[abrichr]

Replaces #1261 (the spike). Same work plus the feature, rebuilt as one commit on main, because gitleaks scans history and a made-up token in a test on that branch would have failed every run.

What it does

A web form save that OpenAdapt can repeat as one request now runs as one request through the replaying browser's own session. The right-record check before the save and the record check after it stay the same. When a check fails before the save is sent, the recorded GUI steps run instead, resolving on the page structure first as they always do.

• Capture (record --capture-network, web only): writes network.jsonl beside the events. No headers are written. Passwords, --secret fields, CSRF and session tokens, and echoed cookie values are withheld before anything reaches the disk. The format is a versioned contract: docs/NETWORK_CAPTURE.md.
• Proposal (compile): an ApiBinding(kind="web_form", on_unavailable="gui") on the save, only when every field of the request is explained (run parameter, select label, session value, or form default). Reads whose responses carry the text the GUI checks before saving become pre-checks; on OpenEMR, that's the duplicate search that must say "No matches were found." api_proposal.json gives the reason when nothing is proposed.
• Admission (openadapt-flow api show | propose | admit): only a person admits, at a terminal, as with check admit. The admission is bound to the exact binding and copies the save step's record check.
• Run (WebFormActuator + Replayer): each run re-reads the form (CSRF token, defaults, options, field and validation-rule drift), enforces required fields, runs the pre-checks, and posts once. Every refusal before the post falls back to the GUI. Once the post starts, the API tier's no-double-write rule applies: HALT, and RECONCILIATION_REQUIRED on a lost response. Reports mark api_folded and api, and put api_fallback on the first covered step.
• Not used (the GUI runs instead) under each_item or problems_only approval (the person approves what the screen shows), governed, durable, resumed, or multi-surface runs, and when the steps, checks or record check changed after the proposal or admission.

Docs: docs/API_TIER.md, docs/NETWORK_CAPTURE.md. Tests: tests/test_api_tier_web_form.py (31).

Status

• tests/test_api_tier_web_form.py: 31 pass, covering capture redaction, the proposal and its refusals, person-only admission, actuator refusals and HALTs, the replayer span and its fallbacks, and RECONCILIATION_REQUIRED on a lost response.
• On the local OpenEMR referral with this code: a demonstration recorded with capture (28 requests, 12 of 12 saved). The compiler proposed the API step for the save in place of 41 GUI steps: all 105 fields explained, the duplicate check carried as a pre-check, and 11 record-check effects. An earlier smoke run saved two referrals 12 of 12 through the live session.
• Numbers: none claimed here. The 20 vs 20 measurement runs as scoreboard arm program_api against program (benchmark/openemr_api_tier/scoreboard_arm.py), owned by the scoreboard (demo: CUA to program on openIMIS claims, plus the scoreboard (arms 1-3) #1303) under its protocol and load gate. The spike's figures in benchmark/openemr_api_tier/spike/ used a standalone sign-in and are not the feature's.
• Root CAPABILITIES.md (docs: one map of what OpenAdapt can do #1260) is not on main yet. Its two rows ("Capture a recording's network traffic…" and "Fall back from the API step…") and scripts/build_llms_full.py get updated when this lands.

🤖 Generated with Claude Code