# Issue #9 authenticated browser evidence

This directory binds the dashboard menu-transition acceptance evidence to the exact working-tree files listed in `manifest.json`.

## Captured transition

- **Path:** `요약` → `분류 규칙`
- **Input:** native Streamlit menu click in an authenticated HTTPS browser session
- **Fixture:** generated synthetic SQLite database only
- **Sampling:** 35 DOM/style frames at 50 ms intervals
- **Viewport:** 1280 × 720
- **Browser:** Headless Chrome 154 on Linux x86_64
- **Fixture host:** Linux aarch64, Python 3.13.5, Streamlit 1.58.0, Uvicorn 0.49.0

## Verified browser observations

All eight manifest checks are true:

- the HTML document marker stayed identical;
- the sidebar marker stayed identical;
- the page background stayed identical;
- no post-click full-document `load` event occurred;
- the target loading state was observed;
- the previous `요약` body was absent in every loading frame;
- the unrelated `fixture=preserved` query key survived;
- final URL, selected menu, target body, and cleared loading state agreed.

`browser-observations.json` contains every sampled frame, body hashes, URL state, history events, document/sidebar markers, computed background, runtime metadata, and explicit limitations. `final-state.jpg` is the final visible browser state; it contains no credential or secret.

## Recheck

Run the exact validator recorded in `manifest.json`. The captured result was:

```text
exit code: 0
PASS source_hashes=5 artifact_hashes=2 checks=8/8 frames=35 full_document_loads=0
```

The browser action was executed through `mcp__playwright__browser_run_code_unsafe`. That API reports success/error rather than a numeric process exit code; this boundary is explicit in the manifest instead of being represented as a fabricated exit status.

## Evidence boundaries

- This is synthetic-fixture browser evidence, not operating-ledger evidence.
- A fixture-only external wrapper delayed the rules renderer by two seconds so the loading interval could be sampled. It did not alter repository source.
- A temporary HTTPS ingress adapter supplied trusted proxy scheme/Host metadata. Repository authentication and same-origin enforcement remained active.
- The tunnel URL is intentionally ephemeral and is retained in the frame record only for provenance.
- The screenshot supplements, but does not replace, the machine-readable continuous-frame observations.