Expose browser-owned public site tools (#553)

[Flow-Fly]

Implements #553. An external agent can discover the versioned site-tool contract, request local approval, observe the selected project, propose edits through its visible Creative Run, and retrieve a bounded review package. WebMCP and the deterministic fallback share the same validation and authority boundary. Target selection, sharing consent, Artist Mode, Brief approval, Start, recovery, and final acceptance remain local.

Linked task issues

• [Agentic Preview task] Publish the versioned site-tool contract and bounded wire format #609 — Publish the versioned Site Tool contract and bounded wire format
• [Agentic Preview task] Connect site tools to browser consent and Creative Runs #610 — Connect caller-scoped site tools to browser-owned sessions and Creative Runs
• [Agentic Preview task] Register WebMCP tools with a conforming fallback #611 — Register the facade through feature-detected WebMCP and its deterministic fallback
• [Agentic Preview task] Prove site-tool conformance through the normal Chromium app #612 — Prove transport conformance and the normal Chromium entry path

Behavior and review decisions

• Publishes facade/catalogue 1.0 negotiation, catalogue-backed JSON Schemas, a Bootstrap Guide, stable errors, and expiring result handles with byte counts and SHA-256 digests.
• Uses opaque caller credentials and locally selected targets, with explicit content disclosure, session/run/target-bound grants, and content-free local egress records. Proposals use existing revision checks, transactions, Creative Run controls, timeline, and recovery checkpoints.
• Separates registration, invocation cancellation, run control, session revocation, and page lifecycle. Queued work is cancelled; committed work remains observable; retrying an operation cannot commit twice.
• Preserves local recovery when authority ends. Continuation uses a new ordinary request, fresh credentials, local approvals, a new session/run, and a fresh observation. The old request never receives replacement credentials or renewed access. The interface explains this path where automatic session replacement is unavailable.
• Allows package preparation while paused before local Accept, through the existing save/revision/package boundary. Resume cannot overlap that preparation.

The first Astra High finalizer found and corrected five issues: disposed recovery controls, an unsupported visible Resume action, an asynchronous transport-state race, a missing one-of-each schema constraint, and a package/resume race. A full browser check also caught and corrected a duplicate live status region in the new guidance. A fresh Astra High finalizer independently reviewed the complete corrected PR and returned APPROVE for the unchanged candidate below, with no Standards or Spec findings. Its own focused 45-test run passed; it verified all 80 retained first-pass artifact hashes and the CI checkout/tree provenance.

Verification

Candidate: a5a5869eeca274a09c9864212e5e29ff368fabd3. Starting/comparison base: e94f52e4f8c22f78db93688f5dab3ad95430a652.

• Standard npm run test:run: 133 files / 978 tests pass, plus the shared Node import check.
• npm run test:browser: 19 files / 129 tests pass, one native API check explicitly skipped. The normal-entry Golden journey exercises local approvals, observation/edit/package results, cancellation/revocation, recovery, and continuation through a newly approved request.
• TypeScript, lint, build, and whitespace checks pass. Fallow 3.2.0 reports no issues in exactly 18 changed files against the explicit starting base; no thresholds or suppressions changed.
• CI 34454210254 passes, including the standard root and Chromium suites, build, Fallow, and server-container checks. Exact local command logs, requirement digests, failed intermediate attempts, and CI checkout/tree provenance are retained in the delivery handoff. Coverage was not collected.

The browser lane uses Playwright 1.62.1 / Chromium 151.0.7922.34 and loads the real application/Vite/PWA entry point; only Sentry initialization is mocked. Activated Canary 153.0.7982.0 registers native tools but does not supply the required per-invocation cancellation signal, so that shape is explicitly refused before effects. The deterministic fallback is verified; native conformance is not claimed. See docs/agents/site-tools.md for the supported contract and separate, unclaimed owner live-host checklist.

No backend/provider calls, production telemetry, project-format migration, deployment, or owner live-host acceptance. This PR targets develop; production acceptance remains with the owner under #524.

Delivery authorization

Owner mandate: “Je te laisse gérer jusqu'a la delivery de #553”. Director record: this delegation authorizes completing the bounded delivery, including integration of the independently approved, green, unchanged candidate into develop. It does not authorize deployment, owner live-host acceptance, or promotion to main.

Delivered into develop as d6d4042bddba54a050442534c32e97da9d8a8c07. Its tree exactly matches the reviewed candidate. Post-merge CI 34456889339 passes. #609, #610, #611, #612, #553 and capability #534 are closed; outcome #527 and initiative #524 retain their remaining acceptance gates.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Free

Run ID: e194cd9b-26c3-41b4-9883-ccb40f3e2d20

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Flow-Fly]

Post-merge production-build playtest requested by the owner on 2026-09-10.

The tested lifecycle passes, but the fresh-copy first-raster scenario is blocked by confirmed bug #619. This adds a functional limitation to the earlier green delivery checks; no production code was changed during the playtest.

Exact source: a5a5869eeca274a09c9864212e5e29ff368fabd3, tree d77b0ddc8542297f518df66e1c4201aab097e64b, identical to merged develop d6d4042bddba54a050442534c32e97da9d8a8c07. Served the production build on localhost with real browser storage/canvas and actual local UI approvals, without a mocked host/adapter or provider calls.

• Chrome 152.0.7977.83: fallback lifecycle passes.
• Canary 155.0.8050.0, activated with --enable-features=WebMCP: the same lifecycle passes through the seven actual registered native tools. This is new local application evidence beyond the earlier Canary 153 inert probe; executeTool takes a RegisteredTool object in this build.
• Both paths cover discovery, denial before consent/Start, safe-copy selection, a frame-duration commit, then exact orange/yellow raster drawing, idempotent replay, Pause, package/chunk/binary checksums, explicit revocation, refusal of late writes/old handles, a local Recovery Copy, fresh request and approvals, and local Accept reaching the terminal accepted state and ending sharing. Twelve checks pass per path; no uncaught page errors.
• If raster drawing is the first transaction on a fresh blank copy, both paths fail with revision_conflict and enter recovery-required with zero committed raster transactions. First raster write on a fresh safe copy conflicts with its recovery checkpoint #619 contains the minimal reproduction and diagnosis: checkpoint serialization adds palette indices between raster observation and validation without changing revision, changing the digest. The guard refuses the write; no partial raster change was observed.

This remains a local deterministic client test, not a deployed-host/model-client evaluation. A separate real-tab-background probe could not produce its required hidden state, and a CDP freeze/resume probe did not observe the expected resume event; neither is counted as product validation. Explicit revocation and fresh-approval continuation are validated.

Local evidence: /var/folders/ck/ghnswppx69s4966p8885hfbr0000gn/T/pixel-forge-553-delivery-_ng4llv7/playtest/REPORT.md, successful lifecycle JSON reports, red-capable one-pixel scripts, digest-framing trace, screenshots and recordings. Credentials are not persisted in the reports.

#619 records the repair separately from this merged PR. No production deployment, model profile, embedded-agent or local-bridge milestone is claimed by these tests.