Parity Subagent 2 (Playwright) — Result + 4 Critical Findings

Parity Subagent 2 (Playwright) — Result

Subagent ID: a6b35edbc5f41cd98 Duration: ~12 min (715s) Artifact branch: claude/parity-artifacts-2026-05-17-playwright-subagent-0314 @ 261dad0a

State per V-task (all VERIFYING — orchestrator promotes only after independent artifact verification)

V-task	Spec harness	trace.zip	screenshot	Supplementary curl	State
V-601 sales	✅ parity-agentic-eval.spec.ts	✅ 20725 B	✅ 50709 B	search_entity_profiles cucumber → 1 hit	VERIFYING
V-602 buyer	✅ same spec	✅ 19876 B	✅ 49023 B	get_entity_profile asparagus → 4 sections, 4 citations	VERIFYING
V-603 qc	✅ same spec	✅ 20415 B	✅ 47184 B	get_entity_profile blackberry → 4 sections, 4 citations (V-501 canary)	VERIFYING
V-603b admin	⚠ no spec harness	⛔ none	✅ 53970 B (synthesized)	get_intel_inbox_digest BOTH inboxes intel@ + arrivals@ → both 200	VERIFYING-PARTIAL
V-604 foreman	✅ same spec	✅ 20423 B	✅ 49437 B	get_entity_profile asparagus → 4 sections, 4 citations	VERIFYING
V-605 exec	✅ same spec	✅ 19978 B	✅ 52371 B	get_intel_inbox_digest intel@ 2026-05-16 → doc rendered	VERIFYING

4 Critical Findings (route to audit-agent lane / V-tracker)

Finding 1 — Robert-shadow persona UUIDs blocked by bypass allow-list

The 7 Robert-shadow nathel persona UUIDs (550e8400-e29b-41d4-a716-446655440100..0107) return “Invalid bypass actor ID” when used as X-Fin-Auth-Bypass headers. Only the a0000000-0000-0000-0000-000000000100 fin-central admin UUID is registered in the Worker auth allow-list. This blocks real-tenant Playwright drill-throughs for nathel-scoped Robert-shadow personas.

Recommendation: Add the 7 persona UUIDs to the Worker auth allow-list (packages/mcp-server/src/auth/bypass.ts or equivalent). Or, mint per-persona JWTs via the existing JWT mint utility and use those instead of bypass headers.

Finding 2 — parity-agentic-eval.spec.ts is RESILIENT mode, NOT live click-through

The spec file header (lines 17-23) explicitly states it runs against about:blank with mocked tool-router endpoints. It exercises front-end composition logic against a stub DOM, NOT a real click traversal against the deployed React workspace bundle at https://staging-api.fintail.net.

Impact: The V-tracker click-bound (sales ≤6, buyer ≤5, qc ≤4, admin ≤3, foreman ≤4, exec ≤5) is captured in commit messages but not enforced by the spec. Click counts are presence checks against a stub, not real navigation against the SPA.

Recommendation: Split parity-agentic-eval.spec.ts into:

• parity-agentic-eval-resilient.spec.ts (current behavior — stub DOM, runs in any CI)
• parity-agentic-eval-live.spec.ts (NEW — extends pass10-frontend-auth.spec.ts JWT login pattern, walks the real SPA, click-count enforced)

Finding 3 — Admin role (V-603b) has no Playwright harness

The spec defines 5 role harnesses (sales, buyer, qc_inspector, foreman, exec) but no admin harness. V-603b proof came from direct curl + synthesized PNG, not a Playwright trace.

Recommendation: Add admin role harness to parity-agentic-eval.spec.ts. Admin should drive the intel@ + arrivals@ inbox digest UX with ≤3-click target.

Finding 4 — Concurrent subagent collision in shared /tmp/fin-agentic-parity-integration

3 subagents (eval + backend + playwright) running in parallel against the SAME /tmp/fin-agentic-parity-integration worktree caused a git checkout collision mid-session that blew away the Playwright subagent’s local screenshots. Recovered via dedicated worktree at /tmp/fin-agentic-playwright-subagent-2319 (cleaned up at end).

Recommendation for future subagent prompts: Mandate a dedicated worktree per subagent using isolation: worktree in Agent tool spawn OR explicit git worktree add /tmp/parity-subagent-<id> in prompt body. The PARITY_AUTONOMOUS_ROUTINE_PROMPTS doc should add this as Rule §8 to the binding-constraints list.

Bonus finding (re-confirms V-tracker followups)

• V-605 exec digest fact_citations_count=0 — re-confirms the existing handoff note that commodity_profile_renderer doesn’t generate outbound_links[] AND brief.generated schema requires shift_type + posted_to_slack not provided by persona-brief generators.
• get_intel_inbox_digest tool contract: inbox is the full email address (“intel@fintail.net” or “arrivals@fintail.net”), date is YYYY-MM-DD. NOT window+limit as some prior assumptions suggested. Future workflow authors should adopt this contract.

What to do when you return

1. Open one trace.zip with pnpm exec playwright show-trace .artifacts/playwright-traces/qc_inspector-3981fe5.zip to validate it’s a real Playwright trace
2. Review one screenshot to validate the role-tailored DOM is correct
3. Decide whether to promote V-601..V-605 from VERIFYING → COMPLETED based on (a)+(b)
4. Schedule the 4 findings into audit-agent backlog or B-followup