[Mathieu2301]

Summary

• replace the hand-written Node user in the cross-repository relay gate with the public miakapi/browser client running in real headless Chromium
• serve a bounded synthetic browser bundle from loopback HTTPS with an exact allowed Origin, restrictive CSP, no-store responses, and fixture-only credentials
• prove enrollment, initial snapshot, one state patch, call/result, and completed same-socket reauthentication
• pin the merged MiakAPI browser SDK and install its exact Playwright Chromium runtime in CI
• document the real-browser evidence and the current trusted-relay authentication boundary

Reauthentication evidence

The initial user lease lasts four seconds and renewal starts near its midpoint. The gate waits three additional seconds after the renewal request, then requires a second successful call while the browser remains ready with zero failures, no reconnect token request, and exactly one WebSocket. This proves the relay accepted REAUTH/REAUTH_OK rather than merely proving that the token provider ran.

Security boundary

The integration uses synthetic tokens accepted only by the ephemeral fixture verifier. It records no traces or WebSocket frames and emits only closed semantic JSON. The current Firebase bearer profile remains restricted to official or explicitly fully trusted relays; arbitrary community-relay selection remains blocked pending attenuated control-plane credentials.

Validation

• formatting check
• go vet ./...
• go test -race ./...
• canonical control-plane authentication vectors
• full emulator Home Key / JWKS rotation integration
• real Chromium/WSS integration, including a post-lease call on one socket
• distroless production image build