[hiroTamada]

{
"message": "Not Found",
"documentation_url": "https://docs.github.com/rest",
"status": "404"
}Stacked on #12 (retail-cart-providers).

Summary

Adds an arm to retail-cart-providers that runs codex-pw-kernel with the whole browser session sent through Evervault's browser proxy, so the comparison covers a Kernel browser whose traffic exits from Evervault instead of Kernel's stealth proxy pool.

• kernel-evervault provider (harness/providers.py). For each trial it:

  1. mints an Evervault Browser Tokens session (POST /browser-tokens) and takes its proxy credentials,
  2. creates a Kernel custom HTTPS proxy from them with Evervault's CA (https://ca.evervault.com) as ca_bundle, because the proxy terminates TLS,
  3. creates the browser with that proxy_id.

  On release it deletes the browser and then the proxy. The proxy is named with the run's bench-<run>- prefix, so the existing leftover cleanup removes it if a trial crashes. The mint holds one placeholder credential.password value. The session is only used for its proxy, and no card or credential is revealed. A failed mint reports only the HTTP status, because the response body carries the proxy password.

• Arm codex-pw-kernel-evervault: the same agent, tools and stealth: true as codex-pw-kernel, plus an evervault table with the mint's ttl, its allowed hosts and optional proxy_settings (Evervault's own egress proxy setting, passed through as proxySettings).

• Workflow and README: _run.yml passes EV_APP_UUID and EV_API_KEY. The run checks for them before starting an arm that uses this provider.

• retail-cart-geo, for sites outside the US:

  • retail-cart takes a tasks suite arg (another task file of the same shape) and an optional per-task country, recorded in task.toml metadata.
  • The geo configurator turns that country into a per-trial proxy_create. RemoteBrowserEnvironment passes it to the provider, and the Kernel providers create the proxy before the browser and delete it after.
  • codex-pw-kernel-geo: Kernel stealth plus a new residential proxy in the site's country for each trial.
  • codex-pw-kernel-evervault-eu: the Evervault arm through the Ireland relay (relay_host). The minted credentials work on either region's relay.

Before a full run

• The repo needs EV_APP_UUID and EV_API_KEY secrets, with a key that has browserToken:create.
• The TTL is 900s, the sandbox cap. A production app allows up to 4 hours. In the run below no trial came close: the longest took 376s.
• Evervault's egress is used as it is. If we learn which residential egress the real deployment uses, set it in proxy_settings.

Testing

• ruff check, ruff format --check, pytest (41 passed). The new tests cover the mint body, the custom proxy config, browser and proxy create and delete order, and that a failed mint doesn't surface the response body.
• bench prepare retail-cart-providers --arms codex-pw-kernel-evervault --tasks all writes the expected config for all 16 tasks.
• Live, Kernel side only: creating a custom HTTPS proxy to us-va.browser.relay.evervault.app with Evervault's CA and dummy credentials reached the relay and got 407 Proxy Authentication Required from Kernel's connection test. Kernel accepts the proxy shape, and the relay answers over it. The test proxy was deleted.
• Egress check: through the arm's proxy, ipinfo.io reported AS14618 (Amazon, Ashburn VA), which is Evervault's default egress. The same check on the Kernel stealth arm reported a residential ISP.
• Full run, local, 16 tasks × 10 attempts per arm, same time window, sandbox Evervault app. No infrastructure failures and no leftover proxies.

Task	codex-pw-kernel	codex-pw-kernel-evervault
amazon-aa-batteries	10/10	10/10
costco-microfiber-towels	10/10	10/10
dickssportinggoods-water-bottle	9/10	9/10
ebay-usb-c-cable	9/10	2/10
guitarcenter-picks	0/10	0/10
harborfreight-utility-knife	3/10	5/10
homedepot-desk	10/10	10/10
lowes-metal-kit	10/10	10/10
mouser-usb-c-receptacle	0/10	0/10
newark-aa-batteries	4/10	0/10
radwell-fuse	2/10	5/10
staples-copy-paper	10/10	9/10
target-paper-towels	0/10	0/10
walmart-paper-towels	7/10	8/10
wbmason-sticky-notes	2/10	2/10
zoro-nitrile-gloves	1/10	0/10
Total	87/160 (54%)	80/160 (50%)

Blocked: 70 vs 75. The Evervault arm's cost and median duration are within a few percent of the Kernel arm's.

retail-cart-geo

Run locally on a private task file: 71 European retail sites, of which 46 are UK storefronts and the rest are in their home market (PL, DE, CZ, ES, FR, NL, GR, RO, SK, PT, DK). 5 attempts per site per arm, same time window, sandbox Evervault app. The task file is not committed.

• Egress check: the geo arm exited from residential ISPs in the target country (GB: BT, PL: Cyfronet). The EU relay exited from AS16509 (AWS, Dublin).

	codex-pw-kernel-geo	codex-pw-kernel-evervault-eu
Success	289/355 (81%)	264/355 (74%)
Cart verified	285	265
Blocked	53	67
Website error	8	19
Sites at 4/5 or better	55	52
Median duration	145s	138s
Infra failures, leftover proxies	0, 0	0, 0

On 15 sites the geo arm did better, on 9 the Evervault arm did, and on 47 they matched. Sites with the largest gaps were behind Akamai, which blocked the AWS egress, on one side, and on the other side sites that blocked the residential pool.