,
|
||||
"top_fields": [
|
||||
"version",
|
||||
"updated",
|
||||
"domain",
|
||||
"collision_policy",
|
||||
"sources",
|
||||
"capabilities",
|
||||
"composed_at",
|
||||
"stale"
|
||||
],
|
||||
"matching_cards": 1,
|
||||
"summaries": [
|
||||
"Headless browser automation, screenshots and keyboard trials through rapp-playwright 0.1.0 (Playwright 1.64.0, Chromium 156.0.8078.4). Human and coding-agent managed trials passed on 2026-10-18 through the existing supervised workstation connection. Use the documented kubectl port-forward to 127.0.0.1:18081, then the pinned standalone Python client preflight/trial commands. No local browser installation. Independent per-caller managed admission remains pending; availability stays A5. Contract: https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md."
|
||||
],
|
||||
"mentions_current_supervised_profile": true
|
||||
}
|
||||
|
|
@ -0,0 +1,61 @@
|
|||
{
|
||||
"scope": "Bounded WP-80 build-flow samples; not full security acceptance",
|
||||
"playwright": {
|
||||
"scope": "Playwright working build profile only",
|
||||
"measurements": [
|
||||
{
|
||||
"consumer": "human",
|
||||
"run_id": "d81a5166-83d9-4382-a6e8-a90cfc3f0a51",
|
||||
"completed_steps": 14,
|
||||
"run_duration_seconds": 3.801,
|
||||
"keyboard_and_responsive": true
|
||||
},
|
||||
{
|
||||
"consumer": "agent",
|
||||
"run_id": "893a8bcb-9b7f-48f1-8a51-c116de3f3097",
|
||||
"completed_steps": 14,
|
||||
"run_duration_seconds": 3.938,
|
||||
"keyboard_and_responsive": true
|
||||
}
|
||||
],
|
||||
"consumer_commands_after_connection": 2,
|
||||
"connection_commands": 1,
|
||||
"manual_connection_setup_required": true,
|
||||
"local_browser_install_required": false,
|
||||
"baseline_comparison": "No comparable prior end-to-end baseline measured; no percentage improvement claimed.",
|
||||
"forgejo_measurement": "pending T37",
|
||||
"reuse": "Existing rapp-playwright client and Kubernetes port-forward, zero new clients or deployments."
|
||||
},
|
||||
"git": {
|
||||
"operation": "existing developer Git SSH read",
|
||||
"command": "git -C /home/worsch/the-custodian ls-remote origin refs/heads/main",
|
||||
"exit_code": 0,
|
||||
"seconds": 0.629,
|
||||
"revision": "17635cb0a76e5595ec06421ab7419ae889f6d731",
|
||||
"profile": "existing authenticated workstation developer SSH path",
|
||||
"independent_current_keycape_checks": false,
|
||||
"write_proof": "Normal prior source publication17635cb0; no extra trial branch, commit or mutation needed."
|
||||
},
|
||||
"scanner": {
|
||||
"evidence": "docs/changes/netkingdom-target-2026-10-18/receive-scanner-batch-r1/scan-activation.json",
|
||||
"evidence_sha256": "af72791078842255de4cfb561acd51ef89520279076508058223af1a3bfdc0f5",
|
||||
"seconds": 58.18,
|
||||
"objects": 278,
|
||||
"unchanged_deadline_seconds": 90,
|
||||
"scope": "Retained exact clean delta proof; not general scanner latency"
|
||||
},
|
||||
"manual_touches": {
|
||||
"documented_connection_commands": 1,
|
||||
"documented_client_commands_after_connection": 2,
|
||||
"human_receipt": "Founder actually ran the trial using the already established connection; no cold onboarding time measured",
|
||||
"git": "Existing authenticated workstation path; no new login during the read sample",
|
||||
"forgejo_sign_in": "Not activated; human interaction count and duration unmeasured",
|
||||
"forgejo_api": "Owner transport denied before API command; successful duration unmeasured"
|
||||
},
|
||||
"remaining": [
|
||||
"Actual human NetKingdom sign-in/account continuity",
|
||||
"Complete agent Git and authenticated API acceptance",
|
||||
"Actual Forgejo setup/manual-touch and duration samples"
|
||||
],
|
||||
"baseline": "No comparable cold-onboarding or end-to-end baseline; no percent improvement claimed"
|
||||
}
|
||||
|
|
@ -0,0 +1,24 @@
|
|||
{
|
||||
"available": true,
|
||||
"error": null,
|
||||
"checked_at": "2026-10-18T17:41:39.749Z",
|
||||
"browser_version": "156.0.8078.4",
|
||||
"api_version": "1",
|
||||
"service_version": "0.1.0",
|
||||
"playwright_version": "1.64.0",
|
||||
"execution_location": "railiance01/playwright",
|
||||
"release": "forgejo.coulomb.social/coulomb/rapp-playwright@sha256:8d6fd5a8172cf906bb503642ed620761945c5138b86f6396c36f65cbe6def441",
|
||||
"allowed_origins": [
|
||||
"https://onco.cc"
|
||||
],
|
||||
"fixture": true,
|
||||
"active": 0,
|
||||
"queued": 0,
|
||||
"limits": {
|
||||
"concurrency": 1,
|
||||
"max_queue": 4,
|
||||
"max_timeout_ms": 120000,
|
||||
"retention_ms": 3600000,
|
||||
"max_runs": 64
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,16 @@
|
|||
{
|
||||
"verified": true,
|
||||
"original_task_bindings_preserved": 44,
|
||||
"new_task": "CUST-WP-0080-T45",
|
||||
"new_task_uuid": "34641b3d-bfe6-5fc3-bfa9-b2d9f93fe339",
|
||||
"changed_existing_statuses": [
|
||||
"T33: todo -> progress",
|
||||
"T37: todo -> progress"
|
||||
],
|
||||
"unrelated_worktree_and_index_preserved": 8,
|
||||
"owner_published_postimages_match": true,
|
||||
"canonical_playwright_client_pin_matches": true,
|
||||
"local_markdown_links_checked": 6,
|
||||
"native_changes_executed": false,
|
||||
"authenticated_api_verified": false
|
||||
}
|
||||
|
|
@ -0,0 +1,94 @@
|
|||
{
|
||||
"ok": true,
|
||||
"status": "applied",
|
||||
"repo_slug": "reuse-surface",
|
||||
"commit": "ed3c900efbe96b931747dee336bf30e92744764f",
|
||||
"requests": 2,
|
||||
"elapsed_ms": 5972.5,
|
||||
"git": {
|
||||
"upstream": "origin/main",
|
||||
"behind": 0,
|
||||
"ahead": 0
|
||||
},
|
||||
"identifiers": {
|
||||
"schema": "repo-manager.identifier-assignment.v1",
|
||||
"ok": true,
|
||||
"executed": true,
|
||||
"repo": "reuse-surface",
|
||||
"namespace": "helixforge",
|
||||
"assignments": [],
|
||||
"historical_invalid_identifiers": [],
|
||||
"historical_identity_collisions": [],
|
||||
"files_changed": []
|
||||
},
|
||||
"receipt": {
|
||||
"schema": "state-hub.repository-projection-reconcile.v1",
|
||||
"instance_role": "primary",
|
||||
"instance_label": "railiance01",
|
||||
"expected_commit": "ed3c900efbe96b931747dee336bf30e92744764f",
|
||||
"derived_commit": "ed3c900efbe96b931747dee336bf30e92744764f",
|
||||
"outcome": {
|
||||
"schema": "state-hub.projection-reset.v1",
|
||||
"repo_slug": "reuse-surface",
|
||||
"commit": "ed3c900efbe96b931747dee336bf30e92744764f",
|
||||
"status": "applied",
|
||||
"counts": {
|
||||
"created": 0,
|
||||
"updated": 27,
|
||||
"retired": 0,
|
||||
"refused": 0,
|
||||
"released": 0,
|
||||
"created_tasks": 0,
|
||||
"updated_tasks": 1,
|
||||
"cancelled_tasks": 0,
|
||||
"created_edges": 0,
|
||||
"removed_edges": 0,
|
||||
"unresolved_edges": 0,
|
||||
"external_edges": 0
|
||||
},
|
||||
"created": [],
|
||||
"updated": [
|
||||
"ADHOC-2026-10-13",
|
||||
"REUSE-WP-0001",
|
||||
"REUSE-WP-0002",
|
||||
"REUSE-WP-0003",
|
||||
"REUSE-WP-0004",
|
||||
"REUSE-WP-0005",
|
||||
"REUSE-WP-0006",
|
||||
"REUSE-WP-0007",
|
||||
"REUSE-WP-0008",
|
||||
"REUSE-WP-0009",
|
||||
"REUSE-WP-0010",
|
||||
"REUSE-WP-0011",
|
||||
"REUSE-WP-0012",
|
||||
"REUSE-WP-0013",
|
||||
"REUSE-WP-0014",
|
||||
"REUSE-WP-0015",
|
||||
"REUSE-WP-0016",
|
||||
"REUSE-WP-0017",
|
||||
"REUSE-WP-0018",
|
||||
"REUSE-WP-0019",
|
||||
"REUSE-WP-0020",
|
||||
"REUSE-WP-0021",
|
||||
"REUSE-WP-0022",
|
||||
"REUSE-WP-0023",
|
||||
"REUSE-WP-0024",
|
||||
"REUSE-WP-0025",
|
||||
"REUSE-WP-ADHOC-2026-10-16"
|
||||
],
|
||||
"retired": [],
|
||||
"released": [],
|
||||
"created_tasks": [],
|
||||
"updated_tasks": [
|
||||
"REUSE-WP-ADHOC-2026-10-16-T01"
|
||||
],
|
||||
"cancelled_tasks": [],
|
||||
"created_edges": [],
|
||||
"removed_edges": [],
|
||||
"unresolved_edges": [],
|
||||
"external_edges": [],
|
||||
"refused": [],
|
||||
"notes": []
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -0,0 +1,17 @@
|
|||
{
|
||||
"exit_code": 0,
|
||||
"commit": "ed3c900efbe96b931747dee336bf30e92744764f",
|
||||
"base": "01af18964b170eaa87f8560ce9285518e8dc6d7e",
|
||||
"files": [
|
||||
{
|
||||
"path": "registry/capabilities/capability.infotech.headless-browser.md",
|
||||
"sha256": "3d3c12616fd1aa94f7ac3f393387e801323647baee6fcf041b9bfc548be63fb7"
|
||||
},
|
||||
{
|
||||
"path": "registry/indexes/capabilities.yaml",
|
||||
"sha256": "2d810013a88b6dcf292ab20acb1599f573f669a5df96f523c1c5fd7f9c32863c"
|
||||
}
|
||||
],
|
||||
"stdout": "[main ed3c900] Point browser discovery to the verified supervised managed development flow\n 2 files changed, 30 insertions(+), 30 deletions(-)\n",
|
||||
"stderr": ""
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{
|
||||
"owner": "reuse-surface",
|
||||
"base_revision": "01af18964b170eaa87f8560ce9285518e8dc6d7e",
|
||||
"message": "Point browser discovery to the verified supervised managed development flow",
|
||||
"files": [
|
||||
{
|
||||
"path": "registry/capabilities/capability.infotech.headless-browser.md",
|
||||
"sha256": "3d3c12616fd1aa94f7ac3f393387e801323647baee6fcf041b9bfc548be63fb7"
|
||||
},
|
||||
{
|
||||
"path": "registry/indexes/capabilities.yaml",
|
||||
"sha256": "2d810013a88b6dcf292ab20acb1599f573f669a5df96f523c1c5fd7f9c32863c"
|
||||
}
|
||||
]
|
||||
}
|
||||
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"command": [
|
||||
"/home/worsch/reuse-surface/.venv/bin/python",
|
||||
"-m",
|
||||
"reuse_surface.cli",
|
||||
"validate",
|
||||
"--root",
|
||||
"/home/worsch/reuse-surface",
|
||||
"--fail-on-warnings"
|
||||
],
|
||||
"exit_code": 0,
|
||||
"stdout": "ok: validated 3 capability entries\n",
|
||||
"stderr": ""
|
||||
}
|
||||
|
|
@ -0,0 +1,10 @@
|
|||
{
|
||||
"native_changes": false,
|
||||
"client": "installed Tea 0.9.2",
|
||||
"profile": "existing routed workstation development credential; no independent agent identity claim",
|
||||
"original_tea_configuration_used": false,
|
||||
"credential_values_emitted": false,
|
||||
"configuration_isolation_verified": true,
|
||||
"mode": "configuration-isolation-only; no credential or API request",
|
||||
"temporary_configuration_removed": true
|
||||
}
|
||||
118
docs/netkingdom-development.md
Normal file
118
docs/netkingdom-development.md
Normal file
|
|
@ -0,0 +1,118 @@
|
|||
# Working development entrypoints
|
||||
|
||||
Verified 18 October 2026 for CUST-WP-0080. Use the existing owner implementations
|
||||
below; the table distinguishes working paths from remaining acceptance.
|
||||
|
||||
| Flow | Verified result | Still required |
|
||||
| --- | --- | --- |
|
||||
| Playwright, human and coding agent | Both real fixture trials passed, with keyboard interaction and desktop/mobile screenshots | Independent per-caller identity is deferred to WP-82 |
|
||||
| Forgejo Git | Existing workstation SSH read and ordinary source publication work | T44 must accept the complete agent Git/API flow |
|
||||
| Forgejo authenticated API | Owner-routed check stopped at OpenBao 403 before Tea ran | Supported caller login, then the actual API check |
|
||||
| Forgejo through NetKingdom | Candidate preparation and local interoperability proofs passed | T42 approval/reviews/activation, then T43 actual human sign-in |
|
||||
|
||||
## Playwright
|
||||
|
||||
Use the provider-owned [consumer contract](https://forgejo.coulomb.social/coulomb/rapp-playwright/src/commit/8831a05aeba5ce588f3b395ade676dde2a151c5d/docs/consumer-contract.md)
|
||||
and standalone Python client. No local Playwright or browser installation is
|
||||
needed. The verified client is `client/rapp_playwright.py` at commit
|
||||
`8831a05aeba5ce588f3b395ade676dde2a151c5d`, SHA-256
|
||||
`9967a0831ed04e27fde419098af707722d5c81c993e4c294b3677ffb75729c12`.
|
||||
|
||||
With the existing supervised workstation Kubernetes connection to railiance01,
|
||||
start the documented loopback connection if one is not already running:
|
||||
|
||||
```sh
|
||||
kubectl -n playwright port-forward deployment/playwright 18081:8080 --address 127.0.0.1
|
||||
```
|
||||
|
||||
Leave it running. In another terminal:
|
||||
|
||||
```sh
|
||||
python3 /home/worsch/rapp-playwright/client/rapp_playwright.py preflight
|
||||
python3 /home/worsch/rapp-playwright/client/rapp_playwright.py trial --out /tmp/wp80-playwright-new-trial
|
||||
```
|
||||
|
||||
Choose a **new output directory** on every trial. Preflight should report
|
||||
`available: true` and execution location `railiance01/playwright`; the trial
|
||||
should report `status: passed`, four downloaded PNGs and their SHA-256 hashes.
|
||||
The private `run.json` is a capability handle and must stay out of Git and chat.
|
||||
|
||||
The [actual human and agent receipts](changes/netkingdom-target-2026-10-18/wp80-build-mode-r1/README.md)
|
||||
prove this supervised profile. The provider contract governs supported scenarios
|
||||
and target origins; the remote browser's localhost is the provider's localhost.
|
||||
|
||||
Discovery uses the existing `capability.infotech.headless-browser` record in
|
||||
reuse-surface. Its [published owner card](https://forgejo.coulomb.social/coulomb/reuse-surface/src/commit/ed3c900efbe96b931747dee336bf30e92744764f/registry/capabilities/capability.infotech.headless-browser.md)
|
||||
now points to this working managed entrypoint. The local query and hosted
|
||||
federation both returned it. Availability remains A5: the supervised pilot does
|
||||
not establish independent managed admission for every caller.
|
||||
|
||||
## Forgejo Git and API
|
||||
|
||||
Use the existing repository remote and normal source publication process:
|
||||
|
||||
```sh
|
||||
git -C /home/worsch/the-custodian ls-remote origin refs/heads/main
|
||||
```
|
||||
|
||||
The measured read succeeded in 0.629 seconds at revision
|
||||
`17635cb0a76e5595ec06421ab7419ae889f6d731`. That revision's ordinary commit,
|
||||
scanner, publication and primary projection receipts provide the existing write
|
||||
sample. Use the repository's normal commit and `statehub fix-consistency` path.
|
||||
|
||||
Discover the API credential owner first:
|
||||
|
||||
```sh
|
||||
warden route find 'Forgejo API access with existing tea coding-agent client' --json
|
||||
warden plan 'forgejo admin api token' --json
|
||||
```
|
||||
|
||||
The reviewed probe uses installed Tea 0.9.2 and a disposable isolated
|
||||
configuration. It reads the authenticated identity and `coulomb/the-custodian`,
|
||||
prints metadata only and removes its temporary configuration. Run through the
|
||||
existing owner transport after its caller prerequisites are satisfied:
|
||||
|
||||
```sh
|
||||
warden access forgejo-admin-api-token --exec --field API_TOKEN -- python3 /home/worsch/the-custodian/docs/changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/check_forgejo_cli.py
|
||||
```
|
||||
|
||||
**Current result: not passed.** The owner transport returned OpenBao 403 before
|
||||
the probe received a credential or invoked the API. The installed Tea default
|
||||
points at a retired Gitea host; that credential was not used against the current
|
||||
forge. No authenticated API result has been accepted.
|
||||
|
||||
`warden plan 'oidc login forgejo admin' --json` identifies the existing
|
||||
founder-required KeyCape OIDC/MFA login lane. That human login is still a
|
||||
prerequisite to resolve through the owner path. The recorded route plans and
|
||||
closed failure markers are in the [entrypoint evidence](changes/netkingdom-target-2026-10-18/wp80-development-entrypoints-r1/README.md).
|
||||
|
||||
## Forgejo NetKingdom sign-in and repository privacy
|
||||
|
||||
The [prepared rollout](changes/netkingdom-target-2026-10-18/forgejo-good-case-preparation-r1/README.md)
|
||||
is revision 2, pending actual founder disposition and independent owner reviews.
|
||||
It proposes using the existing KeyCape issuer and upstream Forgejo OIDC/PKCE
|
||||
support, with local account linking. It has not been activated. The human
|
||||
sign-in/account-continuity test follows activation.
|
||||
|
||||
Making repositories private is owned by ORGREF-WP-0002 in
|
||||
`prj-forgejo-org-refactor`. WP-80 establishes working development access first.
|
||||
The closure workplan separately proves service readers, rehearses visibility
|
||||
changes and obtains approval for production waves. The proposed login rollout
|
||||
changes no repository visibility.
|
||||
|
||||
## Implementation ownership
|
||||
|
||||
| Need | Existing implementation to reuse |
|
||||
| --- | --- |
|
||||
| Browser execution and job protocol | rapp-playwright service and standalone Python client |
|
||||
| Capability discovery | reuse-surface capability card and existing federation |
|
||||
| Git and API | Existing Git/SSH path, Tea CLI and warden-routed Platform custody |
|
||||
| Identity and client registration | KeyCape issuer and NetKingdom's maintained registration helper |
|
||||
| Forgejo configuration | Apps Helm declarations and upstream Forgejo auth-source command |
|
||||
| Source-to-Hub publication | Existing file-scoped publication, fix-consistency and repo-manager projection |
|
||||
| Repository visibility | ORGREF-WP-0002 and its consumer-readiness/closure evidence |
|
||||
|
||||
Custodian records acceptance and integration evidence. Missing producer features
|
||||
belong in the existing owner's work record. Security acceptance remains in
|
||||
[WP-82](../workplans/CUST-WP-0082-netkingdom-security-hardening.md), including the
|
||||
target of current KeyCape checks on every API/Git/SSH operation.
|
||||
Loading…
Add table
Add a link
Reference in a new issue