Integrate StarLang browser-evidence actor system for web screenshots #132

New issue

Open

opened 2026-09-02 17:26:32 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-02 17:26:32 +00:00

Owner

Goal

Add StarIntel's production integration for the StarLang browser-evidence actor system tracked in lost-rob0t/star-lang#54.

Operator direction received 2026-08-31: build the useful gowitness-style screenshot/evidence capability as a StarLang actor system rather than making gowitness an independent product/database authority.

Current server master inspected: 8fb297d146e7332fae7e38170b5b49d49530ac53.

Architecture

StarIntel typed capture request
        |
        v
released StarLang browser-evidence semantic artifact
        |
        v
BrowserEvidenceSupervisor
        |
        +--> bounded browser.capture capability
        |        |
        |        v
        |   Chromium/CDP adapter
        |
        +--> typed artifact references/results
                 |
                 v
        canonical StarIntel ingest/artifact boundary

StarLang owns actor/message/supervision semantics. StarIntel owns application authorization/scope, deployment/runtime binding, artifact custody, canonical ingest and persistence.

No second authority

Do not:

add a server-local parallel actor DSL;
let the browser adapter write CouchDB/Rabbit directly;
persist a gowitness-compatible database as another canonical store;
put screenshot PNG/DOM blobs directly in actor messages or ordinary canonical documents;
give .star source raw browser/CDP/process/database handles;
bypass existing canonical ingest/outbox semantics.

StarLang dependency

Semantic implementation is lost-rob0t/star-lang#54.

Production in-process binding must use the final/released embedding surface tracked by lost-rob0t/star-lang#53; do not import prototype-private StarLang packages into the server just to land this feature early.

This issue is intentionally narrower than the generic RuntimePlan work in #43. It should consume that boundary when available, not create a second manifest/runtime planner.

StarIntel request policy

Before a real browser capture begins, the server/application boundary must supply:

authenticated principal/context;
explicit target URL;
authorization/scope decision appropriate to the requested acquisition;
one absolute deadline/budget;
capture/browser profile reference;
viewport/artifact options within configured bounds;
correlation/idempotency identity.

The StarLang actor system cannot widen this authority.

Artifact model

Expected artifacts:

screenshot image (PNG initially);
optional DOM/page-source snapshot;
optional compact navigation/console metadata if later justified.

Canonical metadata preserves:

requested/final URL;
capture request/correlation identity;
observed timestamp/duration;
viewport/profile identity;
browser adapter/version;
artifact digest/content type/size/reference;
terminal outcome + failure classification;
provenance linking the normalized observation to its immutable artifacts.

Secrets/cookies/session tokens are not normal document fields.

First implementation proof

After StarLang #54 has a semantic contract and before real browser/process integration:

load/bind the exact semantic artifact through a fake final StarLang embedding port;
issue an authorized fixture capture request;
fake browser.capture returns deterministic screenshot/DOM artifact references;
normalized StarIntel result is submitted through a fake canonical ingest/artifact port;
unauthorized/out-of-policy request invokes zero browser capability calls;
timeout/cancellation rejects late result commit;
duplicate request identity does not create duplicate canonical artifact observations;
no direct CouchDB/Rabbit/browser process side effects occur in this slice.

A later slice replaces the fake browser capability with the real Chromium/CDP adapter and runs the same contract.

Hackmode relationship

Hackmode issue lost-rob0t/hackmode#133 owns its operation-scoped mitmproxy/client-profile policy. A StarIntel browser adapter may accept equivalent typed network/profile inputs, but StarIntel does not depend on Hackmode being online and does not consume Hackmode's operation database as runtime authority.

Definition of done

StarLang #54 semantic actor tests are green with a real StarLang actor runtime;
final StarLang embedding boundary is used, not prototype internals;
browser process lifecycle is bounded/supervised;
screenshot/DOM bytes live in artifact custody;
canonical ingest contains typed metadata + artifact references/provenance;
scope/deadline/cancellation/idempotency are enforced;
server shutdown leaves no browser/StarLang resource leak;
no gowitness database/schema/process becomes a parallel authority.

## Goal Add StarIntel's production integration for the StarLang browser-evidence actor system tracked in `lost-rob0t/star-lang#54`. Operator direction received 2026-08-31: build the useful gowitness-style screenshot/evidence capability as a StarLang actor system rather than making gowitness an independent product/database authority. Current server `master` inspected: `8fb297d146e7332fae7e38170b5b49d49530ac53`. ## Architecture ```text StarIntel typed capture request | v released StarLang browser-evidence semantic artifact | v BrowserEvidenceSupervisor | +--> bounded browser.capture capability | | | v | Chromium/CDP adapter | +--> typed artifact references/results | v canonical StarIntel ingest/artifact boundary ``` StarLang owns actor/message/supervision semantics. StarIntel owns application authorization/scope, deployment/runtime binding, artifact custody, canonical ingest and persistence. ## No second authority Do not: - add a server-local parallel actor DSL; - let the browser adapter write CouchDB/Rabbit directly; - persist a gowitness-compatible database as another canonical store; - put screenshot PNG/DOM blobs directly in actor messages or ordinary canonical documents; - give `.star` source raw browser/CDP/process/database handles; - bypass existing canonical ingest/outbox semantics. ## StarLang dependency Semantic implementation is `lost-rob0t/star-lang#54`. Production in-process binding must use the final/released embedding surface tracked by `lost-rob0t/star-lang#53`; do not import prototype-private StarLang packages into the server just to land this feature early. This issue is intentionally narrower than the generic RuntimePlan work in #43. It should consume that boundary when available, not create a second manifest/runtime planner. ## StarIntel request policy Before a real browser capture begins, the server/application boundary must supply: - authenticated principal/context; - explicit target URL; - authorization/scope decision appropriate to the requested acquisition; - one absolute deadline/budget; - capture/browser profile reference; - viewport/artifact options within configured bounds; - correlation/idempotency identity. The StarLang actor system cannot widen this authority. ## Artifact model Expected artifacts: - screenshot image (PNG initially); - optional DOM/page-source snapshot; - optional compact navigation/console metadata if later justified. Canonical metadata preserves: - requested/final URL; - capture request/correlation identity; - observed timestamp/duration; - viewport/profile identity; - browser adapter/version; - artifact digest/content type/size/reference; - terminal outcome + failure classification; - provenance linking the normalized observation to its immutable artifacts. Secrets/cookies/session tokens are not normal document fields. ## First implementation proof After StarLang #54 has a semantic contract and before real browser/process integration: 1. load/bind the exact semantic artifact through a fake final StarLang embedding port; 2. issue an authorized fixture capture request; 3. fake `browser.capture` returns deterministic screenshot/DOM artifact references; 4. normalized StarIntel result is submitted through a fake canonical ingest/artifact port; 5. unauthorized/out-of-policy request invokes zero browser capability calls; 6. timeout/cancellation rejects late result commit; 7. duplicate request identity does not create duplicate canonical artifact observations; 8. no direct CouchDB/Rabbit/browser process side effects occur in this slice. A later slice replaces the fake browser capability with the real Chromium/CDP adapter and runs the same contract. ## Hackmode relationship Hackmode issue `lost-rob0t/hackmode#133` owns its operation-scoped mitmproxy/client-profile policy. A StarIntel browser adapter may accept equivalent typed network/profile inputs, but StarIntel does not depend on Hackmode being online and does not consume Hackmode's operation database as runtime authority. ## Definition of done - StarLang #54 semantic actor tests are green with a real StarLang actor runtime; - final StarLang embedding boundary is used, not prototype internals; - browser process lifecycle is bounded/supervised; - screenshot/DOM bytes live in artifact custody; - canonical ingest contains typed metadata + artifact references/provenance; - scope/deadline/cancellation/idempotency are enforced; - server shutdown leaves no browser/StarLang resource leak; - no gowitness database/schema/process becomes a parallel authority.

nsaspy referenced this issue from a commit

2026-09-08 01:48:33 +00:00

Merge pull request #132 from lost-rob0t/agent/emacs-client-contract