FLAB: Allow transient Playwright journeys in validation-only jobs

.github/agents/fixlab-autofix.agent.md

@@ -234,6 +234,17 @@ prerequisites as blocked.
    commit, push, or pull-request creation. Do not add a newly generated
    authenticated test such as `*.auth.spec.ts` unless the developer explicitly
    requests permanent coverage or repository instructions require it.
+   In validate-only and playwright-only modes, read-only protects product source,
+   existing tests, repository configuration and business data; it does not prohibit
+   job-owned transient Playwright journeys. Reuse an equivalent existing journey
+   first; otherwise create a new focused journey in the configured test directory.
+   Use existing reviewed fixtures and authentication helpers unchanged. Update or
+   remove only this job's generated journey; retain runner evidence in configured
+   artifact directories. Keep the journey for same-job retries while validation is
+   blocked; clean up only after owned execution finishes. Never overwrite
+   pre-existing tests or change configuration, credentials or browser state.
+   Normal runtime permissions, prior denials, managed policy, human sign-in and
+   data-safety controls still apply; this grants no runtime access or business writes.
 7. **Validate.** Run the narrowest relevant profile commands first, then every
    required type-check, lint, test, build, and browser gate affected by the
    change. Use only profile-approved non-production environments. Never report

.github/agents/fixlab.agent.md

@@ -13,6 +13,18 @@ review, local validation, live validation when configured, evidence, and pull
 request outcome. Never report a skipped or timed-out gate as passed. Never stop
 unrelated processes or expose credentials and private test data.
 
+In validate-only and playwright-only modes, read-only protects product source,
+existing tests, repository configuration and business data; it does not prohibit
+job-owned transient Playwright journeys. Reuse an equivalent existing journey
+first; otherwise create a new focused journey in the configured test directory.
+Use existing reviewed fixtures and authentication helpers unchanged. Update or
+remove only this job's generated journey; retain runner evidence in configured
+artifact directories. Keep the journey for same-job retries while validation is
+blocked; clean up only after owned execution finishes. Never overwrite
+pre-existing tests or change configuration, credentials or browser state.
+Normal runtime permissions, prior denials, managed policy, human sign-in and
+data-safety controls still apply; this grants no runtime access or business writes.
+
 Prefer reviewable repository-owned transient tests and configured runner commands
 over oversized inline scripts. Keep credentials inside existing reviewed
 authentication helpers. After a denial, never replay, encode, conceal, split or

agents/fixlab.md

@@ -335,6 +335,18 @@ unless the user explicitly requests permanent browser-test coverage or
 repository instructions require that exact persisted test. Do not modify
 unrelated or stale browser journeys merely to make a broad suite pass.
 
+In validate-only and playwright-only modes, read-only protects product source,
+existing tests, repository configuration and business data; it does not prohibit
+job-owned transient Playwright journeys. Reuse an equivalent existing journey
+first; otherwise create a new focused journey in the configured test directory.
+Use existing reviewed fixtures and authentication helpers unchanged. Update or
+remove only this job's generated journey; retain runner evidence in configured
+artifact directories. Keep the journey for same-job retries while validation is
+blocked; clean up only after owned execution finishes. Never overwrite
+pre-existing tests or change configuration, credentials or browser state.
+Normal runtime permissions, prior denials, managed policy, human sign-in and
+data-safety controls still apply; this grants no runtime access or business writes.
+
 When the repository profile selects `non-production-read-only` test data and
 the user selects any profile-approved non-production environment, use that
 backend and API as the primary business-data source. Keep access read-only and

bin/fixlab.js

@@ -51,7 +51,7 @@ import { runValidationGate } from "./validation-gate-client.js";
 import { installNotifications } from "./notifications.js";
 import { linkedApiProofPlan, runLinkedApiProof } from "../dashboard/linked-api-proof.js";
 import { runPortalApiProof } from "../dashboard/portal-api-proof.js";
-import { configuredWorkflow, efficientWorkflowGuidance, allowsDraftIntegrationDeferral, UNVERIFIED_DRAFT_GUIDANCE, OPTIONAL_INTEGRATION_GUIDANCE, AUTONOMOUS_RECOVERY_GUIDANCE, DRAFT_INTEGRATION_GUIDANCE, COPILOT_EXECUTION_GUIDANCE, RUNTIME_RECOVERY_GUIDANCE, READ_ONLY_POST_GUIDANCE, API_ONLY_PLAYWRIGHT_GUIDANCE, UNIT_TEST_ONLY_GUIDANCE, CONCISE_PR_GUIDANCE, PR_LEARNING_GUIDANCE } from "../dashboard/workflow-policy.js";
+import { configuredWorkflow, efficientWorkflowGuidance, allowsDraftIntegrationDeferral, UNVERIFIED_DRAFT_GUIDANCE, OPTIONAL_INTEGRATION_GUIDANCE, AUTONOMOUS_RECOVERY_GUIDANCE, DRAFT_INTEGRATION_GUIDANCE, COPILOT_EXECUTION_GUIDANCE, RUNTIME_RECOVERY_GUIDANCE, READ_ONLY_POST_GUIDANCE, API_ONLY_PLAYWRIGHT_GUIDANCE, UNIT_TEST_ONLY_GUIDANCE, TRANSIENT_PLAYWRIGHT_GUIDANCE, CONCISE_PR_GUIDANCE, PR_LEARNING_GUIDANCE } from "../dashboard/workflow-policy.js";
 
 const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const profileRelativePath = join(
@@ -1086,6 +1086,7 @@ function launch(repository, request, runtime, targetEnvironment = "", model = ""
       profile.browserAutomation?.mode !== "api" ? [READ_ONLY_POST_GUIDANCE] : []),
     ...(request ? [componentRetrievalGuidance(profile, request)] : []),
     ...(profile.validation?.liveTestsRequired === false ? [UNIT_TEST_ONLY_GUIDANCE] : []),
+    ...(readOnly ? [TRANSIENT_PLAYWRIGHT_GUIDANCE] : []),
     ...(!readOnly ? [CONCISE_PR_GUIDANCE] : []),
     ...(!readOnly && request ? [PR_LEARNING_GUIDANCE] : []),
     ...(!readOnly && request && !choices.deferValidation ? [AUTONOMOUS_RECOVERY_GUIDANCE] : []),

com.github.copilot/agents/fixlab.agent.md

@@ -335,6 +335,18 @@ unless the user explicitly requests permanent browser-test coverage or
 repository instructions require that exact persisted test. Do not modify
 unrelated or stale browser journeys merely to make a broad suite pass.
 
+In validate-only and playwright-only modes, read-only protects product source,
+existing tests, repository configuration and business data; it does not prohibit
+job-owned transient Playwright journeys. Reuse an equivalent existing journey
+first; otherwise create a new focused journey in the configured test directory.
+Use existing reviewed fixtures and authentication helpers unchanged. Update or
+remove only this job's generated journey; retain runner evidence in configured
+artifact directories. Keep the journey for same-job retries while validation is
+blocked; clean up only after owned execution finishes. Never overwrite
+pre-existing tests or change configuration, credentials or browser state.
+Normal runtime permissions, prior denials, managed policy, human sign-in and
+data-safety controls still apply; this grants no runtime access or business writes.
+
 When the repository profile selects `non-production-read-only` test data and
 the user selects any profile-approved non-production environment, use that
 backend and API as the primary business-data source. Keep access read-only and