Title: Declaration + auto-connect for “in-your-face”: browser-support, network-manager, firewall-control
Body: name: in-your-face
description: Unattended digital-signage / kiosk display application (product: https://inyourface.space) for Ubuntu Core (amd64 signage PCs and Raspberry Pi 5). Runs as a daemon and renders full-screen menus, images, video, and web pages on the connected screen via ubuntu-frame (Wayland). Boxes are headless and provisioned unattended by a script.
snapcraft: PRIVATE
upstream: PRIVATE
upstream-relation: Official publisher and upstream developer
interfaces:
browser-support: request-type: installation reasoning: A feature renders web-page “slides” using an embedded Chromium engine (the webview_cef plugin), which requires browser-support. On upload, the daemon + browser-support combination trips manual review (“‘daemon’ should not be used with ‘browser-support’”) and the resulting revision cannot be released to any channel (“not approved”). The snap is strictly confined, grade stable. We use the plain browser-support interface (allow-sandbox: false, NOT the sandbox variant); Chromium is launched with --no-sandbox, --ozone-platform=headless and single-process flags (–no-zygote --in-process-gpu --disable-gpu), rendered offscreen to the application’s own Flutter texture with no top-level windows. Blocked revisions: 36 (amd64), 37 (arm64).
browser-support: request-type: auto-connection reasoning: Rendering web-page slides is an advertised feature of the application, and the target boxes are unattended kiosks provisioned by a script. Without automatic connection, each provisioned box requires a manual interface-connection step before the feature works. We request auto-connection to provide a functional default install experience on these headless, unattended devices.
network-manager: request-type: auto-connection reasoning: The application drives Wi-Fi onboarding and connectivity detection via nmcli on unattended Ubuntu Core boxes. This interface is already used on our published stable revisions (connected manually today). We request auto-connection so provisioned kiosks work without a manual connection step.
firewall-control: request-type: auto-connection reasoning: Used for the captive-portal Wi-Fi-onboarding flow (an iptables REDIRECT of port 53 to a local resolver on the device). Already used on our published stable revisions. We request auto-connection for the same unattended, headless reason.
