## Summary - document a harness-neutral Playwright MCP setup for authenticated PR preview testing - add a portable Agent Skill for trusted provenance, OAuth, sandbox selection, and serialized deployment checks - persist the browser profile while loading credentials from an external dotenv file - deny Playwright for normal agents and provide a launch-only, browser-only OpenCode profile with unrelated agents, tools, and MCP servers disabled

## Dependency - #97 merged the Coolify direct-reference prerequisite into `main`; PR previews load deployment Compose from the production branch

## Verification - `bun test` - `bun run types` - `bun run ci` - OpenCode base and launch-overlay configuration resolution - preview-browser effective permission ordering - live OAuth, sole-sandbox, channel creation, and ready-workspace smoke test - independent security/documentation review: no remaining findings

The preview deployment for **chopin** is ready. 🟢

[Open app](http://93-chopin.githubnext.com) | [Open Build Logs](https://next-appserver.tail49836a.ts.net/project/l9buznc9ua1if0vflxrjwajs/environment/lxqsvczv19eopxk29vfb46mj/application/hb85gdd9mwqqlfwcteflvpbj/deployment/seezjishujncaqdmhtazefjf) | [Open Application Logs](https://next-appserver.tail49836a.ts.net/project/l9buznc9ua1if0vflxrjwajs/environment/lxqsvczv19eopxk29vfb46mj/application/hb85gdd9mwqqlfwcteflvpbj/logs)

Last updated at: 2026-08-20 14:19:14 CET