@volter/twin-standard 1.0.63 → 1.0.64

package/dist/src/assessment.js

@@ -109,10 +109,10 @@ export async function assessPack(packDir, options = {}) {
     const httpOnly = life.steps.every((step) => 'method' in step || 'wait' in step);
     if (options.browser && httpOnly) {
         const { chromiumServed } = await import("./browser-assessment.js");
-        const transport = await chromiumServed(packDir, life.host ?? 'twin.local');
+        const transport = await chromiumServed(packDir, life.host ?? 'twin.local', 'http-journey');
         try {
             const a = await replay(transport.served), b = await replay(transport.served);
-            browser = { measured: true, target: 'Chromium fetch, cookie jar and HTTP response behavior; no DOM interaction coverage', version: transport.version, answered: a.trace.length, failures: [...a.failures, ...b.failures], replay: { equal: a.trace.length > 0 && json(a.trace) === json(b.trace), firstSha256: hash(a.trace), secondSha256: hash(b.trace), runs: 2 }, operationCoverage: coverageOf(a), domCoverage: null, clock: transport.clock };
+            browser = { measured: true, target: 'HTTP customer journey replay through Chromium at each request origin; authored HTTP headers and observed wire responses', responseObservation: 'Transport observes status, headers and body, including redirects and Set-Cookie; these are not JavaScript-visible response claims', applicationOriginCorsCoverage: null, cookieJarCoverage: null, version: transport.version, answered: a.trace.length, failures: [...a.failures, ...b.failures], replay: { equal: a.trace.length > 0 && json(a.trace) === json(b.trace), firstSha256: hash(a.trace), secondSha256: hash(b.trace), runs: 2 }, operationCoverage: coverageOf(a), domCoverage: null, clock: transport.clock };
         }
         finally {
             await transport.stop();

package/dist/src/browser-assessment.d.ts

@@ -1,5 +1,5 @@
 import type { ServedTwin } from './walk/behavior-journey.js';
-export declare function chromiumServed(packDir: string, host: string): Promise<{
+export declare function chromiumServed(packDir: string, host: string, mode?: 'browser-fetch' | 'http-journey'): Promise<{
     served: ServedTwin;
     version: string;
     clock: {

package/dist/src/browser-assessment.js

@@ -11,7 +11,7 @@ import { join } from 'node:path';
 import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { worldNow } from '@volter/world-core/runtime';
-export async function chromiumServed(packDir, host) {
+export async function chromiumServed(packDir, host, mode = 'browser-fetch') {
     const { chromium } = await import('playwright');
     const mod = await import(__rewriteRelativeImportExtension(join(packDir, 'src/index.ts')));
     const factory = Object.entries(mod).find(([name, value]) => /^create\w+Fetch$/.test(name) && !/TwinFetch$/.test(name) && typeof value === 'function')?.[1];
@@ -43,11 +43,12 @@ export async function chromiumServed(packDir, host) {
         syncClock();
         const fetchPack = factory({ root, ...options });
         const context = await browser.newContext({ serviceWorkers: 'block', locale: 'en-US', timezoneId: 'UTC' });
-        const page = await context.newPage();
-        const harness = `https://${host}/__catalog_assessment__`;
+        const pages = [];
+        const pending = new Map();
+        const harnesses = new Set();
         await context.route('**/*', async (route) => {
             const request = route.request();
-            if (request.url() === harness) {
+            if (request.isNavigationRequest() && harnesses.has(request.url())) {
                 await route.fulfill({ status: 200, contentType: 'text/html', body: '<!doctype html><title>Catalog assessment</title>' });
                 return;
             }
@@ -55,8 +56,12 @@ export async function chromiumServed(packDir, host) {
                 await route.abort('blockedbyclient');
                 return;
             }
+            const observation = pending.get(request.frame().page());
             try {
-                const response = await fetchPack(new Request(request.url(), { method: request.method(), headers: await request.allHeaders(), ...(request.postDataBuffer() ? { body: new Uint8Array(request.postDataBuffer()).buffer } : {}) }));
+                if (mode === 'http-journey' && !observation)
+                    throw new Error('HTTP journey request has no authored input');
+                // HTTP transcripts explicitly name actors and headers; strict browser checks use the native wire instead.
+                const response = await fetchPack(new Request(request.url(), { method: request.method(), headers: mode === 'http-journey' ? observation.request.headers : await request.allHeaders(), ...(request.postDataBuffer() ? { body: new Uint8Array(request.postDataBuffer()).buffer } : {}) }));
                 const headers = Object.fromEntries(response.headers);
                 // Playwright otherwise adds CORS permission to cross-origin fulfillments. Absence means denial on the vendor wire.
                 if (!Object.hasOwn(headers, 'access-control-allow-origin'))
@@ -64,31 +69,65 @@ export async function chromiumServed(packDir, host) {
                 const cookies = response.headers.getSetCookie();
                 if (cookies.length)
                     headers['set-cookie'] = cookies.join('\n');
-                await route.fulfill({ status: response.status, headers, body: Buffer.from(await response.arrayBuffer()) });
+                const bytes = Buffer.from(await response.arrayBuffer());
+                if (observation)
+                    observation.response = new Response(request.method() === 'HEAD' || [204, 205, 304].includes(response.status) ? null : bytes, { status: response.status, headers: response.headers });
+                await route.fulfill({ status: response.status, headers, body: bytes });
             }
-            catch {
+            catch (error) {
+                if (observation)
+                    observation.error = error;
                 await route.abort('failed');
             }
         });
-        await page.goto(harness);
-        await page.clock.setFixedTime(syncClock());
+        const acquire = async (origin) => {
+            const available = pages.find((entry) => entry.origin === origin && !entry.busy);
+            if (available) {
+                available.busy = true;
+                return available;
+            }
+            const page = await context.newPage();
+            const entry = { page, origin, busy: true };
+            pages.push(entry);
+            const harness = `${origin}/__catalog_assessment__`;
+            harnesses.add(harness);
+            await page.goto(harness);
+            return entry;
+        };
         return {
             scheme: 'https',
             fetch: async (request, options) => {
-                await page.clock.setFixedTime(syncClock());
-                const body = request.body ? Buffer.from(await request.arrayBuffer()).toString('base64') : null;
-                const result = await page.evaluate(async ({ url, method, headers, body, credentials }) => {
-                    const bytes = body === null ? undefined : Uint8Array.from(atob(body), (char) => char.charCodeAt(0));
-                    const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials });
-                    const data = new Uint8Array(await response.arrayBuffer());
-                    let text = '';
-                    for (let i = 0; i < data.length; i += 32768)
-                        text += String.fromCharCode(...data.subarray(i, i + 32768));
-                    return { status: response.status, headers: [...response.headers], body: btoa(text) };
-                }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body, credentials: options?.credentials ?? 'same-origin' });
-                if (!result.status)
-                    throw new Error('Chromium returned an opaque response; this journey needs browser-specific navigation assertions');
-                return new Response([101, 204, 205, 304].includes(result.status) || request.method === 'HEAD' ? null : Buffer.from(result.body, 'base64'), { status: result.status, headers: result.headers });
+                const entry = await acquire(mode === 'http-journey' ? new URL(request.url).origin : `https://${host}`);
+                const { page } = entry;
+                const observation = { request };
+                pending.set(page, observation);
+                try {
+                    await page.clock.setFixedTime(syncClock());
+                    const body = request.body ? Buffer.from(await request.arrayBuffer()).toString('base64') : null;
+                    const result = await page.evaluate(async ({ url, method, headers, body, credentials }) => {
+                        const bytes = body === null ? undefined : Uint8Array.from(atob(body), (char) => char.charCodeAt(0));
+                        const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials });
+                        const data = new Uint8Array(await response.arrayBuffer());
+                        let text = '';
+                        for (let i = 0; i < data.length; i += 32768)
+                            text += String.fromCharCode(...data.subarray(i, i + 32768));
+                        return { status: response.status, headers: [...response.headers], body: btoa(text) };
+                    }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body, credentials: options?.credentials ?? 'same-origin' });
+                    if (mode === 'http-journey') {
+                        if (observation.error)
+                            throw observation.error;
+                        if (!observation.response)
+                            throw new Error('Chromium request produced no observed HTTP response');
+                        return observation.response;
+                    }
+                    if (!result.status)
+                        throw new Error('Chromium returned an opaque response; this journey needs browser-specific navigation assertions');
+                    return new Response([101, 204, 205, 304].includes(result.status) || request.method === 'HEAD' ? null : Buffer.from(result.body, 'base64'), { status: result.status, headers: result.headers });
+                }
+                finally {
+                    pending.delete(page);
+                    entry.busy = false;
+                }
             },
             stop: () => context.close(),
         };

package/dist/src/browser-verification.d.ts

@@ -16,5 +16,12 @@ export declare function verifyBrowserTransport(pack: string): Promise<{
     binaryBytes: number;
     corsEnforced: boolean;
     credentialModes: boolean;
+    httpJourney: {
+        perRequestOrigin: boolean;
+        authoredActorHeaders: boolean;
+        redirectCaptures: boolean;
+        setCookieCaptures: boolean;
+        dispatchExactlyOnce: boolean;
+    };
     domCoverage: null;
 }>;

package/dist/src/browser-verification.js

@@ -26,9 +26,12 @@ export async function verifyBrowserTransport(pack) {
       { id: 'unused', method: 'get', path: '/unused', class: 'get' },
       { id: 'publicCrossOrigin', method: 'get', path: '/public', class: 'get' },
       { id: 'credentialedCrossOrigin', method: 'get', path: '/credentialed', class: 'get' },
+      { id: 'redirect', method: 'post', path: '/redirect', class: 'action' },
     ] }, handlers: {
       login: async () => new Response(null, { status: 204, headers: [['set-cookie', 'session=fixture; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=3600'], ['set-cookie', 'second=fixture; Path=/; Secure; SameSite=Strict; Expires=Thu, 01 Jan 2026 01:00:00 GMT']] }),
       identity: async ({ request }) => {
+        const actor = request.headers.get('cookie')?.match(/actor=([^;]+)/)?.[1];
+        if (actor) return Response.json({ actor, origin: request.headers.get('origin') });
         const session = request.headers.get('cookie')?.includes('session=fixture') || false;
         const second = request.headers.get('cookie')?.includes('second=fixture') || false;
         return Response.json({ authenticated: session && second, session, second });
@@ -37,6 +40,7 @@ export async function verifyBrowserTransport(pack) {
       head: async () => new Response(null, { status: 204 }),
       publicCrossOrigin: async () => Response.json({ public: true }, { headers: { 'access-control-allow-origin': '*' } }),
       credentialedCrossOrigin: async () => Response.json({ credentialed: true }, { headers: { 'access-control-allow-origin': 'https://browser-fixture.test', 'access-control-allow-credentials': 'true' } }),
+      redirect: async () => new Response(null, { status: 302, headers: [['location', 'https://console-fixture.test/identity'], ['set-cookie', 'actor=second; Path=/; Secure; HttpOnly'], ['set-cookie', 'redirect=fixture; Path=/; Secure']] }),
     }, gap: async () => Response.json({ error: 'unsupported' }, { status: 404 }) });
   }
   `);
@@ -46,6 +50,9 @@ export async function verifyBrowserTransport(pack) {
     const seen = new Set();
     const unsubscribe = observeDerivedDispatch(({ operation }) => seen.add(operation.id));
     const replays = [];
+    let redirects = 0;
+    const stopRedirects = observeDerivedDispatch(({ operation }) => { if (operation.id === 'redirect')
+        redirects++; });
     try {
         for (let run = 0; run < 2; run++) {
             progress(`replay-${run + 1}:start`);
@@ -79,6 +86,7 @@ export async function verifyBrowserTransport(pack) {
                 await assert.rejects(() => served.fetch(new Request('https://another-origin.test/public'), { credentials: 'include' }), /Failed to fetch/, 'credentialed fetch refuses wildcard permission');
                 progress(`replay-${run + 1}:credentialed-wildcard-denied`);
                 assert.deepEqual(await (await served.fetch(new Request('https://another-origin.test/credentialed'), { credentials: 'include' })).json(), { credentialed: true }, 'credentialed fetch requires matching origin and credential permission');
+                await assert.rejects(() => fetch('/redirect', 'POST'), /opaque response/, 'strict Fetch must not expose HTTP redirect captures');
                 progress(`replay-${run + 1}:complete`);
                 replays.push({ identity, expired, binaryBytes: binary.byteLength, headStatus: head.status, gapStatus: 404 });
             }
@@ -87,10 +95,42 @@ export async function verifyBrowserTransport(pack) {
             }
         }
         assert.deepEqual(replays[0], replays[1]);
-        assert.deepEqual([...seen].sort(), ['binary', 'credentialedCrossOrigin', 'gap', 'head', 'identity', 'login', 'publicCrossOrigin']);
-        return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 8, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, credentialModes: true, domCoverage: null };
+        setClock('2026-01-01T00:00:00.000Z');
+        progress('http-journey:launch');
+        const http = await chromiumServed(pack, 'browser-fixture.test', 'http-journey');
+        progress('http-journey:launched');
+        try {
+            for (let run = 0; run < 2; run++) {
+                progress(`http-journey-${run + 1}:start`);
+                setClock('2026-01-01T00:00:00.000Z');
+                const served = await http.served(world.root(), {});
+                try {
+                    const redirect = await served.fetch(new Request('https://api-fixture.test/redirect', { method: 'POST' }));
+                    progress(`http-journey-${run + 1}:redirect`);
+                    assert.equal(redirect.status, 302);
+                    assert.equal(redirect.headers.get('location'), 'https://console-fixture.test/identity');
+                    assert.equal(redirect.headers.getSetCookie().length, 2, 'HTTP observations retain all Set-Cookie headers');
+                    for (const actor of ['first', 'second', 'first']) {
+                        const response = await served.fetch(new Request('https://console-fixture.test/identity', { headers: { cookie: `actor=${actor}`, origin: 'https://authored-app.test' } }));
+                        assert.deepEqual(await response.json(), { actor, origin: 'https://authored-app.test' }, 'HTTP transcripts retain authored actor and origin headers');
+                    }
+                    assert.equal((await served.fetch(new Request('https://third-fixture.test/unknown'))).status, 404, 'changing hosts does not erase real HTTP gaps');
+                    progress(`http-journey-${run + 1}:complete`);
+                }
+                finally {
+                    await served.stop();
+                }
+            }
+        }
+        finally {
+            await http.stop();
+        }
+        assert.equal(redirects, 4, 'each strict or HTTP redirect request executes exactly once');
+        assert.deepEqual([...seen].sort(), ['binary', 'credentialedCrossOrigin', 'gap', 'head', 'identity', 'login', 'publicCrossOrigin', 'redirect']);
+        return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 9, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, credentialModes: true, httpJourney: { perRequestOrigin: true, authoredActorHeaders: true, redirectCaptures: true, setCookieCaptures: true, dispatchExactlyOnce: true }, domCoverage: null };
     }
     finally {
+        stopRedirects();
         unsubscribe();
         try {
             await browser.stop();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/twin-standard",
-  "version": "1.0.63",
+  "version": "1.0.64",
   "description": "The Protocol 3 standard for Volter twin packs: the criteria a pack is graded by, the grader, the gate a pack repository and the twin catalog run on every change and submission, and the spec derivation the grade checks against. Pin a version: every place a pack is judged judges by that standard.",
   "keywords": [
     "twin",
@@ -75,7 +75,7 @@
     "yaml": "2.9.0"
   },
   "peerDependencies": {
-    "@volter/world-core": "3.0.71",
+    "@volter/world-core": "3.0.72",
     "@volter/world-runtime": "*",
     "playwright": "^1.63.0"
   },

package/src/assessment.ts

@@ -81,10 +81,10 @@ export async function assessPack(packDir: string, options: AssessmentOptions = {
   const httpOnly = life.steps.every((step) => 'method' in step || 'wait' in step);
   if (options.browser && httpOnly) {
     const { chromiumServed } = await import('./browser-assessment.ts');
-    const transport = await chromiumServed(packDir, life.host ?? 'twin.local');
+    const transport = await chromiumServed(packDir, life.host ?? 'twin.local', 'http-journey');
     try {
       const a = await replay(transport.served), b = await replay(transport.served);
-      browser = { measured: true, target: 'Chromium fetch, cookie jar and HTTP response behavior; no DOM interaction coverage', version: transport.version, answered: a.trace.length, failures: [...a.failures, ...b.failures], replay: { equal: a.trace.length > 0 && json(a.trace) === json(b.trace), firstSha256: hash(a.trace), secondSha256: hash(b.trace), runs: 2 }, operationCoverage: coverageOf(a), domCoverage: null, clock: transport.clock };
+      browser = { measured: true, target: 'HTTP customer journey replay through Chromium at each request origin; authored HTTP headers and observed wire responses', responseObservation: 'Transport observes status, headers and body, including redirects and Set-Cookie; these are not JavaScript-visible response claims', applicationOriginCorsCoverage: null, cookieJarCoverage: null, version: transport.version, answered: a.trace.length, failures: [...a.failures, ...b.failures], replay: { equal: a.trace.length > 0 && json(a.trace) === json(b.trace), firstSha256: hash(a.trace), secondSha256: hash(b.trace), runs: 2 }, operationCoverage: coverageOf(a), domCoverage: null, clock: transport.clock };
     } finally { await transport.stop(); }
   }
   const conform = options.conformance === false ? null : await conformance(packDir);

package/src/browser-assessment.ts

@@ -4,7 +4,7 @@ import { existsSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { worldNow } from '@volter/world-core/runtime';
 import type { ServedTwin } from './walk/behavior-journey.ts';
-export async function chromiumServed(packDir: string, host: string) {
+export async function chromiumServed(packDir: string, host: string, mode: 'browser-fetch' | 'http-journey' = 'browser-fetch') {
   const { chromium } = await import('playwright');
   const mod = await import(join(packDir, 'src/index.ts')) as Record<string, unknown>;
   const factory = Object.entries(mod).find(([name, value]) => /^create\w+Fetch$/.test(name) && !/TwinFetch$/.test(name) && typeof value === 'function')?.[1] as ((options: import('@volter/world-core').PackFetchOptions) => (request: Request) => Promise<Response>) | undefined;
@@ -29,39 +29,66 @@ export async function chromiumServed(packDir: string, host: string) {
     syncClock();
     const fetchPack = factory({ root, ...options });
     const context = await browser.newContext({ serviceWorkers: 'block', locale: 'en-US', timezoneId: 'UTC' });
-    const page = await context.newPage();
-    const harness = `https://${host}/__catalog_assessment__`;
+    type Page = Awaited<ReturnType<typeof context.newPage>>;
+    const pages: Array<{ page: Page; origin: string; busy: boolean }> = [];
+    const pending = new Map<Page, { request: Request; response?: Response; error?: unknown }>();
+    const harnesses = new Set<string>();
     await context.route('**/*', async (route) => {
       const request = route.request();
-      if (request.url() === harness) { await route.fulfill({ status: 200, contentType: 'text/html', body: '<!doctype html><title>Catalog assessment</title>' }); return; }
+      if (request.isNavigationRequest() && harnesses.has(request.url())) { await route.fulfill({ status: 200, contentType: 'text/html', body: '<!doctype html><title>Catalog assessment</title>' }); return; }
       if (!['xhr', 'fetch'].includes(request.resourceType())) { await route.abort('blockedbyclient'); return; }
+      const observation = pending.get(request.frame().page());
       try {
-        const response = await fetchPack(new Request(request.url(), { method: request.method(), headers: await request.allHeaders(), ...(request.postDataBuffer() ? { body: new Uint8Array(request.postDataBuffer()!).buffer } : {}) }));
+        if (mode === 'http-journey' && !observation) throw new Error('HTTP journey request has no authored input');
+        // HTTP transcripts explicitly name actors and headers; strict browser checks use the native wire instead.
+        const response = await fetchPack(new Request(request.url(), { method: request.method(), headers: mode === 'http-journey' ? observation!.request.headers : await request.allHeaders(), ...(request.postDataBuffer() ? { body: new Uint8Array(request.postDataBuffer()!).buffer } : {}) }));
         const headers = Object.fromEntries(response.headers);
         // Playwright otherwise adds CORS permission to cross-origin fulfillments. Absence means denial on the vendor wire.
         if (!Object.hasOwn(headers, 'access-control-allow-origin')) headers['access-control-allow-origin'] = '';
         const cookies = response.headers.getSetCookie();
         if (cookies.length) headers['set-cookie'] = cookies.join('\n');
-        await route.fulfill({ status: response.status, headers, body: Buffer.from(await response.arrayBuffer()) });
-      } catch { await route.abort('failed'); }
+        const bytes = Buffer.from(await response.arrayBuffer());
+        if (observation) observation.response = new Response(request.method() === 'HEAD' || [204, 205, 304].includes(response.status) ? null : bytes, { status: response.status, headers: response.headers });
+        await route.fulfill({ status: response.status, headers, body: bytes });
+      } catch (error) { if (observation) observation.error = error; await route.abort('failed'); }
     });
-    await page.goto(harness);
-    await page.clock.setFixedTime(syncClock());
+    const acquire = async (origin: string) => {
+      const available = pages.find((entry) => entry.origin === origin && !entry.busy);
+      if (available) { available.busy = true; return available; }
+      const page = await context.newPage();
+      const entry = { page, origin, busy: true };
+      pages.push(entry);
+      const harness = `${origin}/__catalog_assessment__`;
+      harnesses.add(harness);
+      await page.goto(harness);
+      return entry;
+    };
     return {
       scheme: 'https',
       fetch: async (request: Request, options?: { credentials?: RequestCredentials }) => {
-        await page.clock.setFixedTime(syncClock());
-        const body = request.body ? Buffer.from(await request.arrayBuffer()).toString('base64') : null;
-        const result = await page.evaluate(async ({ url, method, headers, body, credentials }) => {
-          const bytes = body === null ? undefined : Uint8Array.from(atob(body), (char) => char.charCodeAt(0));
-          const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials });
-          const data = new Uint8Array(await response.arrayBuffer());
-          let text = '';
-          for (let i = 0; i < data.length; i += 32768) text += String.fromCharCode(...data.subarray(i, i + 32768));
-          return { status: response.status, headers: [...response.headers], body: btoa(text) };
-        }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body, credentials: options?.credentials ?? 'same-origin' });
-        if (!result.status) throw new Error('Chromium returned an opaque response; this journey needs browser-specific navigation assertions');
-        return new Response([101, 204, 205, 304].includes(result.status) || request.method === 'HEAD' ? null : Buffer.from(result.body, 'base64'), { status: result.status, headers: result.headers });
+        const entry = await acquire(mode === 'http-journey' ? new URL(request.url).origin : `https://${host}`);
+        const { page } = entry;
+        const observation = { request } as { request: Request; response?: Response; error?: unknown };
+        pending.set(page, observation);
+        try {
+          await page.clock.setFixedTime(syncClock());
+          const body = request.body ? Buffer.from(await request.arrayBuffer()).toString('base64') : null;
+          const result = await page.evaluate(async ({ url, method, headers, body, credentials }) => {
+            const bytes = body === null ? undefined : Uint8Array.from(atob(body), (char) => char.charCodeAt(0));
+            const response = await fetch(url, { method, headers, body: bytes, redirect: 'manual', credentials });
+            const data = new Uint8Array(await response.arrayBuffer());
+            let text = '';
+            for (let i = 0; i < data.length; i += 32768) text += String.fromCharCode(...data.subarray(i, i + 32768));
+            return { status: response.status, headers: [...response.headers], body: btoa(text) };
+          }, { url: request.url, method: request.method, headers: Object.fromEntries(request.headers), body, credentials: options?.credentials ?? 'same-origin' });
+          if (mode === 'http-journey') {
+            if (observation.error) throw observation.error;
+            if (!observation.response) throw new Error('Chromium request produced no observed HTTP response');
+            return observation.response;
+          }
+          if (!result.status) throw new Error('Chromium returned an opaque response; this journey needs browser-specific navigation assertions');
+          return new Response([101, 204, 205, 304].includes(result.status) || request.method === 'HEAD' ? null : Buffer.from(result.body, 'base64'), { status: result.status, headers: result.headers });
+        } finally { pending.delete(page); entry.busy = false; }
       },
       stop: () => context.close(),
     };

package/src/browser-verification.ts

@@ -27,9 +27,12 @@ export async function verifyBrowserTransport(pack: string) {
       { id: 'unused', method: 'get', path: '/unused', class: 'get' },
       { id: 'publicCrossOrigin', method: 'get', path: '/public', class: 'get' },
       { id: 'credentialedCrossOrigin', method: 'get', path: '/credentialed', class: 'get' },
+      { id: 'redirect', method: 'post', path: '/redirect', class: 'action' },
     ] }, handlers: {
       login: async () => new Response(null, { status: 204, headers: [['set-cookie', 'session=fixture; Path=/; HttpOnly; Secure; SameSite=Strict; Max-Age=3600'], ['set-cookie', 'second=fixture; Path=/; Secure; SameSite=Strict; Expires=Thu, 01 Jan 2026 01:00:00 GMT']] }),
       identity: async ({ request }) => {
+        const actor = request.headers.get('cookie')?.match(/actor=([^;]+)/)?.[1];
+        if (actor) return Response.json({ actor, origin: request.headers.get('origin') });
         const session = request.headers.get('cookie')?.includes('session=fixture') || false;
         const second = request.headers.get('cookie')?.includes('second=fixture') || false;
         return Response.json({ authenticated: session && second, session, second });
@@ -38,6 +41,7 @@ export async function verifyBrowserTransport(pack: string) {
       head: async () => new Response(null, { status: 204 }),
       publicCrossOrigin: async () => Response.json({ public: true }, { headers: { 'access-control-allow-origin': '*' } }),
       credentialedCrossOrigin: async () => Response.json({ credentialed: true }, { headers: { 'access-control-allow-origin': 'https://browser-fixture.test', 'access-control-allow-credentials': 'true' } }),
+      redirect: async () => new Response(null, { status: 302, headers: [['location', 'https://console-fixture.test/identity'], ['set-cookie', 'actor=second; Path=/; Secure; HttpOnly'], ['set-cookie', 'redirect=fixture; Path=/; Secure']] }),
     }, gap: async () => Response.json({ error: 'unsupported' }, { status: 404 }) });
   }
   `);
@@ -47,6 +51,8 @@ export async function verifyBrowserTransport(pack: string) {
   const seen = new Set<string>();
   const unsubscribe = observeDerivedDispatch(({ operation }) => seen.add(operation.id));
   const replays = [];
+  let redirects = 0;
+  const stopRedirects = observeDerivedDispatch(({ operation }) => { if (operation.id === 'redirect') redirects++; });
   try {
     for (let run = 0; run < 2; run++) {
       progress(`replay-${run + 1}:start`);
@@ -79,12 +85,38 @@ export async function verifyBrowserTransport(pack: string) {
         await assert.rejects(() => served.fetch(new Request('https://another-origin.test/public'), { credentials: 'include' }), /Failed to fetch/, 'credentialed fetch refuses wildcard permission');
         progress(`replay-${run + 1}:credentialed-wildcard-denied`);
         assert.deepEqual(await (await served.fetch(new Request('https://another-origin.test/credentialed'), { credentials: 'include' })).json(), { credentialed: true }, 'credentialed fetch requires matching origin and credential permission');
+        await assert.rejects(() => fetch('/redirect', 'POST'), /opaque response/, 'strict Fetch must not expose HTTP redirect captures');
         progress(`replay-${run + 1}:complete`);
         replays.push({ identity, expired, binaryBytes: binary.byteLength, headStatus: head.status, gapStatus: 404 });
       } finally { await served.stop(); }
     }
     assert.deepEqual(replays[0], replays[1]);
-    assert.deepEqual([...seen].sort(), ['binary', 'credentialedCrossOrigin', 'gap', 'head', 'identity', 'login', 'publicCrossOrigin']);
-    return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 8, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, credentialModes: true, domCoverage: null };
-  } finally { unsubscribe(); try { await browser.stop(); } finally { world.restore(); } }
+    setClock('2026-01-01T00:00:00.000Z');
+    progress('http-journey:launch');
+    const http = await chromiumServed(pack, 'browser-fixture.test', 'http-journey');
+    progress('http-journey:launched');
+    try {
+      for (let run = 0; run < 2; run++) {
+        progress(`http-journey-${run + 1}:start`);
+        setClock('2026-01-01T00:00:00.000Z');
+        const served = await http.served(world.root(), {});
+        try {
+          const redirect = await served.fetch(new Request('https://api-fixture.test/redirect', { method: 'POST' }));
+          progress(`http-journey-${run + 1}:redirect`);
+          assert.equal(redirect.status, 302);
+          assert.equal(redirect.headers.get('location'), 'https://console-fixture.test/identity');
+          assert.equal(redirect.headers.getSetCookie().length, 2, 'HTTP observations retain all Set-Cookie headers');
+          for (const actor of ['first', 'second', 'first']) {
+            const response = await served.fetch(new Request('https://console-fixture.test/identity', { headers: { cookie: `actor=${actor}`, origin: 'https://authored-app.test' } }));
+            assert.deepEqual(await response.json(), { actor, origin: 'https://authored-app.test' }, 'HTTP transcripts retain authored actor and origin headers');
+          }
+          assert.equal((await served.fetch(new Request('https://third-fixture.test/unknown'))).status, 404, 'changing hosts does not erase real HTTP gaps');
+          progress(`http-journey-${run + 1}:complete`);
+        } finally { await served.stop(); }
+      }
+    } finally { await http.stop(); }
+    assert.equal(redirects, 4, 'each strict or HTTP redirect request executes exactly once');
+    assert.deepEqual([...seen].sort(), ['binary', 'credentialedCrossOrigin', 'gap', 'head', 'identity', 'login', 'publicCrossOrigin', 'redirect']);
+    return { purpose: 'browser-transport-fixture', passed: true, chromium: browser.version, replays: 2, exercisedOperations: seen.size, declaredOperations: 9, cookieJar: true, cookieExpiry: ['Expires', 'Max-Age'], clock: browser.clock, binaryBytes: 100000, corsEnforced: true, credentialModes: true, httpJourney: { perRequestOrigin: true, authoredActorHeaders: true, redirectCaptures: true, setCookieCaptures: true, dispatchExactlyOnce: true }, domCoverage: null };
+  } finally { stopRedirects(); unsubscribe(); try { await browser.stop(); } finally { world.restore(); } }
 }