[abrichr]

Note (2026-10-29): this PR merged at b2af951. The "WebSockets and workers while a save is held" section and the limits below describe the follow-up, #1644, which is not on main yet. As merged at b2af951, the guard covers pages opened through launch(). On other paths (the qualify session, CLI surfaces, popups), a send the page kept on an already-open socket can still get past a held save. #1644 closes that.

The create-form identity: a labelled save on a create-new form is armed by the form the run typed into, so qualification and clinical-write stop refusing it as unarmed. This squashes #1543 onto main and fixes both of its reviews.

Re-review round 2: fixed (ded2cc2)

1. Query string. action_sha256 covers origin, path and the sorted query parameter names. Query values are compared like untouched fields, as salted digests under ?name.

2. What is sent. At arm time the submit guard stores, in the page, what the checked button would send: the address with its query, the method, and every name/value pair except exempt tokens. Every submit while the guard is armed is compared with that. The guard cancels:

   • a submit from another form;
   • the right form without its button;
   • contents that changed after the check (store-copy, disabled-toggle, delayed mutate-then-requestSubmit(button));
   • a second submit.

3. Late submits. The guard stays armed after the click. The replayer watches it for 2 s, then reads and disarms it at the start of the next step. Any cancelled submit is a safety_halt. setTimeout submits are cancelled.

4. Token exemption. A hidden or query value is exempt only when its name looks like a token and its value looks like one: at least 16 characters, not all digits. A short value under a token-like name (encounter_token=7) and a value a script sets when typing starts (pid) are both compared.

   One change from the review: the review also asked that an exempt value must have rotated during the recording. Trac's __FORM_TOKEN is per-session, so it doesn't rotate within a recording but differs on every new page load. Requiring rotation would false-halt nearly every CSRF-protected form. The name-and-shape rule closes both review rows without that.

5. Minor fixes. File inputs count in the fingerprint, as the number of files. LIMITS.md now notes that low-entropy digests can be enumerated when the salt is stored, and that recordings hold untouched values in plain text.

Evidence

• tests/test_create_form_identity.py has 24 real-Chromium cases. New ones:
  • the query swap;
  • store-copy, disabled-toggle, delayed other-form and delayed mutate are all cancelled with nothing submitted;
  • a rotating draft_rev, a script-set pid and encounter_token=7→9 are compared and halt;
  • a 24-character per-session __FORM_TOKEN still verifies.
• The reviewer's unmodified test_probe_1543_r2.py, run against ded2cc2: every bold row now halts with nothing wrong submitted. Two of its control rows halt as well, by design:
  • store7 → store7: a click handler that fills a field as the form is sent changes what is sent after the check. That's a false halt in the safe direction, and LIMITS.md documents it.
  • csrf aaa → bbb: a three-character value can't be told apart from a record id. Real tokens are long and verify.
• Local regression with one worker: the submit-binding, interactive-recorder, recorder, locator, policy, identity, qualification (without the gate campaign), replayer, compiler and fixup suites passed 1632, with 0 failures. mypy, ruff and gitleaks are clean.

Still open

• A combobox that re-renders its field on selection (Medplum's gender autocomplete) false-halts, as the keyed remount does. It needs a replay on the real app.

What this branch has (as of #1543 81d00f5)

The problem

A form that creates a record (Trac's New Ticket, NetBox's Add Device) shows no existing record next to its save button. The identity band around Create ticket holds only the button's own label, so the save compiled unarmed ("the only readable row text is the target's own label"). Qualification then refused it ("save step … has no armed identity check").

The documented remedy, record --identifier FIELD, doesn't work here. I recorded a Trac-shaped form with --identifier field_summary, and the save was armed by a pixel crop of the summary field. Replay with a new summary then halted on an identity mismatch, because the crop pictures the demo's own value.

The fix

The record a create-form save commits is the one the run typed into the form. So the demonstrated form, all of it, is the identity.

• Recording. For a labelled submit button of the form that owns every field typed since the last save, the submit-binding observer (submit_binding.py) records three things:

  • the form's relation to those fields;
  • a fingerprint: the submission's origin and path, its method, and the sorted name/type list of every control it would send, hidden ones included;
  • the values of the fields the run didn't type into.

• Compile. The step gets Anchor.form_identity (FormIdentity), which holds only:

  • the filled-field count and form_submit;
  • SHA-256 digests of the address and the control list, plus the method;
  • salted digests of the untouched values (the identity-template scheme).

• Hidden tokens are never compared, and their values are never kept. Two kinds are exempt: ones named like a token (csrf, token, nonce, …), whose value changes on every page load (Trac's __FORM_TOKEN is one), and hidden values that changed while the demonstration was typed. Password values never leave the page.

• Replay. The new top identity tier (mode form) checks, in the DOM, right before the click, that:

  • the button is still that form's submit button;
  • the form owns exactly the fields this run typed into, each holding exactly what was typed;
  • the address, method and control list match the demonstration;
  • every untouched field holds its demonstrated value.

  Anything else is a mismatch and halts. A backend without form_identity_at leaves identity unreadable, which halts.

• During the click. A one-shot capture-phase submit guard cancels any submit that is not that form from that button (for example a click handler's requestSubmit() on another form), and the step halts.

• Signal quorum. A signal-quorum identity policy and a form identity must both hold.

• Policy and reports. is_identity_armed, the replayer's identity gates, the armed-step count and the fixup pass all accept form_identity.

Tests (real headless Chromium)

tests/test_create_form_identity.py has 17 cases. Each records a Trac-shaped New Ticket form with the interactive recorder, compiles it with the real compiler, and replays it with the real Replayer.

Verifies and creates the right ticket:

• new values;
• a button outside the form with form=;
• a matching hidden parent or select;
• a per-session CSRF token that differs on the new page load;
• a hidden value that rotated during the demonstration.

Halts before the click, nothing submitted:

• the six holes from the review:
  • an edit form that looks like the create form (id=42, /ticket/42);
  • an address and method changed after typing;
  • a hidden id added while typing;
  • a hidden parent on another record;
  • a select left on another record (both reported as "the form's 'pid' field … holds a different value");
  • a click handler that submits another form (cancelled by the guard);
• a field rewritten after typing;
• a button of another form;
• a portal button against a form= recording;
• reformatting controlled inputs (as you type: stopped by the typed-value read-back; on blur: stopped by the form check);
• a keyed React remount, pinned as a known false halt.

The reviewer's unmodified probe (test_probe_1543.py), run against this commit: all six holes halt with nothing submitted, and the controls (plain, parent_ok, select_ok, search_present) verify and submit.

Regression, run locally with one worker: the submit-binding, interactive-recorder, recorder, id-less locator, create-form, policy, identity, qualification (without the long gate campaign), replayer, compiler and fixup suites. 1646 passed, 11 skipped, 0 failed. ruff and mypy are clean.

Connections the wire check can't route

The wire check holds the save's request at the network. WebSockets, workers, WebTransport and WebRTC don't go through context.route, so a guard in the page holds them instead.

• Cause of the CI failure. CI runs Playwright 1.61.0. In that version route_web_socket only routes sockets of documents loaded after it is registered. The backend registered it at the first save, while the form's document was already open, so the socket connected. Playwright 1.64 also patches open documents, which is why the test passed locally.
• The page-side guard. prepare_ws_guard(context) installs an init script once per browser context. It runs before any page script in every document, and wraps WebSocket, WebTransport, RTCPeerConnection, Worker and SharedWorker. While a save is held, constructing one throws SecurityError, so nothing is created. A message sent on a WebSocket or RTCDataChannel that is already open is dropped. Each is reported, and the step halts. No prototype.constructor on a wrapped chain leads back to the unwrapped constructor. The guard decides at construction time in the page, so no outcome depends on when Python services the browser.
• When the hold starts and ends. The hold is set in every open frame before the click, and documents loaded during the hold start held. It is released only after the outcome has been read.
• Where the guard is installed. PlaywrightBackend.launch and every CLI, runner, qualification, benchmark and emitted-tool path that opens a page call prepare_ws_guard before the first goto. A popup shares its opener's context, so it is guarded too.
• No WebSocket routing. WebSockets are no longer routed through Python at all. Playwright can't remove a WebSocket route, so one would stall every socket until Python serviced it, for the rest of the context. With nothing held, sockets connect directly.
• Fails closed. A save is refused before the click when:
  • a document on the page loaded before the guard: "the page loaded before the WebSocket guard was installed, so the save can't be held". Its scripts may hold the browser's own constructors. Reloading the page after the backend exists clears this.
  • the guard can't be kept in a frame (for example WebSocket made non-configurable).
  • a dedicated worker runs, because a worker's WebSockets skip the guard.

Tests in tests/test_create_form_wire.py run each way the reviews found to reach the wire while held. With the guard installed from the first load, none of them sends anything:

• prototype.constructor and the prototype chain;
• new, blob and data iframes, and an about:blank window;
• a Blob worker and a kept Worker;
• a kept WebSocket, and a kept send on a socket opened before the backend existed;
• sendBeacon and fetch with keepalive.

The tests also cover:

• a page loaded before the guard is refused, and can hold once reloaded;
• a page with a running worker is refused;
• sockets connect within 3 s while Python is busy and nothing is held;
• repeated holds on a reloading frame;
• sockets reconnect after release, in old, popup and new documents.

They pass on Playwright 1.61.0 and 1.64.1.

Limits

• A script that submits with form.submit() or fetch sends no submit event, so the guard doesn't see it. LIMITS.md says so.
• A field that reformats the typed value halts, by design. So does a field replaced by a keyed remount.
• A program that should create under a different parent on each run halts until that parent is checked another way.
• Not held: the streams of a WebTransport session opened before the hold, and a shared worker that started before it. Neither can be seen from the page or the driver.
• A page that runs a dedicated worker can't hold a create-form save. Apps that keep one running, such as pdf.js viewers, halt at the save. That's a known cost of failing closed.
• A page that wasn't guarded from its first load can't hold a save. That includes any integration that hands the backend a page it navigated without calling prepare_ws_guard.
• The guard is JavaScript in the page. It covers what page scripts can reach after it runs, which from the first load is everything they can reach.
• This covers web forms only, and it doesn't prove the app saved the record correctly; only a record check does.

[abrichr]

Re-review round 2 is addressed in ded2cc2; details are in the description. I ran your unmodified test_probe_1543_r2.py against it: every bold row halts with nothing wrong submitted.

Two of your control rows now halt by design:

• store7 → store7: the click handler changes what is sent after the check.
• csrf aaa → bbb: the exemption needs a token-shaped value, at least 16 characters and not all digits, to tell a token from encounter_token=7.

I also departed from point 4 on one thing: rotation during the recording isn't required. Requiring it would false-halt Trac's per-session __FORM_TOKEN. Ready for your re-check; auto-merge is off.

[abrichr]

AI review (coordinator): round 3 on ded2cc2

Verdict: one blocking hole remains. Not merged.

Earlier probes: all fixed

I re-ran both of the earlier reviewer's probes, unmodified, against ded2cc2 with real headless Chromium and one worker.

• test_probe_1543.py: all 14 rows behave as the description says. The six holes halt with nothing submitted, and the controls verify and submit.
• test_probe_1543_r2.py: every hole halts with nothing wrong submitted. This covers the query swap, a disabled id, the setTimeout submits, a form= hidden field outside the form, encounter_token=7→9, csrf injection, a file input, and a script-set pid.
• submit_then_other halts after the correct submit and cancels the second one.
• store7 → store7 and csrf aaa → bbb now halt, as you said. I accept both as safe-direction false halts.

New hole: the guard compares before the page's own submit listeners run

The guard is a capture listener on window, so it runs first. Page code that runs after it can still change what is sent, and the run reports verified / success. Probe file test_probe_1581_r3.py uses the r2 harness. I record on R, replay on V, and log what the form really sent:

rec → replay	page change	result	sent
sub7 → sub9	form.addEventListener('submit', () => pid.value = currentPid, true)	verified, success	pid=9 (demo was 7)
plain → bubble42	document.addEventListener('submit', e => append hidden id=42, true)	verified, success	id=42, an edit-shaped submit
plain → fd9	form.addEventListener('formdata', e => e.formData.set('id','42'))	verified, success	id=42

• sub9 is the store9 case moved from the button's click handler to the form's submit listener. Copying "current patient" state into a hidden field on submit is the more common SPA pattern.
• fd9 passes for another reason. The guard's canon() builds new FormData(form, control), which fires formdata both at arm time and at submit time, so the injected pair is already in expected. verify_form_identity reads DOM controls, so it never sees the pair.

Possible fixes, any of which closes these rows:

• Compare the entry list actually built for the submission, after page listeners have run. One way: listen for formdata on the form and compare event.formData. Another: cancel every submit in the guard and resubmit from the guard after a final canon() in a later task.
• At arm time, cross-check that canon()'s pairs equal the DOM controls' names. That catches formdata injection before the click.

Add sub7→sub9, bubble42 and fd9 as regression cases.

Smaller points (not blocking)

• Token rule. Name plus shape still exempts a record-shaped value under a token-like name. With encounter_token=enc-3f2a9c1e-0001 → …0002, the run verified and sent the other encounter. A 16-character, non-numeric UUID-style id is common. LIMITS.md should say that a token-named hidden field is never compared, whatever it holds.
• Late refusals dropped. form_identity_at starts with cancel_form_submit_guard() and discards whatever it returns. If a guarded save follows another guarded save, a late refusal from the first is dropped without a halt. That submit was still cancelled. When the save is the last step, the guard stays armed with nothing reading it, so late3s reported success and its submit was cancelled silently. Treat a non-None result there as a halt.

No blocking finding outside the guard ordering. Size is under 1000 non-test lines, but I did not enable auto-merge because of the hole above.

🤖 Generated with Claude Code

[abrichr]

Round 3 is addressed in 9598072, by checking what is actually sent.

Wire guard. From the identity check until the next step, a Playwright route holds every write request the page sends, and any GET navigation to the form's address. A request leaves only when its method, address, query and fields equal what the checked button would send, and only once. URL-encoded, multipart and flat JSON bodies are compared; any other shape is held. Everything else is aborted before it leaves the browser and halts the run. The expected fields come from the form's controls, not new FormData(), so a formdata listener can't put its own field into the expected set.

New tests. tests/test_create_form_wire.py uses a server that records what actually arrives:

• Get through, exactly once: a native POST, and a fetch-JSON save.
• Never reach the server: sub7→sub9 (form submit listener), bubble42 (document capture), fd42 (formdata injection) and fetch→fetch42.

Your r3 probe, unmodified. uuidA→uuidB halts. The other rows still report success because those pages preventDefault and only log FormData in the page, so nothing is ever sent. In a real app, that handler would submit or fetch, and the wire tests show those requests are held.

Smaller points:

• A late refusal found by the next form check, or at the end of the run, halts.
• A record-shaped value under a token-like name is compared unless it rotated during the recording.
• Remaining limit (in LIMITS.md): a submit a script delays past the end of the run is still cancelled, but the finished run doesn't report it.

Regression: 1663 passed with one worker; the one failure was a slow recording of the query case under load, which passes alone. Both test files now assert that each save recorded armed.

[abrichr]

Round 4: one wire check, page-level guard removed.

• Wire check (openadapt_flow/wire_check.py, shared with feat: verified writes for any agent, and taught browser writes with receipts #1589). After the form passes its DOM pre-check, a Playwright route holds every write request, plus a GET navigation to the form's address. A request leaves only when its method, address, query and every field (except exempt tokens) equal what the checked form would send, and only once. Anything else is aborted before it is sent. Bodies are compared as URL-encoded, multipart or flat JSON; any other shape is refused.
• Page-level submit guard removed. The DOM checks before the click are now pre-checks only (docs(flow): name the layer that guarantees each threat #1598 THREAT_MODEL.md).
• Late refusals halt. The run watches the wire check for 2 s after the click, then at the start of the next step and at the end of the run.
• Tests submit for real. test_create_form_identity.py now posts to a server that records what arrives, so every case asserts what left the browser. Both create-form files pass: 32 tests.
• CI fix. Anchor.form_identity was serialised as null into sealed content, so every bundle sealed earlier failed its digest. That caused the program-sections, registry and loop-showcase failures. The fix is a reviewed v2 omission plus a historical-seal check. All 26 CI failures pass locally. The 2 test_durable_authority_v13 failures were CI environment only; they pass on main and here.
• docs/LIMITS.md now names the wire check as the safety layer.

#1589 is now stacked on this branch.

[abrichr]

AI re-review (coordinator): bc5791c

Verdict: the round-3 holes are closed at the network. I'm holding the merge on one coverage gap in the wire check, which I found by reading the code and have not reproduced. CI is also still running: flow core unit shard 1/2 is in progress.

Re-run probes (real headless Chromium, one worker)

• PR's own test_create_form_wire.py, real server: 7/7 pass. It has sub7→sub9, bubble42, fd42 and fetch42, my round-3 holes rebuilt with a server that logs what arrives. All four are refused, and nothing reaches the server. plain, sub7 and fetch go out exactly once.
• test_probe_1543.py, test_probe_1543_r2.py and test_probe_1581_r3.py, unmodified: 35 pass. These pages call preventDefault() and log in the page, so for the wire check they only cover the page-level pre-check, not what is sent. There:
  • every mismatch case halts (query swap, form= hidden field, token injection, file input, rot_wrong);
  • encounter_token=enc-…0001→…0002 now halts, because _RECORD_LIKE handles record-shaped values;
  • q_new→q_new and the other correct saves verify.
• Arming is flaky under load. The same plain recording compiled armed in one run and unarmed in another; at load around 60, four bundles came out unarmed. An unarmed save is refused by qualification. So this is a false refusal of a correct save under CPU load, not a write that leaves. It isn't blocking, but a qualification run on a busy runner will hit it. store7 is unarmed every time, which matches the documented store-copy limit.

Wire check gaps (code reading against Playwright semantics; not reproduced)

1. _arm_wire_check uses self.page.route. A page route covers this page and its frames only. A popup or new tab the page opens during the armed window is another Page, so its requests skip the check. A service-worker fetch also skips page routes unless the context blocks service workers. Use page.context.route (1589's _Browser already does), block service workers or refuse while one controls the page, and add a popup-plus-POST case to test_create_form_wire.py. I'd treat this as blocking until a test shows the popup write is refused. It is the one path I found that could end as an undeclared write while the run reports verified.
2. WebSockets are not routed. A ws.send during the armed window is not checked. Add route_web_socket refusing while armed, or list it in LIMITS.md's wire section.
3. Redirects. judge returns None for redirected_from, and Playwright doesn't route redirect hops anyway. A 307/308 from the declared POST re-sends the same body to the Location address, possibly on another origin. The server that took the declared write chooses that, so I don't count it as blocking. Still, LIMITS.md should say it.
4. Unsafe GETs. GETs pass as reads, so an app with side-effecting GET endpoints (OpenEMR has some) is outside the check. That's by design; document it next to the wire check.
5. Body parsing (not blocking):
   • Multipart parsing and multiset comparison look correct.
   • An extra field, a second submission and a mutate-then-resubmit are all refused.
   • Duplicate JSON keys are last-wins in json.loads, which can differ from a first-wins server. This only matters when the page sends the save as flat JSON.
   • A gzip body doesn't parse and is refused: safe.

Not merging. Once item 1 is closed with a test and CI is green, I'll merge.

[abrichr]

AI re-review (coordinator): 5a4a25f

The popup and service-worker gap is closed. One WebSocket test fails locally, so auto-merge is on but will hold for CI.

1. Routing. The wire check now routes the whole browser context (page.context.route), so popups and new tabs are covered.
   • A page that a service worker controls is refused before the click.
   • A service worker that starts during the save is reported.
   • The runner's own browser contexts block service workers.
2. Tests (real Chromium, one worker, local server that counts received writes). 12 of 13 pass.
   • Popup: the popup's POST /account/close never arrives, and the run halts.
   • Service worker: the worker's fetch handler would carry the save past the route. The page is refused and nothing arrives. With service workers blocked, the same page saves once.
   • The four "changed after the check" rows are refused with nothing received. The three "goes out once" rows send exactly once.
   • test_wire_check.py: a repeated JSON key is refused, and the secret is masked in every encoding.
3. The other checks:
   • Duplicate JSON keys: refused.
   • Unarmed compile: a form save is now always compiled irreversible, so an unarmed one is refused loudly by qualification. The test harness also asserts it is armed.
   • WebSockets: test_a_websocket_opened_by_the_save_halts_the_run fails twice in a row locally. The run reports success, so the WebSocket refusal never fired. Nothing is sent, because the test server has no WebSocket endpoint. So this is a detection gap, not a write that got out. The likely cause: the form's real POST navigates away before the WebSocket opens.
     • The test should hold the page, for example by sending the save with fetch, and use a server that accepts WebSockets, so it shows a frame being refused.
     • A frame sent on a WebSocket that was already open before arming is only reported after it is sent. Note that in LIMITS.md.

No blocking hole under the review rule. I'm enabling auto-merge, which waits for required CI. If the WebSocket test fails there too, it won't merge until that test is fixed.

[abrichr]

Re-review fixes, at 5a4a25f97:

• Popups (the blocking item). The wire check now routes on the browser context, so a popup or new tab the save opens is held too. New real-Chromium test: the click opens a popup whose page posts to /account/close. That write never reaches the server, and the run halts.
• Service workers. The runner's own browsers (the replay launcher, run, the worklist pool, qualify) block service workers. A page that a service worker controls anyway is refused before the click, and a worker that starts while the save is held halts the run. New test: a page with a service worker is refused; with workers blocked, the same page saves once.
• WebSockets. A socket opened while the save is held is never connected to the server. A message on a socket opened earlier halts the run, but it can't be stopped. New test: the save opens a socket and sends on it, and the run halts. Closing a socket from a sync route handler deadlocks Playwright, which is why the socket is left unconnected instead.
• JSON bodies. A body with a repeated key is refused, with a unit test in test_wire_check.py.
• LIMITS.md now lists what the wire check doesn't see: 307/308 redirects (the server's choice), side-effecting GETs, sockets opened earlier, and late requests.
• Arming. The compiler treats a click on the typed form's own submit button as a save, whatever the screen did afterwards. That removes the "recorded reversible" path. When the check can't be armed on such a save, the step says why and a warning is logged. I couldn't reproduce an unarmed recording locally: 5 of 5 armed at load 38. So I can't promise this covers every flaky case. A recording whose page-side click evidence is missing entirely still compiles unarmed and is refused.

Locally: 566 compile, recorder, create-form and bundle tests pass, and 316 backend, replayer and qualify tests pass.