FastForm Phases 0–4: cookie/parse/match/compile/classify/transport pipeline

[SupaOhm]

Implements Phases 0–4 of the FastForm design: a hand-runnable pipeline that
submits a Google Form by POSTing directly to formResponse, with authentication
read live from Chrome. Task 11 (the fire.py CLI that wires the pipeline into a
single command) is intentionally not in this PR yet.

What's here

• cookies.py — reads Google auth cookies live from Chrome's cookie store
  (Keychain secret → PBKDF2 → AES-128-CBC via openssl, zero deps). Requires an
  explicit profile; resolve_accounts() names each profile's account.
• parse.py — form page → FormSpec from FB_PUBLIC_LOAD_DATA_; detects
  sign-in state and scrapes the per-load token/tag hidden inputs.
• match.py — matches prepared answers to questions by text with a
  confidence ladder; a choice value not in the options list is a gap, not a fill.
• compile.py — FilledForm → request body + headers; refuses to build
  without token/tag.
• classify.py — response → outcome, from measured fixtures.
• transport.py — one warm connection reused across GET and POST.

Verified against the real Google Forms behavior

This design was corrected repeatedly by empirical testing, not assumption. Key
findings, all encoded in the code and its tests:

• Cookies expire in minutes (Chrome rotates __Secure-1PSIDTS), so a static
  captured header is unusable — cookies are read live at run time.
• The POST needs token and tag, per-page-load hidden inputs, HTML-escaped
  in the page. Not reCAPTCHA — scrapeable.
• A signed-out form returns HTTP 200 with the full structure, never a
  redirect; detected by a data-sign-in-to-continue attribute.
• There is no server-side duplicate protection — no fbzx dedupe, no
  limit-to-one enforcement against a direct POST. The client's stop-on-success
  is the only safeguard, which shaped the retry policy.
• The classifier keys on the <form> element, because a success page and a
  rejection page both contain FB_PUBLIC_LOAD_DATA_. An earlier heuristic
  reported a recorded submission as REJECTED; that regression is now pinned to
  a real fixture by a test.

Tests

93 tests, stdlib unittest, no network (a local server exercises transport).

python3 -m unittest discover -s tests -v

Not included / follow-ups

• Task 11 (fire.py CLI) — the pipeline is built but not yet wired into the
  single-command runner.
• Chrome profile is unset in config/profile.toml; the tool refuses to run
  until an account is chosen.
• Minor review findings (e.g. hidden-input regex assumes attribute order) are
  tracked for the final review.

🤖 Generated with Claude Code

https://claude.ai/code/session_01HvAS3iP5DJxYkmGuwXadoL

[Copilot]

Pull request overview

Implements the initial FastForm “Phases 0–4” pipeline for submitting Google Forms via a direct formResponse POST, with cookie auth sourced live from Chrome, plus a fixture-driven test suite that exercises parsing, matching, compilation, transport reuse, and response classification.

Changes:

• Added core pipeline modules: Chrome cookie extraction (cookies.py), page parsing into a FormSpec (parse.py), answer matching (match.py), request compilation (compile.py), warm-connection transport (transport.py), and response classification (classify.py).
• Added extensive unittest coverage and local fixtures for parser/classifier/transport behavior.
• Added configuration scaffolding (config/*.toml, .gitignore) and a detailed design/spec document.

Reviewed changes

Copilot reviewed 21 out of 26 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
fastform/cookies.py	Reads/decrypts Google cookies from Chrome profile store and verifies sign-in state.
fastform/parse.py	Extracts FB_PUBLIC_LOAD_DATA_ + hidden inputs into FormSpec and question list.
fastform/match.py	Matches answer-bank entries to questions and produces FilledForm + confidence/gaps.
fastform/compile.py	Builds POST body/headers for formResponse, enforcing presence of token/tag.
fastform/transport.py	Provides a reusable warm HTTP(S) connection and basic heartbeat logic.
fastform/classify.py	Classifies submission outcomes using structural markers and saved fixtures.
tests/test_cookies.py	Unit tests for cookie loading/verification/decryption and profile selection logic.
tests/test_parse.py	Parser tests against real/synthetic fixtures; sign-in and hidden-input extraction coverage.
tests/test_match.py	Matching and confidence ladder tests, including choice-option constraints and blockers.
tests/test_compile.py	Request compilation tests (headers/encoding/fbzx/token/tag/pageHistory/email).
tests/test_transport.py	Ensures response draining enables keep-alive reuse; validates elapsed timing and reconnect semantics.
tests/test_classify.py	Classifier tests pinned to captured response bodies and redirect semantics.
tests/__init__.py	Marks tests package.
fixtures/resp-success.bin	Captured “recorded” response fixture used by classifier tests.
fixtures/resp-closed.bin	Captured “closed form” response/landing fixture used by classifier tests.
fixtures/f3-viewform.html	Synthetic multi-section form HTML for parser tests.
fixtures/f4-viewform.html	Synthetic file-upload blocker form HTML for parser tests.
fixtures/README.md	Documents fixture provenance and intended semantics.
docs/superpowers/specs/2026-08-05-fastform-design.md	Architecture/design rationale and phased build plan.
config/answers.toml	Initial answer bank example (match phrases/regex/value).
config/profile.toml	Chrome profile selection guidance (intentionally unset by default).
.gitignore	Ignores cookie override file and curl fixture artifacts.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.