afk-pipeline: verify-phase agent-browser Chromium/CDP fails to launch in linux/arm64 local-lane container (acredix #134)

[JorgeMenaDev]

Note

Triage status 2026-07-12 (verified vs origin/main, afk-pipeline v2.13.1)
Done since filing: acredix regenerated at v2.10.11 (.sandcastle/runtime.ts pins gpt-5.6-luna, commit 059360f4); the Dockerfile has always handled arm64 (Debian chromium + AGENT_BROWSER_EXECUTABLE_PATH), and the local lane now rebuilds the image whenever the AFK version label changes, flushing the suspected stale-image gap.
Remaining scope of this issue: (1) verify-phase browser-launch preflight with honest criterion-level degrade — a Chromium launch failure still terminal-fails the run as infra; (2) codex session .jsonl transcripts — salvage.sh still does bare git add -A with no exclusion and the .sandcastle/.gitignore template doesn't cover workspace-root transcripts; (3) Chromium launch on the acredix image was never re-proven post-regen.

Seen 2026-07-10, Arketix/acredix run 29115922787 (issue #134, engine codex, lane agent:implement-local, container sandcastle-acredix on the mini): implement + review + shell verification all passed, then the verify phase failed the RUN because agent-browser could not launch Chromium/CDP in the linux/arm64 container. Evidence: docs/evidence/issue-134/agent-browser-blocker.txt on branch agent/issue-134-seo-009-serve-robots-txt-publicly-x-robots-tag-noi. Delivery was salvaged manually (PR #135).

Notes:

• superaseo local orchestrate: 10 conductor-experience frictions from a live run — undocumented ledger contracts burn the conductor's context #94 ran codex-driven browser verify successfully (2026-07-08), so this is likely a sandcastle-acredix image gap (Chromium/deps missing or broken for arm64), not a lane-wide regression. Worth an image-build check + a verify-phase preflight that degrades honestly (criterion-level BLOCKED) instead of failing the whole run when the browser can't even launch.

Two smaller observations from the same run, fix opportunistically:

• acredix's generated runtime still pins codex -m gpt-5.5 (template moved to gpt-5.6-luna in 0f179c9; andyChat already noted 2026-07-10) — regen acredix.
• The salvage WIP commit captured two codex session .jsonl transcripts from the workspace root — codex session artifacts should be written outside the workspace or gitignored so salvage doesn't ship them.