v1.0.3 — BrowserMCP real composite (6.20) + upstream bug filings

Patch release on top of v1.0.2. Preserves v1.0's 7-MCP composite framing; adds real BrowserMCP harness data + upstream contributions.

BrowserMCP real harness composite: 6.20

Ran the v1.0 harness against BrowserMCP via Chrome Agent + extension. Real composite from one harness pass is 6.20 — replaces the rough speculative 6.93 from v1.0.2's EXPLORATORY.md.

Per-dim breakdown

Dim	Weight	Score	Reasoning
Data Quality	3×	6	S1 PARTIAL + S2 EMPTY_BY_DESIGN + S3 OK
Reliability	3×	7	Single-pass, no flakiness; connection-fragility from 2026-04 NOT reproduced
Speed	2×	9	Sub-100ms tool calls; real-Chrome native perf
Token Efficiency	2×	7	Clean YAML accessibility tree
Interaction Depth	2×	2	S4 cascade kills S5-S7; only S8 worked
JS Rendering	1×	10	Real Chrome IS the engine
Setup Complexity	1×	3	Chrome Agent + extension + tab pre-bound
Error Handling	1×	5	Clear messages; recursive-close bug surfaced

Composite = 93/15 = 6.20 — would slot SECONDARY tier above browser-use-direct (5.87), below lightpanda (6.31). Not in scores.json — preserves v1.0's 7-MCP framing per G-744 v1.1 candidate-decision deferral.

Stage outcomes

Stage	Outcome
S1 (Greenhouse extract)	PARTIAL_VIA_MCP
S2 (Ashby React extract)	EMPTY_BY_DESIGN (React hydration wipe)
S3 (Platform detection)	OK
S4-S7 (Form fill)	FAILED — React app's failed re-fetch wipes DOM with 404 before form-fill can fire
S8 (Screenshot)	CAPTURED

Full transcript + evidence: results/2026-05-29-browsermcp/PASS1/

Upstream bug filings

🆕 h4ckf0r0day/obscura#197 — Linux x86_64 phantom listener (new)

Filed new issue with full bisection. The Obscura engine binary on Linux x86_64 prints Obscura CDP server listening on ws://127.0.0.1:9222 but ss -ltn confirms the port is never actually bound. macOS arm64 build of the same version binds correctly. Minimal reproducer + environment details + cross-link to our v1.0.2 release.

💬 browsermcp/mcp#163 — server.close recursive crash (comment)

Already filed by Cyberneticsplus (CVSS 7.5 / CWE-674). Added our independent stdio-only reproducer that fires the bug deterministically without an AI client. Cross-linked to our EXPLORATORY.md.

Sanity gates

• pytest -q → 309/309 baseline holds
• python3 -m bench.wave_close_check → all_pass=True (candidate_count=7, rubric_columns=8, terminal_craft_commits=0, no_new_mcps=True)
• git diff main -- scoring/score.py scoring/rubric.md .mcp.json → 0 lines (sacrosanct triad byte-for-byte unchanged from v1.0)
• scores.json untouched

Cost ledger

• $0 marginal — Claude Max subscription, unlimited Claude Code usage

What's still deferred

• 3-pass FAIRNESS-01 median for BrowserMCP (would refine the Reliability score) — v1.1 work
• Cold-start 3-segment for BrowserMCP — v1.1 work
• Token efficiency 3-scope for BrowserMCP — v1.1 work
• TLS fingerprint capture for the other 6 v1.0 MCPs — G-739/#11
• Formal candidate decision for BrowserMCP (include in v1.1? separate category?) — G-744