reviewer-app-testing

name	reviewer-app-testing
description	Use when operating reviewer-account browser rehearsals that require BYOK unlock, memory-only decrypted information, and same-session client navigation.

Hussh Reviewer App Testing Skill

Purpose and Trigger

• Primary scope: reviewer-app-testing
• Trigger on reviewer Playwright flows, BYOK unlock continuity, protected route chains, or cold-session re-unlock proof.
• Avoid overlap with vault-pkm-governance, pkm-upgrade-rehearsal, and frontend-cache-coherence.

Coverage and Ownership

• Role: spoke
• Owner family: security-audit

Owned repo surfaces:

1. .codex/skills/reviewer-app-testing
2. hushh-webapp/scripts/testing/reviewer-test-identity.mjs
3. hushh-webapp/scripts/testing/verify-signed-in-routes.mjs

Non-owned surfaces:

1. consent-protocol/hushh_mcp/vault
2. hushh-webapp/lib/pkm
3. scripts/ci/pkm-upgrade-gate.sh

Do Use

1. Canonical reviewer identity, authentication, passphrase-wrapper unlock, and vault-key integrity proof.
2. Same-browser-context protected flows where decrypted information and keys must remain memory-only.
3. Separate cold-context reauthentication and re-unlock proof after the same-session route chain.
4. Shared Playwright helpers used by domain-specific reviewer rehearsals.

Do Not Use

1. Vault cryptography or PKM storage implementation changes; use vault-pkm-governance.
2. PKM restructuring, preservation, scope, rollback, or payload acceptance; use pkm-upgrade-rehearsal.
3. Generic public-route browser checks that do not depend on an unlocked vault.
4. Shared reviewer mutation without explicit operator authority for the current task.

Read First

1. .codex/skills/reviewer-app-testing/references/byok-reviewer-browser-contract.md
2. hushh-webapp/scripts/testing/reviewer-test-identity.mjs
3. hushh-webapp/lib/testing/native-test.ts
4. hushh-webapp/components/app-ui/native-test-bootstrap.tsx
5. hushh-webapp/components/app-ui/native-test-router.tsx
6. hushh-webapp/lib/utils/browser-navigation.ts

Workflow

1. Resolve the canonical reviewer through the shared identity module; never print or persist its secrets.
2. Decide and record whether the run is read-only or explicitly mutation-authorized.
3. Prove a cold authenticated entry visibly hard-gates on the vault before supplying any passphrase.
4. Unlock, derive the wrapper key locally, and verify vaultKeyHash.
5. Keep passphrase, tokens, key, and decrypted information in memory throughout the same-session route chain.
6. Use Next client navigation and assert vault_unlocked after every protected route transition.
7. Fail the route chain on critical first-party vault, consent, connection, notification, or PKM API 5xx responses.
8. Close the context, then test cold-session authentication and re-unlock separately.
9. Hand domain assertions to the owning spoke while retaining this BYOK/session contract.

Localhost Enablement

Reviewer rehearsals run against http://localhost:3000, not only UAT, so agents can review app changes locally without a deploy:

1. The local backend loads the git-ignored maintainer overlay .env.local in the consent-protocol directory (consent-protocol/hushh_mcp/runtime_settings.py; a no-op in deployed environments, override=False keeps .env authoritative).
2. Set APP_REVIEW_MODE=true in that .env.local, alongside the Secret-Manager-sourced REVIEWER_UID and REVIEWER_VAULT_PASSPHRASE (bootstrap hydrates the fixture when gcloud is available). No NEXT_PUBLIC_* passphrase is ever used.
3. Restart the local backend, confirm GET /api/app-config/review-mode returns {"enabled": true}, then drive createReviewerSessionHarness({ appOrigin: "http://localhost:3000" }). This stays local-only: .env.local never ships and the custom-token minter binds to the localhost backend; keep the passphrase, tokens, and vault key memory-only per the BYOK contract and never print them.

Handoff Rules

1. Vault and encrypted-storage implementation work routes to vault-pkm-governance.
2. PKM upgrade and exact payload rehearsal routes to pkm-upgrade-rehearsal.
3. Cache behavior proof routes to frontend-cache-coherence; broad security work returns to security-audit.

Required Checks

./scripts/ci/reviewer-app-testing-check.sh
./bin/hushh codex route-task reviewer-app-rehearsal --text