feat: scope browser tooling to workspace temporary storage

Author: antropos17

.github/workflows/ci.yml

@@ -42,12 +42,16 @@ jobs:
       - run: npm ci
       - run: npm run build
       - run: npx playwright install --with-deps chromium
+      - run: npm run browser:doctor
       - run: npm run test:ui
       - uses: actions/upload-artifact@v7
         if: failure()
         with:
           name: browser-failures
-          path: runtime/browser-results
+          path: |
+            runtime/browser-results
+            .cache/verification/latest-browser.json
+          include-hidden-files: true
           retention-days: 7
           if-no-files-found: ignore
   dependency-audit:

docs/CONTEXT.md

@@ -82,7 +82,7 @@ and external AI CLIs require a direct user request. Never merge old work implici
 - Existing Commons run 49092854-f9bd-4b7a-8d12-4ac5ea0e5f70 retains the approved,
   unmerged safe-timer change from job 811bdb98-bcbb-4b65-80b9-f19693aef6b4.
   Preserve it. 29 earlier lab experiments were verified before this release work.
-- Public source: antropos17/commit-zero at ae6569b; all three CI jobs passed after Commons retry repair. Preserve separate histories.
+- Public source: antropos17/commit-zero at 0835284; all three CI jobs passed after account recovery. Preserve separate histories.
   README GIF is a 15.8s condensed walkthrough of retained Sequence Kit work,
   not a continuous live recording. Static fallback included; desktop/mobile and all
   three CI jobs passed. Evidence: runtime/verification/github-readme-gif-2026-10-19.json.

docs/DEVELOPMENT.md

@@ -31,6 +31,11 @@
 Append `-- --plan` to any suite to inspect its exact commands without running them.
 Area maps also list Playwright `.spec.mjs` files for navigation; area checks run
 only Node `.test.mjs` files. Run `npm run test:ui` for real browser coverage.
+`npm run browser:doctor` checks the configured Chromium executable, opens a
+fresh blank page, verifies its temporary profile is inside `.cache/tmp`, closes
+it and checks profile removal. It reports no application or sandbox qualification.
+No browser is downloaded automatically. The mutable report is
+`.cache/verification/latest-browser.json`; preserve an immutable copy when needed.
 `npm run benchmark:ui -- --history 1000 --samples 5` measures a labelled read-only
 chat fixture in cold browser contexts after `npm run build`. Use the same browser,
 viewport and parameters for comparison; it never opens a retained user store.
@@ -85,7 +90,12 @@ output under `.cache/tmp`. Child processes receive TEMP/TMP/TMPDIR explicitly.
   normal 180-request/minute API limiter active. `scripts/test-ui.mjs`
   checks that each browser spec is listed exactly once. Playwright global setup
   awaits child-service shutdown after each group; the production limit is not
-  changed. Run a focused spec with `npx playwright test tests/browser/<name>.spec.mjs`.
+  changed. Run a focused spec with
+  `npm run test:browser -- tests/browser/<name>.spec.mjs` (and optional `--grep`).
+  The runner applies workspace `TEMP`, `TMP` and `TMPDIR` before importing
+  Playwright or starting children. Capture and benchmark helpers use the same
+  setup. These process-local paths are ordinary same-user storage, not isolation.
+  Existing files, symlinks or junctions at `.cache`/`.cache/tmp` are rejected.
   Recovery fixtures wait for the actual failed request to settle before retrying.
   The initial Commons retry test pauses polling with Playwright's clock and holds
   the retry response until busy/disabled assertions pass. Resume its clock before

docs/DISTRIBUTION.md

@@ -94,13 +94,13 @@ announcement posted elsewhere.
 Before publishing a release, replace the candidate version with an actual tag,
 link its exact commit and CI run, re-run the documented gates, and record real
 browser/model/sandbox coverage separately. No release was created by this note.
-Current implemented-code checkpoint: public `ae6569b`, [CI run 39220678511](https://github.com/antropos17/commit-zero/actions/runs/39220678511)
-passed the full gate, Chromium and runtime dependency audit after the Commons
-retry repair. Local frozen gate at `3bfcc8d` passed 72/72 Node tests, DOM/axe 2/2,
+Current implemented-code checkpoint: public `0835284`, [CI run 39222123250](https://github.com/antropos17/commit-zero/actions/runs/39222123250)
+passed the full gate, Chromium and runtime dependency audit after account
+recovery. Local frozen gate at `b027fab` passed 72/72 Node tests, DOM/axe 2/2,
 build and serving with source hash
-`26cf7d425e0bc517e4e67b52aa530f315823736ffc268f940052dd7474f47c73`;
-separate local Chrome coverage passed 12/12. The account-recovery addition awaits
-its full gate. Verify the final candidate revision before creating a release.
+`18a10d49f2f726f5005289d035fe01d558b70fa72f8cc55e81996a26d404b3b4`;
+separate local Chrome coverage passed 15/15. Browser tooling changes await
+their full gate. Verify the final candidate revision before creating a release.
 The checked capture set is already published at `98389bd`.
 
 ## Show HN fact sheet for a human author

docs/ECOSYSTEM-DECISIONS.md

@@ -53,4 +53,5 @@ No substitute model is inferred from a familiar display name.
 | Generated-code execution | Docker daemon remains unavailable. Keep the digest/mount/resource plan source-tested and the product blocked. [Setup path and unverified properties](SANDBOX-ADAPTER.md). |
 | Collaboration failure/recovery | Seeded actors exercise actual HTTP contracts in disposable stores. [Commands, seeds and limits](SIMULATIONS.md). |
 | Browser/workflow feedback | Use real Chrome, scoped fixtures and frozen full gates; preserve the production limiter. [Comparable measurements and limits](WORKFLOW-MEASUREMENTS.md). |
+| Browser startup and temporary files | Reuse installed Playwright 1.64.1, apply workspace temporary variables before import/spawn, and inspect/remove a fresh Chrome profile in a separate readiness probe. [Primary launch reference, baseline and actual receipt](WORKFLOW-MEASUREMENTS.md#browser-temporary-paths-and-readiness). No new dependency or sandbox is introduced. |
 | Open-source distribution | Prepare real captures and channel-specific material, respect channel restrictions, and publish only source/docs. [Rules, drafts and assets](DISTRIBUTION.md). |

docs/HANDOFF-2026-10-19.md

@@ -8,17 +8,17 @@ tracks dated decisions and receipts; this file is the operational entry point.
 ## Repositories and state
 
 - Working repository: `X:\ai-github`, branch `codex/development-foundation`,
-  latest fully checked local commit `3bfcc8d` at this checkpoint. The local data and model
+  latest fully checked local commit `b027fab` at this checkpoint. The local data and model
   installation are here. Recheck status before acting; this file can age.
 - Public repository: [antropos17/commit-zero](https://github.com/antropos17/commit-zero),
-  `main` at `ae6569ba672dfed53cefe8967aa516764473feae` after a normal push.
+  `main` at `083528425ab1dcb32418bc993715e870f3ee68c7` after a normal push.
   Its separate checkout is `.cache/publication`. The histories are unrelated;
-  the public tree matches local `3bfcc8d` (`46b22e1534ce4a2a2c520dc973e256e054f52f5e`).
-  An account saved-list recovery/session-race unit is currently awaiting final gates.
+  the public tree matches local `b027fab` (`597e18872e2d6d9853ac81e8560b046a40d37780`).
+  A browser temporary-directory/readiness unit is currently awaiting final gates.
   Do not merge histories, reset the local branch or force push. Recheck remote
   before publishing anything else.
-- Public CI [run 39220678511](https://github.com/antropos17/commit-zero/actions/runs/39220678511)
-  passed full gate, Chromium and runtime dependency audit for `ae6569b`. The
+- Public CI [run 39222123250](https://github.com/antropos17/commit-zero/actions/runs/39222123250)
+  passed full gate, Chromium and runtime dependency audit for `0835284`. The
   preceding retry-fixture failure at `5f9f88e` is preserved in the mission log.
 - This mission has not run local or hosted model inference, spawned product
   agents, submitted promotional posts or created a new release. Prior retained
@@ -101,20 +101,22 @@ Timer proposal from job `811bdb98-bcbb-4b65-80b9-f19693aef6b4`. Preserve it.
 
 ## Evidence and limits
 
-The pending account unit separates successful authentication from saved-list
+The account unit separates successful authentication from saved-list
 loading. `AccountProvider` scopes reads to the active identity and invalidates
 older reads after a bookmark write. `MyProfile` has known/loading/error states
 and explicit Refresh, with keyboard focus restored only if the user has not
 chosen another control. Three focused Chrome tests passed, including a held
 prior-account response. [Actual failure capture](media/account-unavailable-2026-10-19.png).
-Grouped Chrome passed 15/15 and `check:identity` passed 10/10; the frozen full
-gate remains before this unit is committed.
+Grouped Chrome passed 15/15, `check:identity` passed 10/10 and the frozen full
+gate passed before that unit was committed. Browser tooling now has shared
+temporary setup and a separate `browser:doctor`; its grouped Chrome 15/15 passed,
+with the frozen full gate and hosted browser-health evidence still pending.
 
-- Latest local frozen full gate at `3bfcc8d`: 72/72 Node tests, compiled DOM/axe
+- Latest local frozen full gate at `b027fab`: 72/72 Node tests, compiled DOM/axe
   2/2, build and static serving passed. Stable source hash
-  `26cf7d425e0bc517e4e67b52aa530f315823736ffc268f940052dd7474f47c73`;
-  receipt `runtime/verification/commons-retry-full-2026-10-19.json` (ignored by Git).
-- Installed Chrome browser suite passed 12/12 at desktop and 390px. Real captures
+  `18a10d49f2f726f5005289d035fe01d558b70fa72f8cc55e81996a26d404b3b4`;
+  receipt `runtime/verification/account-recovery-full-2026-10-19.json` (ignored by Git).
+- Installed Chrome browser suite passed 15/15 at desktop and 390px. Real captures
   are `runtime/verification/commons-first-run-{desktop,narrow}-2026-10-19.png`,
   `commons-provider-offline-desktop-2026-10-19.png` and catalog captures. Tests
   used in-memory services; provider-health responses were controlled in the
@@ -181,7 +183,7 @@ gate remains before this unit is committed.
 
 ## Next work, in order
 
-1. Complete account recovery: run grouped Chrome and `npm run check` on frozen source,
+1. Complete browser runtime tooling: run grouped Chrome and `npm run check` on frozen source,
    commit it, copy the unpublished local commit into the separate public
    checkout, compare Git trees, push without force and inspect public CI.
    Record exact SHA and receipt.
@@ -214,7 +216,7 @@ gate remains before this unit is committed.
 > `docs/HANDOFF-2026-10-19.md`, and `docs/MISSION-2026-10-19.md`. Recheck Git
 > state and `npm run doctor`; use `npm run map -- <area>`. Preserve all runtime
 > data, credentials, earlier model receipts, and separate Git histories.
-> First confirm public CI for `ae6569b` and complete any dirty account recovery or
+> First confirm public CI for `0835284` and complete any dirty browser runtime or
 > handoff unit. Then reproduce and improve one
 > concrete browser or transaction journey, using focused checks and the full
 > `npm run check` on frozen source. Keep model-backed catalog roles disabled;

docs/MISSION-2026-10-19.md

@@ -12,7 +12,7 @@ Start: 03:46:17 UTC. Deadline: 15:46:17 UTC. Final integration reserve begins 14
 
 ## Current action
 
-Finish account saved-list recovery and stale-response guards. Registration, keyboard refresh and two held-response races pass in Chrome; run grouped browser and frozen full gates, then publish through the existing separate checkout. Keep all new profiles disabled. The final integration reserve still begins at 14:16:17 UTC.
+Finish browser temporary-directory/readiness tooling. Actual Chrome profile containment/cleanup, missing executable, redirected-path fixtures and capture/benchmark entrypoints passed; run grouped Chrome and the frozen full gate, then publish. Keep all new profiles disabled. The final integration reserve still begins at 14:16:17 UTC.
 
 ## Decisions and limits
 
@@ -79,6 +79,9 @@ Finish account saved-list recovery and stale-response guards. Registration, keyb
 - 08:08 UTC: Commons retry committed locally as `3bfcc8d` after full gate 72/72, stable source hash `26cf7d425e0bc517e4e67b52aa530f315823736ffc268f940052dd7474f47c73`; receipt `runtime/verification/commons-retry-full-2026-10-19.json`. Normal publication produced `ae6569b` with identical tree `46b22e1534ce4a2a2c520dc973e256e054f52f5e`. [CI run 39220678511](https://github.com/antropos17/commit-zero/actions/runs/39220678511) passed all three jobs, including the formerly failing retry browser fixture.
 - 08:13 UTC: real Chrome reproduced registration HTTP 200 followed by saved-list HTTP 503 leaving the signup page without a visible error; baseline trace is under `runtime/verification/account-recovery-baseline-2026-10-19`. Authentication now completes independently of the optional list. The profile distinguishes unknown/loading/failed/known lists and has explicit Refresh. Generation and owner guards reject delayed reads after a bookmark write or session change. Three focused Chrome tests passed, including keyboard focus recovery and preserving a different focus choice while pending. Focused UI passed DOM/axe 2/2, build and serving. Final grouped/browser and full gates remain; retained account stores are untouched.
 
+- 08:20 UTC: account recovery committed locally as `b027fab` after full gate 72/72, stable source hash `18a10d49f2f726f5005289d035fe01d558b70fa72f8cc55e81996a26d404b3b4`; receipt `runtime/verification/account-recovery-full-2026-10-19.json`. Normal publication produced `0835284` with identical tree `597e18872e2d6d9853ac81e8560b046a40d37780`. [CI run 39222123250](https://github.com/antropos17/commit-zero/actions/runs/39222123250) passed all three jobs. Actual account error capture matches its runtime PNG by SHA-256 `63479869`.
+- 08:28 UTC: read-only baseline found Node's default temporary directory outside the workspace. New shared setup configures browser runners/capture/benchmark before import or child creation. Two host tests passed file/junction denial and caller-environment preservation, with no skips. Actual `browser:doctor` opened Chrome 155, observed its profile inside `.cache/tmp`, closed it and confirmed removal; a missing executable reported blocked. The first CDP attempt failed because Chrome required `--enable-automation`; the corrected probe passed, and both receipts are retained. `test:browser` passed account recovery 3/3; `check:tooling` passed 10/10. Launch capture and an 80-message/one-sample benchmark both exited cleanly; this is integration evidence, not a new speed comparison. [Details](WORKFLOW-MEASUREMENTS.md#browser-temporary-paths-and-readiness). Full grouped browser and frozen gates remain.
+
 ## Next checkpoint
 
-Account recovery passed identity 10/10 and all 15 grouped Chrome tests. Run the frozen full gate, commit and publish, then measure and address workspace temporary-output handling in browser tools. Keep the final 90-minute reserve from 14:16:17 UTC.
+All 15 grouped Chrome tests passed through the workspace-temporary runner, and the added redirected-temp junction case passed without skips. Run the frozen full gate and final browser probe, commit and publish; then consolidate a reproducible source/publication/evidence preflight from the repeated manual release checks. Keep the final 90-minute reserve from 14:16:17 UTC.

docs/WORKFLOW-MEASUREMENTS.md

@@ -6,6 +6,38 @@ or normal user database write was part of these measurements.
 
 ## Feedback loop
 
+### Browser temporary paths and readiness
+
+Before the browser-runtime change, a read-only Node check returned
+`C:\Users\murtu\AppData\Local\Temp`. Installed Playwright 1.64.1 source uses
+`os.tmpdir()` for temporary profiles/artifacts; the old browser entrypoints did
+not set workspace variables. No baseline browser was launched for this check.
+Receipt: `runtime/verification/browser-temp-baseline-2026-10-19.json` includes
+the installed bundle digest and baseline local commit `b027fab`.
+
+Decision: share process-local `TEMP`/`TMP`/`TMPDIR` setup before Playwright import
+or child creation. The [Playwright launch reference](https://playwright.dev/docs/api/class-browsertype#browser-type-launch),
+accessed 2026-10-19, documents temporary artifact/download cleanup after browser
+closure. `browser:doctor` checks the actual profile path through CDP rather than
+inferring it solely from those settings. This probe uses `--enable-automation`
+because the installed Chrome otherwise rejects command-line inspection.
+
+One actual Chrome 155.0.8059.80 probe took 1,196 ms, opened only `about:blank`,
+observed a profile inside `X:\ai-github\.cache\tmp`, and confirmed removal after
+close. A missing-executable probe reported `blocked`; the first CDP attempt
+reported `failed` without claiming cleanup verification. Receipts are
+`runtime/verification/browser-doctor-{missing,cdp-baseline,profile}-2026-10-19.json`.
+This single observation is not a startup speedup or application acceptance test.
+No global Windows setting, existing browser profile or model was changed.
+
+`test:browser` passed the three account recovery journeys through the new runner.
+Launch capture and an 80-message/one-sample UI benchmark also exited successfully;
+their integration receipts are `browser-temp-{launch,benchmark}-2026-10-19.json`
+under `runtime/verification`. That small benchmark is not a new timing comparison.
+The profile/path checks establish ordinary tool hygiene, not a security boundary.
+
+### Earlier feedback measurements
+
 | Command | Observed samples | What it covers |
 | --- | --- | --- |
 | `npm run check:fast` | One current run: lint 689 ms, repository 95 ms, pure tests 1,334 ms (9/9) | Useful for quick pure-code feedback; excludes databases, build, DOM and serving. Not acceptance. |

package.json

@@ -27,6 +27,8 @@
     "db:verify-snapshot": "node scripts/store-snapshot.mjs verify",
     "diagnostics": "node scripts/diagnostics.mjs",
     "test:ui": "node scripts/test-ui.mjs",
+    "test:browser": "node scripts/browser-runtime.mjs test",
+    "browser:doctor": "node scripts/browser-runtime.mjs doctor",
     "test:dom": "node --test tests/interface.dom.mjs",
     "test:serve": "node scripts/smoke-build.mjs",
     "test:services": "node --test tests/services.test.mjs",

scripts/benchmark-ui.mjs

@@ -2,7 +2,7 @@ import { createHash } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { performance } from "node:perf_hooks";
 import { parseArgs } from "node:util";
-import { chromium } from "@playwright/test";
+import { browserTools } from "./browser-runtime.mjs";
 import { startServices } from "./services.mjs";
 import { fingerprint } from "./project-files.mjs";
 
@@ -17,6 +17,7 @@ if (!Number.isInteger(history) || history < 1 || history > 5000 ||
 
 // A routed, read-only browser fixture measures client rendering, not storage or
 // provider throughput. Every service uses disposable in-memory databases.
+const { chromium } = await browserTools();
 const cluster = await startServices({ memory: true, staticRoot: "dist",
   ports: { gateway: 0, workspace: 0, identity: 0, ranking: 0 } });
 let browser;