# Issue #9 authenticated browser evidence

This directory binds the dashboard menu-transition acceptance evidence to the exact Git head and working-tree files listed in `manifest.json`.

## Captured transition

- **Path:** `요약` → `분류 규칙`
- **Input:** native Streamlit menu click in an authenticated HTTPS browser session
- **Fixture:** generated synthetic SQLite database only
- **Sampling:** 35 DOM/computed-style frames at 50 ms intervals
- **Viewport:** 1280 × 720
- **Browser:** Headless Chrome 154; Client Hints architecture `arm`, bitness `64`
- **Fixture host:** Linux aarch64, Python 3.13.5, Streamlit 1.58.0, Uvicorn 0.49.0

## Verified browser observations

All twelve manifest checks are true:

- the HTML document and sidebar markers stayed identical;
- `[data-testid="stAppViewContainer"]` retained a non-`none` computed `backgroundImage` and remained visible/rendered in every frame;
- `[data-testid="stSidebar"]` retained a non-`none` computed `backgroundImage` and remained visible/rendered in every frame;
- computed `backgroundImage`, `backgroundColor`, `visibility`, `display`, `opacity`, and rendered geometry were captured for both surfaces in every frame;
- the click and all 35 frames completed inside one uninterrupted Playwright evaluation context, so no full-document navigation occurred;
- the target loading state was observed in two frames;
- the previous `요약` body was absent in every loading frame;
- the unrelated `source=evidence` query key survived;
- final URL, selected menu, target body, and cleared loading state agreed.

`browser-observations.json` contains every frame, body hashes, URL state, markers, computed surface styles, runtime metadata, and explicit limitations. `final-state.jpg` is the final visible browser state and contains no credential or secret.

## Recheck

Run the exact validator recorded in `manifest.json`. The captured result was:

```text
exit code: 0
PASS source_hashes=5 artifact_hashes=2 checks=12/12 frames=35 full_document_loads=0 surfaces=2
```

The browser actions used Playwright MCP. That API reports success/error rather than a numeric process exit code; the manifest records this boundary instead of fabricating an exit status.

## Evidence boundaries

- This is synthetic-fixture browser evidence, not operating-ledger evidence.
- A temporary HTTPS ingress adapter normalized the request scheme. Repository authentication and same-origin enforcement remained active.
- The tunnel URL is intentionally ephemeral and retained only as provenance.
- The screenshot supplements, but does not replace, the machine-readable continuous-frame observations.