feat(evidence): add web smoke contract #163

Merged

pdurlej merged 2 commits from codex/web-smoke-evidence into main

2026-06-24 00:18:53 +02:00

pdurlej commented

2026-06-24 00:10:53 +02:00

Owner

Summary

add read-only web-smoke-check for Steel Browser or compatible browser-smoke producer reports
define patchwarden.web_smoke.v1 schema/example with URL scenarios, screenshot/trace refs, console/network summaries, failure reason, redaction metadata, and top-level evidence[]
extend evidence-check/evidence-bundle-plan with a web evidence class and web-smoke PR-class requirement
update status/docs/vision ledger so #151 is represented as a delivered contract while live browser producer wiring remains external

Boundary

Patchwarden still does not create browser sessions, visit URLs, run Playwright/Steel/Selenium, upload artifacts, post statuses, approve, or merge. It only normalizes and evaluates the producer artifact for the exact head.

Tests

PYTHONPATH=src:. python3 -m unittest tests.test_web_smoke tests.test_cli_web_smoke tests.test_evidence_gate tests.test_evidence_bundle_plan tests.test_cli_status tests.test_status_html tests.test_docs_module_inventory tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_web_smoke_schema_contract tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_sandbox_smoke_schema_contract tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_evidence_verdict_schema_contract tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_evidence_bundle_plan_schema_contract tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_schema_readme_lists_every_public_schema tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_schema_readme_lists_every_public_example tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_schema_readme_example_schema_columns_match_validation_contract tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_public_schema_examples_validate_against_declared_schema -> 45 tests OK
PYTHONPATH=src:. python3 -m unittest discover -s tests -> 684 tests OK
git diff --check -> OK

Closes #151

## Summary - add read-only `web-smoke-check` for Steel Browser or compatible browser-smoke producer reports - define `patchwarden.web_smoke.v1` schema/example with URL scenarios, screenshot/trace refs, console/network summaries, failure reason, redaction metadata, and top-level `evidence[]` - extend `evidence-check`/`evidence-bundle-plan` with a `web` evidence class and `web-smoke` PR-class requirement - update status/docs/vision ledger so #151 is represented as a delivered contract while live browser producer wiring remains external ## Boundary Patchwarden still does not create browser sessions, visit URLs, run Playwright/Steel/Selenium, upload artifacts, post statuses, approve, or merge. It only normalizes and evaluates the producer artifact for the exact head. ## Tests - `PYTHONPATH=src:. python3 -m unittest tests.test_web_smoke tests.test_cli_web_smoke tests.test_evidence_gate tests.test_evidence_bundle_plan tests.test_cli_status tests.test_status_html tests.test_docs_module_inventory tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_web_smoke_schema_contract tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_sandbox_smoke_schema_contract tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_evidence_verdict_schema_contract tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_evidence_bundle_plan_schema_contract tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_schema_readme_lists_every_public_schema tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_schema_readme_lists_every_public_example tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_schema_readme_example_schema_columns_match_validation_contract tests.test_artifact_schema_contract.ArtifactSchemaContractTests.test_public_schema_examples_validate_against_declared_schema` -> 45 tests OK - `PYTHONPATH=src:. python3 -m unittest discover -s tests` -> 684 tests OK - `git diff --check` -> OK Closes #151

pdurlej added 1 commit

2026-06-24 00:10:53 +02:00

feat(evidence): add web smoke contract

fallow-py / fallow-py-advisory (pull_request) Successful in 16s

Details

0701cc7cbc

ollama added 1 commit

2026-06-24 00:17:15 +02:00

fix(evidence): keep web smoke slice within policy

fallow-py / fallow-py-advisory (pull_request) Successful in 14s

Details

c46bc8cb90

pdurlej commented

2026-06-24 00:18:52 +02:00

Author

Owner

Patchwarden dogfood before merge:

Head: c46bc8cb90d504f5cc5da1a3b114efbcbe046e0d
Changed files after repair: 20 (large-change blocker cleared)
Forgejo commit status: success (fallow-py / fallow-py-advisory)
Targeted suite after repair: 44 tests OK
Full suite after repair: PYTHONPATH=src:. python3 -m unittest discover -s tests -> 684 tests OK
contract-pr dry run: blocked only on patchwarden.pr.path_classification / governance_tier_path, expected for schema/status/module-policy surfaces
repair-instruction-check: ready, next action operator_required

The earlier large_change_set blocker was repaired by reducing the net PR diff to 20 files. This PR keeps Patchwarden read-only: it consumes web-smoke evidence but does not create browser sessions, visit URLs, upload artifacts, post statuses, approve, or merge.

Patchwarden dogfood before merge: - Head: `c46bc8cb90d504f5cc5da1a3b114efbcbe046e0d` - Changed files after repair: `20` (large-change blocker cleared) - Forgejo commit status: `success` (`fallow-py / fallow-py-advisory`) - Targeted suite after repair: 44 tests OK - Full suite after repair: `PYTHONPATH=src:. python3 -m unittest discover -s tests` -> 684 tests OK - `contract-pr` dry run: blocked only on `patchwarden.pr.path_classification` / `governance_tier_path`, expected for schema/status/module-policy surfaces - `repair-instruction-check`: `ready`, next action `operator_required` The earlier `large_change_set` blocker was repaired by reducing the net PR diff to 20 files. This PR keeps Patchwarden read-only: it consumes web-smoke evidence but does not create browser sessions, visit URLs, upload artifacts, post statuses, approve, or merge.

pdurlej merged commit bb8051b9ca into main

2026-06-24 00:18:53 +02:00

pdurlej deleted branch codex/web-smoke-evidence

2026-06-24 00:18:53 +02:00

pdurlej referenced this pull request from a commit

2026-06-24 00:18:54 +02:00

Merge pull request #163 from codex/web-smoke-evidence

claude commented

2026-06-24 00:19:41 +02:00

Collaborator

🏛️ Architect ✅ (loop) — resolves #151, safe to merge. Verified consumer-not-executor (the L1 boundary): docstring "consumes browser-smoke … does not create browser"; stdlib-only imports (no playwright/selenium/webdriver/subprocess/requests — urlsplit parses the artifact's URL, ALLOWED_PROVIDER_TYPES validates a field, neither executes); fail-closed + head-bound (web_smoke_head_missing / head_mismatch / not_successful / scenario_not_successful); external_write_allowed=false; sanitized. The evidence-check/evidence-bundle-plan web-class extension is additive and clean. 684 green. Same proven pattern as the #162 sandbox twin.

With this, all three D28 closing loops are shipped (L1 sandbox #162 + web #163 · L2 #156 · L3 #161). Per self-usable-milestone.md the only remaining piece is the merge-actuation frontier (merge actuator + external-controller identity + loop runner) — still build-time-banned, and the one I'll review hardest when it lands. No changes requested. — claude (architect loop)

🏛️ Architect ✅ (loop) — resolves #151, safe to merge. Verified consumer-not-executor (the L1 boundary): docstring "consumes browser-smoke … does not create browser"; **stdlib-only** imports (no playwright/selenium/webdriver/subprocess/requests — `urlsplit` parses the artifact's URL, `ALLOWED_PROVIDER_TYPES` validates a field, neither executes); fail-closed + head-bound (`web_smoke_head_missing` / `head_mismatch` / `not_successful` / `scenario_not_successful`); `external_write_allowed=false`; sanitized. The `evidence-check`/`evidence-bundle-plan` `web`-class extension is additive and clean. 684 green. Same proven pattern as the #162 sandbox twin. With this, **all three D28 closing loops are shipped** (L1 sandbox #162 + web #163 · L2 #156 · L3 #161). Per `self-usable-milestone.md` the only remaining piece is the **merge-actuation frontier** (merge actuator + external-controller identity + loop runner) — still build-time-banned, and the one I'll review hardest when it lands. No changes requested. — claude (architect loop)