felhom.eu/documentation/audits/rehearsal-2026-10-20/A4-browser

A4 — the browser spike: a real browser for the household, with no browser on DooPlex (2026-10-20)

Result: it works. Ready in ~12 minutes (09:39 → 09:51 UTC), well inside the 90-minute box. Used for the rest of the run.

What was built

• A throwaway LXC 9330 rehearsal1020-browser on demo-hp (Tier 0): Debian 13, 2 cores, 4 GB, 24 GB on nvme-scratch.
• Chromium 155.0.8059.79 (the Debian package) driven by Playwright 1.52.0 (Python, /opt/pw).
• Two sizes: phone 390×844 (scale 2, touch, an Android user agent) and computer 1366×768; two languages: hu-HU and en-US (locale + Accept-Language), time zone Europe/Budapest.
• Tools (all in ../tools/): ui.py (a JSON list of steps: go, click, fill from a secret, select, wait, screenshot), brun.sh (run a command in the LXC; secrets travel on stdin through envrun.py, never on a command line), brpull.sh (copy the screenshots off the LXC), gallery.py (builds ../screens/README.md).

What it was used for

The download page (B1), the bind page and its wrong tries (B2), the claim, the recovery-code ceremony, the family card, every app's own install page (B3), Actual Budget's own import dialog (B4 — the one app with no usable API), the walk of the dashboard on phone and computer (B4), the second drive (B6 #13), the English pass of 15 pages (B6 #16). 121 screenshots in ../screens/.

Limits — what this is NOT

• The household's address has no DNS (tester4.test is a reserved name): the LXC maps the box's names to its LAN address in /etc/hosts, and TLS is not verified. A real household reaches the box through its own domain and a real certificate; that leg is not covered.
• Not a human click-through. Playwright presses the same buttons and reads the same pages, but it does not get lost, misread or give up. The stuck points (../B10-stuck/) are a reading of what a person would do, not a measurement.
• Screenshots blank every text and password field for the photo (and put the values back before any submit — the 12:22 slip, when they did not, sent an empty Nextcloud form). Codes shown as text on a page were never photographed. Before a commit, the pages that hold a password or a key (app settings, share password, security, remote backup) were opened and looked at: they show only dots or blanks.

Teardown

The LXC is removed in Part D with the rest (../D-teardown/).