A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live
I1304
The browser transport is the one this repository already drives
Where it stands
devtask.issue- Readiness
- blocked 1 of its dependencies is not DONE
- Status
- BLOCKED
- Can start
- not now
- Milestone
- Milestone status
- ACTIVE
- Wave
2- Waiting on
- Holds back
- Behind it in all
3- Evidence
0of5
| In the way | Subject | Detail |
|---|---|---|
| issue | I1302 | I1302 is not DONE |
Moves
plan.transitionWhat it is
- Objective
- Implement the authenticated browser transport in the Node tooling layer beside scripts/lib/ui-audit.mjs: Playwright over the system Chrome, an explicitly named profile, observation scoped to the vendor's own origins, and sanitisation before anything is persisted.
- Why
- ADR 0025 withdrew the second Rust crate for this reason: scripts/lib/ui-audit.mjs:262 and scripts/lib/cockpit-probe.mjs:436 already launch Chrome through Playwright's CDP transport, deliberately the system browser and never a downloaded one, wired into CI and skipping cleanly where Chrome is absent. A hand-written CDP client would reimplement that in the language with the strictest dependency budget in the repository.
- Now
- The two existing consumers each inline their own chromium.launch; no shared launcher was factored out. Neither targets an authenticated third-party session.
- Wanted
- One launcher, shared by the existing consumers and the new transport, takes the profile by explicit configuration outside the tree. The transport observes only requests whose origin matches the workspace declaration, redacts authorisation headers and cookies before any value leaves memory, and refuses to run against a profile it was not told to use.
- Done when
- unknown: the record declares no `completion`
- Risk
- Refactoring the two existing consumers onto a shared launcher can break the site and cockpit gates, which are the slowest to run and the ones a laptop skips. The refactor lands with its own green run of both.
Acceptance
- The transport attaches to an explicitly configured, already-authenticated browser profile and refuses to guess one
- Observation is scoped to the origins the workspace declaration names; traffic to any other origin is never recorded
- Authorisation headers, cookies and set-cookie values are redacted before an observation is written anywhere
- The existing UI and cockpit consumers use the same launcher, so the repository has one answer to how it starts a browser
- Absent Chrome or absent node_modules, the command skips with the defined exit code the repository already uses rather than failing
- Validation
bash test/run.shscripts/ui audit- Evidence required
profile_explicitorigin_scopedredaction_before_persistenceone_launcherskips_cleanly- Evidence present
- unknown: the record carries no `evidence` entries
Scope
- Touches
scripts/libscriptspackage.json- Not
Any credential written to disk, including a copied cookie jar or a profile archiveAny interaction with authentication, multi-factor prompts or anti-abuse controlsDOM scraping where a network observation answers the same question- Depends on
- Priority
- p0
- Profile
- deep-work
- Parallel safe
- true
- Owner
- unknown: the record declares no `owner`
The work so far
- Branches
- none
- Merged
- none
- Commits
0- Trunk
- master
- Sessions
- none
- Created
- 2026-09-09
- Updated
- 2026-09-09
- Started
- unknown: the record declares no `started_at`
- Verified
- unknown: the record declares no `verified_at`
- Completed
- unknown: the record declares no `completed_at`
Synchronisation
- Adapter
scripts/github-sync- Repository
- unknown: the derived plan's header carries no repository
- External issue
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
- State there
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
Findings
Nothing is wrong with these records.