Back to Details

tk-browser-verify

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Browser Verification

Browser Verification

Verify only 
browser-visible
acceptance criteria that require runtime evidence. Explicit invocation provides the criteria directly. Nested execution uses the target, scenario, authentication, and evidence plan already defined by a parent task such as a Ready 
seed.md
, 
tk-pr-respond
, 
tk-pr-sweep
, or 
tk-prototype
.
This is a read-only acceptance verifier. Do not modify product/test/configuration source, Git commits, or remote state. Do not create a Markdown lifecycle ledger. For nested execution, return only compact evidence to the parent task.
仅验证需要运行时证据的
browser-visible
验收标准。 显式调用会直接提供标准。嵌套执行会使用父任务已定义的目标、场景、认证和证据计划，例如Ready状态的
seed.md
、
tk-pr-respond
、
tk-pr-sweep
或
tk-prototype
。
这是一个只读的验收验证器。请勿修改产品/测试/配置源、Git提交或远程状态。 请勿创建Markdown生命周期台账。对于嵌套执行，仅向父任务返回简洁的证据。

Headless Prerequisites

无头环境前提条件

All required scenarios must be executable headlessly. Use this priority order:
  1. no authentication required
  2. reuse an existing safe, verifiable, run-owned authenticated session/profile
  3. temporarily inject user-supplied short-lived token/session material through a repository/application-supported header, cookie, or storage bootstrap
  4. use username/password only for fully non-interactive login without OTP, MFA, SSO, CAPTCHA, passkey, or device approval
Do not guess the authentication injection method. Tie it to repository/application evidence or a user-specified method and verify the resulting authenticated state.
Do not store usernames, passwords, tokens, OTPs, cookies, session values, recovery codes, or sensitive identities in the conversation, 
.tigerkit/*.md
, prompts, logs, summaries, or child receipts. Record only non-sensitive facts such as 
auth mode: token-headless
or 
authenticated state established
.
If safe headless authentication cannot be established, do not fall back to a visible browser; return 
Unverifiable
.
所有要求的场景必须能在无头模式下执行。请遵循以下优先级顺序：
  1. 无需认证
  2. 复用现有安全、可验证、运行所属的认证会话/配置文件
  3. 通过仓库/应用支持的请求头、Cookie或存储引导，临时注入用户提供的短期令牌/会话材料
  4. 仅在完全无交互登录（无需OTP、MFA、SSO、CAPTCHA、密钥或设备审批）的情况下使用用户名/密码
请勿猜测认证注入方式。需基于仓库/应用证据或用户指定的方式进行操作，并验证最终的认证状态。
请勿在对话、
.tigerkit/*.md
、提示词、日志、摘要或子任务回执中存储用户名、密码、令牌、OTP、Cookie、会话值、恢复码或敏感身份信息。 仅记录非敏感事实，例如
auth mode: token-headless
或
authenticated state established
。
若无法建立安全的无头认证，请勿回退到可见浏览器；返回
Unverifiable
。

🔴 CHECKPOINT · 🛑 STOP · Verification readiness

🔴 CHECKPOINT · 🛑 STOP · 验证就绪检查

Before browser or server execution, treat unresolved target, criterion, authentication, readiness, or evidence inputs as a hard stop: return 
Blocked
for a user-owned decision or 
Unverifiable
when safe verification cannot be established.
在浏览器或服务器执行前，若目标、标准、认证、就绪状态或证据输入存在未解决问题，需立即终止：若需要用户确认决策则返回
Blocked
，若无法建立安全验证则返回
Unverifiable
。

Parent Handoff

父任务交接

When possible, the parent task provides:
  • exact acceptance criterion
  • target URL/environment
  • headless requirement
  • auth strategy and secret-free bootstrap method
  • viewport/state
  • development server command/cwd/readiness
  • required screenshot evidence
  • sensitive capture/redaction rule
  • Pass condition
If the Ready Seed already owns this information, do not ask for the same decisions again. If required values are missing but can be safely determined from repository evidence, fill them in. Return only outcome-changing user-owned decisions to the parent owner.
父任务可能会提供以下信息：
  • 精确的验收标准
  • 目标URL/环境
  • 无头模式要求
  • 认证策略和无密钥引导方式
  • 视口/状态
  • 开发服务器命令/工作目录/就绪状态
  • 所需的截图证据
  • 敏感内容捕获/脱敏规则
  • 通过条件
若Ready Seed已包含这些信息，请勿重复询问相同决策。 若缺少必要值但可从仓库证据中安全获取，则自行补充。 仅将影响结果的用户决策返回给父任务所有者。

Execution

执行步骤

  1. Scope: Fix the exact criteria, target/environment, current candidate, and approved interaction boundary.
  2. Preparation: Read only the required references: environment, behavior, visual, accessibility, safety.
  3. Execution setup: Without installing new dependencies, use a native, Playwright-compatible, MCP, or verified CDP path. Any new Chrome/Chromium process must prove effective 
    --headless=new
    .
  4. Server: If the parent requires a development server, this verifier owns starting the background process, readiness checks, and cleanup. For standalone execution, present multiple plausible commands and get the user's choice before starting; do not choose arbitrarily. When the selected server is 
    react-scripts
    /CRA, include 
    BROWSER=NONE
    or the repository-documented equivalent to suppress auto-open. Manage PID/cwd/port/command and bounded logs as run evidence, and wait for a readiness signal rather than process exit.
  5. Verification: Start from a known state and inspect the required interaction and final state. Capture and actually inspect at least one non-empty run-owned screenshot for every final state relevant to the decision.
  6. Decision: Map each criterion to current evidence and assign 
    Pass | Fail | Blocked | Unverifiable
    . When visual comparison is required, cover asset/content/geometry/typography/color/imagery/responsive/state axes.
  7. Cleanup: Close only run-owned browser/server/resources and check for residue according to session lifecycle.
  1. 范围确定：明确精确的验收标准、目标/环境、当前候选版本和已批准的交互边界。
  2. 准备工作：仅读取必要的参考文档：environment、behavior、visual、accessibility、safety。
  3. 执行设置：无需安装新依赖，使用原生、Playwright兼容、MCP或已验证的CDP路径。任何新启动的Chrome/Chromium进程必须证明
    --headless=new
    模式有效。
  4. 服务器管理：若父任务要求启动开发服务器，该验证器负责启动后台进程、就绪检查和清理工作。对于独立执行，需提供多个可行命令并获取用户选择后再启动；请勿随意选择。当所选服务器为
    react-scripts
    /CRA时，需添加
    BROWSER=NONE
    或仓库文档中指定的等效参数以阻止自动打开。将PID/工作目录/端口/命令和有限日志作为运行证据进行管理，并等待就绪信号而非进程退出。
  5. 验证操作：从已知状态开始，检查所需的交互和最终状态。针对每个与决策相关的最终状态，至少捕获并实际检查一张非空的运行所属截图。
  6. 结果判定：将每个标准与当前证据匹配，分配
    Pass | Fail | Blocked | Unverifiable
    状态。若需要视觉对比，需覆盖资源/内容/布局/排版/颜色/图像/响应式/状态等维度。
  7. 清理工作：仅关闭运行所属的浏览器/服务器/资源，并根据session lifecycle检查残留。

Evidence

证据管理

이진 근거는 run-owned 
.tigerkit/evidence/browser/<run-id>/
에 둘 수 있으며 Markdown file은 두지 않습니다. user fixture를 이동하지 않고, 민감한 capture는 verified redaction과 residue absence를 확인한 경우에만 evidence로 사용합니다.
중첩 결과는 다음 정도로 제한합니다.
  • status
  • criterion별 사실
  • non-sensitive auth mode
  • absolute evidence directory
  • inspected screenshot path
  • limitation
  • cleanup fact
PR evidence가 필수이면 
evidence_required: true
, 해당 criterion, producer 
tk-browser-verify
도 반환하되 upload하지 않습니다.
독립 실행 결과는 
## Verdict
와 정확한 
Status: <token>
으로 시작하고 verified facts, 필요한 limitation, evidence path, cleanup fact를 보여줍니다. 필수 런타임 evidence가 없으면 절대 
Pass
로 올리지 않습니다.
상태의미
Pass
승인된 모든 브라우저 기준에 현재 inspected evidence가 있음
Fail
현재 런타임 evidence가 criterion을 위반함
Blocked
실행 전에 user-owned safety/target decision이 필요함
Unverifiable
필수 headless auth, environment, evidence를 확립할 수 없음
Do not cause unauthorized payments, external communications, destructive mutations, production-data mutations, or account/permission changes.
二进制证据可存储在运行所属的
.tigerkit/evidence/browser/<run-id>/
目录中，请勿存储Markdown文件。 请勿移动用户固定数据，仅在确认已验证脱敏且无残留的情况下，才将敏感捕获内容用作证据。
嵌套执行的结果需限制为以下内容：
  • 状态
  • 各标准对应的事实
  • 非敏感认证模式
  • 证据目录绝对路径
  • 已检查的截图路径
  • 限制条件
  • 清理情况
若需要PR证据，需返回
evidence_required: true
、对应的标准和生产者
tk-browser-verify
，但无需上传。
独立执行的结果需以
## Verdict
和精确的
Status: <token>
开头，并展示已验证的事实、必要的限制条件、证据路径和清理情况。 若无必要的运行时证据，绝对不能判定为
Pass
。
状态含义
Pass
当前检查的证据符合所有已批准的浏览器标准
Fail
当前运行时证据违反了验收标准
Blocked
执行前需要用户确认安全/目标相关决策
Unverifiable
无法建立必要的无头认证、环境或证据
请勿触发未授权支付、外部通信、破坏性变更、生产数据变更或账户/权限变更。