[cppla]

Summary

• Add an opt-in H3/download_1k fetch-credentials diagnostic to the existing WebDriver runner. Default JavaScript, the 13-field formal receipt, and its digest remain unchanged, with golden regression coverage.
• Diagnostic receipts have a separate kind, insufficient_evidence status, and treatment-bound digest. The formal campaign validator rejects them, including superficial relabeling/field stripping.
• Add a bounded, loopback-only H3 fixture that reports physical connection IDs, with no forwarding, no TCP fallback, restricted request logging, and tested request/connection/time limits.
• Document the distinct workflows and a limited six-trial real Chrome diagnostic. Fix the existing Chromium H3 example's missing required certificate pin.

Validation completed locally

• make check
• make race
• make stealth-tools-check (including 23 Python browser-runner tests)
• Independent read-only review: no P1/P2 findings; fixture race and Linux/Windows package compilation checks passed.
• Isolated Playwright CLI / Chrome 153.0.8010.52 on macOS arm64: three pairs, six valid trials, no retries. Navigation and fetch were H3 and server IDs correlated in every trial; omit used two physical connections, same-origin reused one, in all three pairs. Runtime identities unchanged. Paired collection took 26.69 seconds.

Evidence limits and safety

This is diagnostic tooling, not a production transport change or an indistinguishability claim. There is no AutoCAR traffic comparison, PCAP corpus, remote-browser validation, or historical-browser reproduction. Playwright Firefox 156 failed two separately recorded readiness attempts and was excluded before freezing the paired plan; the failure cause is unresolved. The full preregistered corpus was not resumed. Existing samples and release gates are unchanged. Raw local artifacts, private lab key, and browser profiles are ignored, not committed.

Exact-head GitHub validation

Final head: 35e4575a4faa01f88e880630962ff7afb7e94d9c. Linux CI/Docker integration, macOS tests, race, cross-builds, vulnerability scan, CodeQL and netem all passed: CI 35725464606, CodeQL 35725464639, netem 35725464538. The offline browser regression suite is now part of Linux CI and its explicit step passed. One automated indentation finding was reproduced against the actual source and resolved as a false positive with local and CI evidence; no production implementation change was needed.

No release/tag is created by this PR.

Post-merge verification

Squash-merged as ab8af9663aab36a1e6b15baf35adce323c77a154. Its tree matches the validated final head. All main push workflows passed for this exact SHA: CI 35725784545, CodeQL 35725784696, and Linux netem 35725784906. The main CI job confirms the offline browser regression step and container integration succeeded. Local main is synchronized and clean; owned browser sessions/fixture were stopped and ignored diagnostic artifacts retained. No tag/release was created.

[Copilot]

Copilot review overview

🟡 Changes recommended

The diagnostic runner fails every valid diagnostic invocation due to mismatched script-anchor indentation.

Get a fresh assessment by requesting another Copilot review.

Review effort: Lite
Findings: 1

Open (1)

• Fix diagnostic script anchor indentation mismatch · New

What changed in this PR

Adds opt-in browser connection-reuse diagnostics and a bounded loopback HTTP/3 fixture while preserving formal workload behavior. The diagnostic path currently has a critical indentation mismatch that prevents valid execution.

Changes:

• Adds diagnostic receipts, validation, and regression coverage.
• Adds a loopback-only HTTP/3 connection-ID fixture with limits and tests.
• Documents workflows, evidence limits, and local diagnostic results.
• Ignores local diagnostic artifacts.

File	Summary
scripts/​stealth-browser/​test_run_cover.py	Diagnostic regression coverage
scripts/​stealth-browser/​run_cover.py	Diagnostic runner and receipt logic; execution is blocked by an anchor indentation mismatch
scripts/​stealth-browser/​README.md	Diagnostic usage documentation
scripts/​browser-connection-fixture/​README.md	Fixture usage documentation
scripts/​browser-connection-fixture/​main.go	Bounded loopback HTTP/3 fixture
scripts/​browser-connection-fixture/​main_test.go	Fixture behavior and limit tests
scripts/​browser-connection-fixture/​DIAGNOSTIC-2026-09-22.md	Diagnostic methodology and results
.gitignore	Ignores local diagnostic artifacts

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.