A Browser Click Is Not Proof: Verifying That Web Apps Actually Work

A web app can look finished while its most important actions do nothing durable. RealDone is not a Save-button checker. It discovers user-reachable actions across the app-including create, edit, delete, button clicks, form submit and Enter-submit, toggles, status changes, navigation, multi-step workflows, role handoffs, and configured provider boundaries-then verifies their observable consequences. Risky or external actions remain blocked until the project owner explicitly allows them.

A Save button may show a spinner and a success toast. A new row may appear. The API may even return HTTP 200. Then the user refreshes the page and the data disappears. That gap is the reason I built RealDone, an open-source behavioral verification tool that uses a real browser and checks observable consequences instead of trusting UI claims.

One Simple Failure Pattern

Consider a typical create flow:

• Fill a form.
• Click Save.
• See “Saved successfully.”
• Refresh.
• Discover that nothing was persisted.

A normal click script can prove steps 1-3 happened. It cannot prove the feature worked. RealDone treats the visible action as the beginning of verification, not the conclusion. It observes the action, network activity, DOM changes, browser storage, reload behavior, and-when configured-the application’s source of truth.

Evidence Before Verdicts

The verifier distinguishes several evidence levels:

• the UI claimed success;
• the action was initiated;
• a write request was observed;
• the backend accepted it;
• the resource was read back;
• it survived reload, a new tab, or a clean session;
• a database or provider confirmed the outcome;
• another role or user could observe the correct result.

This matters because different applications have different persistence models. Local-first data is not automatically a bug. A backend-backed Save that only mutates React state usually is. When the evidence is incomplete, RealDone reports UNCERTAIN, SKIPPED, BLOCKED, or ENVIRONMENT_INVALID instead of inventing an application defect.

One-Command First Run

From a web project directory:

npx realdone scan

RealDone can discover common local runtimes, start the app, ask once for project-level action consent, scan with Chromium, write an evidence report, and stop the runtime afterward. Any web app already reachable over HTTP can be scanned by passing its URL. The CLI does not require an AI account, an API key, or a hosted dashboard. Coding agents can call the same core through MCP, but agent output is never treated as verification evidence.

Safety Is Part of Correctness

Automatic browser actions are useful only when they fail closed. RealDone blocks destructive actions, production-like hosts, payments, email, webhooks, and external effects by default. Credentials are supplied through environment variables and redacted from artifacts. A broad “scan everything” flag never silently grants payment or deletion authority.

Testing the Verifier Itself

For v1.3.3, I ran a reproducible Chromium batch across ten pinned MIT projects. Each project kept a clean control and received one minimal injected no-op Create action. RealDone reported all ten injected faults as NO_EFFECT / RD002.

The release also refreshed evidence for TodoMVC, Actual Budget, Conduit with SQLite, Conduit with PostgreSQL plus a Supabase Data API boundary, and a Codex-generated multi-role project. The hosted release passed all 15 normative gates on Windows, macOS, and Linux. That does not mean every web widget is solved forever. It means the current claims are tied to executable gates, pinned inputs, raw reports, and reproducible evidence.

RealDone is MIT licensed: https://github.com/datzle123/RealDone

I would especially value feedback on false positives, false negatives, unusual widgets, and real persistence models.

Disclosure: I built RealDone. This post was prepared with AI-assisted editing and manually reviewed against the project’s release evidence.