MÓDULO HAR.Art¶
Application-layer HAR replay client — 10k sessions/host, WAF tuning, regression testing. Standalone dashboard page (not an Art Studio tab — audience is QA web teams / WAF admins / app owners / perf engineers).
Function¶
Replays browser-recorded HAR files at L7 scale. Distinct from:
- PW.Art — actually drives a browser (~50 sessions/host)
- DoYour.Art Replay tab — PCAP at L2-L4 (packet-level)
HAR.Art replays the HTTP records captured by a browser, bypassing the browser overhead. ~10K sessions per host vs PW's ~50. Used for WAF rule tuning, cross-vendor HTTP regression, post-deploy app-layer smoke testing, performance attribution, multi-region testing, and load multiplication (1 captured HAR × 10000 parallel = realistic flash-sale load).
See ADR-0084 for the locked decisions (5 open-question answers, tier policy, architectural decisions).
Status¶
| Phase | Scope | Status |
|---|---|---|
| HAR-1 (PR #1031) | Client engine pkg/har-art/ — parser + rewriter + replay engine + CLI/server binary + 17 unit tests |
✅ |
| HAR-2 (PR #1032) | Drizzle 0038 + dual-mode store + 5 API routes + admin page /admin/har-art + 29 i18n keys × 3 locales |
✅ |
| HAR-3 (PR #1033) | K8s manifests slot .83 + VLAN 2903 + gVisor + RWX PVC har-library + Drizzle 0039 per-operator metadata + tier-bound quotas |
✅ |
| HAR-4 (this PR) | ADR-0084 + module docs 3 langs + recovery memo | ✅ |
| Phase B (future) | Drag-and-drop upload · quota CronJob · S3/MinIO · TLS fingerprint preservation · Playwright-mode browser-faithful replay | ⏳ |
Identity¶
| Element | Value |
|---|---|
| Plane | DATA (generates wire traffic at L7) |
| Internal code | pkg/har-art/ (client engine), har-engine/ (server-side persona archetype, sister MÓDULO) |
| K8s namespace | har-art (dedicated, distinct from web-agents) |
| OOBI slot | .83 |
| Network | VLAN 2903, subnet 172.22.0.0/16 |
| Sandbox | gVisor (runsc, shared with offensive-tooling family) |
| Tier gate | free allowed (low-risk web traffic per memo) |
| HTTP listener | :9092 (cluster-internal Service) |
Hardware envelope¶
Single replica handles ~10k concurrent sessions on 4 cores / 4 GiB (per the memo's headline target and HAR-3's Deployment limits). Each replica adds another ~10k; scale horizontally via kubectl scale deployment har-art --replicas=N. Practical ceilings: CPU peaks ~4 cores under sustained TLS handshakes; ephemeral port range needs sysctl bump >28k concurrent against the same target.
Operator controls¶
/admin/har-art — standalone admin page:
- Start form (12 fields) — operator / tier / HAR filename + path + entry count / target host / sessions / User-Agent override / Authorization (sentinel
STRIP) / pace-from-HAR / anonymize-PII - Tier-cap labels rendered live (e.g. "max 5 000 clients · 3 concurrent · 2 h")
- Sessions table — TanStack 5 s polling, inline cancel button
- Live counters — requests/sessions/bytes mirrored from pkg/har-art
/statusviaPATCH /api/har-art/replays/[id]/counters
Tier caps (locked, ADR-0084)¶
| Tier | Concurrent runs | Replay clients | Duration cap | HAR library |
|---|---|---|---|---|
| free | 1 | 100 | 5 min | 100 MiB · 5 files |
| indie | 1 | 500 | 30 min | 1 GiB · 25 files |
| team | 3 | 5 000 | 2 h | 10 GiB · 100 files |
| enterprise | 10 | 10 000 | 24 h | 100 GiB · unlimited |
Tier-cap errors return HTTP 429 with code: tier-* discriminator so the dashboard renders a coherent upsell path.
PII anonymization (locked ON by default)¶
The replay engine auto-strips a curated 10-header set (Cookie, Set-Cookie, Authorization, Proxy-Authorization, X-Api-Key, X-Auth-Token, X-Csrf-Token, X-Session-Id, X-Forwarded-User, X-Real-Ip) and regex-redacts email / CC / SSN shapes from request bodies. Opt out via Policy.anonymizePII=false for segregated-lab work.
Key telemetry¶
har_replay_requests_{total,ok,failed}_total— per-request countershar_replay_sessions_{started,finished}_total— per-session lifecyclehar_replay_bytes_{sent,received}_total— bandwidth
API surface¶
| Endpoint | Method | Purpose |
|---|---|---|
/api/har-art/replays |
GET / POST | List / start (Zod-validated, 429 on tier cap) |
/api/har-art/replays/[id] |
GET / DELETE | Single row / operator-initiated cancel |
/api/har-art/replays/[id]/counters |
PATCH | Dashboard poller mirror |
Notes¶
HAR.Art is DATA plane (generates wire traffic) despite operating at L7. Classification follows "test-traffic-generating MÓDULOs are DATA-plane regardless of OSI layer."
Related¶
- ADR-0084 — Authoritative design (Accepted 2026-05-24)
- ADR-0081 — sister DoYour.Art (PCAP replay; sibling)
- ADR-0082 — sister KALI.Art (pen-test pod; sibling)
pkg/har-art/README.md— engine + binary docshar-engine/README.md— sister persona SERVER archetypek8s/har-art/— namespace + NAD + PVC + deploymentdiscuss_har_art_2026_05_10— strategic memo- Patent claim #17