software-defence-factory 0.8.0 → 0.9.0

package/THIRD_PARTY_NOTICES.md

@@ -152,6 +152,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+
 ## @radix-ui/react-compose-refs 1.1.5
 
 MIT License
@@ -574,3 +575,12 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+## Optional browser verification image
+
+The operator-built Playwright runner image installs `playwright` and
+`playwright-core` 1.63.0 from the exact lockfile in `factory/web/` under the
+Apache License 2.0. The original license files are retained in the built image
+under `/opt/factory-web/node_modules/playwright/LICENSE` and
+`/opt/factory-web/node_modules/playwright-core/LICENSE`. Factory does not bundle
+the built browser image in its npm package.

package/bin/software-defence-factory.mjs

@@ -16,6 +16,7 @@ import { bootstrap, registerInstallation, VERSION } from '../factory/updates.mjs
 import { hasService, manageService, serviceDefinition, withServiceOperation, isManagedLaunch } from '../factory/services.mjs';
 import { runCandidateGit } from '../factory/git-environment.mjs';
 import { initializeDemoRepository } from '../factory/demo-fixture.mjs';
+import { probeWebBrowser } from '../factory/web-readiness.mjs';
 
 try {
   const handled = await bootstrap(process.argv.slice(2));
@@ -190,8 +191,9 @@ try {
   else if(command==='status') { const snapshot=await api(state,'/api/v1/status');delete snapshot.csrf_token;console.log(JSON.stringify(snapshot,null,2)); }
   else if(command==='doctor') {
     const config=configAt(state),dockerVersion=run('docker',['info','--format','{{.ServerVersion}}']),imageStatus=inspectImageInstallation(state,config);
-    console.log(JSON.stringify({node:process.version,docker:dockerVersion,engineInstalled:imageStatus.installed,image:imageStatus.image,repo:config.repo,harness:harnessOf(config),agent:harnessOf(config),checksConfigured:!!config.check?.trim(),inference:'Not called or verified',qualification:{model:'not assessed',toolchain:'not assessed'},dashboard:`http://127.0.0.1:${config.port}`},null,2));
-    if(!imageStatus.installed)process.exitCode=1;
+    const webVerification=config.webVerification?.enabled?probeWebBrowser(config,state):null;
+    console.log(JSON.stringify({node:process.version,docker:dockerVersion,engineInstalled:imageStatus.installed,image:imageStatus.image,repo:config.repo,harness:harnessOf(config),agent:harnessOf(config),checksConfigured:!!config.check?.trim(),inference:'Not called or verified',qualification:{model:'not assessed',toolchain:'not assessed'},dashboard:`http://127.0.0.1:${config.port}`,...(webVerification?{web_verification:webVerification}:{})},null,2));
+    if(!imageStatus.installed||webVerification&&!webVerification.ready)process.exitCode=1;
   } else if(command==='issue') {
     const action=positional[0], sourceURL=flags.url || flags.github;
     if(action==='list') {
@@ -263,11 +265,20 @@ try {
       initializeDemoRepository(repo);
       init(repo,'mock',"test \"$(cat value.txt)\" = fixed",Number(flags.port || 7332));
     } else if(harnessOf(configAt(state))!=='mock')throw new Error('Demo requires a mock configuration');
+    save(join(state,'synthetic-demo.json'),{version:1,createdAt:new Date().toISOString(),purpose:'Disposable Factory runtime qualification only'});
     await withServiceOperation('demo startup',async()=>{await install();await up();});console.log(JSON.stringify(await submit('software','Synthetic installation qualification: fix value.txt. No inference is used.')));
     console.log('Review the synthetic change in the dashboard and approve its handoff.');
   } else if(['version','--version','-v'].includes(command))console.log(VERSION);
   else if(command==='qualify') {
     await stream(process.execPath,[join(ROOT,'scripts/probe-platform.mjs'),state]);
+  } else if(command==='qualify-web') {
+    if(!flags.image)throw new Error('qualify-web requires --image sha256:<local browser image ID>');
+    await stream(process.execPath,[join(ROOT,'scripts/probe-web.mjs'),state,flags.image]);
+  } else if(command==='web') {
+    if(positional[0]!=='probe'||positional.length!==1)throw new Error('Use web probe to execute the configured browser readiness check');
+    const readiness=probeWebBrowser(configAt(state),state);
+    console.log(JSON.stringify(readiness,null,2));
+    if(readiness.enabled&&!readiness.ready)process.exitCode=1;
   } else if(command==='kit') {
     if(!flags.output)throw new Error('kit requires --output NEW_DIRECTORY');
     await stream(process.execPath,[join(ROOT,'scripts/export-kit.mjs'),resolve(flags.output)]);
@@ -276,11 +287,13 @@ try {
   kit --output NEW_DIRECTORY               Export the portable method without a runtime
   demo                                    Install and run a synthetic sample (no model key)
   qualify --state PATH                    Exercise recovery and isolation with a stopped demo job
+  qualify-web --state PATH --image ID     Exercise Playwright Verify with a synthetic delayed-action fixture
   init --repo PATH --harness codex|pi|custom --check "npm ci && npm test" [--source-ref REF]
        [--inference-provider PROVIDER]
        [--delivery-provider github --delivery-repository https://github.com/OWNER/REPO --delivery-target main|dev]
   install [--image LOCAL_REF]             Build the standard image, or select an existing local image
   doctor | up | status | stop              Inspect / operate your private installation
+  web probe --state PATH                    Execute the pinned local Chromium readiness probe
   foundation                              Read the operator setup skill; no installation required
   definition | agents | skills            Inspect roles, instructions and installation settings
   inbox | infrastructure | automations    Inspect live tasks, host/worker and automation state

package/docs/interfaces.md

@@ -34,6 +34,7 @@ shell endpoint or a second scheduler.
 | Synthetic qualification | `demo`, `qualify` | No qualification endpoint | Synthetic disclosure only | Explicit separate state; never target an application accidentally |
 | Immutable source admission | `init --source-ref`, `run --source-ref`, `issue start --source-ref`; status and build evidence carry the resolved SHA | `POST /api/v1/jobs` resolves/retains before acknowledgement; shared source metadata in status | New issue and revision forms accept a ref; task detail shows requested ref, resolved SHA and prior source commits | Build/retry use retained objects; revisions keep the recorded source unless a new ref is explicit; legacy source remains unknown |
 | Trusted PR handoff | `publish JOB_ID` publishes/reconciles; `abandon-delivery JOB_ID --branch-sha SHA` records a checked local resolution for a pre-write branch collision | Authenticated `POST /api/v1/jobs/:id/publish` and `/abandon-delivery`; shared receipt, conflict identity and removal policy | Publish/reconcile and explicit “Abandon local delivery; keep remote branch” actions share controller state; errors/results and inspected branch identity are visible | New writes require matching protected Codex/Pi build/review provenance, deterministic verify/handoff provenance, non-synthetic bound artifacts and a qualified GitHub Actions tree. Shared delivery status exposes `workflow_qualification` and the same reason blocks CLI/API/dashboard capability and publication/retry. Candidate workflow changes, unsupported triggers/syntax, or active generated-push, selected-ref-dispatch and PR jobs with write/secrets/environment/OIDC/deploy access, self-hosted runners or ambiguous privileged guards refuse trusted writes. Supported ASCII guard comparisons follow GitHub's case-insensitive string semantics; unknown PR refs, non-ASCII mismatches, and glob/escaped branch filters cannot prove a privileged job inactive. The shared summary's `action_mode` distinguishes new/resumable publication from read-only reconciliation and drives idle and pending task button wording. Branch-only collisions and unknown/abandoned states offer neither; known PR receipts and pending PR-creation checkpoints retain read-only reconciliation. Abandonment checks the current run, saved intent, exact branch head and absence of an associated PR; it writes no provider data, preserves the remote branch/evidence, disables republishing and permits local removal. Uncertain effects and incompatible evidence stay blocked. Destination remains private operator config; patch-only remains default |
+| Optional trusted web verification | `web probe` performs a real local Chromium interaction; `doctor` reports readiness | Verify stores a shared story summary and protected JSON artifact in the run | Task history shows passed/failed/unavailable/inconclusive plus tool, candidate, policy and story hashes | Disabled by default. Required operator stories and Playwright/Chromium image ID are frozen in attempt policy. Linux Chromium proof cannot qualify native/mobile OS behavior; see [the browser contract](web-verification.md) |
 
 The current generic task form can name the Defence workflow; that is not a
 substitute for the CLI's validated incident admission. Treat the typed intake

package/docs/recovery.md

@@ -29,6 +29,21 @@ alongside the cleanup error.
 Inspect that retained attempt before manual removal; never substitute the source
 candidate path for the scratch path.
 
+When trusted web verification is enabled, Verify keeps the copied check output
+as disposable preview scratch and creates separate preview and browser
+containers. The preview uses `network none`; the browser shares only that exact
+preview's isolated network namespace for loopback. Their mounts and PID
+namespaces remain separate, and only the browser mounts its private result and
+screenshot directory. The `web-policy.json`, preview scratch, browser output
+and active fence remain until both exact labelled containers are confirmed
+removed. Normal stop/retry recovery reconciles all Factory-labelled containers
+before removing those files. An unknown stop, deadline or cancellation keeps
+the state and fence for recovery. A missing browser, unsupported Linux
+capability, interrupted story or malformed evidence blocks acceptance; never
+retry around a retained writer or reuse earlier story evidence for a changed
+candidate or policy. Browser traces and screenshots are private evidence and
+are presented through the shared interfaces. See [the web contract](web-verification.md).
+
 ## Review feedback or phase retry
 
 Use **Request changes** on a failed software review only when its validated

package/docs/setup.md

@@ -169,6 +169,14 @@ Checkpoint: record the exact source revision, image ID, check command, resource
 limits, inference connectivity and CI result. Keep product controllers stopped
 until their tasks are explicitly ready to run.
 
+Optional web verification is configured separately from the selected harness
+and model. The execution-host owner prepares and pins the Playwright/Chromium
+image, writes trusted stories in private `factory.json`, then runs `web probe`
+and `doctor` on that installation. Use [the browser setup and story contract](web-verification.md)
+for the recipe, dependency preparation and limits. Verify uses separate isolated
+Linux preview and browser containers and cannot qualify native/mobile operating
+systems.
+
 ### Optional trusted PR delivery
 
 Patch-only handoff is the default. When the operator intends to enable GitHub

package/docs/web-verification.md

@@ -0,0 +1,167 @@
+# Optional trusted web verification
+
+Browser verification is an operator-controlled extension of the existing
+Verify phase. It is disabled when `webVerification` is absent. Issue text,
+candidate files and generated tests cannot enable it or change its required
+stories. The selected harness and model remain independent of this capability.
+
+## Prepare and qualify Playwright/Chromium
+
+The first adapter uses the Playwright 1.63.0 package and Chromium version from
+the matching Microsoft Playwright image. Build it explicitly on the execution
+host from the installed Factory package (or a trusted Factory source checkout):
+
+```sh
+docker build --pull -f factory/web/Dockerfile \
+  -t software-defence-factory-playwright:1.63.0 factory/web
+docker image inspect --format '{{.Id}}' software-defence-factory-playwright:1.63.0
+```
+
+Copy the resulting `sha256:…` image ID into private `factory.json`. The
+Dockerfile uses the versioned `mcr.microsoft.com/playwright:v1.63.0-noble`
+base and `npm ci` with the committed lockfile. Factory resolves no tag, pulls
+no image, installs no package and falls back to no other browser during a job.
+Rebuild and deliberately select a new image ID when upgrading the base or
+Playwright version.
+
+For a global npm installation, resolve the packaged recipe directory first:
+
+```sh
+factory_package="$(npm root -g)/software-defence-factory"
+docker build --pull -f "$factory_package/factory/web/Dockerfile" \
+  -t software-defence-factory-playwright:1.63.0 "$factory_package/factory/web"
+browser_image="$(docker image inspect --format '{{.Id}}' software-defence-factory-playwright:1.63.0)"
+```
+
+Run the readiness check from the selected installation:
+
+```sh
+software-defence-factory web probe --state /private/state/project
+software-defence-factory doctor --state /private/state/project
+```
+
+The probe runs a real headless Chromium click and result assertion in a bounded,
+read-only, `network none` Docker container as the controller UID. Its real
+wall-clock deadline stops the exact labelled probe, and readiness is reported
+only after that container is confirmed removed. A missing image, unsupported
+adapter/version or browser launch failure reports unavailable. The probe never
+downloads or builds an image.
+
+## Configure trusted stories
+
+Stop the installation before editing its private `factory.json`. Add an
+operator-authored value like this and adapt names, routes, actions and result
+text to the application:
+
+```json
+{
+  "webVerification": {
+    "enabled": true,
+    "adapter": "playwright",
+    "version": "1.63.0",
+    "image": "sha256:REPLACE_WITH_LOCAL_IMAGE_ID",
+    "previewCommand": ["npm", "run", "preview", "--", "--host", "127.0.0.1", "--port", "4173"],
+    "port": 4173,
+    "timeoutSeconds": 90,
+    "themes": ["light", "dark"],
+    "stories": []
+  }
+}
+```
+
+`stories` is a small declarative contract; the empty array in this sketch is a
+placeholder and is rejected until the complete trusted story set is supplied.
+Every selected theme requires an interactive `desktop-<theme>` and
+`narrow-<theme>` story. All installations
+also require these named stories, using the first configured theme at desktop
+size:
+
+- `busy-disabled`: click an action, observe its disabled state, wait for it to
+  become enabled, and check the result text.
+- `result`: exercise an action and assert its result text.
+- `failure-retry`: assert a `role: "alert"` failure, click Retry, then assert a
+  `role: "status"` result.
+- `keyboard-focus`: press a supported key and assert the expected control has
+  focus.
+
+Each story names `viewport` (`desktop` or `narrow`), `theme` (`light` or
+`dark`), a local `path` beginning with `/`, and ordered `steps`. Supported
+steps are `click`, `expect-visible`, `expect-enabled`, `expect-disabled`,
+`expect-text`, `press` and `expect-focused`. Actions and assertions use exact
+accessible roles and names. Arbitrary selectors, JavaScript, source tests and
+candidate-supplied story files are not accepted. `factory/web/qualification-fixture.mjs`
+shows the complete eight-story contract used by the disposable installed
+qualification.
+
+`execution.json` freezes and hashes this complete operator configuration with
+the attempt policy. The check evidence records the candidate head/tree, Verify
+attempt, policy hash, immutable browser image ID, adapter/tool/browser versions,
+story-set hash and each story's content hash. Any changed tree, tool, story or
+policy makes prior evidence stale. Missing, failed, unavailable, inconclusive
+or malformed required evidence blocks Review, handoff and trusted PR delivery.
+The run summary and `web-verification.json` artifact are shared through CLI,
+API and dashboard; the dashboard renders traces as text and retained PNGs as
+images. It does not execute candidate HTML in the controller origin.
+
+## Package and preview guidance
+
+Use the configured project check for dependency preparation and build output.
+For Node projects, install from the committed lockfile with the project's
+frozen install command (for example `npm ci --ignore-scripts`), run the build,
+then configure `previewCommand` to start the already-prepared local preview
+from the project root in the disposable check copy.
+The preview phase reuses that check's disposable scratch copy. It does not run
+another install or contact a package registry. The qualified project job image
+provides the preview runtime. Do not add secrets to the preview environment or
+image.
+
+Verify starts two containers with separate mount and PID namespaces. The
+preview uses the configured project job image, the candidate at `/workspace`
+read-only, and the writable `/scratch` copy. It runs as the controller UID with
+`network none`, dropped capabilities, a read-only root and bounded resources.
+The browser uses the pinned Playwright image as the same UID, with its own
+read-only root, writable temporary profile and a separate private output mount.
+It receives the frozen trusted stories on stdin and does not mount the
+candidate, project scratch or controller results. The browser shares only the
+exact preview container's `network none` namespace to reach its loopback port;
+each container retains its own PID namespace. Neither container gets host
+networking, published ports, extra capabilities, a Docker socket, controller,
+forge or inference credentials, or a user profile.
+
+The controller enforces a real wall-clock deadline, stops and reconciles both
+exact labelled containers, then reads the bounded result and PNG screenshots
+from the browser-only mount. The private result contains candidate/tree,
+attempt, policy, pinned tool/image and story hashes, bounded action traces and
+screenshot hashes. CLI, API and dashboard expose the same evidence; screenshots
+can be viewed as images, and no candidate HTML is served on the controller
+origin. Chromium is headless and uses the outer Docker boundary; this is not a
+hosted browser service.
+
+This adapter proves only Linux Chromium interaction with a local web preview.
+It does not qualify Android/iOS, desktop-native applications, Safari, Firefox,
+mobile operating systems, production access or an application's overall
+correctness. Deterministic checks and independent Review remain separate.
+
+## Installed synthetic fixture qualification
+
+The release lead owns this Docker/browser qualification on the installed
+execution host. Use a separate demo state, complete and inspect the demo's
+normal sample handoff, stop that controller, then run the exact qualification
+command with the already-built browser image ID:
+
+```sh
+software-defence-factory demo --state /private/state/sdf-web-proof --port 7348
+# Review and approve the synthetic demo task in its dashboard.
+software-defence-factory stop --state /private/state/sdf-web-proof
+browser_image="$(docker image inspect --format '{{.Id}}' software-defence-factory-playwright:1.63.0)"
+software-defence-factory qualify-web --state /private/state/sdf-web-proof --image "$browser_image"
+```
+
+The installed command probes actual Chromium interaction, then runs a
+disposable delayed-save/failure-retry fixture through mock Build/Review and
+real Docker Verify. Its deliberate variant removes the busy disabled state and
+changes the result text; Verify must fail and no acceptance record may appear.
+The command records a private `qualification.json` under the demo state's
+private qualification directory. It never targets an application or calls a
+model/provider. Do not report this as passed until the lead observes the
+installed invocation and its result.

package/factory/definition.mjs

@@ -1,6 +1,7 @@
 import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { ROOT, digest, harnessOf } from './lib.mjs';
+import { expectedWebStories, webPolicyHash } from './web-verification.mjs';
 
 // Execution order is shared with the queue; presentation cannot invent phases.
 export const WORKFLOWS = Object.freeze({
@@ -9,7 +10,7 @@ export const WORKFLOWS = Object.freeze({
 });
 const phaseInfo = {
   build: { title: 'Implement', owner: 'agent', skills: ['factory-implement'], description: 'Implement the accepted scope in an isolated checkout. Produce a candidate and evidence.' },
-  verify: { title: 'Check', owner: 'factory', skills: [], description: 'Run the project check command against the candidate. A failure stops delivery.' },
+  verify: { title: 'Check', owner: 'factory', skills: [], description: 'Run project checks and any optional trusted browser stories against the candidate. Missing or non-passing required proof stops delivery.' },
   review: { title: 'Review', owner: 'agent', skills: ['factory-review', 'factory-security'], description: 'Review the candidate and evidence in a separate agent invocation. Security review applies when required by the accepted scope.' },
   handoff: { title: 'Accept & hand off', owner: 'operator', skills: [], description: 'Wait for operator approval, then confirm the candidate and policy still match the checks and review. Record acceptance; do not push, merge or deploy.' },
   defence: { title: 'Investigate', owner: 'agent', skills: ['factory-security'], description: 'Investigate supplied incident evidence within the accepted scope. Produce a private draft with findings and unknowns. No production access or recovery action is granted.' },
@@ -40,7 +41,13 @@ export function factoryDefinition(config) {
     skills,
     configuration: { harness, agent: harness, // agent is a v1 compatibility alias
       model: config.model || null, check: config.check, timeoutSeconds: config.timeoutSeconds,
-      memoryMiB: config.memoryMiB, cpus: config.cpus || 2 },
+      memoryMiB: config.memoryMiB, cpus: config.cpus || 2,
+      web_verification: config.webVerification?.enabled ? {
+        enabled: true, adapter: config.webVerification.adapter, version: config.webVerification.version,
+        browser: 'chromium', image: config.webVerification.image, policy_hash: webPolicyHash(config.webVerification),
+        required_stories: expectedWebStories(config.webVerification), platform: 'linux-container', coverage: 'web',
+      } : { enabled: false },
+    },
     method: {
       preparation: ['factory-triage', 'factory-spec'], evaluation: ['factory-evaluate'],
       instructions: 'All six skills are available read-only to agent phases. A skill is an instruction set, not a separate agent or an automatic workflow step.',

package/factory/delivery.mjs

@@ -10,6 +10,7 @@ import { publicSourceAdmission } from './source-admission.mjs';
 import { QueueError } from './queue.mjs';
 import { readProjectLinks } from './project-links.mjs';
 import { qualifyGitHubActions } from './workflow-qualification.mjs';
+import { assertCurrentWebEvidence, assertCurrentWebArtifacts } from './web-verification.mjs';
 
 const MAX_PATCH_BYTES = 8 * 1024 * 1024;
 const MAX_CHANGED_FILES = 500;
@@ -269,6 +270,16 @@ function acceptanceSummary(job, state, config, sourceAdmission) {
   const byID = id => job.runs.find(run => run.id === id);
   const buildRun = byID(accepted.build_run_id), checkRun = byID(accepted.checks_run_id), reviewRun = byID(accepted.review_run_id);
   const handoffRun = byID(accepted.handoff_run_id);
+  let browserEvidenceCurrent = true;
+  if (config.webVerification?.enabled) {
+    try {
+      assertCurrentWebEvidence(config.webVerification, checks.web_verification,
+        { job: job.id, attempt: checkRun?.id, meta: candidate, policyHash: expectedPolicy });
+      assertCurrentWebArtifacts(config.webVerification, checks.web_verification,
+        join(state, 'jobs', job.id, 'artifacts', checks.web_verification.attempt));
+    }
+    catch { browserEvidenceCurrent = false; }
+  }
   const phaseEvidence = trustedPhaseEvidence(state, job, expectedPolicy,
     { build: buildRun, verify: checkRun, review: reviewRun, handoff: handoffRun }, candidate, checks, review);
   if (!phaseEvidence.trusted) return { state: 'blocked', reason: phaseEvidence.reason };
@@ -282,7 +293,7 @@ function acceptanceSummary(job, state, config, sourceAdmission) {
     && accepted.base === job.source_admission?.resolved_sha && accepted.policyHash === expectedPolicy
     && accepted.checks_run_id === checkRun.id && accepted.review_run_id === reviewRun.id
     && checks.run_id === checkRun.id && checks.passed === true && checks.head === accepted.head
-    && checks.tree === accepted.tree && checks.policyHash === expectedPolicy && checks.command === config.check
+    && checks.tree === accepted.tree && checks.policyHash === expectedPolicy && checks.command === config.check && browserEvidenceCurrent
     && review.run_id === reviewRun.id && review.verdict === 'pass' && review.head === accepted.head
     && review.tree === accepted.tree && review.policyHash === expectedPolicy && reviewRun.review_verdict === 'pass';
   if (!bound) return { state: 'blocked', reason: 'Candidate, checks, review or approval evidence is stale or does not match the current Factory policy.' };
@@ -515,6 +526,15 @@ export class DeliveryService {
       || review.run_id !== reviewRun.id || review.verdict !== 'pass' || review.head !== accepted.head || review.tree !== accepted.tree
       || review.policyHash !== expectedPolicy || reviewRun.review_verdict !== 'pass')
       throw new QueueError('Current successful checks and independent review for this candidate are required.');
+    if (config.webVerification?.enabled) {
+      try {
+        assertCurrentWebEvidence(config.webVerification, checks.web_verification,
+          { job: job.id, attempt: checkRun.id, meta: candidate, policyHash: expectedPolicy });
+        assertCurrentWebArtifacts(config.webVerification, checks.web_verification,
+          join(this.state, 'jobs', job.id, 'artifacts', checks.web_verification.attempt));
+      }
+      catch { throw new QueueError('Required browser evidence is missing, stale or non-passing; publication is blocked.'); }
+    }
     if (!SHA1.test(accepted.base || '') || !SHA1.test(accepted.head || '') || !SHA1.test(accepted.tree || '')
       || accepted.head === accepted.base || candidate.parent !== accepted.base)
       throw new QueueError('Candidate base, head or tree is invalid for trusted PR delivery.');

package/factory/execution-evidence.mjs

@@ -1,7 +1,11 @@
-export function assertCurrentHandoffEvidence(meta, checks, review, policyHash) {
+import { assertCurrentWebEvidence } from './web-verification.mjs';
+
+export function assertCurrentHandoffEvidence(meta, checks, review, policyHash, config = {}, job) {
   if (review.verdict !== 'pass' || review.head !== meta.head || review.tree !== meta.tree
     || !checks.passed || checks.head !== meta.head || checks.tree !== meta.tree
     || checks.policyHash !== policyHash || review.policyHash !== policyHash
     || meta.build_policy_hash !== policyHash)
     throw new Error('Build/checks/review do not cover candidate and current policy');
+  if (config.webVerification?.enabled) assertCurrentWebEvidence(config.webVerification, checks.web_verification,
+    { job, attempt: checks.run_id, meta, policyHash });
 }

package/factory/execution-profile.mjs

@@ -4,6 +4,7 @@ import { digest } from './lib.mjs';
 import { VERSION } from './updates.mjs';
 import { usageFields } from './usage.mjs';
 import { effectiveInferenceProvider } from './model-environment.mjs';
+import { expectedWebStories, webPolicyHash } from './web-verification.mjs';
 
 export function withRequestedModel(configuration, requestedModel) {
   const config = structuredClone(configuration);
@@ -33,13 +34,19 @@ export function executionProfile(config, phase) {
   const applicable = !deterministic && harnessOf(config) !== 'mock';
   const provider = applicable && ['codex', 'pi'].includes(harnessOf(config));
   const requestedModel = provider ? config.model || null : null;
-  return {
+  const profile = {
     version: 1, phase, executor: deterministic ? 'deterministic' : harnessOf(config),
     requestedModel,
     modelSelection: !applicable ? 'not_applicable' : !provider ? 'unknown' : requestedModel ? 'explicit' : 'provider_default',
     runtimeVersion: VERSION, image: phase === 'handoff' ? null : config.image,
     policyHash: digest(JSON.stringify(config)), hostName: hostname(),
   };
+  if (config.webVerification?.enabled) profile.webVerification = {
+    enabled: true, adapter: config.webVerification.adapter, version: config.webVerification.version,
+    browser: 'chromium', image: config.webVerification.image, policyHash: webPolicyHash(config.webVerification),
+    requiredStories: expectedWebStories(config.webVerification), platform: 'linux-container',
+  };
+  return profile;
 }
 
 export function attemptPresentation(attempt, recoveredUsage) {