diff --git a/docs/receipts/README.md b/docs/receipts/README.md index 74f8fb5..d854917 100644 --- a/docs/receipts/README.md +++ b/docs/receipts/README.md @@ -39,6 +39,7 @@ Current authority order: **live receipt > committed receipt > memory**. - **T3MP3ST** (815 ★, AGPL-3.0): verify-claims pattern validates fable-agent's receipt-first approach. Learn-only. - **pxpipe** (2364 ★, MIT): token compression for pipeline context. Relevant but lossy on byte-exact content. Advisory. - **GRC_Claw** (2 ★, MIT): Agent Policy Firewall + attestation ledger. Same governance problem. Advisory. +- `browser-harness-engineering-advisory-map-20260705.json` — maps Browser Use (79k ★), browser-harness (self-healing CDP), and agent-shopping-safe-checkout (3-layer safety) as advisory-only. Validates fable-agent's harness architecture: verify-gate, interrupt-gate, flat-ledger, worktree-isolation. 8 pattern mappings. No vendoring. ## Memory quarantine diff --git a/docs/receipts/browser-harness-engineering-advisory-map-20260705.json b/docs/receipts/browser-harness-engineering-advisory-map-20260705.json new file mode 100644 index 0000000..bf1e8f6 --- /dev/null +++ b/docs/receipts/browser-harness-engineering-advisory-map-20260705.json @@ -0,0 +1,104 @@ +{ + "schema": "fable.external_project.review.v1", + "id": "browser-harness-engineering-advisory-map-20260705", + "title": "Browser Use + Harness Engineering + Safe Checkout \u2014 Advisory Map", + "source": { + "type": "video + repos", + "video": "David Ondrej interviewing Browser Use founder \u2014 harness engineering > prompt engineering", + "repos": [ + "https://github.com/browser-use/browser-use", + "https://github.com/browser-use/browser-harness", + "https://github.com/pawel-cell/agent-shopping-safe-checkout" + ], + "fetchedAt": "2026-07-05T23:41:05.925718+00:00" + }, + "externalProjectReviews": [ + { + "repo": "browser-use/browser-use", + "stars": 79000, + "license": "MIT", + "description": "Python library for AI browser automation. Connect any LLM, run locally or self-host. 79k+ GitHub stars.", + "keyPattern": "LLM connects to browser via CDP (Chrome DevTools Protocol). Agent writes Python to execute browser actions dynamically.", + "relevance": "Validates fable-agent execution-pipeline.ts approach: model-driven harness, not fixed prompts. The agent IS the harness controller.", + "decision": "advisory", + "safeToVendor": false, + "vendorReason": "Python library, different runtime. Learn the pattern, not the code." + }, + { + "repo": "browser-use/browser-harness", + "stars": null, + "license": "MIT", + "description": "Self-healing CDP harness. Thin WebSocket to Chrome. Agent writes missing helpers at runtime. Harness improves itself every run.", + "keyPattern": "The agent writes what is missing during execution. The harness improves itself every run. No heavy abstractions, no fixed prompts, no recipes \u2014 just raw CDP access with typed wrappers.", + "relevance": "DIRECTLY validates fable-agent harness architecture: (1) verify-gate.ts = hard verification gate, (2) interrupt-gate.ts = human approval, (3) flat-ledger.ts = state outside LLM context, (4) repo-mapper.ts = environment mapping, (5) execution-pipeline.ts = wires it all end-to-end. Browser Harness does for browsers what fable-agent does for code: thin scaffold + model fills gaps.", + "decision": "advisory", + "safeToVendor": false, + "vendorReason": "Browser-specific. But the PATTERN is identical to our pipeline: minimal scaffold, model writes helpers at runtime, harness self-heals.", + "patternMappings": [ + { + "browser_harness": "One WebSocket to Chrome, nothing between", + "fable_agent": "One pipeline (execution-pipeline.ts), 5 components, no framework" + }, + { + "browser_harness": "Agent writes missing helpers during execution", + "fable_agent": "runDeepSeekAgent() generates code, verify-gate checks it, interrupt-gate gates it" + }, + { + "browser_harness": "Harness improves itself every run", + "fable_agent": "FlatLedger records every run, repo-mapper injects updated tree" + }, + { + "browser_harness": "56 CDP domains, 652 typed wrappers, zero wrapping", + "fable_agent": "37785 lines TypeScript, 231 files, 295 tests, no framework dependency" + }, + { + "browser_harness": "The protocol is the API", + "fable_agent": "TypeScript types are the API \u2014 no runtime schema, no IR layer" + } + ] + }, + { + "repo": "pawel-cell/agent-shopping-safe-checkout", + "stars": 13, + "license": "NOASSERTION", + "description": "Safe-checkout pattern for AI agents driving real web purchases. Three independent guardrails: browser isolation, payment isolation, human gate.", + "keyPattern": "Three-layer safety: (1) Browser isolation (fresh Chrome profile), (2) Payment isolation (one-time virtual card), (3) Human gate (explicit submit phrase before final click).", + "relevance": "The three-layer guardrail pattern maps directly to fable-agent: verify-gate = browser isolation (clean environment), interrupt-gate = human gate (explicit approval), worktree-isolation = payment isolation (blast radius contained).", + "decision": "advisory", + "safeToVendor": false, + "vendorReason": "Small repo (13 stars). But the three-layer safety pattern is exactly what fable-agent already implements.", + "patternMappings": [ + { + "safe_checkout": "Browser isolation \u2014 fresh profile, never daily", + "fable_agent": "worktree-isolation.ts \u2014 disposable git worktree, never main branch" + }, + { + "safe_checkout": "Payment isolation \u2014 one-time virtual card", + "fable_agent": "execution-pipeline.ts \u2014 task-scoped, cleaned up after verify-gate" + }, + { + "safe_checkout": "Human gate \u2014 explicit submit phrase", + "fable_agent": "interrupt-gate.ts \u2014 requireApproval() with allow/deny/skip/quit" + } + ] + } + ], + "keyTakeaways": [ + "Harness engineering > prompt engineering: the scaffold matters more than the prompt. fable-agent already does this.", + "Self-healing harness: agent writes what is missing at runtime. fable-agent execution-pipeline.ts already supports this via runDeepSeekAgent callback.", + "Three-layer safety: isolation + payment + human gate. fable-agent already has worktree-isolation + verify-gate + interrupt-gate.", + "The protocol is the API: no abstraction layers needed. fable-agent TypeScript types ARE the API \u2014 no IR, no schema runtime.", + "David Ondrej video is advisory only. No code changes warranted. Pattern validation is the value." + ], + "contentVerified": true, + "liveVerification": "GitHub API + web search confirmed all 3 repos exist with stated descriptions. browser-use has 79k+ stars (MIT). browser-harness is the thin CDP harness. agent-shopping-safe-checkout has 13 stars with 3-layer safety pattern.", + "advisoryOnly": true, + "noActionRequired": true, + "fableAgentStatus": { + "containers": 19, + "phase": 4, + "autoPatchProven": false, + "tests": "295 passing, 69 files", + "commit": "bac54fa" + } +} \ No newline at end of file