diff --git a/.gitignore b/.gitignore
index 8bb79b2..228d858 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,11 @@ lab/gitea
lab/*.age
lab/rung1-*
+# browserrot Node sidecar: ship the source (index.js/heal.js/package.json), never the
+# installed dependency tree or lockfile churn (npm install regenerates them)
+internal/browserrot/sidecar/node_modules/
+internal/browserrot/sidecar/package-lock.json
+
# editor / OS
*.swp
.DS_Store
diff --git a/README.md b/README.md
index a1963ef..c896905 100644
--- a/README.md
+++ b/README.md
@@ -138,6 +138,25 @@ The 8 `LIVE-VM` claims are reproducible from a clean machine — see
rotate **fake** credentials in an **isolated** gopass store. Nothing there can
touch a real store or provider.
+## Browser-based rotation (Phase A engine)
+
+The site-side rotation engine ([`internal/browserrot`](internal/browserrot)) drives a
+**real** headless Chromium end-to-end — no language model in the loop:
+
+
+
+
+
+
probe
"); err != nil {
+ t.Fatalf("Goto: %v", err)
+ }
+ ss, ok := sess.(*sidecarSession)
+ if !ok {
+ t.Fatalf("expected *sidecarSession, got %T", sess)
+ }
+ sig, err := ss.Probe(ctx)
+ if err != nil {
+ t.Fatalf("Probe: %v", err)
+ }
+ t.Logf("stealth signals via %s: %+v", sig.Driver, sig.Signals)
+ if sig.Driver != "patchright" {
+ t.Fatalf("stealth requires the patchright driver; got %q — run npm install patchright", sig.Driver)
+ }
+ if sig.Signals.Webdriver {
+ t.Fatal("navigator.webdriver is TRUE — stealth posture failed (bot tell present)")
+ }
+}
+
+// A sidecar Session must satisfy the Session contract at compile time.
+var _ Session = (*sidecarSession)(nil)
diff --git a/lab/lab-provision-browserrot.sh b/lab/lab-provision-browserrot.sh
index a85fce3..2bd7829 100755
--- a/lab/lab-provision-browserrot.sh
+++ b/lab/lab-provision-browserrot.sh
@@ -48,8 +48,45 @@ echo "== using Chromium: $CHROME_BIN"
# Run from the repo root (the dir containing go.mod).
cd "$(git -C "$(dirname "$0")" rev-parse --show-toplevel 2>/dev/null || echo "$(dirname "$0")/..")"
-echo "== running the LIVE-VM browser-rotation proof =="
+# The Node sidecar (patchright real-fingerprint Chromium) is an OPTIONAL swap-in Driver
+# that must reach parity with go-rod. If a `node` runtime + the sidecar deps are present,
+# prove BOTH drivers through the identical harness; otherwise prove go-rod only.
+SIDECAR_DIR="internal/browserrot/sidecar"
+have_sidecar() {
+ command -v node >/dev/null 2>&1 && [ -d "$SIDECAR_DIR/node_modules/playwright-core" ]
+}
+
+echo "== running the LIVE-VM browser-rotation proof (go-rod) =="
CHROME_BIN="$CHROME_BIN" go test -run TestIntegration_realBrowserRotation -v ./internal/browserrot/
+if have_sidecar; then
+ echo
+ echo "== running the LIVE-VM browser-rotation proof (node-sidecar, parity) =="
+ node --version | sed 's/^/ node /'
+ CHROME_BIN="$CHROME_BIN" go test -run TestIntegration_sidecarBrowserRotation -v ./internal/browserrot/
+
+ if [ -d "$SIDECAR_DIR/node_modules/patchright" ]; then
+ echo
+ echo "== M-B2 stealth: patchright fingerprint + humanized input =="
+ CHROME_BIN="$CHROME_BIN" go test -run 'TestIntegration_sidecarStealth' -v ./internal/browserrot/
+ else
+ echo
+ echo "== M-B2 stealth SKIPPED (patchright not installed) =="
+ echo " to enable: (cd $SIDECAR_DIR && npm install patchright)"
+ fi
+
+ echo
+ echo "== M-B3 self-heal: rotted selector -> Tier-2 heal -> rewrite recipe (no secret to heal) =="
+ CHROME_BIN="$CHROME_BIN" go test -run 'TestIntegration_sidecarSelfHeal' -v ./internal/browserrot/
+else
+ echo
+ echo "== node-sidecar SKIPPED (no node runtime or deps not installed) =="
+ echo " to enable: (cd $SIDECAR_DIR && PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD=1 npm install)"
+fi
+
+echo
+echo "== secret-seam leak guard (browser-free) =="
+go test -run TestSidecar_secretSeamBase64 -v ./internal/browserrot/
+
echo
echo "LIVE-VM BROWSER-ROTATION ENGINE PROOF PASSED"