feat(track-a): persistent KasmVNC desktop and controller handoff

[blakinio]

Objective

Replace the unstable/per-agent noVNC presentation with a real persistent KasmVNC desktop on Synology while preserving the already-validated same-task controller handoff that removes historical session_id reuse.

Target architecture

browser
  -> https://synology:6902/
  -> DSM Reverse Proxy + WebSocket
  -> https://127.0.0.1:6901/
  -> stock KasmVNC HTTPS/WebSocket
  -> persistent task-owned Kasm desktop DISPLAY=:1

KasmVNC is the desktop provider. The new path does not use x11vnc -> websockify -> noVNC.

container: otclient-track-a-kasmvnc
image: kasmweb/ubuntu-noble-desktop:1.17.0
runtime_namespace: track-a-kasmvnc-desktop
backend_host: 127.0.0.1
backend_port: 6901
backend_protocol: HTTPS
public_frontend: https://synology:6902/
restart_policy: unless-stopped

Scheduler diagnosis

The earlier queued generation used runs-on: self-hosted. Commit 65c541ca76bb5241d38ef976cc4ef3df8cd2b47e changed the selector to:

runs-on: [otclient, synology]

The successor physical job was then accepted by the real synology-otclient-01 and passed the workflow's exact RUNNER_NAME admission check. This functionally proves the intended runner listener and repository access are working. Older generations are cancelled by the workflow concurrency group when a synchronized successor is created.

Current exact head

7ef011b0a0c60752b4b97e9a9565855cbda023e6

The contract and ADR now match the owner-configured DSM rule exactly:

source:      HTTPS synology:6902
destination: HTTPS 127.0.0.1:6901
WebSocket:   enabled

The deploy workflow verifies the real user-facing boundary rather than treating an unauthenticated backend fetch as sufficient:

• KasmVNC browser credential remains in the task-private mode-0600 state file and is never printed;
• authenticated HTTPS backend at 127.0.0.1:6901;
• running task-owned container with restart=unless-stopped and loopback-only port binding;
• real DISPLAY=:1, X11 socket and KasmVNC Xvnc process;
• persistent Docker container identity across replacement workflow/agent generations;
• authenticated DSM https://synology:6902/ content matches the backend application;
• /websockify returns a valid WebSocket upgrade both directly and through DSM;
• PR runtime(track-a): native login to in-game E2E v3 #528 observer is rechecked before/after without mutation;
• no official Tibia client or Tibia secret is accessed by this deployment.

Current physical generation: Track A KasmVNC deploy run 32165034052, job 95802882538. Earlier synchronized generations were cancelled during image pull before the deploy step. Physical E2E is not claimed PASS until this current exact-head job passes the backend + DSM/WebSocket gates.

Controller continuity / raw-XRes

On the current exact head, hosted controller-handoff validation and its fresh authority/isolation audit are PASS. The deterministic job proves same-task handoff, replacement-session resume and raw-XRes canonical reuse contracts.

Historical session_id is not used as desktop/runtime identity. Canonical reuse/rebind/Gate B remains fail-closed and uses the raw-XRes probe rather than xdotool --pid.

PR #528 isolation

PR #528 remains an active Track A RUNTIME task. It currently owns the native-login/exact-SHA runtime lane and retains the legacy DISPLAY=:99 / http://192.168.1.2:6083/ observer. #541 therefore deploys only the isolated Kasm desktop and does not start, login, attach to, or mutate an official Tibia client until that ownership is released or explicitly reconciled.

Closeout status

PR remains Draft. Before readiness/merge it still requires:

1. physical Kasm backend + DSM HTTPS/WebSocket E2E PASS;
2. persistence/handoff proof across a fresh successor generation;
3. exact-head hosted CI and audit PASS;
4. zero unresolved review threads;
5. task/governance closeout consistent with current runtime(track-a): native login to in-game E2E v3 #528 ownership and Track A admission.