progress.md

progress.md: WebRunner

Outstanding work only. When an item is done, delete it in the same commit and add a #done entry to docs/updates/ (format and query commands: docs/updates/README.md). No finished items, no history, no rules (rules live in CLAUDE.md). Item numbers (#n) are never reused. Tags: [DECIDE] needs the owner's decision, [BLOCKED] waits on something else, [UNVERIFIED] observed but not confirmed. Cross-repo and workspace items live in D:\Codes\progress.md (relevant here: X-6, X-12, X-13, X-27).

Open

• #20 Two-way bridge with AutoControl (je_auto_control, AutoControlGUI repo; workspace X-27), what is left: [BLOCKED: needs a desktop nobody is using, with no Jeffrey_RPA batch and no other window able to come in front of Chrome] run test/integration_test/test_autocontrol_native_desktop.py with WEBRUNNER_NATIVE_DESKTOP_TESTS=1 and je_auto_control 0.0.225 or newer (the first release with AC_write_secret; the local AutoControlGUI working tree is still on an older commit and has to be pulled, or the release installed, first). WR_ac_click_element_native, WR_ac_fill_native_file_dialog and WR_ac_assert_image_on_screen have not yet passed on a real desktop, and WR_ac_basic_auth has passed there once. The test also checks the page-to-screen mapping against where AutoControl finds the same element's image.

• #21 [UNVERIFIED] Deferred at the owner's request: do not start or resume the 24-hour acceptance without a new explicit instruction. Remaining acceptance is the full 24-hour run in scripts/verify_issue_worker.py, including its final container/browser gates, against unchanged sources. Interrupted evidence is retained at D:/WebRunnerValidation/runtime-20261023/attempt-04; any resumed run needs a fresh attempt directory. Short or interrupted runs do not substitute for full-duration acceptance.

• #22 [WIP] Managed browser integration for AutoControlGUI: retain the actual original helper/page after input ownership retirement and bind SDK freeze_readonly() / read-only contract 1 to existing completion/skill review, API and GUI workflows. Keep consumer refusal until that provider has live same-context evidence; a new page, cached observation or capability marker is insufficient, and network-retired DOM reads cannot establish new server responses. Complete production host-service helper Python/package/Chromium configuration, deployment/recovery and real application/browser acceptance. Existing owner-requested native/browser/24-hour acceptance deferrals remain. Source worktrees: WebRunner .worktrees/agent-managed and AutoControlGUI .worktrees/agent-runtime.

• #23 [TODO] Resolve existing whole-package quality debt: mypy reports 510 errors in 75 files, including missing requests stubs; flake8 reports 116 findings at the project limits. A fresh strict Sphinx build reports 58 existing warnings, including viewport docstring markup, duplicate MCP declarations/section labels and ambiguous builtin references. Exact committed 84a86dea comparison confirms no added diagnostics; the earlier c400466c comparison is recorded in docs/updates/2026-10-b.md. Whole-package Pylint still exits 30 (9.30/10); scoped SDK success does not clear that debt.

• #27 [BLOCKED] Pillow 13.0.0 in pyproject.toml, dev.toml, requirements.txt, dev_requirements.txt and uv.lock (Dependabot: 41 Pillow advisories, critical among them; U-20261101-01). ci.txt already locks 13.0.0 on Python 3.11+. The floor cannot move yet: the autocontrol extra needs je_auto_control>=0.0.225, which pins pillow==12.3.0. Once a je_auto_control release pins pillow==13.0.0; python_version >= '3.11' (AutoControlGUI fix/dependabot-vulnerabilities), raise that extra's floor to it, split the Pillow floor the same way (>=12.3.0 below 3.11, >=13.0.0 from 3.11) and re-lock uv.lock.