oficina / home Public

Candidate0b00720fe1da0add0ee4fc8b81bbd69f9e9b03df pushed, clean test/credential-browser-driver, two test/tool files only; frozen4013745 candidate untouched. Fullgate with explicit browser enabled passed including race, latest browser after debug suppression passed, actual CI exacthead green. ActualCI skips opt-in browser; local proof is separate. Local real WebAuthn registration+assertion/RPID/signcount, host-only Secure/HttpOnly/Lax cookies and actual directory requests without cookies, enrol/codes continuation, scriptless recovery and single-use rejection, exactly4 captured mails. Six pre-POST refusal cases passed. Evidence /tmp/oficina-home-browser-driver/{browser.log,browser-final.log,full-gate-final.log,ci.json,review.txt,usage-llm.txt}. No live mail/auth actions, no Fable call. Live driver requires explicit controlled disposable account and mailbox adapter, exact canary origins/build, fixed4-mail consent and exclusive0600 recovery output; account/passkey/sessions persist after browser cleanup. Hardware authenticators, actual canary ceremonies, Keymail and restore remain unproven. Fable review pending.

Independent Codex review of 0b00720 requests changes before live use. Version preflight follows redirects without proving the final URL belongs to each requested origin. Mail budget counts completed mailbox sequences rather than outgoing POST /signin requests, so it does not enforce the declared request cap under repeated or redirected requests. Cancellation uses SIGINT and bounded waits but has no process-exit proof. Private owned0600/no-follow input checks, exclusive recovery output and actual ceremony/cookie assertions are substantive.

Original driver worker owns fixes and regressions on its existing isolated branch. Root has not queued this candidate for Fable or used it with a live mailbox. Frozen credential candidate4013745 and deployed canary651e5b3 remain unchanged. Expected handback: exact final commit, red-before-fix evidence, browser cancellation/process proof, full local/race and actual CI.

Worker reproduced the original request-budget defect against the local harness: 307/308 loops reached20 sign-in POSTs and scripted repeats reached7. Its CDP request-stage correction limits each case to4. Redirected version checks now reject both a different final URL and a redirect roundtrip returning to the expected URL. Cancellation test observed five Chromium children and verified descendants exited.

Root review of the in-progress correction identified the same redirect limitation in context.route's origin allowlist. Asked worker to enforce the two-origin allowlist and pre-verification POST refusal at CDP request stage on every hop too, with an actual third-host redirect regression proving zero requests reach that host. Full final candidate gates remain pending; no live invocation or review approval.

Correction to the origin-check concern: unlike the version and mail-budget defects, no external-request leak was reproduced. The local browser refuses the third-host redirect with ERRINVALIDARGUMENT even when both explicit origin guards are disabled. Thus zero third-host requests cannot be cited as an independent mutation proof of those guards. Worker will retain the explicit Fetch checks, restore normal fixture CSP and state this evidence limit. The version redirect and request-budget red/green reproductions remain valid; cancellation has observed child-process exit evidence.

Root review requested changes to0b00720; no Fable approval claimed. Addressed actual version-response URL and redirect chain, outgoing sign-in request cap, cancellation proof and per-hop origin enforcement. Frozen4013745 untouched.

Actual red-before-fix: version-red.log firstcase completed authentication despite redirected/api/version; separate version-roundtrip-red.log accepted chain returning to exactoriginal URL. budget-red.log server counted20POSTs for307,20for308,7for repeated submissions. Pending-mail cancellation already passed onoriginaldriver, now regression retained: after actual/signin POST and while no mailbox input arrives, observed5Chromium descendants, interrupted driver and verified all observed descendants exited; no cleanup fix invented.

Fix checks exact response.url and no redirectedFrom chain before verified. CDP Fetch request-stage interception gates every outgoing/signin POST before delivery, including redirect hops; fifth aborted independently of incoming mailbox sequence. Full normal ceremony still sends exactly4. Context and Fetch both enforce exactpairedorigins; Fetch blocks every POST before both version checks finish. Browser signal cleanup preserved.

Green budget evidence boundaries-green.log: actualserver4POSTs for307/308/repeated submissions,1for pending-mail cancellation; all observed Chromium descendants exited. New thirdlocalhost TLS307/308 cases see zero third-host requests. LIMIT: these do not independently prove origin-guard sensitivity. With contextguardmutatedoff and oldFetchwithoutorigincheck, browser still rejected cross-origin hop net::ERRINVALIDARGUMENT; external-independent-red.log is PASS despite filename, not red evidence. An exploratory fixture bypassing page CSP also stayed blocked. Restored normal CSP; no claim of reproduced external-address leak. Defense strengthened at exact Fetch boundary, code reviewed and end-to-end zero-target outcome retained. No diagnostics or guard mutations remain in source; no token/address logs emitted.

All local fixtures use existing app+test capturedmailer, no live mail/auth. Liveaccount/passkey/session persistence, private recovery output, explicitfixed4mailbudget and controlledmailbox requirement unchanged. CI without Playwright env still skips opt-in browser; local fullgate explicitly enables it and race. Fable review and live use remain pending.

Final candidate f94d690bfb3c1494b093b4259d4a71369ded90d1 pushed, clean branch test/credential-browser-driver. Full local gate with explicit browser+race passed; final-origin-full-gate.log (Go10.572s, race15.803s). Final actualCI receipt pending next check.

Actual CI now passed exact f94d690bfb3c1494b093b4259d4a71369ded90d1. Receipt /tmp/oficina-home-browser-driver/revision-ci.json. No merge, deployed canary run or Fable approval claimed; private review prompt updated to final SHA.

Root verified exact clean f94d690bfb3c1494b093b4259d4a71369ded90d1 and actual CI passed. Added it as the eighth job to the active 01:51 Dublin Fable timer, resuming the Home reviewer with this separate test-only diff and its documented limitations. No Fable call made before reset. The frozen4013745 credential candidate and651e5b3 live canary are unchanged. New runtime driver remains unused with a live mailbox.