Skip to content

docs(cables-relay): update verification status with real browser-automation findings - #11

Merged
vdmo merged 2 commits into
mainfrom
docs/cables-relay-verification-status
Oct 1, 2026
Merged

vdmo merged 2 commits into
mainfrom
docs/cables-relay-verification-status

Conversation

@vdmo

@vdmo vdmo commented Oct 1, 2026 •

Copy link
Copy Markdown
Owner

Summary

  • Replaces the "not tested against real cables.gl" caveat in tools/cables-pchi-relay/README.md with what live browser automation actually proved: the real op class (Ops.Net.WebSocket.WebSocket_v2) confirmed in a live, currently-maintained example patch, its canvas located inside cables' separate-origin sandbox.cables.gl iframe, and its URL field genuinely read and edited through cables' own UI.
  • Follow-up commit: the full live round-trip is now verified too — a real governance event sent through the actual Conductor and this relay was received by the live cables.gl op, which reported Connected: true, Valid JSON: true, and a Raw Data value carrying the real gate_state: "DENY" payload. Reproduced twice.
  • Documents exactly what it took to get there: Chrome's Local Network Access check genuinely blocks a public-origin page from reaching a loopback relay (net::ERR_BLOCKED_BY_LOCAL_NETWORK_ACCESS_CHECKS). Granting the local-network-access permission programmatically did not clear it; disabling Chromium's LocalNetworkAccessChecks/LocalNetworkAccessChecksWebSockets feature flags at browser launch did. Both are automation-only levers, so the README is explicit that this isn't confirmed to match what a real visitor clicking through Chrome's actual interactive prompt would experience — with cables' own standalone/Electron build noted as the clean production path around the whole question.

Test plan

🤖 Generated with Claude Code

vdmo and others added 2 commits October 1, 2026 17:46
…mation findings

The "not tested against real cables.gl" caveat was written before live
browser automation against the actual cables.gl editor (real op class
confirmed, real DOM field editing verified). Replace it with what was
actually proven, and name the real blocker found afterward — Chrome's
Local Network Access policy blocking a public-origin page from reaching
localhost, not a defect in the relay or in cables.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Follow-up to the previous commit on this branch, which documented that
a round-trip wasn't completed yet. It now is: driven end to end
against the real public cables.gl editor, the live WebSocket_v2 op
showed Connected/Valid JSON/Raw Data with this relay's real DENY
payload, reproduced twice. Records exactly what unblocked it
(Chromium feature flags, not a permission grant) and what's still
unconfirmed (whether a real user's interactive permission prompt
behaves the same way).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@vdmo
vdmo merged commit 76303b1 into main Oct 1, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant