[MichaelWave369]

R16: test actual live public GitHub Pages embedding, not only an assembled local artifact

Grounded baseline

PhiOS #413 merged at a2b70cf965b3c6d6b09899d1cd953ff87a55e79b, and its post-merge native-image, PhiOS Site, and two-origin browser jobs are green. Its browser test served a locally built project Pages artifact. The live public PixelForge Studio and bridge script also respond, but live iframe framing and deployed-source integrity remain unproven.

Scope

• Preserve existing R12–R15 local browser acceptance as its default test. Add an explicit PHIOS_R16_LIVE_PAGES=1 CI-only mode in the same browser harness.
• For live mode, fetch exactly https://michaelwave369.github.io/parallax-pixelforge/vr-studio/ public index.html and the two bridge modules. Require 200/no redirect, correct HTML MIME, reviewed panel, and SHA-256-exact deployed bridge client/UI module bytes from pinned PixelForge merge SHA b1c6314da005de801ba3b0417ffe4b4abe461828.
• Capture real X-Frame-Options, CSP and Referrer-Policy response headers, then embed the live HTTPS PixelForge in an actual Chromium iframe from a separately hosted localhost PhiOS build. Handle cross-site out-of-process iframe debugging contexts.
• Keep the full consent, default-deny, canceled approval, provider separation, V2 drift revoke, reapproval, disconnect/reconnect default-deny, zero world-file transfer, and launcher-no-auto-frame assertions unchanged.
• Add a separate read-only GitHub Actions live-web acceptance. No production trust config, native app package, user accounts, deployments, permission grants, or source pin changes.

Interpret carefully

Live Pages embedding from an ephemeral loopback PhiOS origin does not establish that a real deployed Netlify PhiOS origin is permitted. If the live source differs or framing blocks, the check must fail, with no CSP bypass. The full PhiOS native image, signature and release gates are separate. Keep this PR draft for evidence-led review.

Confirmed current-head evidence

• Actual LIVE public GitHub Pages Chromium audit #42565066483 SUCCESS on PR head b517b170f8130b00c850b4df0e35fc6965e1a3e9. The public Studio URL returned HTTP 200, text/html, and no X-Frame-Options/CSP/Referrer-Policy response headers; both deployed bridge modules SHA-256 matched pinned merged PixelForge Add experimental AgentCeption dispatch and field-guided cognitive-architecture recommendation (MCP Phase 16/17) #89. The browser loaded the actual GitHub Pages HTTPS Studio inside the PhiOS loopback iframe, with a separate Chrome target where necessary.
• The PHIOS_R12_PIXELFORGE_TWO_ORIGIN_CHROME receipt verified pixelForgeServedFromActualPublicPages=true, default denial, canceled consent, approved opaque project ref, revocation on V2 drift, restored V2 still denied, deliberate reapproval, manual revoke, fresh reconnect denied, and worldFilesTransferred=0.
• The unchanged local assembled Pages two-origin regression #42565066504 SUCCESS.
• Full PhiOS qualification #42565066471 is a separate fixture-free native image / VM / release gate and was still running at this report. Do not merge based only on browser green.

Remaining deployment distinction: successful framing from a disposable loopback PhiOS parent does not prove framing from a live Netlify PhiOS origin or authorize persistent production endpoint settings.