feat(console): isolate production browser acceptance

.github/workflows/ci.yml

@@ -112,6 +112,10 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
+      - name: Verify Console workspace package
+        run: >-
+          node -e "const fs=require('fs'); const p=JSON.parse(fs.readFileSync('apps/console/package.json','utf8')); for (const name of ['typecheck','test','build']) { if (typeof p.scripts?.[name] !== 'string' || p.scripts[name].trim() === '') throw new Error('apps/console script is missing: ' + name); }"
+
       - name: Typecheck frontend
         run: pnpm typecheck
 
@@ -121,6 +125,132 @@ jobs:
       - name: Build frontend
         run: pnpm build
 
+  console-browser-acceptance:
+    needs: frontend
+    runs-on: ubuntu-latest
+    timeout-minutes: 40
+    env:
+      # Deterministic CI-only fixtures. These values are never production
+      # configuration and are not written into the imported Console source.
+      POSTGRES_USER: nekiro_console_acceptance
+      POSTGRES_PASSWORD: nekiro-console-acceptance-only
+      POSTGRES_DB: nekiro_console_acceptance
+      POSTGRES_PORT: "55432"
+      CONTROL_PLANE_PORT: "18080"
+      A2A_ROUTER_PORT: "18081"
+      NEKIRO_COMPOSE_DATABASE_URL: postgresql://nekiro_console_acceptance:nekiro-console-acceptance-only@postgres:5432/nekiro_console_acceptance?sslmode=disable
+      NEKIRO_DEV_AUTH_PRINCIPALS_JSON: '[{"id":"root-console-provider","tokenSha256":"4def860d949646b1515e6d28096af112224f06cf6a5941ab0ac51b9a458b1252"},{"id":"root-console-owner","tokenSha256":"4162f45cb0487cc2205850cc622fbecaa976a87f7aae8a96fa1676e2a984d2ac"}]'
+      NEKIRO_INTERNAL_DEV_AUTH_PRINCIPALS_JSON: '[{"id":"root-console-router-internal","tokenSha256":"4285e7349a2517fbdbfac9c1bc072a5ff1ef702d6cfe1826d62f02d73334bdc0"}]'
+      NEKIRO_ROUTER_SERVICE_PRINCIPALS_JSON: '[{"id":"root-console-control-plane","tokenSha256":"e3a864d8b9d70000e50e42d94761cc5d5996a36f39137735dca3a830f23cf4ba"}]'
+      NEKIRO_ROUTER_AGENT_PRINCIPALS_JSON: '[{"workspaceId":"root-console-workspace","agentId":"runtime-a","tokenSha256":"fd59489764dad19b9c276a8fb0187fdb187f3de6b426467c0af9659edbe4159f"},{"workspaceId":"root-console-workspace","agentId":"runtime-b","tokenSha256":"43a0b80acc0b4436c4433b8313bc4c41cbb5534751c458f6e2cfe4af602ca34f"}]'
+      NEKIRO_ROUTER_INTERNAL_BEARER_TOKEN: root-console-router-internal-token
+      NEKIRO_CONTROL_PLANE_SERVICE_TOKEN: root-console-control-plane-token
+      NEKIRO_CORS_ALLOWED_ORIGINS: http://127.0.0.1:4173
+      NEKIRO_ENDPOINT_CHALLENGE_TTL_SECONDS: "300"
+      NEKIRO_ENDPOINT_VERIFICATION_TIMEOUT_MS: "10000"
+      NEKIRO_ENDPOINT_ALLOWED_PRIVATE_HOSTS_JSON: '["runtime-a","runtime-b"]'
+      NEKIRO_CONTROL_PLANE_INTERNAL_REQUEST_MAX_BYTES: "1048576"
+      NEKIRO_GATEWAY_INVOCATION_REQUEST_MAX_BYTES: "1048576"
+      NEKIRO_GATEWAY_SSE_EVENT_MAX_BYTES: "65536"
+      NEKIRO_GATEWAY_METADATA_RESPONSE_MAX_BYTES: "1048576"
+      NEKIRO_GATEWAY_INVOCATION_DEADLINE_MS: "30000"
+      NEKIRO_ROUTER_INTERNAL_REQUEST_LIMIT_BYTES: "1048576"
+      NEKIRO_ROUTER_AGENT_REQUEST_LIMIT_BYTES: "1048576"
+      NEKIRO_ROUTER_CONTROL_PLANE_RESPONSE_LIMIT_BYTES: "1048576"
+      NEKIRO_ROUTER_AGENT_RESPONSE_LIMIT_BYTES: "1048576"
+      NEKIRO_ROUTER_A2A_EVENT_LIMIT_BYTES: "1048576"
+      NEKIRO_ROUTER_SSE_EVENT_LIMIT_BYTES: "65536"
+      NEKIRO_ROUTER_RESOLUTION_DEADLINE_MS: "30000"
+      NEKIRO_ROUTER_AGENT_DEADLINE_MS: "30000"
+      NEKIRO_ROUTER_AGENT_CREDENTIAL_ISSUER: https://a2a-router.nekiro.test
+      NEKIRO_ROUTER_AGENT_CREDENTIAL_KEY_ID: root-console-browser-key-1
+      NEKIRO_ROUTER_AGENT_CREDENTIAL_PRIVATE_KEY_BASE64URL: AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8DoQe_884Qvh1w3RjnS8CZZ-TWMJulDV8d3IZkElUxuA
+      NEKIRO_ROUTER_AGENT_CREDENTIAL_TTL_SECONDS: "30"
+      NEKIRO_AGENT_ROUTER_ISSUER: https://a2a-router.nekiro.test
+      NEKIRO_AGENT_ROUTER_KEY_ID: root-console-browser-key-1
+      NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL: A6EHv_POEL4dcN0Y50vAmWfk1jCbpQ1fHdyGZBJVMbg
+      RUNTIME_A_ROUTER_TOKEN: root-console-runtime-a-token
+      RUNTIME_A_RESPONSE_LIMIT_BYTES: "1048576"
+      RUNTIME_A_EVENT_LIMIT_BYTES: "65536"
+      RUNTIME_B_ROUTER_TOKEN: root-console-runtime-b-token
+      RUNTIME_B_RESPONSE_LIMIT_BYTES: "1048576"
+      RUNTIME_B_EVENT_LIMIT_BYTES: "65536"
+      NEKIRO_E2E_BASE_URL: http://127.0.0.1:4173
+      NEKIRO_E2E_COMPOSE_PROJECT: nekiro-root-console-browser
+      NEKIRO_E2E_COMPOSE_FILE: ${{ github.workspace }}/deploy/compose.yaml
+      VITE_NEKIRO_API_BASE_URL: http://gateway.nekiro.test:18080
+      VITE_NEKIRO_PROVIDER_ID: root-console-provider
+      VITE_NEKIRO_PROVIDER_NAME: Root Console Provider
+      VITE_NEKIRO_PROVIDER_TOKEN: root-console-provider-token
+      VITE_NEKIRO_OWNER_TOKEN: root-console-owner-token
+      VITE_NEKIRO_DEFAULT_WORKSPACE_ID: root-console-workspace
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 11.3.0
+          run_install: false
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24.16.0
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Install frontend dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Map the Gateway to an explicit non-IP origin
+        run: echo "127.0.0.1 gateway.nekiro.test" | sudo tee -a /etc/hosts
+
+      - name: Start fresh platform Compose
+        run: docker compose --project-name "$NEKIRO_E2E_COMPOSE_PROJECT" --file "$NEKIRO_E2E_COMPOSE_FILE" up --build --detach --wait --wait-timeout 120
+
+      - name: Install Chromium
+        run: pnpm --dir apps/console exec playwright install --with-deps chromium
+
+      - name: Build production Console with explicit browser configuration
+        run: pnpm --dir apps/console run build
+
+      - name: Run production browser acceptance
+        run: pnpm --dir apps/console run test:e2e
+
+      - name: Capture sanitized console acceptance backend logs
+        if: always()
+        shell: bash
+        run: |
+          docker compose --project-name "$NEKIRO_E2E_COMPOSE_PROJECT" --file "$NEKIRO_E2E_COMPOSE_FILE" logs --no-color 2>&1 |
+            perl -pe '
+              BEGIN {
+                @secret_names = qw(
+                  POSTGRES_PASSWORD NEKIRO_COMPOSE_DATABASE_URL
+                  NEKIRO_ROUTER_INTERNAL_BEARER_TOKEN NEKIRO_CONTROL_PLANE_SERVICE_TOKEN
+                  NEKIRO_ROUTER_AGENT_CREDENTIAL_KEY_ID NEKIRO_ROUTER_AGENT_CREDENTIAL_PRIVATE_KEY_BASE64URL
+                  NEKIRO_AGENT_ROUTER_KEY_ID NEKIRO_AGENT_ROUTER_PUBLIC_KEY_BASE64URL
+                  RUNTIME_A_ROUTER_TOKEN RUNTIME_B_ROUTER_TOKEN
+                  VITE_NEKIRO_PROVIDER_TOKEN VITE_NEKIRO_OWNER_TOKEN
+                );
+                @secrets = grep { defined($_) && length($_) } @ENV{@secret_names};
+                @fixtures = qw(
+                  browser-json browser-sse
+                );
+              }
+              for my $value (@secrets, @fixtures) { s/\Q$value\E/[REDACTED]/g; }
+              s/\b[0-9a-f]{64}\b/[REDACTED-64-HEX]/g;
+              s{(?:[A-Za-z0-9_-]+\.){2}[A-Za-z0-9_-]+}{[REDACTED-ROUTER-CREDENTIAL]}g;
+              s/\b[A-Za-z0-9_-]{86}\b/[REDACTED-ED25519-SIGNATURE]/g;
+              s/\brtj_[A-Za-z0-9._:-]*/[REDACTED-ROUTER-JTI]/g;
+            '
+
+      - name: Tear down fresh platform Compose
+        if: always()
+        run: docker compose --project-name "$NEKIRO_E2E_COMPOSE_PROJECT" --file "$NEKIRO_E2E_COMPOSE_FILE" down --volumes --remove-orphans
+
   compose-config:
     runs-on: ubuntu-latest
     timeout-minutes: 15

AGENTS.md

@@ -3,9 +3,23 @@
 <!-- SPECKIT START -->
 For additional context about technologies to be used, project structure,
 shell commands, and other important information, read the current plan
-at specs/026-trusted-publication-acceptance/plan.md
+at specs/027-console-trusted-publication/plan.md
 <!-- SPECKIT END -->
 
+## Current delivery status
+
+Spec 027 has implemented the production Console, trusted publication operations,
+the reverse Runtime B -> Router -> Runtime A acceptance, and real frontend CI.
+The reviewed Console is imported under `apps/console`; root CI run
+`30322101411` passed seven workflow jobs plus the Codecov patch check (eight
+reported checks). Slice C is delivered through upstream PR
+#63 and Slice D is delivered through stacked upstream PR #64, satisfying the
+independent-PR scope gate. The historical Slice A T005 ordering deviation
+remains explicitly recorded in `specs/027-console-trusted-publication/tasks.md`
+and is not retroactively claimed as satisfied. The older Spec 026-only status
+paragraph below is retained as historical context and is superseded by this
+current delivery record.
+
 本文件是整个仓库的长期项目宪章，适用于所有目录、模块和参与者。它记录稳定的产品目标、领域语言、架构边界和交付标准，不替代具体需求、API 文档或 ADR。
 
 本文件应根据项目当前状态、已验证需求和正式架构决策持续自我更新迭代，但任何更新都必须说明原因与影响，并保持核心边界和兼容性变化清晰可追溯。

README.md

@@ -59,14 +59,21 @@ capability, Invocation, Task, parent lineage, Trace, and endpoint origin.
 Both sample Runtimes verify the credential and reject direct execution before
 runtime logic; stream cancellation receives a separate one-time `jti`.
 
-Frontend Console work remains paused and `apps/console` is not yet present. The
-thin Go Agent SDK, Router-owned nested adapter, isolated Runtime A, cross-Runtime
-nested invocation, and process/Compose wiring are implemented. CI run
-`30060752722` passed root build/test/race/vet/lint, Runtime A test/vet/race,
-PostgreSQL integration, Compose configuration, Frontend, Codecov, and the real
-authenticated Invoke-to-Record acceptance. The repository therefore proves
-the backend/headless Phase 1 loop, but not yet the user-facing Console or the
-later production governance and deployment integration stages.
+The production Console is now imported under `apps/console` and exercises the
+Gateway-only trusted workflow: Register -> Verify -> Publish -> Discover ->
+Install -> Invoke -> Record. It preserves the four isolated comparison demo
+routes, keeps provider and Workspace-owner credentials separate and transient,
+and displays Gateway-provided Invocation/Trace lineage. Root CI run
+`30322101411` passed seven workflow jobs plus the Codecov patch check (eight
+reported checks), including the fresh Compose backend
+acceptance and production `console-browser-acceptance`. The reverse backend
+slice is tracked by [PR #63](https://github.com/NeKiro-project/NeKiro/pull/63)
+and the stacked Console/CI integration by
+[PR #64](https://github.com/NeKiro-project/NeKiro/pull/64). The standalone
+Console source and its independently reviewed UI/browser PRs remain in
+[NeKiro-Console](https://github.com/NeKiro-project/NeKiro-Console). The
+historical Slice A T005 ordering deviation remains a process record, not a
+runtime behavior gap.
 
 The Go Workspace Client SDK under `sdks/client-sdk` is the application-facing
 entry point for invoking an installed Agent through Gateway. One immutable

apps/console/.env.example

@@ -0,0 +1,7 @@
+# NeKiro public Gateway configuration. Every value must be supplied explicitly.
+VITE_NEKIRO_API_BASE_URL=""
+VITE_NEKIRO_PROVIDER_ID=""
+VITE_NEKIRO_PROVIDER_NAME=""
+VITE_NEKIRO_PROVIDER_TOKEN=""
+VITE_NEKIRO_OWNER_TOKEN=""
+VITE_NEKIRO_DEFAULT_WORKSPACE_ID=""