test(rate): qualify production browser surfaces

[d-sorgcodexagent]

Summary

• qualify the exact-revision static inspection bundle and packaged same-origin companion in Chromium, Firefox, and WebKit
• add a secret-free native lifecycle harness that proves hard-loss authority replacement behind the stable public gateway
• audit browser-visible requests/runtime state, enforce serious/critical accessibility checks, and keep traces, screenshots, video, profiles, tokens, and private ports out of release evidence
• fix the CSP data-font mismatch exposed by the browser gate and keep Playwright specifications outside Vitest unit discovery
• add an independent protected browser qualification job with pinned Python test plugins and all three browser engines

Stack

• issue: Rate of Closure: Playwright production-browser qualification #4380
• epic: EPIC: Rate of Closure production distribution and runtime qualification #4377
• base: codex/4379-same-origin-companion (PR feat(rate-of-closure): add secure production web companion #4390)
• corrected parent head propagated normally: c3ecfd48910aa5aafb89962a256333690e8e72c5
• no force push, retargeting, admin merge, or protection bypass

Local qualification

• TypeScript type-check and zero-warning ESLint: pass
• React/Vitest: 922 pass
• deterministic release artifact checks: 6 pass, 1 expected Windows symlink skip
• focused companion/browser Python contracts: 60 pass; exact final-head subset: 21 pass
• production smoke: 9/9 across Chromium, Firefox, and WebKit
• authority hard-loss lifecycle: 3/3 across Chromium, Firefox, and WebKit
• exact generated manifest revision equals final local head

Explicit limits

This PR does not claim forced parent-process descendant-tree cleanup, Windows ACL/reparse privacy, frozen/PyQt installers, signing, SBOM/attestation, calibrated or compiled physics, downstream parity, parent readiness, protected merge, or release to main. It must remain dependency-ordered behind #4390 and requires fresh protected CI on its own exact head.

[d-sorgcodexagent]

Final handoff head: 3f98017857e9e05a826dcc4e23ad6745ff0e362f.

Post-handoff local checks:

• campaign release manifest: 8 passed
• exact-revision Chromium static/companion smoke: passed
• exact-revision Chromium authority hard-loss lifecycle: passed
• generated release manifest revision equals the final commit

The earlier implementation head completed the full Chromium/Firefox/WebKit smoke and lifecycle matrix. Fresh protected CI on this final head remains required; this comment does not assert parent readiness or protected release.

[d-sorgcodexagent]

Exact corrective head: de673971bfae83a9d673bba4859def5322635af9.

Hosted-failure corrections and final local qualification:

• pinned Starlette 1.6 TestClient's isolated httpx2==2.10.0 dependency;
• documented the native browser harness as fixture/support in the assertion gate while retaining behavioral assertions in its separate test module;
• diagnosed and removed the WebKit lifecycle race by observing the initial capability 200 before inducing authority hard loss;
• retained actionable runtime error summaries with bounded URL/token-like-value redaction;
• clean Python 3.11 packaged install: 21/21 harness and companion app contracts;
• exact-revision Chromium/Firefox/WebKit smoke: 12/12;
• exact-revision Chromium/Firefox/WebKit hard-loss lifecycle: 3/3;
• TypeScript, zero-warning ESLint, release-contract tests (6 pass, 1 expected Windows symlink skip), exact revision-bound manifest, git diff --check, and clean worktree passed.

Human review is approved as an operational release input. Protected checks and dependency order remain authoritative; no bypass or merge is requested by this comment.

[d-sorgcodexagent]

Exact acceptance head: 0de3de8a41c018aec03dead8371a1f3ec6e1912f.

This closes the previously documented #4380 qualification gaps with built-surface, zero-retry Playwright coverage for:

• Python-authoritative prepare → confirm → single submit → poll → canonical job/result download → reload/import → retained-result recovery;
• cooperative cancellation and prepared-job staleness with no automatic resubmission;
• an intentionally forbidden browser Worker on the authority-only execution path;
• authority hard loss with token/private-port rotation and stable-gateway recovery;
• public gateway hard loss with bounded expected transport diagnostics;
• missing declared entry assets, malformed capability responses, and corrupt persisted browser preferences;
• successful-path same-origin/credential-free request, console/page-error, download, and accessibility audits;
• a native bounded scan proving the bearer token and private child port are absent from public HTML/capability responses while the browser request audit proves they are absent from requests.

Exact local evidence:

• Rate Python: 1,328 passed, 2 expected platform skips;
• React/Vitest: 138 files, 922 tests passed;
• release contracts: 6 passed, 1 expected Windows symlink skip;
• Playwright: 36/36 passed across Chromium, Firefox, and WebKit, one worker, zero retries;
• TypeScript, zero-warning ESLint, Ruff, Ruff format, focused MyPy, campaign validator, eight manifest tests, and git diff --check: passed;
• generated release manifest revision: exact 0de3de8a41c018aec03dead8371a1f3ec6e1912f;
• worktree clean after the consolidated normal push.

All three canonical handoffs, SPEC.md, and campaign limitations were updated in the implementation commit. The PR remains draft pending fresh exact-head protected checks and parent-first dependency order; no merge-protection bypass is requested.