fix(sync): add trusted Playwright verification adapter

docs/global_sync_resolution_plan.md

@@ -495,9 +495,39 @@ class VerificationObligation:
 class VerificationProfile:
     unit_id: UnitId
     obligations: tuple[VerificationObligation, ...]
+    required_requirement_ids: tuple[str, ...]
     profile_digest: str
+    assurance: AssuranceLevel = AssuranceLevel.STANDARD_FRAMEWORK
 ```
 
+`AssuranceLevel` is an ordered, digest-bound profile property:
+
+- `standard_framework` is the compatibility default. It assumes the selected
+  pytest, Jest, Vitest, or Playwright framework and its in-process hooks report
+  honestly. The checker creates, owns, and bounds the FIFO/file-descriptor framework
+  observation transport. It is candidate-visible under `standard_framework` and is
+  not authenticated evidence against candidate code in the same address space and
+  descriptor table.
+- `isolated_black_box` is stronger. It requires candidate code to execute only as
+  an external SUT behind a process boundary that cannot mutate checker state or its
+  observation channel. No current in-process framework adapter satisfies this
+  assurance.
+
+Protected base/head reconciliation takes the stronger assurance level and records
+an attempted downgrade as invalid. Assurance is included in `profile_digest`, so
+evidence cannot be replayed across assurance levels. Until an external SUT adapter
+is implemented, an in-process adapter selected by an `isolated_black_box` profile
+returns a deterministic non-pass result and the unit remains semantic `UNKNOWN`;
+it cannot issue a passing result for that obligation.
+
+This boundary is fundamental rather than a missing FIFO, proxy, seccomp, or
+cryptographic feature. Hostile code executing inside the test framework's process
+can alter framework callbacks, memory, and inherited descriptors before the
+checker observes them. Signing the resulting statement authenticates who signed
+it and what was bound, but cannot retroactively make the in-process observation
+Byzantine-resistant. The isolated-black-box follow-up therefore requires a truly
+out-of-process adapter, not another in-process reporter transport.
+
 The profile accounts for every structured prompt requirement/contract identifier,
 declared interface, required story/example, PDD-owned and human-owned validation
 test, policy/security check, and dependency-closure obligation. A completeness
@@ -1132,7 +1162,9 @@ Tasks:
 - Deploy the evidence trust plane before PR 13:
   - Protected-base/control-plane `AttestationTrustPolicy` loader and verifier.
   - Post-validation signer using dedicated workload identity and no candidate code.
-  - Authenticated trusted-runner result channel plus a nonce/check-run authority.
+  - Checker-owned bounded framework-observation transport for standard-framework
+    adapters, plus an isolated external observation boundary before any
+    isolated-black-box adapter is supported.
   - Transparency/audit record store and evidence cache invalidation service.
   - Threshold protected human-review attestation workflow for non-machine-verifiable
     obligations.
@@ -1583,6 +1615,11 @@ The tracking epic records owner, PR, state, and exit-gate evidence for every row
 
 ## 11. Definition of Done
 
+The global predicate described below is not currently achieved. In particular,
+standard-framework observations do not satisfy a Byzantine-resistant
+isolated-black-box claim, the external SUT adapter does not yet exist, and the
+release/nightly evidence gates remain outstanding.
+
 The global sync epic may close only when all conditions below hold with attached
 commands, commit SHAs, and reports.
 

pdd/commands/sync_core.py

@@ -45,7 +45,9 @@
 from ..sync_core.runner import (
     RunnerConfig,
     _load_vitest_toolchain_descriptor,
+    _playwright_toolchain_identity,
     _protected_command_error,
+    _playwright_command_error,
     _vitest_command_error,
 )
 from .. import __version__
@@ -166,9 +168,29 @@ def _protected_command(value: str | None, option: str, cwd: Path) -> tuple[str,
     return command
 
 
+def _protected_playwright_command(
+    value: str | None, cwd: Path
+) -> tuple[str, ...] | None:
+    """Parse the fixed executable-plus-entrypoint Playwright descriptor."""
+    command = _protected_command(value, "--playwright-command", cwd)
+    if command is None:
+        return None
+    if len(command) != 2 or not Path(command[1]).expanduser().is_absolute():
+        raise click.ClickException(
+            "--playwright-command must contain exactly an absolute executable "
+            "and absolute external CLI entrypoint"
+        )
+    if any(part.startswith("-") for part in command[1:]):
+        raise click.ClickException(
+            "--playwright-command must not contain interpreter options"
+        )
+    return command
+
+
 def _runner_config_from_options(
     options: dict[str, object], cwd: Path
 ) -> RunnerConfig:
+    # pylint: disable=too-many-locals
     """Build trusted validator configuration from protected CLI/env options."""
     jest_command = options.get("jest_command")
     vitest_command = options.get("vitest_command")
@@ -194,6 +216,24 @@ def _runner_config_from_options(
         error = _vitest_command_error(cwd, protected_vitest)
         if error is not None:
             raise click.ClickException(f"--vitest-command: {error}")
+    playwright_command = options.get("playwright_command")
+    playwright_manifest = options.get("playwright_toolchain_manifest")
+    protected_playwright = _protected_playwright_command(
+        playwright_command if isinstance(playwright_command, str) else None,
+        cwd,
+    )
+    playwright_manifest_path = (
+        Path(playwright_manifest).expanduser().resolve()
+        if isinstance(playwright_manifest, str) and playwright_manifest else None
+    )
+    if (protected_playwright is None) != (playwright_manifest_path is None):
+        raise click.ClickException(
+            "--playwright-command and --playwright-toolchain-manifest are required together"
+        )
+    if protected_playwright is not None:
+        error = _playwright_command_error(cwd, protected_playwright)
+        if error is not None:
+            raise click.ClickException(f"--playwright-command: {error}")
     config = RunnerConfig(
         jest_command=_protected_command(
             jest_command if isinstance(jest_command, str) else None,
@@ -202,6 +242,8 @@ def _runner_config_from_options(
         ),
         vitest_command=protected_vitest,
         vitest_toolchain_manifest=manifest_path,
+        playwright_command=protected_playwright,
+        playwright_toolchain_manifest=playwright_manifest_path,
     )
     if protected_vitest is not None:
         try:
@@ -213,6 +255,26 @@ def _runner_config_from_options(
             vitest_command=config.vitest_command,
             vitest_toolchain_manifest=config.vitest_toolchain_manifest,
             vitest_toolchain_identity=descriptor.identity,
+            playwright_command=config.playwright_command,
+            playwright_toolchain_manifest=config.playwright_toolchain_manifest,
+            adapter_identities=config.adapter_identities,
+        )
+    if protected_playwright is not None:
+        try:
+            identity = _playwright_toolchain_identity(
+                cwd, protected_playwright, playwright_manifest_path
+            )
+        except (OSError, ValueError) as exc:
+            raise click.ClickException(f"invalid Playwright toolchain: {exc}") from exc
+        config = RunnerConfig(
+            jest_command=config.jest_command,
+            vitest_command=config.vitest_command,
+            vitest_toolchain_manifest=config.vitest_toolchain_manifest,
+            vitest_toolchain_identity=config.vitest_toolchain_identity,
+            playwright_command=config.playwright_command,
+            playwright_toolchain_manifest=config.playwright_toolchain_manifest,
+            playwright_toolchain_identity=identity,
+            adapter_identities=config.adapter_identities,
         )
     return config
 
@@ -478,6 +540,17 @@ def baseline(ctx: click.Context, module: str, reviewed_by: str, reason: str) ->
     type=click.Path(path_type=Path),
     help="Protected external Node/Vitest toolchain closure manifest.",
 )
+@click.option(
+    "--playwright-command",
+    envvar="PDD_SYNC_PLAYWRIGHT_COMMAND",
+    help="Protected absolute external Playwright command argv.",
+)
+@click.option(
+    "--playwright-toolchain-manifest",
+    envvar="PDD_SYNC_PLAYWRIGHT_TOOLCHAIN_MANIFEST",
+    type=click.Path(path_type=Path),
+    help="Protected external Playwright toolchain manifest.",
+)
 @click.pass_context
 def validate(
     ctx: click.Context,
@@ -487,6 +560,8 @@ def validate(
     jest_command: str | None,
     vitest_command: str | None,
     vitest_toolchain_manifest: Path | None,
+    playwright_command: str | None,
+    playwright_toolchain_manifest: Path | None,
 ) -> None:
     # pylint: disable=too-many-arguments,too-many-positional-arguments
     """Run protected obligations and transactionally finalize trusted evidence."""
@@ -504,6 +579,9 @@ def validate(
                 "vitest_command": vitest_command,
                 "vitest_toolchain_manifest": str(vitest_toolchain_manifest)
                 if vitest_toolchain_manifest else None,
+                "playwright_command": playwright_command,
+                "playwright_toolchain_manifest": str(playwright_toolchain_manifest)
+                if playwright_toolchain_manifest else None,
             },
             root,
         ),

pdd/sync_core/__init__.py

@@ -121,6 +121,7 @@
 )
 from .waivers import SyncWaiver, WaiverSet, load_sync_waivers
 from .types import (
+    AssuranceLevel,
     ArtifactSnapshot,
     BaselineStatus,
     CandidateId,
@@ -137,6 +138,7 @@
 )
 
 __all__ = [
+    "AssuranceLevel",
     "ArtifactSnapshot",
     "ALIAS_POLICY_PATH",
     "AttestationBinding",

pdd/sync_core/evidence_store.py

@@ -83,6 +83,10 @@ def attestation_payload(envelope: AttestationEnvelope) -> dict[str, Any]:
         payload["binding"]["adapter_identities"] = [
             list(item) for item in binding.adapter_identities
         ]
+    if binding.playwright_toolchain_identity is not None:
+        payload["binding"]["playwright_toolchain_identity"] = (
+            binding.playwright_toolchain_identity
+        )
     return payload
 
 
@@ -127,6 +131,11 @@ def decode_attestation(payload: Mapping[str, Any]) -> AttestationEnvelope:
             or len(set(adapter_identities)) != len(adapter_identities)
         ):
             raise TypeError("adapter_identities must be sorted and unique")
+        toolchain_identity = binding_data.get("playwright_toolchain_identity")
+        if toolchain_identity is not None and (
+            not isinstance(toolchain_identity, str) or not toolchain_identity
+        ):
+            raise TypeError("playwright_toolchain_identity must be a non-empty string")
         binding = AttestationBinding(
             subject,
             _string(binding_data, "snapshot_digest"),
@@ -136,6 +145,7 @@ def decode_attestation(payload: Mapping[str, Any]) -> AttestationEnvelope:
             _string(binding_data, "base_sha"),
             _string(binding_data, "checked_sha"),
             adapter_identities=adapter_identities,
+            playwright_toolchain_identity=toolchain_identity,
         )
         results = tuple(
             ObligationEvidence(

pdd/sync_core/finalize.py

@@ -225,12 +225,14 @@ def _reusable_result(
             profile, root=root, ref=head_sha,
             config=RunnerConfig(
                 adapter_identities=envelope.binding.adapter_identities,
+                playwright_toolchain_identity=envelope.binding.playwright_toolchain_identity,
             ),
         ),
         TRUSTED_RUNNER_VERSION,
         base_sha,
         envelope.binding.checked_sha,
         adapter_identities=envelope.binding.adapter_identities,
+        playwright_toolchain_identity=envelope.binding.playwright_toolchain_identity,
     )
     verifier.verify_current_for_idempotency(envelope, binding, now=now)
     ancestry = subprocess.run(
@@ -325,6 +327,10 @@ def finalize_unit(
     if len(matches) != 1:
         raise ValueError(f"finalization requires exactly one managed unit: {module}")
     profiles = load_verification_profiles(repository_root, manifest)
+    if profiles.invalid_reasons:
+        raise ValueError(
+            "canonical finalization requires valid protected verification profiles"
+        )
     profile = profiles.for_unit(matches[0].unit_id)
     if profile is None or not profile.complete:
         raise ValueError("finalization requires a complete protected profile")

pdd/sync_core/git_io.py

@@ -44,6 +44,21 @@ def read_git_regular_blob(root: Path, ref: str, path: PurePosixPath) -> bytes |
     return read_git_blob(root, ref, path)
 
 
+def read_git_mode(root: Path, ref: str, path: PurePosixPath) -> str | None:
+    """Return the exact tree mode for one path without materializing it."""
+    result = subprocess.run(
+        ["git", "ls-tree", ref, "--", path.as_posix()],
+        cwd=root,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    if result.returncode != 0 or not result.stdout.strip():
+        return None
+    fields = result.stdout.split(None, 3)
+    return fields[0] if len(fields) == 4 else None
+
+
 def resolve_git_commit(root: Path, ref: str) -> str:
     """Resolve one exact commit or fail closed."""
     result = subprocess.run(