Phase 2: pi-browser-harness fetcher for Compass + Cloudflare/login findings

- scripts/compass-fetch.mjs drives pi-browser-harness (daemon socket) to log
  in once and store raw Compass pages with a sha256/byte-count manifest
- clear the Cloudflare managed challenge via a desktop-UA override plus an
  isolated browser context (the default HeadlessChrome UA loops the challenge)
- docs/phase-2-harness-notes.md records the harness entrypoint, the Compass
  login form, and the stored-page evidence
- gitignore local runtime state (var/, sqlite files)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

docs/phase-2-harness-notes.md

@@ -0,0 +1,72 @@
+# Phase 2 — Compass login + fetch notes
+
+Status: **partially proven.** The browser path to Compass works; the login and
+per-child fetch are blocked on a Compass credential that is not available to the
+agent. See AUD-104.
+
+## Harness used
+
+- `pi-browser-harness` **v0.11.0**
+  (`/home/sam/.agents/extensions/pi-browser-harness/package.json`).
+- Entrypoint: the pi extension `src/index.ts` plus its long-lived daemon
+  `src/daemon/index.ts`. The daemon bridges `pi → Unix socket
+  (/tmp/pi-browser-daemon.sock) → Chrome DevTools Protocol`.
+- Chrome: systemd user service `chrome-pi.service`
+  (`/home/sam/.config/systemd/user/chrome-pi.service`), `--headless=new`,
+  `--remote-debugging-port=9222`, `--user-data-dir=/home/sam/.chrome-pi`.
+- The Phase 2 fetcher (`scripts/compass-fetch.mjs`) talks to the harness daemon
+  socket and drives the harness's Chrome over CDP.
+
+## Compass
+
+- URL: `https://nhs-vic.compass.education/login.aspx` (Northcote High School).
+- Login form: `#username`, `#password`, hidden `browserFingerprint`,
+  `__RequestVerificationToken`, submit `#button1`
+  (`formaction="/login?handler=Login"`). Also present: a SAML button and
+  **"Parent sign in with one-time code"** (`formaction="/login?handler=OtpSignin"`).
+
+## Cloudflare finding (important)
+
+Compass is behind a Cloudflare managed challenge. With the default
+`HeadlessChrome` user agent, the challenge loops forever
+(`title="Just a moment..."`, body "Compass is verifying your connection...").
+The fix that works:
+
+1. Override the user agent to a normal desktop Chrome UA
+   (`Network.setUserAgentOverride`), and
+2. run the page in an **isolated browser context**
+   (`Target.createBrowserContext`) so stale `cf_clearance` / `cf_chl_rc_ni`
+   cookies from earlier attempts do not loop the challenge.
+
+With both, the challenge clears in ~5 s and the real login page loads. Both are
+implemented in `scripts/compass-fetch.mjs`.
+
+## Proof stored (2026-10-15)
+
+```
+var/raw/harry/<runId>/login.html
+var/raw/harry/<runId>/login.meta.json
+var/raw/harry/<runId>/manifest.json
+```
+
+- `var/` is git-ignored. Raw pages stay local, never committed.
+- `login` — `https://nhs-vic.compass.education/login.aspx`, title
+  `Login | Compass`, **125 741 bytes**, sha256
+  `4d3b731c34d64b6978d4e1bd7f4a7772ae2b5d8687241db3d7163c2beb325f01`.
+
+## Blocked on
+
+A Compass account credential (not `HeadlessChrome`-related, not a Cloudflare
+issue). Nothing matching `COMPASS*`, `SCHOOL*`, `NORTHCOTE*`, `HARRY*`, `FINN*`,
+or `TEAMS*` exists in `~/.config/environment.d/10-secrets.conf` or the paperclip
+secrets available to the agent. The account can be a parent/guardian account or
+per-child; confirmation of whether Compass enforces a one-time code on a new
+device is also needed.
+
+## Smallest useful scope for Phase 3
+
+The login page exposes a username/password form and a parent one-time-code
+option. Until a login succeeds we cannot enumerate the per-child page URLs, so
+the smallest useful scope cannot be fixed yet. It is expected to be the
+"today/planner" page plus the messages/notices list, which is what answers "what
+is overdue".