test(rate-web): add trusted production Worker browser gate

.github/workflows/local-only-runner-guard.yml

@@ -29,12 +29,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Python
         env:
           AGENT_TOOLSDIRECTORY: ${{ runner.temp }}/_tool_cache
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.12"
 
@@ -69,6 +69,7 @@ jobs:
           }
           ALLOWLIST_JOBS = {
               ("ci-standard.yml", "quality-gate"),
+              ("rate-web-playwright.yml", "production-worker-e2e"),
           }
           HOSTED = re.compile(r"^(ubuntu|macos|windows)(-latest|-\d+)?$")
 
@@ -148,7 +149,8 @@ jobs:
               print(f"{len(violations)} workflow(s) leak to hosted runners.")
               print(
                   "Allowed: local-only-runner-guard.yml, runner-health-alert.yml, "
-                  "ci-standard.yml::quality-gate, and jobs literally named "
+                  "ci-standard.yml::quality-gate, "
+                  "rate-web-playwright.yml::production-worker-e2e, and jobs literally named "
                   "'Reject hosted runner routing'."
               )
               sys.exit(1)

.github/workflows/rate-web-playwright-trusted.yml

@@ -0,0 +1,54 @@
+name: Rate Web Playwright Trusted
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "src/rate_of_closure/web/**"
+      - ".github/workflows/rate-web-playwright.yml"
+      - ".github/workflows/rate-web-playwright-trusted.yml"
+concurrency:
+  group: rate-web-playwright-trusted-main
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  push-production-worker-e2e:
+    name: Rate web production Worker E2E (trusted push)
+    if: github.event_name == 'push'
+    runs-on: d-sorg-fleet
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: src/rate_of_closure/web
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: src/rate_of_closure/web/package-lock.json
+
+      - name: Install locked web dependencies
+        run: npm ci
+
+      - name: Install Playwright-pinned Chromium runtime
+        run: npx --no-install playwright install --with-deps chromium
+
+      - name: Exercise production Worker lifecycle and layouts
+        run: npm run test:e2e
+
+      - name: Retain Playwright evidence
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: rate-web-playwright-trusted-push-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            src/rate_of_closure/web/playwright-report/
+            src/rate_of_closure/web/test-results/
+          if-no-files-found: error
+          retention-days: 14

.github/workflows/rate-web-playwright.yml

@@ -0,0 +1,53 @@
+name: Rate Web Playwright PR
+
+on:
+  pull_request:
+    paths:
+      - "src/rate_of_closure/web/**"
+      - ".github/workflows/rate-web-playwright.yml"
+      - ".github/workflows/rate-web-playwright-trusted.yml"
+
+concurrency:
+  group: rate-web-playwright-pr-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  production-worker-e2e:
+    name: Rate web production Worker E2E (ephemeral PR)
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    defaults:
+      run:
+        working-directory: src/rate_of_closure/web
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Set up Node.js
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: src/rate_of_closure/web/package-lock.json
+
+      - name: Install locked web dependencies
+        run: npm ci
+
+      - name: Install Playwright-pinned Chromium runtime
+        run: npx --no-install playwright install --with-deps chromium
+
+      - name: Exercise production Worker lifecycle and layouts
+        run: npm run test:e2e
+
+      - name: Retain Playwright evidence
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: rate-web-playwright-pr-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            src/rate_of_closure/web/playwright-report/
+            src/rate_of_closure/web/test-results/
+          if-no-files-found: error
+          retention-days: 14

.gitignore

@@ -80,6 +80,8 @@ flask_pid.txt
 node_modules/
 dist/
 build/
+playwright-report/
+test-results/
 
 # Cache
 .cache/

AGENT_HANDOFF.md

@@ -3,6 +3,52 @@
 > **Update this file with every PR and every push to main.**
 > Last updated: 2026-08-12
 
+## 2026-08-12 Integrated localized torque and Playwright stack (#4142, 1.16.59)
+
+This branch now preserves the complete histories of localized-torque head
+`10524cc2151c7b60c4a097939b29202158aff012` and reviewed Playwright head
+`6df0ed09388ba36630c5fc6be7a31a334a4b6243` in a normal two-parent merge.
+The localized Python execution/validation contracts and the Rate-web production
+Worker/browser gates coexist without changing either scientific or browser
+contract. Publication, protected CI, remaining localized UI/Rust/persistence
+work, and full R14.5 visual/browser certification remain open.
+Integrated local evidence is 171/171 localized changed-test cases, 18/18
+Playwright workflow/security tests, and 5/5 real Chromium tests, plus scoped
+Ruff, Ruff format, documentation governance, workflow validation, and diff
+hygiene.
+
+## 2026-08-12 Real-browser variation Worker foundation (#4142 R14.5)
+
+Local branch `codex/4142-rate-web-playwright` starts from exact integrated
+commit `11a699155588d3d948990c5f08b72c5cc8d2c746`. The Rate web package pins
+Playwright Test 1.62.1 in its own manifest/lock and owns a deterministic
+Chromium configuration across two path-filtered workflows. Every PR runs only
+on ephemeral `ubuntu-latest`; the PR YAML has no fleet/self-hosted reference.
+The separate trusted workflow runs only for pushes to `main`, checks out the
+push event commit, and has neither a PR nor manual-dispatch ref seam. Checkout,
+Node setup, and artifact upload actions are pinned to full immutable SHAs.
+Artifact names include the workflow run and attempt IDs.
+
+The gate builds and serves the Vite production bundle, then uses role/label
+locators against the actual bundled module Worker. It observes strict
+intermediate and terminal progress during a seeded 24-run study and proves a
+deterministic rerun. Cancellation of a 500-run swing/OAT job observes actual
+Worker termination before two identical seeded reruns, proving the cancelled
+generation cannot publish a partial or late result. Navigation terminates
+active work on primary-tab unmount, and every case rejects browser page errors.
+Blocking service workers in the
+test context does not replace or disable the dedicated module Worker; every
+lifecycle case observes the hashed production Worker chunk. Desktop 1440x1000
+and narrow 390x844 checks enforce zero document-level horizontal overflow and
+attach full-page screenshots to the retained Playwright report.
+
+This is a narrow R14.5 foundation, not R14.5 completion or complete visual
+certification. It covers bundled Chromium only; screenshots are review
+artifacts, not cross-platform golden baselines. WebKit, Firefox, assistive-
+technology automation, PyQt interaction, protected runner evidence, and a
+CI-authority visual baseline remain open. Local evidence is 5/5 Playwright and
+743/743 Vitest tests, plus TypeScript, ESLint, and the Vite production build.
+
 ## 2026-08-12 Localized torque static-gate closure (#4142)
 
 The final cumulative changed-source MyPy blockers are closed without runtime

SPEC.md

@@ -26,12 +26,57 @@
 | **Owner**               | D-sorganization                            |
 | **Primary Language(s)** | Python 3.11+, Rust, JavaScript, TypeScript |
 | **License**             | MIT                                        |
-| **Current Version**     | 1.16.58                                    |
-| **Spec Version**        | 1.16.58                                    |
+| **Current Version**     | 1.16.59                                    |
+| **Spec Version**        | 1.16.59                                    |
 | **Last Spec Update**    | 2026-08-12                                 |
 
 ## 2. Purpose & Mission
 
+### 2026-08-12 Integrated localized torque and Playwright stack (#4142)
+
+Version 1.16.59 merges the exact localized-torque history at
+`10524cc2151c7b60c4a097939b29202158aff012` above the reviewed Playwright
+history at `6df0ed09388ba36630c5fc6be7a31a334a4b6243` with a normal two-parent merge.
+The strict Python localized-torque execution, validation, typed miss, and PyQt
+filtering contracts coexist with the trust-separated production-Worker browser
+gate; neither scientific nor browser authority is weakened. Protected
+publication, full R14.5 certification, localized locus authoring, additional
+sources, Rust parity, and complete state/event/torque persistence remain open.
+Integrated verification passes 171 localized changed-test cases, 18 Playwright
+workflow/security tests, and five real production-Worker Chromium tests, plus
+scoped Ruff/format, documentation governance, workflow validation, and diff
+hygiene.
+
+### 2026-08-12 Real-browser variation Worker foundation (#4142 R14.5)
+
+Version 1.16.57 pins Playwright Test 1.62.1 inside the Rate web package and
+adds a dedicated deterministic Chromium configuration with separate trust
+domains. The pull-request workflow contains only one ephemeral `ubuntu-latest`
+job and no persistent-fleet or self-hosted reference. A separate trusted
+workflow runs only for pushes to `main` and checks out the push event commit.
+It has no PR or manual-dispatch workflow-definition ref seam. Every external
+action reference in both Playwright workflows is pinned to a full immutable
+commit SHA. The gate builds and previews the production Vite output. Role/label
+locators drive the real hashed module Worker through a seeded 24-run study,
+observe at least one strict intermediate progress value before completion, and
+prove an identical rerun. A 500-run swing/OAT cancellation observes Worker
+termination before two identical seeded reruns, proving the cancelled generation
+cannot publish a partial, late, or stale result. Primary-tab navigation also
+terminates active work before the Variation panel unmounts. The test context
+blocks service workers but not the tested dedicated module Worker.
+
+Desktop 1440x1000 and narrow 390x844 projects enforce zero document-level
+horizontal overflow and attach deterministic full-page screenshots. Reports,
+failure screenshots, traces, and videos are retained as attempt-identified CI
+artifacts. Local
+evidence is 5/5 Playwright tests and 743/743 Vitest tests, with TypeScript,
+ESLint, and the Vite production build green.
+
+This is a narrow R14.5 foundation rather than R14.5 completion. The screenshots
+are review artifacts, not CI-authority or cross-platform pixel baselines. Only
+bundled Chromium is exercised; WebKit, Firefox, assistive-technology automation,
+PyQt interaction, protected runner execution, and an approved visual baseline
+remain open. No scientific, plan, result, or persistence contract changed.
 ### 2026-08-12 Localized torque static-gate closure (#4142)
 
 Version 1.16.58 closes the final cumulative changed-source static-analysis
@@ -3405,11 +3450,12 @@ Active development with stable core, continuous tool expansion, and web API in p
 
 | Date | Version | Changes |
 | ---- | ------- | ------- |
+| 2026-08-12 | 1.16.59 | merge(rate-of-closure, #4142): preserve the exact localized-torque and reviewed Playwright histories in a normal two-parent integration; retain strict localized scientific/source/UI contracts beside trust-separated production-Worker browser gates; and keep protected publication, full R14.5 certification, locus authoring, Rust parity, and complete archive authority open. |
 | 2026-08-12 | 1.16.58 | fix(rate-of-closure, #4142): close the cumulative 16-source static gate with explicit NumPy CSV array annotations and removal of redundant pipeline/source-config casts; restore the missing 1.16.55-1.16.58 append-only history while preserving runtime and wire behavior. |
-| 2026-08-12 | 1.16.57 | fix(rate-of-closure, #4142): validate source run configurations before exact-`None` fallback; reject prescribed mode/profile, locks, and localized offsets on manual/triple sources; and require a genuine non-Boolean integer outer variation-dataset schema discriminator. |
-| 2026-08-12 | 1.16.56 | fix(rate-of-closure, #4142): reject localized torque offsets on unsupported manual/triple sources; validate run-config offset collections before tuple conversion; and require genuine non-Boolean integer variation-plan schema versions. |
-| 2026-08-12 | 1.16.55 | fix(rate-of-closure, #4142): fail closed on malformed localized numeric/collection domains; make the fixed-step effective RK4 duration authoritative for windows; and hide or atomically reject localized PyQt factors until locus authoring exists. |
-| 2026-08-12 | 1.16.54 | feat(rate-of-closure, #4142): execute additive shoulder/wrist commanded-torque offsets over strict half-open one-point loci at every Python RK4 stage; bind deterministic variation samples to exact topological joint IDs; fail closed on unsupported source, locus, duration, and Rust contracts; preserve typed no-impact and distinct spatial provenance while keeping UI, persistence, protected release, and epic completion open. |
+| 2026-08-12 | 1.16.57 | fix(rate-of-closure, #4142): validate source run configurations before exact-`None` fallback; reject prescribed mode/profile, locks, and localized offsets on manual/triple sources; require a genuine non-Boolean integer outer variation-dataset schema discriminator; remove manual dispatch from the self-hosted Playwright workflow; observe strict intermediate production-Worker progress; and prove cancellation terminates the old Worker before deterministic reruns accept results. |
+| 2026-08-12 | 1.16.56 | fix(rate-of-closure, #4142): reject localized torque offsets on unsupported manual/triple sources; validate run-config offset collections before tuple conversion; require genuine non-Boolean integer variation-plan schema versions; split the ephemeral PR Playwright gate from the trusted main workflow; and pin all external actions to immutable SHAs. |
+| 2026-08-12 | 1.16.55 | fix(rate-of-closure, #4142): fail closed on malformed localized numeric/collection domains; make the fixed-step effective RK4 duration authoritative for windows; hide or atomically reject localized PyQt factors until locus authoring exists; and isolate pull-request browser execution on ephemeral hosted runners while retaining the locked production gate. |
+| 2026-08-12 | 1.16.54 | feat(rate-of-closure, #4142): execute additive shoulder/wrist commanded-torque offsets over strict half-open one-point loci at every Python RK4 stage; bind deterministic variation samples to exact topological joint IDs; fail closed on unsupported source, locus, duration, and Rust contracts; preserve typed no-impact and distinct spatial provenance; and add a pinned real-browser production-Worker foundation with seeded lifecycle, cancellation, unmount, and review-screenshot evidence while keeping UI, persistence, visual certification, protected release, and epic completion open. |
 | 2026-08-12 | 1.16.53 | feat(rate-of-closure, #4142 R11.5): add immutable resource-bounded ensemble stream headers/result chunks and an injected commit/abort sink lifecycle; project and release one chunk of complete runs at a time; retain the existing materialized API through a compatibility collector; and keep durable streaming/archive/memory claims explicitly open. |
 | 2026-08-12 | 1.16.52 | fix(rate-of-closure, #4142): satisfy the exact protected Python 3.12 / NumPy 2.3.5 / Mypy 1.13 typing boundary with explicit array annotations/casts and built-in-float `finfo` normalization; retain unchanged numerical and wire behavior. |
 | 2026-08-12 | 1.16.51 | fix(rate-of-closure, #4142 R11.4): require complete trial output scalars to be finite real non-booleans; normalize accepted NumPy real scalars to built-in floats; and prove typed-object writer/reader domain closure with five TDD cases and 39 focused persistence tests. |

docs/development/RATE_OF_CLOSURE_CAMPAIGN_HANDOFF.md

@@ -1,5 +1,51 @@
 # Rate of Closure Campaign Handoff
 
+## 2026-08-12 #4142 integrated localized torque and Playwright stack (1.16.59)
+
+- Normal two-parent integration retains exact localized-torque head
+  `10524cc2151c7b60c4a097939b29202158aff012` and reviewed Playwright head
+  `6df0ed09388ba36630c5fc6be7a31a334a4b6243` without rebase or history rewrite.
+- Localized Python torque execution, validation, typed miss behavior, and PyQt
+  filtering remain intact beside the trust-separated production-Worker browser
+  workflows and real Chromium lifecycle evidence.
+- Protected publication, full R14.5 certification, localized locus authoring,
+  Rust parity, and complete state/event/torque persistence remain open.
+- Integrated evidence is 171/171 localized changed-test cases, 18/18 workflow
+  security/policy tests, and 5/5 real production-Worker Chromium tests, with
+  scoped Ruff/format, documentation governance, workflow validation, and diff
+  hygiene green.
+
+## 2026-08-12 #4142 R14.5 real-browser variation Worker foundation
+
+- Local branch `codex/4142-rate-web-playwright` starts from exact integrated
+  commit `11a699155588d3d948990c5f08b72c5cc8d2c746`.
+- The Rate web package pins Playwright Test 1.62.1 in its own manifest/lock;
+  the dedicated configuration serves the production Vite build in deterministic
+  Chromium desktop and narrow projects.
+- Every PR runs the equivalent locked production gate only on ephemeral
+  `ubuntu-latest`; its workflow file has no fleet/self-hosted reference. A
+  separate trusted workflow runs only for `main` pushes and checks out the
+  event commit. It exposes neither a PR trigger nor manual-dispatch definition
+  ref, so untrusted or caller-selected workflow code cannot reach the fleet.
+  Every external action in both Playwright workflows is pinned to a full
+  immutable SHA; evidence artifacts include the run and attempt IDs.
+- Role/label-driven tests observe the hashed production module Worker and prove
+  strict intermediate and terminal progress plus reproducible rerun for a
+  seeded 24-run study. Long-run cancellation observes Worker termination before
+  two identical seeded reruns, rejecting partial, late, or stale result
+  acceptance; navigation separately proves Worker termination on tab unmount.
+  `serviceWorkers: "block"` suppresses unrelated service-worker state only; the
+  tested dedicated module Worker remains active and is never mocked.
+- Desktop 1440x1000 and narrow 390x844 layouts have no document-level
+  horizontal overflow. Both full-page screenshots and all failure traces,
+  screenshots, and videos are retained in the Playwright report artifact.
+- Local evidence: 5/5 Playwright tests, 743/743 Vitest tests, TypeScript,
+  ESLint, and Vite production build. Chromium installed locally without error.
+- This is not R14.5 completion: screenshots are review artifacts rather than
+  CI-authority golden comparisons, and WebKit, Firefox, assistive-technology,
+  PyQt interaction, protected runner evidence, and cross-platform visual
+  baselines remain open.
+
 ## 2026-08-12 #4142 localized torque static-gate closure
 
 - Explicit NumPy annotations on variation CSV input/success arrays close the

scripts/check_local_only_workflows.py

@@ -33,6 +33,7 @@
 }
 HOSTED_RUNNER_ALLOWLIST = {
     (".github/workflows/ci-standard.yml", "quality-gate"),
+    (".github/workflows/rate-web-playwright.yml", "production-worker-e2e"),
 }
 HOSTED_RUNNER = re.compile(r"^(ubuntu|macos|windows)(-latest|-\d+(?:\.\d+)*)$")