Cloud runtime controlled from normal ChatGPT mobile/web.

• No Codex.
• No user PC.
• No local browser runtime.
• Normal ChatGPT is the control plane.
• Val Town is the persistent cloud compute/state plane.
• No automatic browser schedule is enabled.

ChatGPT -> authenticated Val Town plugin -> val-scoped SQLite -> runner.ts -> provider router -> cloud browser -> verified receipt

The public HTTP endpoint is liveness-only. Provider configuration, task state, receipts, health and cost metrics are available only through authenticated status.ts execution.

1. Kernel — primary/champion.
2. Browserless — recurring-free fallback.
3. Browserbase — researched fallback, not implemented.
4. Steel — one-time-credit fallback, not preferred for steady state.

Cross-provider fallback is allowed only for read_only. A write failure is never replayed automatically on another provider because failure is not proof of zero side effects.

• $0/month plus usage costs.
• $5/month free credits.
• 5 concurrent browsers.
• live view.
• stealth mode with CAPTCHA solver/proxy.
• managed auth.
• no card required to get started.
• usage model: GB-second.

• 1,000 units/month.
• 2 concurrent browsers.
• 2-minute max session.
• no card required.
• browser time: 1 unit per 30-second block.
• successful CAPTCHA solve: additional units.
• built-in proxies: additional units.
• provider supports an overage cap that should be set to $0 for this project's zero-surprise-cost policy.

Supported:

• goto
• wait_for
• click
• fill
• fill_secret
• type
• select
• extract_text
• extract_attribute
• expect_text
• expect_url

Arbitrary JavaScript and shell input are intentionally absent from the task schema.

The value attribute is blocked from extract_attribute to reduce accidental credential exfiltration after form fill.

• read_only: normal execution.
• reversible_write: requires explicit approved=true.
• consequential: requires explicit approved=true.
• fill_secret: separately requires explicit approval, even during a read-oriented flow.

Passwords, cookies and provider tokens must never be stored in task_json.

Use:

{"action":"fill_secret","selector":"#password","envVar":"PORTAL_PASSWORD"}

Only the environment-variable name is stored. The value is resolved in memory immediately before execution.

Provider credentials belong only in Val Town env vars:

• KERNEL_API_KEY
• BROWSERLESS_TOKEN
• optional BROWSERLESS_BASE_URL

Before any provider call, runner.ts runs a fail-closed network preflight:

• only HTTP/HTTPS;
• URL userinfo is blocked;
• nonstandard ports are blocked;
• localhost/private/link-local/reserved/documentation IP ranges are blocked;
• known metadata/internal hostnames are blocked;
• allowedHosts are validated;
• hostnames are resolved with DNS-over-HTTPS and all A/AAAA results must be public.

The browser program itself also restricts main-frame navigation to the original target host plus explicit allowedHosts.

DNS preflight reduces SSRF/DNS-rebinding risk but is not a mathematical proof against DNS rebinding after the preflight. Provider isolation and post-action validation remain required.

When risk=read_only, browser network requests using methods other than GET/HEAD/OPTIONS are aborted. Popups are closed.

This prevents common POST/PUT/PATCH/DELETE side effects. It cannot guarantee zero side effects on badly designed GET endpoints.

• task run_id is unique/idempotent;
• atomic queue claim;
• 90-second RUNNING lease;
• stale lease recovery;
• max 2 task attempts;
• read-only FAIL retry delay: 10 seconds;
• writes are not auto-retried;
• browser timeout: 25 seconds;
• Kernel cleanup timeout: 5 seconds;
• provider circuit opens after 3 consecutive provider FAILs;
• circuit cooldown: 15 minutes;
• BLOCKED configuration errors do not degrade provider health;
• no cron/automatic runner, so eligible retries still require an explicit ChatGPT runner invocation.

Default is minimal:

• status;
• final URL;
• expectations/checks;
• error;
• duration;
• fallback metadata;
• DNS preflight evidence.

Extracted outputs and provider session IDs are not persisted by default.

Use evidenceRetention: "full" only when the extracted output is intentionally safe to retain.

browser_attempts records per-attempt provider/status/duration and an estimated Browserless browser-time unit count.

Browserless estimates exclude CAPTCHA/proxy add-ons. Kernel usage is not estimated locally because its billing basis is GB-second; actual account usage must be observed from Kernel.

TOOL_SUCCESS_RESPONSE != BEHAVIOR_PROOF.

A browser execution with no positive expectation remains PARTIAL. PASS requires all explicit expectations to succeed.

PASS:

• Val Town plugin authenticated.
• Free workspace.
• create/edit/run/deploy.
• public liveness endpoint.
• authenticated diagnostics.
• val-scoped SQLite.
• schema versioning.
• atomic task claim.
• stale lease recovery.
• persisted task/attempt receipts.
• retry decision logic.
• timeout control.
• provider circuit breaker and restore test.
• risk approval gate.
• secret approval gate.
• invalid provider rejection.
• value attribute extraction rejection.
• DNS-over-HTTPS preflight.
• private/metadata URL blocking in both self-test and runner pipeline.
• Kernel SDK module loading.
• Browserless adapter module loading.
• safe missing-provider-credential classification.

UNVERIFIED:

• Kernel API authentication for this account.
• live Kernel browser creation.
• live Kernel Playwright execution.
• Kernel actual credit consumption.
• Browserless API authentication for this account.
• live Browserless /function execution.
• Browserless actual unit consumption.

No user-created environment variables are currently configured, so no live browser provider has been promoted to OPERATIONAL.

docs/SMOKE_TASK.json is deliberately a DRAFT, not a queued task. After exactly one provider credential is configured, ChatGPT can enqueue that read-only smoke task, run runner.ts, persist the attempt and promote the provider only if the explicit expectations PASS.

See:

• docs/CURRENT_STATE.md
• docs/PROVIDER_CENSUS.md
• docs/ACTIVATION_RUNBOOK.md
• docs/TASK_SCHEMA.md
• docs/SMOKE_TASK.json