Browser mission: complete stable local and remote browsing with human and agent parity

@andersalm

A Home owner can open Browser from a normal installation, browse with smooth audio/video/input, recover interruptions and close all owned resources. The same Browser and operator contracts work with independently selected local or remote Engine and Exit services.

Product owner: Anders (@andersalm). Acceptance revision: Browser-2026-10-07-R1. This is the full Browser mission requested by Anders, including preserved B01–B16 requirements. #87 remains the local Mac/Wallet release parent with its current release scope; remote/operator work has separate owning tasks. This mission establishes acceptance and work ownership; it does not promote a release.

Baseline: complete B01–B16 acceptance, Browser contract, role matrix and 7 October evidence review.

Acceptance ownership

The full preserved baseline is below, with stable Bxx.Ay checkbox IDs. Existing owning issues record implementation/status/proof for their scopes; this mission records coverage across every claimed role and placement. A local pass applies to its exact candidate/role and does not complete remote qualification.

Goal	Owning issue / scope	Remaining acceptance
B01	#293 certification; #87 Mac admission; #90 Jetson; #165/#406 Linux host setup; PR #349 x86 source	Role matrix, matching payloads and version/device rejection; installed receipts for each support claim.
B02	#87 Mac consumer; #90 Jetson consumer; #217 producer; #89/#108/#112 signed set	Empty-Home Browser journey and missing/corrupt/interrupted/incompatible setup cases.
B03	#87/#90 local and preparation; #290/#291 operator/remote; #293 privacy proof	Correct stage, structured error and one bounded redacted export.
B04	#290 operator parity	Native workflow, declared Playwright/Camofox adapters, headless/handoff and Camoufox/Firefox qualification.
B05	#87 local; #290 shared actions; #291 remote; #293 measurement	Continuous wheel, IME/Unicode/focus/clipboard/resize/touch, ordering and visible latency.
B06	#87 local; #289 dispatch; #291 remote; #131 lifetime; #292 state	Reload/network/sleep/provider faults, private-state continuity and exact ownership/reconciliation.
B07	#131 exact cleanup; #289 responsiveness/quotas; #293 measurements/cycles	Independent short operations, bounded admission/capacity and all cleanup effects.
B08	#291 ordinary remote service	Two identities offer/request/approve/select/use/revoke/close through ordinary controls.
B09	#291 selected Exit; #173 enforcing authority	Selected Exit DNS/destination/TLS/stream policy, cancellation and local/remote revocation.
B10	#291 placement; #293 physical qualification	All five UI/Engine/Exit placements on physical LAN, WAN and relay-required networks.
B11	#87 functional media; #293 measured use	100 cold/warm samples, input/frame budgets, 30-minute A/V and eight-hour resource run.
B12	#292 full profiles; #131 local transaction; #87/#90 installed continuity; #89 update	Committed durability, principal/writer separation, protected transfer and verified deletion.
B13	#87 local/Wallet; #290 handoff; #291 remote; #293 target proof	Real websites, files, accessibility, trusted approval and actual transaction outcome.
B14	#173 Browser authority; #166/#170/#171/#177/#178/#179/#180 outputs	Provider-side 2s/30s enforcement, adversarial tests, truthful isolation and private diagnostics.
B15	#87/#90 consumers; #89/#108/#109/#112/#113/#217/#274/#287 producers; #292 profiles; #293 maintenance	Atomic compatible updates, profile preservation, interruption/repair and maintenance policy.
B16	#293 qualification	Frozen candidate, applicable B01–B15 gates, hardware/human review and second-maintainer repeat.

Use #87 for Mac, #90 for Jetson, and #289–#293 for their named contributions. #288 was closed as a duplicate of #87. Its Mac preparation/progress checks live in #87; Linux evidence belongs to the applicable target, and PR #349 is the existing x86 source candidate. #287 and #252 retain their original scopes. Each leaf owns its current candidate and proof.

Execution rules

Two Browser lanes: Installed product and Contract and source. A session records its execution owner, candidate, file/resource scope and next proof in the claimed task. Keep one task In progress per lane; take the lowest-numbered eligible task whose producer outputs are satisfied and whose current owner/blockers permit work. Parent issues aggregate acceptance and do not authorize another active task.

One owner controls the shared Mac fixture and one owner holds the host's heavy-build lease. Respect existing Runtime/release owners and the shared lease, including work outside this Browser mission. Source work can progress independently when file scopes and resources are disjoint. Read current issue state and private lifecycle inventories before assuming that a historical process, receipt or owner is current.

Keep verified work in QA / Review until full task acceptance, required reviews and merge. Update the owning issue before reporting passed, failed and pending milestones. During sustained execution use a 30-minute evidence checkpoint, then continue the next authorized experiment. Record a missing target or permission as a specific blocker and continue other eligible work.

Accepted prerequisite outputs and later qualification

Package interface, Runtime projection and Engine protocol are separate compatibility boundaries. At the reviewed source they are capsule/projection v1, Browser page interface 0.5.0 and Engine protocol 2.1. Exact Engine compatibility precedes profile/page/stream effects.

M0: existing shared contract validation (23ea1ebcfbc0b31a28f1c22903bb272f8250c65b), host readiness (122dc4adef51da59091070323ffa0679493a423c), viewer eligibility (6aff190c1351656c6f91a31cdd2deda5c41bb8b3) and bounded Engine-document inspection (4dd0a21696875d424605d6688b70c56b0b98b30c) are integrated prerequisite outputs. The 7 October receipt records 195 relevant Browser and 46 operator-client fixtures passing on develop 91ba79c467cf9cae764d8ff3b76d7c08043e6081, tree aac625e8105e7be2d6bb45b41e0188562266248f. These are contract/source outputs; device/media/full operator certification remains open.

Browser milestones have explicit task owners: M1 (#131) exact installed page/frame/input/cleanup; M2 (#87 and #90 consuming #217/#108/#112/#287 and the applicable #281 bounded acquisition output) complete signed package acquisition/update; O0 (#290) native shared operator workflow; R0 (#291) ordinary remote service/session with independent Exit selection; A0 (#173) bounded provider-side authority; P0 (#292) private durable profile binding. These Browser labels are distinct from #89's staged-install/update M1/M2. Consumers use accepted, compatible milestone receipts while broader producer acceptance remains open.

The operator task can test its core locally, then use R0 for remote/headless conformance. The remote task can establish R0 using existing authorized human controls, then consume O0 for full operator workflows. Neither waits for the other's full closure. Initial support-matrix/audit work can begin from M0; final B01/B16 certification consumes completed behavior. Diagnostics and authority checks apply to every slice.

Proof and closeout gate

Each installed receipt binds source commit/tree and any dirty patch, capsule identity/hash, Runtime/Engine/image/helper and manifest identities, built and installed SHA-256, actual installed/running artifacts, device/OS/resources, viewer/client/adapter versions, selected Engine/Exit and UI/Engine/Exit placement, network profile, exact commands, timings, failed cases, cleanup and matching media/manual evidence. Public issues carry safe summaries and evidence links; credentials, private paths, identity state and sensitive raw traces retain their existing private access controls.

Product viewing remains real decoded WebRTC through Runtime-mediated networking. Operator inspection/capture has explicit capability checks. Source presence, an image alone, a screenshot, a logical two-Runtime loopback run or a desktop mobile viewport provides only its bounded proof.

Full qualification retains 100 lifecycle cycles, 100 cold and 100 warm launch samples, 30-minute A/V, eight-hour mixed/hidden use, all five placements A/A/A, A/B/A, A/A/B, A/B/B and A/B/C, physical LAN/WAN/relay, faults/capacity/mixed versions, human/agent conformance and a second-maintainer fresh install. Original numerical budgets remain in the owning tasks; any change needs an explicit reviewed rationale.

Independent agent review and required human review are separate. irzhywau reviews applicable signing/update/approval/authority/isolation changes; #87 retains Wallet and Sasha's screen/manual reviews. Close tasks only when acceptance passes, findings are resolved, required reviews are complete and implementing PRs are merged. Closing or hiding a feature cannot substitute for its complete installed journey.

Elastos boundaries and shared work

Runtime owns authority, routing, artifact compatibility and lifecycle. Engine owns website execution/rendering; Exit owns selected network execution. Carrier is the off-box transport below the same contract. Local/nonlocal operations retain equal permissions and lifecycle semantics. Platform-specific payloads and explicit private-profile placement remain separate from package portability.

Reuse existing owners for signed delivery/update (#89/#108/#113/#217/#274), truthful isolation/verified assets/confinement/trusted approval (#170/#171/#173/#178), Linux host setup (#165) and actual Jetson coverage (#90). Keep #182 generic VM capsules and #281 broader provider distribution in their current scope. This Browser mission does not require a general VM redesign to prove its next journey.

GitHub issues own work status, acceptance and proof. Repository contract files remain product instructions; #293 corrects their obsolete TASKS closure footer. Keep branch/artifact lifecycle inventories private and preserve unique history and dirty work until owner decisions.

Each owning task records its approved base and target; the current fetched source is in the checkpoint below. New branches follow AGENTS' approved-base rule. Merge, history rewrite, production signing, release, public deployment and changes to existing operator Homes keep their existing approval gates. No new authority is inferred from this mission record.

Delivery dependencies

M1 installed cleanup: Gateway SIGTERM leaves orphan browser-vm-control-service #131 produces the exact page/frame/input/normal-Close milestone, then separate graceful gateway stop, active SIGTERM, crash/restart and orphan recovery with bounded cleanup. A matching installed candidate, current fixture ownership and staging access are actual prerequisites.
M2 normal delivery: Wrap third-party software as capsules served over Carrier; never download from other servers #217 produces the complete signed role closure/CID, matching image/helpers, compatible managed dependencies, truthful adapter metadata and canonical configuration; G1 Install and update: Signed update #89/UP-02: Stage one complete release #108 and UP-06: Produce the exact signed test candidate #112 supply compatible activation and the approved signed candidate. Undo and older Homes fetch components by name, so they get the newest release's bytes #287 supplies accepted generic CID selection; Anyone can host signed capsules: the seed is one provider among many (free and paid) #281 supplies the held-only bounded Content/Carrier acquisition output consumed by the Browser image path. Its Browser receipt remains open. G5 Private Browser: Browser on Apple Silicon Mac #87 and G5 Private Browser: Jetson support #90 own their ordinary preparation and installed acceptance. Browser: prepare the selected local Engine during normal installation and repair #288 is the historical Mac duplicate. M2 must expose actionable preparation/readiness and preserve principal/profile state, initial-creation recovery, active ownership and atomic replacement. Source work starts from accepted contracts; installed acceptance consumes exact compatible producer outputs and M1 cleanup. Broader producer closure is a separate gate.
D0 diagnosis / A0 authority: G5 Private Browser: Browser on Apple Silicon Mac #87 and this issue consume correct error stages and reports; Required: Isolation as promised #173 supplies Browser provider-side bounded authority. These checks accompany every slice. Applicable trusted-approval/asset/isolation outputs remain final gates.
O0 operator: the existing bounded admission/inspection contract permits a native local shared workflow first. Remote/headless conformance consumes an accepted R0 service/session result; full B04 remains open until declared adapters and provider paths pass.
R0 remote service: ordinary two-identity Engine/Exit admission works with existing authorized human controls. R1 complete remote usability consumes O0 and compatible authority/profile outputs. Operator and remote work depend on intermediate outputs, rather than waiting for each other's full closure.
P0 profiles: local durability starts from existing profile ownership. Transfer/deletion uses R0; supported upgrade uses M2. The profile's explicit grant controls remote placement.
Q0 qualification: initial matrix/audit-schema work can start from M0. Full B01/B16 consumes integrated local, remote, operator, profile, authority and measured-use results. Missing hardware keeps its row unverified, while other ready work proceeds.

Remote ownership explicitly includes applicable B05/B06/B13 input, recovery, files, accessibility and Wallet flows on all five placements. Observe the destination and DNS at the selected Exit, especially A/B/A, A/A/B and A/B/C. Fail/revoke Engine and Exit independently. Logical same-host fixtures supply bounded evidence; physical LAN/WAN/relay runs remain required.

Current checkpoint — 3 November 2026

Delivered and under proof. Published 2.0.0 offers Browser on Apple Silicon Mac. #87 owns its exact signed installed journey and the accepted single-window scope. #131 retains the bounded historical Mac lifecycle proof from the repair carried by merged PR #307. The current lifecycle and human gates stay open. Jetson is the separate #90 lane for the proposed 2.1.0 release. Main reports source-Home browse, Close/reopen with a saved profile, and Home restart on the copy-free Linux overlay path. The ten-cycle run, independent review, compatible signed release and ordinary installed update remain pending. The recorded times remain baseline measurements. Current candidate and target evidence live in #90. The published Mac fresh-install check excluded Home start, Browser and passkey. Use the complete #87 journey for that claim. Stable publication proof

Architecture. Admit one compatible signed closure for the Browser UI, Engine, image and host helpers. Keep the admitted image immutable, a disposable guest and its scratch state under a session lease, and the principal profile in a separate owned disk. Runtime controls authority, limits, settlement and service selection. Engine owns page execution, rendering and website TLS. Exit owns authorized DNS and destination streams. Carrier carries traffic between selected Runtimes. The same typed Browser actions serve human and agent clients. WebRTC remains the product display. Local and remote share authority and behavior while their transport and latency budgets differ.

Order	Existing owner	Evidence that advances the work
1. Finish the local delivery slice	#90 Jetson; #87 Mac; #217/#89 signed delivery; #165/#406 privileged host setup	Freeze one candidate. On Jetson, prove repeated Close/reopen, restart and exact resource release on the overlay path. Then prove ordinary signed installation and update with the matching Engine/helper set and preserved profile. For Mac, use the existing exact-release journey and reproduce #477 on a source Home separately. On an empty Jetson host, #165 must select the confined userspace transport explicitly and #406 must bind the signed helper bytes to the privileged step. #293 supplies the target receipt and manual validator path. #183/#518/#519 own the background-service boundary and its device access proof when used.
2. Close local lifecycle and interaction gaps	#131 settlement; #289 capacity; #457 Close latency; #482 input ownership; #292 local profiles	Trace open, cancellation, normal Close, SIGTERM, crash/restart and repair from exact page/generation through guest and worker absence. Keep ownership until settlement. Preserve committed profile state and refuse a concurrent writer. Test responsiveness during another stalled launch, and measure actual limits. PR #526 fixes the separate false TURN-port Close failure. #457 still owns visible Close and measured latency.
3. Prove provider authority and ordinary remote use	#173/#177/#179 enforcement; #291 R0; #290 O0; #438/#439 operator settlement; #485 principal/grant regression	R0 uses two real owners and the ordinary approved People/Runtime grant and selection path. O0 uses the same existing Engine page locally, with handoff/takeback. Relay-required WAN evidence consumes #345; initial same-device/LAN proof can proceed from its own accepted inputs. They can progress independently where scope and resources allow. Before claiming remote support, prove provider-side revocation, partition expiry, typed refusal versus uncertain effects, and independent Engine/Exit behavior. #456 is the physical Android viewer proof, including the separate Home Back behavior under #92.
4. Complete daily use and qualify advertised rows	#87 local/Wallet; #292 protected transfer/deletion; #293 matrix and measured qualification; #475/#217 upkeep	Consume the accepted local, operator, remote, profile and authority outputs. Prove real A/V, input, accessibility, files and trusted Wallet approvals on applicable rows. Keep #349 as the existing x86 candidate and use #293 for its support proof. Run the original fault, latency, cycle, physical network, soak and second-maintainer checks on the frozen release.

Priority and boundaries. Device eligibility, signed readiness, a working session and a supported role are four separate claims. Keep ARM64 private until the release admission and applicable device gates pass. The Linux overlay replaces the full-copy path and Linux refill pool. Preserve only compatibility removal paths and explicit test fixtures with named callers; Mac VZ retains its own host adapter. Verify that the backing image generation stays bound across launch/update/Undo and that disk-worker leases keep deletion safe. #289 verifies that concurrent admission accounts for the combined overlay, profile and update budget. Profiles remain principal-owned and explicitly outside protected-storage/Recovery Kit claims until #292 supplies the relevant proof. For remote authority, the current five-second watchdog and 50-second stale threshold do not establish B14's two-second reachable revocation or 30-second partition lease. Prove effect termination at the enforcing provider.

Measure the work users feel. Keep install time, launch to usable frame, input to visible result, Close settlement, and restart/reopen distinct. Main's Jetson reports of roughly 50 seconds first open and 38–43 seconds on later opens are useful baselines. B11 still has proposed local p95 targets of 5 seconds cold, 1 second warm and 100 ms input-to-visible. Apply the original named-device sample counts and budgets. A change to those targets needs explicit review. Optimize the measured stage. VOXL is a steady-state display benchmark reference; any transport or capture experiment belongs under the existing #293 proof and the same Runtime authority. Keep hibernation, generic VM work (#182) and engine replacement outside the current installed repair.

One record per result. #283 owns this order and B01–B16. Leaf issues own status and receipts. #293 owns support verdicts. #217 owns signed producer and CI details. Reuse exact input-bound image/helper artifacts and the existing check entry points. Batch a build after inputs freeze, test the first installed failure, and repeat the affected slice. Use accepted producer milestones without waiting for unrelated owner issues to close. The original criteria, approvals, human/media checks and operational gates follow below.

Local acceptance contribution moved from #87

#87 local release contribution

The checks below are the local Mac/Wallet contribution owned by #87. The full B01–B16 baseline stays here. Remote Engine/Exit and operator qualification retain #291 and #290.

Local acceptance uses B03, B05, B06 and B13, with the local profile/media/update portions of B11/B12/B15. The complete criterion text in #283 remains the baseline; these checks identify this issue's contribution.

Ordinary signed installation supplies the matching Runtime, Browser, Engine image and helpers; Home opens the controlled page, receives decoded WebRTC media and completes navigate/type/scroll/Close.
Natural input includes IME/Unicode/composition, clipboard/shortcuts/focus, zoom/resize/HiDPI, input ordering and the applicable latency budget.
Reload, network interruption, sleep/wake and Engine/Exit/Runtime faults produce the documented recovery or actionable failure while retaining exact ownership and private state.
Real audio is audible and decoded, with correct unlock/status and continuity; matching human media/input evidence is bound to the exact machine receipt.
Daily site/forms/frames/popups/files/media/accessibility and Wallet approval/rejection/account-change/disconnect workflows pass. Actual transaction results and the existing purchase-result regression retain Irzhy's Wallet/chain review and Sasha's screen review.
Cookies/localStorage/IndexedDB survive the supported reopen/crash/update journey. Browser mission: complete stable local and remote browsing with human and agent parity #283 owns the full migration/principal/deletion requirements; G1 Install and update: Signed update #89 owns shared update behavior.
Installed failures identify the correct stage and export a bounded redacted report. Gateway SIGTERM leaves orphan browser-vm-control-service #131 supplies graceful/abrupt shutdown and orphan-cleanup proof.

Use the current #87 installed candidate and its fixture owner, consuming compatible #131 lifecycle, #217 payload and #89 update outputs. Keep the shared Mac lease and the common receipt/review gate.

When crosvm and the guest kernel are published again (they ship for no platform since alpha.8), the minimal profile selects them again; today it resolves to nothing (components.json). (Entropy check, 7 Oct)

Complete preserved B01–B16 acceptance

The complete baseline from the immutable source linked above follows. Checkbox IDs are the only change to its criterion text. Its old TASKS completion footer is omitted because AGENTS makes GitHub issues authoritative. Existing issues record scoped progress; full-mission checkboxes pass only with current evidence across applicable roles/placements.

Full B01 through B16 acceptance checklist: 70 preserved criteria

B01. One Browser contract and an explicit support matrix

Owner: Runtime contracts and release engineering.

Instructions: Specify session, page, profile, display, operator, Engine, and
Exit resources. Define typed requests, events, errors, deadlines, cancellation,
version negotiation, and capability discovery. Keep host launch details and
provider transport private to Runtime adapters. Adapt existing contracts where
possible. Certify viewer, Engine host, and Exit host as separate device roles.
Start with the existing macOS VZ and Linux/crosvm target paths. Evaluate Intel
Mac, Windows, and mobile roles explicitly before advertising support.

Acceptance:

B01.A1 A published matrix names OS and architecture, minimum resources, host
virtualization requirements, outer browser versions, codecs, and supported
roles. Every supported row links to an installed-product test receipt.
B01.A2 Runtime detects capabilities and installs the matching signed payload or
selects an already approved remote service. An unsupported local Engine host
can still serve as a supported viewer when a suitable remote Engine exists.
B01.A3 The same Browser capsule package and operator contract run across certified
hosts. OS switches, executable paths, SSH commands, and VZ/crosvm details are
confined to Runtime/provider adapters.
B01.A4 Supported version combinations pass contract tests. An incompatible peer
produces a typed compatibility error before allocating a page or transferring
profile state.

B02. A fresh installation opens a usable Browser

Owner: Runtime installation and Engine host adapters.

Instructions: Install a verified, compatible artifact set atomically. Include
the Engine, host helpers, VM image where required, configuration, and launch
permissions. Make readiness one authoritative result shared by setup, Home,
service publication, and launch. Model installation, download, verification,
readiness, and failure separately. Offer a direct repair action for repairable
conditions.

Acceptance:

B02.A1 On each certified Engine host, a fresh supported installation opens the
controlled test page with the documented normal setup steps and no manual
paths, copied artifacts, environment variables, or terminal repair.
B02.A2 Tests cover an empty data root, each missing/corrupt artifact, wrong
architecture, denied virtualization access, interrupted download, and low
disk space. Incomplete preparation reports incomplete status and a useful
remedy; it never becomes a ready Engine offer.
B02.A3 A ready remote Engine works from a viewer installation that has no local
Engine binary or VM image. Runtime installs only dependencies needed for the
selected roles.
B02.A4 After installation, built, installed, and served artifacts match their
receipt hashes. First launch has visible progress; cancellation cleans up
partial work. A restart after interruption resumes or repairs deterministically.

B03. Every failure has an actionable diagnosis

Owner: Runtime lifecycle and Browser diagnostics.

Instructions: Trace installation, service resolution, authorization, Engine
acquisition, page creation, signaling, first frame, input acknowledgment, Exit
connection, and close under one operation/session identity. Preserve the failure
stage and cause behind a short user message. Provide the same structured result
to agents. Make a redacted diagnostic report available from the error view.

Acceptance:

B03.A1 Injected missing-artifact, denied-grant, unavailable-peer, version mismatch,
launch timeout, media failure, and Exit failure cases each produce the correct
stage, stable error code, retryability, and recovery action.
B03.A2 One exported report identifies Runtime/Engine/capsule versions, artifact
integrity, detected device capabilities, selected service identities, and
stage timings. A maintainer can distinguish setup, Engine, transport, display,
and website failures without requesting a terminal transcript.
B03.A3 Metrics distinguish first installation from cold launch, warm launch,
website load, and reconnection. Collection uses bounded storage and excludes
credentials, page contents, and browsing history by default.

B04. People and agents have equal Browser capabilities

Owner: Browser contract, operator adapters, and Runtime delegation.

Instructions: Expose a tool-neutral operator contract on the actual Engine
page. Provide semantic inspection, actions, events, and waits. Build adapters
for native Runtime clients, Playwright, and the Camofox agent API; evaluate and
certify a Camoufox/Firefox provider path for its compatible clients. Reuse one
page/session lifecycle and permission model. An agent inspecting the outer
video element is not inspecting the website inside the Engine.

Ship the smallest complete operator surface against the current Engine first.
Additional Engine implementations are separately certified additions. Keep the
public operator contract independent of Playwright, Camofox, and Camoufox so
another conforming tool can use it without becoming a Runtime dependency.

Define these core operations: attach/list/open/close pages; navigate and history;
inspect bounded DOM/accessibility snapshots; locate by role, name, label, and
text; select frames; click, type, select, scroll, drag, and keyboard input;
wait for meaningful page events; capture authorized screenshots; handle dialogs,
popups, uploads, and downloads; request trusted approvals; detach and hand off.
Advertise optional operations such as page script evaluation and network
inspection with their required authority.

Acceptance:

B04.A1 A shared workflow suite passes through the human UI, a native agent client,
the Playwright adapter, and the declared Camofox/Camoufox integration paths.
It covers navigation, forms, frames, popups, scrolling, files, approval,
reconnect, and close. Each result records client, adapter, and Engine versions.
B04.A2 A human hands an existing page to an authorized agent and takes control back.
Page identity, profile, cookies, selected services, and pending work remain
consistent. An explicit control lease orders writers; readers need inspection
authority. Revocation stops that operator's new actions.
B04.A3 Headless operation works without an open viewer. A permitted viewer can attach
later to the same session. Detaching an operator and closing a page have
distinct, tested lifecycle effects.
B04.A4 Element references carry page/document generations. Navigation invalidates
stale references; stale clicks fail clearly. Snapshots have bounds and
pagination. Events and condition waits replace fixed sleeps in the test suite.
B04.A5 Equal grants yield equal permission decisions for equivalent human and agent
operations. Agents use delegated identities with action, profile, duration,
destination, and quota limits. Approval requests reach the trusted approval
surface and return structured pending/approved/denied/expired results.
B04.A6 Adapter compatibility is versioned and explicit. Unsupported protocol methods
return a capability error. A new conforming operator can complete the example
workflow using documented APIs without changing Runtime core.
B04.A7 Inspection and screenshots retain their capability checks. Runtime-scoped
automation keeps provider debug endpoints private, and product viewing
continues to use WebRTC. Effectful actions with an uncertain outcome return
that uncertainty and a reconciliation handle instead of blind replay.

Compatibility basis: Playwright distinguishes its own connection protocol
from Chromium-only CDP, which has lower fidelity. Its native connection requires
compatible client/server major and minor versions. Choose and test the adapter
protocol before promising API coverage.
Playwright BrowserType.
Camoufox documents a Firefox Playwright remote server and marks that server
experimental; this is a separate provider/version qualification task.
Camoufox remote server.
Camofox wraps Camoufox with a REST API, including accessibility snapshots and
element references. Preserve these useful operator semantics while mapping
authority and lifecycle to Runtime.
Camofox project documentation.

B05. Input and navigation feel like a browser

Owner: Browser input and Engine page adapter.

Instructions: Replace trailing gesture delay with bounded frame/time-based
batching. Preserve horizontal and vertical movement, units, accumulated distance,
and ordering. Apply backpressure by combining replaceable motion while retaining
keys, button transitions, and other discrete actions. Handle focus, composition,
clipboard grants, viewport scaling, and touch through the same page contract.

Acceptance:

B05.A1 The continuous-wheel regression emits movement during the gesture, with
p95 dispatch delay at most 32 ms. Vertical, horizontal, diagonal, pixel/line
units, small deltas, and long gestures preserve expected movement.
B05.A2 Keyboard modifiers, held keys, focus loss, text composition, Unicode paste,
selection, drag, touch, back/forward, reload, stop, and address submission pass
the manual and automated corpus on each applicable viewer.
B05.A3 Input ordering survives congestion without stuck keys, stuck buttons, or an
unbounded queue. Disconnected input has an explicit outcome and stale input
is discarded on reconnection.
B05.A4 Input-to-visible-response meets the B11 budget on a controlled page. Agent
semantic actions produce the same page results as equivalent human actions.

B06. Sessions recover from normal interruptions

Owner: Runtime session lifecycle and Engine/display adapters.

Instructions: Use one authoritative session state machine with bounded
acquisition, active, degraded, reconnecting, closing, and terminal states. Make
status observations distinct from close commands. Separate viewer connectivity
from Engine ownership. Use leases, bounded retries with jitter, cancellation,
and explicit terminal causes. Reuse Runtime lifecycle records.

Acceptance:

B06.A1 One failed heartbeat or status fetch preserves a valid page and starts the
appropriate recovery path. The current cleanup regression is covered.
B06.A2 A five-second network interruption and a viewer reload restore the same page
within five seconds of healthy transport, with the same profile and service
selection. Tests cover Wi-Fi changes, background tabs, sleep/wake, Engine
crash, provider restart, and Runtime restart with documented recovery outcomes.
B06.A3 Longer interruptions respect the authorization lease in B14. Recovery after
expiry reacquires authority; page execution and network effects follow the
expired state while the peer is unreachable.
B06.A4 Concurrent retry, cancel, and late launch completion create at most one
acquired session. Repeated close converges on one terminal result. Engine
loss gives a clear restore/reopen choice for recoverable profile state.
B06.A5 Every nonterminal state has a deadline or an active lease. A website action
with an uncertain result is reconciled before an operator retries it.

B07. One slow session cannot block the others

Owner: Runtime provider bridge and Engine scheduling.

Instructions: Move long launches to bounded jobs or otherwise separate them
from short control operations. Retain request/response correlation and safe
cancellation draining. Schedule within declared per-host limits for sessions,
memory, CPU, disk, sockets, and queues. Give close and revocation priority.

Acceptance:

B07.A1 While one launch is deliberately stalled, another active session can receive
input, status, signaling, and close. Short control responses meet p95 250 ms
locally or transport RTT plus 250 ms remotely under the normal test profile.
B07.A2 Cancellation and late responses cannot cross session or principal boundaries.
Tests include overlapping launches, malformed responses, timeout, and provider
restart; removing a lock alone is insufficient proof.
B07.A3 At advertised capacity the resource budget holds. An excess request receives
a typed busy/queued result with a deadline and cancellation path.
B07.A4 One hundred open/close cycles return session-owned processes, streams, ports,
and leases to baseline. Any warm pool has explicit count, memory, and idle
limits. Orphan reclamation is tested after client and provider failure.

B08. Remote Engine is an ordinary Runtime service

Owner: Runtime provider discovery, grants, and transport.

Instructions: Give Engine the standard discover, offer, request, approve,
select, invoke, revoke, and close flow. Runtime resolves endpoints and carries
control/media through approved transport. Keep host launchers inside the serving
Runtime. Publish verified readiness, capacity, protocol features, and service
terms. Extend the existing service model instead of adding Browser-specific
peer infrastructure.

Acceptance:

B08.A1 Two fresh Runtimes with independent identities complete Engine sharing through
normal product controls. The consumer opens and operates a page without SSH,
copied credentials, manual ports, provider URLs, or local VM installation.
B08.A2 Same-device, LAN, and supported WAN/NAT paths pass discovery, approval,
launch, input, media, reconnect, revocation, and cleanup tests.
B08.A3 Unavailable, full, incompatible, expired, and revoked Engine offers have
distinct results. Discovery does not grant use; service selection binds the
session to the approved provider identity.
B08.A4 Human and agent clients use the same service-selection contract. Remote
Engine cost and profile exposure remain within the approved policy.

B09. Exit has identical local and remote network semantics

Owner: Runtime Net and Exit providers.

Instructions: Route website traffic and DNS through the selected authorized
Exit contract. Define behavior for redirects, subresources, workers, WebSockets,
streaming, address families, destination restrictions, and connection closure.
Qualify any advertised UDP/QUIC or website WebRTC support separately. Treat the
Browser display transport and website networking as separate authorities.

Acceptance:

B09.A1 A controlled destination observes the selected Exit identity/address for page,
subresource, worker, and WebSocket traffic in every B10 topology. DNS capture
confirms the declared resolver policy.
B09.A2 Negative tests cover redirects, DNS rebinding, private/loopback destinations,
direct host sockets, and automation-client proxy/network options. Runtime
enforces the same granted destination rules on local and remote operations.
B09.A3 Exit loss pauses/fails affected requests clearly. Retries retain the approved
Exit; any change follows the operator's selection policy. The Engine's host
network cannot silently become the replacement Exit.
B09.A4 TLS certificate errors, stream backpressure, cancellation, idle timeout, and
half-close behavior match the contract. Revocation closes affected authority
within B14's bound and cleanup leaves no owned stream behind.

B10. Prove independent placement of UI, Engine, and Exit

Owner: Runtime integration and Browser service selection.

Instructions: Use the topology matrix below as a required test parameter,
including separate Runtime identities on the same device. Make Engine and Exit
independently selectable by people and agents. Define "this device" relative to
the controlling Runtime in the UI, with explicit service identities in receipts.
Evaluate preapproved defaults before asking an operator to configure anything.

Controlling Runtime	Engine	Exit	Required case
A	A	A	Entirely local
A	B	A	Remote Engine returning through the consumer's Exit
A	A	B	Local Engine with remote Exit
A	B	B	Engine and Exit together on a remote Runtime
A	B	C	Engine and Exit on independent remote Runtimes

Acceptance:

B10.A1 All five placements pass the same navigation, input, media, operator, network,
approval, recovery, and close suite. Run physical LAN and WAN cases, including
relay-required connectivity; loopback-only proof is insufficient.
B10.A2 The same installed Browser capsule uses all placements without code edits or
per-topology configuration files. The viewer can also connect to A from a
separate supported device/browser.
B10.A3 Stopping B or C identifies the failed service correctly. Engine and Exit
grants remain independent, and one service cannot substitute its own authority
for the other.
B10.A4 Default selection is automatic within existing trust, locality, profile, and
cost policy. A change outside that policy requests approval. The operator can
see and change the selected services without transport details.

B11. Meet measured responsiveness and media budgets

Owner: Engine rendering, display transport, and Runtime host adapters.

Instructions: Profile before tuning. Measure launch stages, encode/decode,
frame delivery, input, network use, CPU, memory, and idle power. Adapt resolution,
frame rate, codec, and bitrate to viewport, host capability, and transport.
Evaluate hardware acceleration within the supported isolation model. Keep
WebRTC as the product display path.

Proposed acceptance budgets:

Measurement	Local target	Normal WAN target
Cold launch to first usable frame, dependencies installed	p95 <= 5 s	p95 <= 7 s
Warm launch to first usable frame	p95 <= 1 s	p95 <= 2 s
Input to visible response on a controlled page	p95 <= 100 ms	p95 <= measured control RTT + 100 ms
Recovery after the five-second interruption in B06	<= 5 s after transport is healthy	Same
Continuous test motion	Delivered rate >= 95% of negotiated target; lost/dropped frames < 1%	Same under the normal network profile

Normal LAN: RTT at most 10 ms. Normal WAN: RTT at most 100 ms, jitter at most
20 ms, loss at most 1%, available bandwidth at least 10 Mb/s. Record both A-B
and B-C paths where used; Engine display and website egress are separate timing
components. A stress profile uses 300 ms RTT, 5% loss, and 2 Mb/s and tests
bounded degradation and recovery instead of normal-profile speed.

Acceptance:

B11.A1 Publish measurements for every certified target at its declared resolution,
frame rate, concurrent-session capacity, and workload. Use at least 100 cold
and 100 warm launches for the latency distribution. Installation downloads
and website server delays have their own measurements.
B11.A2 Thirty minutes of controlled video/audio and interaction meet the negotiated
budgets. During active motion, unexplained freezes stay below 250 ms; audio
interruptions stay below 100 ms and A/V offset stays within 100 ms.
B11.A3 An eight-hour mixed workload stays within declared memory/CPU/disk limits,
maintains responsive controls, and returns transient allocations after close.
Idle and hidden sessions use bounded resources and recover correctly.
B11.A4 Measurement uses monotonic clocks or calibrated end-to-end probes; timings
from different machines have a stated synchronization/error method. Save
machine-readable results and matching manual UX evidence.
B11.A5 Text remains readable, resize and device scale remain correct, and adaptation
recovers after congestion. Screenshot/image polling does not substitute for
accepted product media.

B12. Profiles and user state survive safely

Owner: Engine profile provider and Runtime storage authority.

Instructions: Separate profile state from executable artifacts and active
sessions. Define ownership, encryption, retention, single-writer rules,
checkpoint/restore, deletion, and supported migration. Support an explicit
ephemeral mode. Moving execution to another provider follows the profile's
approved placement policy; live migration is a separate capability.

Acceptance:

B12.A1 Cookies, history/settings where advertised, local storage, and IndexedDB
survive ordinary restarts and supported upgrades. Crash tests preserve the
last committed checkpoint and identify any unrecoverable state clearly.
B12.A2 Two principals cannot inspect or modify each other's profiles. Concurrent
writers are serialized or rejected. Agent attachment uses the granted profile
instead of silently creating a second logged-out session.
B12.A3 Supported export/import or checkpoint transfer is authenticated, encrypted,
version-checked, and verified by a restored-session test. Remote placement
requires the profile's grant. Incompatible Engine formats have an explicit
supported migration boundary rather than a claim of universal portability.
B12.A4 Ephemeral sessions remove their profile state on close. Deletion and retention
cover remote copies, backups, and traces with verifiable completion or a
visible pending state for an unavailable provider.

B13. Complete daily browser workflows and accessibility

Owner: Browser UI, Engine page adapter, and trusted feature providers.

Instructions: Maintain a controlled web compatibility corpus plus a small
representative external-site corpus. Cover tab/window lifecycle, forms, login,
files, media, permissions, and wallet/dapp use. Provide a semantic accessibility
bridge for the actual Engine page along with keyboard focus and visible state.
Use Runtime object grants for file transfer and trusted surfaces for sensitive
approvals.

Acceptance:

B13.A1 Redirects, SPAs, frames, popups, cookies, service workers, IndexedDB, downloads,
uploads, and WebSockets complete through every supported Engine/Exit placement.
Files arrive at the selected operator's authorized storage and large transfers
have progress, bounds, cancellation, and integrity checks.
B13.A2 Audio/video playback, mute, autoplay prompts, fullscreen, resize, zoom, and
clipboard behavior pass on the supported viewer matrix. Camera, microphone,
passkeys, DRM, and other optional features are advertised only for tested
combinations with the necessary provider and platform support.
B13.A3 Keyboard-only and screen-reader users can operate Browser chrome and supported
page controls. Focus, accessible names, text entry, zoom, and touch behavior
pass manual checks. Streaming video alone does not satisfy accessibility.
B13.A4 Human-to-agent handoff completes a login/approval workflow in the same page.
Wallet/dapp connect, signing approval, rejection, account change, disconnect,
and revocation use the trusted Wallet path and the correct page origin.

B14. Preserve authority, privacy, and bounded revocation

Owner: Runtime security, Engine isolation, and provider enforcement.

Instructions: Bind requests to principal, operator, session, page/profile,
selected Engine/Exit, and scoped capabilities. Authenticate Runtime peers and
encrypt transport. Maintain Engine isolation and review inner browser sandbox
configuration. Explain that an authorized remote Engine processes page content
and any profile state sent to it. Apply minimal diagnostic retention.

Acceptance:

B14.A1 Adversarial tests reject cross-principal page IDs, replayed/expired grants,
unauthorized inspection, provider substitution, raw debug access, and adapter
options that bypass Net or storage authority. Website text cannot grant new
operator permissions or approve a Wallet action.
B14.A2 Revocation blocks new dispatch at the issuing Runtime immediately. A reachable
provider acknowledges and enforces it within two seconds under the normal
network profile. An unreachable provider loses active authority within a
renewable lease of at most 30 seconds; the enforcing Runtime owns that timer.
Tests exercise both paths, including browser execution and network effects.
B14.A3 Suspend, clock changes, partition, and process restart preserve expiry rules.
Long-lived pages can preserve recoverable private state while expired actions
remain stopped. Reconnection obtains fresh authority before continuation.
B14.A4 Audit links meaningful operations to the correct operator and authority
decision. Credentials, cookies, tokens, typed secrets, and page snapshots are
absent from default logs; authorized traces have explicit bounds and deletion.
B14.A5 Isolation and network tests pass with automation enabled as well as disabled.
Any security exception has a named owner, scope, and release decision.

B15. Updates and repair preserve a working installation

Owner: Runtime distribution and Browser maintenance.

Instructions: Publish signed, reproducible component manifests that bind
Runtime compatibility, capsule payloads, Engine, helpers, and VM images. Apply
updates atomically with staged health checks. Define safe profile schema
migration and recovery. Assign an owner and response deadline for upstream
browser security updates. Integrate standard OS packaging after the underlying
installation is proven.

Acceptance:

B15.A1 Clean install, upgrade from each supported prior release, interrupted update,
failed health check, and repair all pass on certified hosts. Running artifacts
match one compatible manifest after each terminal outcome.
B15.A2 Profile and identity state survive successful updates. A failed migration
retains a verified recoverable state; rollback occurs only across a proven
compatible schema boundary. Retained rollback artifacts have a bounded size
and explicit expiry/cleanup condition.
B15.A3 Upstream Engine/CVE monitoring has a maintainer, documented severity-based
deadlines, and a tested update or feature-disable path. An unsupported browser
version cannot remain advertised as a healthy service indefinitely.
B15.A4 Packaging tests cover launcher paths, permissions, origin/passkey policy,
uninstall behavior, and update delivery. A package format alone does not mark
an OS or Engine role supported.

B16. Release only from repeatable product evidence

Owner: Browser release engineering and target maintainers.

Instructions: Turn the initial reproductions into regression tests. Add
installed-product tests, operator conformance, topology tests, fault injection,
and performance runs around the existing Browser gates. Keep behavioral proof
separate from source/text checks. Test on independently provisioned machines,
including a fresh Mac installation of the reported failing source version.

Acceptance:

B16.A1 Every supported device-role row passes B01-B15 criteria that apply to it.
Missing hardware or remote peers are recorded as unverified coverage; those
rows wait for evidence before support is advertised.
B16.A2 The release suite includes 100 lifecycle cycles, cold/warm launch samples,
the media run, eight-hour soak, all five placements, human/agent conformance,
capacity limits, mixed-version cases, and network/process fault recovery.
Required deterministic cases have zero failures. Retried failures remain in
the record; a clean rerun alone does not explain them.
B16.A3 Each receipt binds source commit/tree, built and installed hashes, capsule and
Engine image manifests, OS/device, operator versions, topology, network
conditions, exact commands, results, and manual UX/media evidence. Public
records omit private operator paths and credentials.
B16.A4 The basic repository gates and relevant Browser entropy/smoke gates pass.
scripts/browser-objective-audit.mjs passes with accepted product media and a
matching manual UX report. Update obsolete audit checks only when behavioral
evidence still enforces the product requirement.
B16.A5 A second maintainer can install and repeat the launch, browse, operator
handoff, remote Engine/Exit, and close workflow from the release instructions.
The release states exactly which roles, features, and versions passed.

Preserved work after the 0.8.0 Browser finish line

The old pre-release scope is historical. #87 owns Mac and #90 owns Jetson. Each target has its own signed install, Close/reopen and update proof. The preserved checks below retain their original scope.

From #87, original box 3:

A wallet dapp connects and signs through the shared Inbox approval flow.

From #87, original box 4:

A successful transaction shows its actual result, with a regression check
for the reported purchase-result error.

From #217, original box 9:

A remote Engine consumer installs only its role payloads and completes the selected remote journey without local VM requirements.

From #288, original box 4:

A selected approved remote Engine works from a viewer installation with no local VM/image dependency. Compatibility refusal precedes page/profile/stream allocation.

Browser-only first-principles plan and ETA — 2026-10-08 00:14 UTC

This plan answers Anders's request for Browser/Engine analysis and ordinary install.sh delivery. It supersedes the broader execution plan in the earlier review. The scope is Browser and the delivery/security outputs it directly consumes. The full 70 B01–B16 criteria and their ownership remain unchanged.

Principles and design decision

Reviewed PRINCIPLES.md, ARCHITECTURE.md, CAPSULE_MODEL.md, CAPSULE_AUTHORING.md, CARRIER.md, CONTENT_CAPSULE_DISTRIBUTION.md, BROWSER_CAPSULE.md, the Browser support/protocol contracts and the acceptance baseline. Keep one Browser app and its existing Runtime → Engine → selected Exit contracts:

Runtime verifies publisher/package identity, principal, capabilities, placement and resources; it owns routing, lifecycle, reconciliation and audit. Providers implement operations. Engine renders pages and owns website TLS; the selected Exit mediates approved DNS/destination streams.
A Digital Capsule identifies a complete immutable signed manifest/payload closure. Catalog, availability, installed inventory and running service offers project different facts from that identity. A source web projection or service offer alone cannot prove portable capsule delivery.
Carrier carries Runtime-selected off-box content and service traffic. Same-node adapters remain below typed Runtime effects. Apps receive the same contract across local and remote placement.
Profiles are separately owned mutable principal state. An active instance retains its exact admitted package/dependencies. Replacement activates as one compatible generation; close uncertainty preserves the owner and blocks conflicting writers.
The Browser VM, opaque UI frame and native provider are different isolation boundaries. Current native providers retain host-account rights; Browser VM proof cannot certify their broader confinement. B14 consumes the applicable Required: Isolation as promised #173/State actual isolation in docs, manifests and release notes #170/Serve only hash-verified capsule assets #171/Runtime-owned approval surface for every approval, with the passkey bound to what is shown #178 evidence.
Home projects Runtime readiness and requests scoped effects. Product viewing remains WebRTC; controlled diagnostics stay capability-bound. Installer shell code remains the small signed bootstrap, and Runtime keeps the canonical installation writer.

This requires completing existing contracts and state transitions. A new Browser framework, Browser-specific downloader or broad Runtime rewrite would add competing ownership.

What is proven now

M0 contract outputs remain accepted. Current clean product 38dca66da4c6bcfbb176311367e2684eae17ec7f, tree 48663ccf8913dc7128ff65535b88fd62cd2a42a4, and harness 1af31a46275246b17dca0f77a8c134047802b97a retain their previous build/install provenance. Product/harness are 0 behind and 12/6 ahead of refreshed develop 1828919980b1af1d60895c6cee178f769daed74c. Installed composition 66b3dc1ad353bc7dd215454e5e16b395b32199859d92b7221deda504660a2965 still matches the selected artifacts.

The current candidate passed retained-profile refusal, visible recovery, preserved bytes and failed-start owned shutdown. The older 6 October normal journey passed decoded frames, navigate/type/scroll, Close and prepared-profile persistence. Its narrower inputs do not establish current first-use or fresh signed installation. Current Reset/normal receipt beb0012015097b56c3cca1870bf68d033d37d823550f1b48720977916e934d56 failed before Engine open. A current decoded-frame baseline and active-VM fault proof remain open. Zero of the full 70 criterion checkboxes is complete; useful intermediate outputs remain real progress.

Root causes and evidence limits

The ordinary producer and local Engine dependency closure are disconnected. install.sh:893 already calls Runtime setup; setup.rs:20/297 defaults to Home, whose component profile already includes Browser and the adapter. The source template/release producer omits browser-vm-image, Mac VZ, common VM control/supervisor/launcher/pool helpers, the managed Node/coturn and role-specific dependency closure, and canonical configuration. Absent adapter configuration yields an empty inventory. crosvm/kernel platform rows are empty. Source-home supplies these through developer procedures. The existing bounded image consumer works for an exact configured local Engine; a manually prepared image is a narrower path. Also, the release-input verifier requires template inventory/profile parity: an image-only overlay would be rejected. Repair the template, producer, verifier, setup and signed package together. Wrap third-party software as capsules served over Carrier; never download from other servers #217 owns this output; G1 Install and update: Signed update #89/UP-02: Stage one complete release #108/UP-07: Accept updates on Mac, Linux and Jetson #113 and Undo and older Homes fetch components by name, so they get the newest release's bytes #287 supply the relevant admission/update/content milestones.
First-use profile state is published before filesystem readiness. Native ensure_sparse_profile_disk creates the final disk and marker before guest initialization. Guest formatting consumes and syncs the marker first; interruption can leave published unusable bytes. Existing preservation/refusal tests contain damage but do not make first use transactional. Under the rooted exclusive profile lease, prepare an unpublished sibling, validate, sync, atomically publish without replacement, then attach. Prefer the producer-owned empty ext4 template proposal, with provenance, features, sparse-copy/capacity policy and delivery proof. It remains a proposal; the verified existing four-member image does not contain this new member. Existing unknown/profile bytes retain explicit recovery authority.
A cached status or deadline can become a false terminal outcome. VZ stop records cached Stopped even after errors; status collapses native non-Running states onto that cache. Cleanup can detach timed-out workers, lose TURN ownership and release profile/rootfs leases while VM absence is uncertain; process exit and the caller's forced termination compound it. Reuse exact native state and keep the existing owner/resources through bounded pending cleanup. Change the native helper and its caller together, retaining strict terminal consumers. A stop deadline limits response time; it does not prove absence. These are current static findings; injected target proof is pending.
Shutdown and restart lose full settlement evidence. Control shutdown bypasses ordinary Close's complete receipt, and Runtime tombstones omit parts of the exact generation/provider/effect proof. Reuse the existing journals/tombstones to persist and replay validated full settlement. Independent process absence remains a separate observation. Capture natural fault evidence before forced fixture cleanup. Gateway SIGTERM leaves orphan browser-vm-control-service #131 owns normal/graceful/SIGTERM/crash/restart/orphan/profile reopening; B07/B16 retain broader cycles/capacity qualification.
Long operations and continuous input still break responsiveness contracts. Provider serial I/O can keep status/input/Close behind long Open. Use the existing accepted-operation contract with short controls, preserving response correspondence. Real Chrome loaded the current input surface: twenty wheel events at about 16 ms intervals lasted 344.5 ms, sent zero dispatches during the gesture and one accumulated dispatch 64 ms after it ended. The trailing 80 ms debounce violates B05's continuous-gesture requirement; the encoder omits horizontal delta and unit semantics. IME/composition and normal shortcut coverage remain incomplete.
Source tests and prepared fixtures leave user transitions uncovered. The installed Reset failure means the harness missed the expected native dialog. The earlier categorical opaque-origin cause is withdrawn: the exact Chrome 151.0.7922.34 executable emitted native confirmation in two nested opaque frames with matching sandbox flags. The HTML prompt algorithm does not establish the inferred origin restriction. Capture actual button/loading state, asset/version, ancestor flags, handler/token readiness, console and both click/dialog outcomes first. The current harness loses the click error after its dialog wait fails. A visible Cancel/Reset prototype passed Cancel, Escape and one explicit Reset while preserving opaque isolation; it is a feasible option, not a proven required repair. Corrected owning record.

Other known Browser gaps remain: Linux attaches no Runtime persistent profile disk; Jetson KVM access/crosvm/network provisioning and installed/reboot proof are open; remote enforcement's current 5 s supervision/50 s heartbeat differs from the 2 s reachable/≤30 s partition contract; default URL diagnostic privacy needs repair; full media/recovery, native/Playwright/Camofox/Camoufox parity, trusted Wallet, files/accessibility, protected profile transfer/deletion, updates and target qualification remain open. These keep their owning producer outputs rather than becoming a generic repository audit.

Ordinary new-user journey

A default Home installation on a compatible localhost should prepare Browser through Runtime setup:

Admit the signed bootstrap and resolve the exact trusted Browser/Engine/Exit role packages through the existing content/Carrier path.
Query actual VZ or KVM support, permissions and resource budget. Platform names alone do not establish readiness.
Install and configure the complete required local role closure; prepare its verified image during setup with visible progress, cancellation and retry. This uses the same preparation operation that later Repair/Open consumes. Avoid a hidden first-Open hour: current Open polls five minutes while image acquisition permits one hour.
On Linux, explain the one-time KVM/TAP/firewall setup and obtain its existing privilege approval. Ordinary Browser launch remains an ordinary-user operation. Changes to existing Homes retain approval gates.
Publish readiness only when the compatible package, permissions and configuration are verified. Home sign-in → Browser → first-use profile → decoded frame/input → Close/reopen uses ordinary controls and retains an exact receipt.
A viewer/remote-consumer installation acquires only its selected local role payloads and uses explicitly approved Engine/Exit services. An incompatible local host receives a precise unavailable/repair result; remote selection preserves its own authority.

Prefetch during compatible Home setup is the selected product plan for Anders's install requirement. It extends Runtime setup rather than adding a shell downloader. Existing source documentation allows on-demand preparation; both triggers must call the same authoritative operation. Private environment overrides, copied artifacts, ambient Homebrew tools and source-home wrappers remain development inputs.

Tested execution plan and gates

Two independent reviews challenged the native owner/state model and ordinary delivery pipeline. They changed the plan: actual Reset diagnosis precedes a UI change; #217 closure/template work progresses in its existing lane alongside #131; diagnostics/privacy, authority and short-control checks accompany every slice.

Milestone	Owner and work	Required proof before its claim
M1a: trustworthy baseline	#131: bounded Reset diagnosis, smallest repair and current normal journey	Exact installed Home/sign-in/controlled page/decoded frame/navigate/type/scroll/Close; first failure retained
M1b/P0-local: dependable ownership	#131/#87: exact native terminal/lifetime, rooted first-use transaction, full-effect journal/replay, short controls	Separate graceful stop, active SIGTERM, crash/restart, natural orphan cleanup and committed-profile read; all 13 effects and numeric deadlines
M2: ordinary Browser delivery	#217 producer plus existing install/update owners: signed role closure, configuration/readiness, setup preparation	Empty isolated Home through actual install.sh with upstream dependency hosts blocked; page/frame/input/Close; corrupt/missing/wrong-arch/denied-virtualization/interrupted/low-disk/update/repair
Local feature acceptance	#87: continuous input/IME, media/reconnect, daily sites/files/accessibility and trusted Wallet	Actual media and outcome, shared controlled workflow, matching human UX; prepared test inputs remain separate
O0/R0/A0/P0-remote	Existing Browser/security owners: tool-neutral operator workflow, ordinary two-identity Engine/Exit, enforcing leases, protected state	Native then declared adapters; same-page handoff/headless; all five placements; actual DNS/destination, revocation, transfer/reopen/delete and independent faults
Q0	#283 and target maintainers: frozen compatible set and full qualification	100 lifecycle cycles, 100 cold and 100 warm launches, 30-minute A/V, eight-hour mixed workload, real target/viewer/network rows, second-maintainer install and required reviews

M1a is a diagnostic baseline, not permission to ignore M1b's fundamental defects. Accepted producer contracts unblock consumers while full parent acceptance remains open. Operator can complete its local core before remote R0; remote R0 uses current human controls before full O0. Keep one active issue per lane and respect current owners. One owner controls the Mac fixture; one nonblocking shared lease controls heavy local builds.

Verification performed for this plan

On clean 38dca66d: installer offline suite 62 passed / four retained-publisher checks skipped (115.3 s); six focused Browser Node files 66 passed / zero skipped; root-free Linux network suite 15 passed. The additional current product-data check passed (42 capsules, eight profiles, 28 method contracts), and its 102 rejection/consistency tests passed. Total: 245 passing source/offline cases, four explicit skips. git diff --check, Rust workspace formatting and chain-provider formatting passed. Historical entropy-check filenames referenced by the supplied instructions are absent in this current source; current AGENTS/justfile use product-data and behavior gates, which were used here. Exact source and the 12 selected installer/input/test input hashes are recorded in #131.

Real-browser probes established the native-dialog counterexample, feasible visible confirmation and the continuous-wheel failure. They used temporary diagnostic HTTP servers and owned Chrome processes, all closed. These probes are narrower than Home/Engine/media acceptance. Native cleanup uncertainty and transactional first use are source findings awaiting new failure-injection tests.

Future verification first adds behavior seams for uncertain native state/worker/TURN/cancellation, unpublished profile interruption/path substitution, journal restart and independently responsive controls, plus a critical real-producer role-closure test. Separate handcrafted image and producer fixtures can currently both pass while their connection is absent. Then freeze the input closure, batch one affected-output build under the lease, reuse only verified unchanged outputs/image, bind built/installed/served hashes and run installed tests. Consume completed CI receipts; repeated local builds and unchanged CI polling do not establish more proof.

ETA and uncertainty

These are cumulative engineering estimates from 7 October, at roughly eight focused hours per engineering day, with one effective implementation owner and independent review help. Parallel source analysis/producer contributions reduce blocking, while the one Mac fixture/build lease and hardware runs stay serialized. They are ranges, not promises or release dates.

Outcome	Estimated effort from now	Confidence
Exact Reset diagnosis and next prepared-fixture baseline attempt	4–12 engineering hours	Medium; the next failure is unknown
Dependable local Mac lifecycle/profile baseline	4–9 engineering days	Medium-low; uncertain native cleanup needs target injection
Browser usable from normal fresh Mac install, with tested update/repair candidate	2–4 engineering weeks	Medium-low; producer/config/dependency integration and signed staging are required
Same basic ordinary-install journey on Mac and Jetson	3–7 engineering weeks	Low until Jetson host/guest admission and persistence pass
Full #283 / all 70 preserved criteria	6–12 engineering weeks	Low; operator, remote/profile/media/latency and target coverage can extend it

The full-mission range is approximately 240–480 active engineering hours. Calendar completion also depends on the approved signed producer/release, Irzhy/Sasha and other required human reviews, second-maintainer repetition, declared hardware/viewer rows and real WAN/relay conditions. This Mac and Jetson remain the authorized execution targets; other physical qualification rows retain their evidence gates. The mandatory eight-hour soak requires uninterrupted target time. A firm full-completion date cannot be justified before those inputs and the next installed baseline are resolved.

Re-estimate after the next decoded-frame baseline, the first uncertain-cleanup injection and the first empty-Home producer-closure proof. The successful cached native continuation took about nine minutes; compilation is not the main schedule risk. Correct ownership, complete delivery and repeated target evidence dominate.

During this analysis: zero builds, reinstallations, source edits, public-host actions, pushes, merges or production signing. Product/harness remain clean, original retained profile/copy remain preserved, OMP retains its work, and the product fixture stays stopped. Implementation resumes from #131's exact first failure and these accepted producer contracts; all hardware/media/soak/human/review/approval gates remain open.

First-principles and Occam review — 2026-10-08

Anders requested a second challenge of the Browser plan and executable GitHub ownership. Two bounded independent reviewers checked current principles/contracts, source seams, all open issue titles and direct producer records. The plan is accepted with four refinements:

Default eligible local Home setup triggers the same Runtime preparation operation as Repair/Open. Check trusted platform/device/resource facts before acquisition; then admit the staged signed helper and verify virtualization, entitlement/library and image compatibility. Installer: clear steps, ElastOS banner and plain output for pipes #252 displays the typed stages. Install verification, host readiness and execution offers remain separate facts under one authoritative preparation result.
Wrap third-party software as capsules served over Carrier; never download from other servers #217 compares a verified empty ext4 template with guest initialization of an unpublished sibling before selecting the smaller complete crash-safe path. Socket readiness alone cannot attest profile identity/filesystem/flush. The template is provisional and the verified four-member image retains its compatibility/reuse contract.
Exact native state, worker/TURN/profile leases, caller termination and durable settlement replay remain one Gateway SIGTERM leaves orphan browser-vm-control-service #131 repair. Runtime retains a pending writer barrier through process death until exact reconciliation permits reuse. Browser: keep controls responsive during launch and enforce session capacity #289 owns independent controls/quotas; response correspondence must survive concurrency.
Accepted producer outputs unblock consumers while full acceptance/review stays open. Browser: complete human and agent workflows on the same Engine page #290 local operator work and Browser: use independently selected remote Engine and Exit through ordinary controls #291's ordinary human remote milestone proceed independently; profile transfer later consumes that remote result. Each task retains its original criteria and current owner gates.

The simplest coherent design keeps the existing signed capsule/content path, one installation writer/generation, one Runtime preparation/lifecycle path, one tool-neutral Browser contract and separately rooted profiles. Engine owns website execution/TLS, Exit owns selected authorized DNS/streams, and Carrier owns off-box carriage below Runtime routing. VM, opaque GUI and native-provider confinement remain distinct tested boundaries. The source/runtime/installed/offer records describe different facts rather than competing controllers.

Six missing executable slices now exist: #288 ordinary install/repair under #87; #289 responsive sessions; #290 operator parity; #291 independent remote Engine/Exit; #292 profiles; #293 qualification/maintenance under #283. All are Backlog; #131 is In progress in the installed lane. Shared delivery/security/target work keeps its existing issues and owners. Native sub-issue creation succeeded, resolving the historical API limitation. Full acceptance stays Browser-2026-10-07-R1, with every criterion preserved.

Current product/harness/installed receipt remain the checkpoint candidate. M0 and the prior 245 passing source/offline cases remain accepted at their recorded scope; four publisher checks remain skipped. Current Reset/normal failure is still beb00120…, before Engine open, with cause unknown. This review changed GitHub records only: zero source edits, builds, installs or product launches. Next installed experiment remains #131's bounded real Reset diagnosis and decoded-frame journey, followed by separate active faults. The Mac 2–4, Mac/Jetson 3–7 and full 6–12 engineering-week estimates remain low-confidence ranges, with human/signing/hardware/physical-network/soak gates outside engineering effort. Re-estimate at current decoded frame, uncertain-cleanup injection and empty-Home signed-closure proof.

Executable task cards and existing owners

Task	Contribution	Native parent / release scope
#288	B02 and consumer B01/B15: ordinary preparation/update/repair	#87; 0.8.0
#289	B07.A1–A3 implementation and B06 operation correlation	#283; After 0.8.0
#290	B04 and shared human/agent actions/handoff	#283; After 0.8.0
#291	B08–B10 and remote B03/B05/B06/B13	#283; After 0.8.0
#292	B12 and protected migration/update state	#283; After 0.8.0
#293	B01/B11/B16 certification, B07 measured capacity/cycles, B15.A3 maintenance	#283; After 0.8.0

#87 keeps local input/media/recovery/Wallet acceptance. #217 supplies the complete signed role closure, #108 one writer/generation, #109 existing controller recovery, #112 the signed candidate, #113 installed update proof, #274 capsule records, #287 immutable fetch and #252 setup presentation. #270 source-home preservation and #194 qualified artifact reuse remain distinct outputs. #165/#90 retain Linux x86/actual Jetson roles; #173 and its security children retain enforcing authority, trusted approval and isolation. #88/#92/#93/#150 retain their install/phone/release/CI gates. #156's already-merged #248 still requires the requested human review before closure.

The original Browser-only root-cause plan and evidence remains the detailed record, with these four refinements superseding its template preference and implicit task ownership. Corrected first failure remains the next experiment. Broad #281 alternate-provider hosting, #182 general VM capsules and #209–#212 host-private-key protection keep their scheduled owners; they are not duplicated in Browser tasks. #159/#158/#157/#186 signing/freshness/key outputs retain their current gates and are consumed through #112.

Final record verification — 2026-10-08 00:48 UTC

PASS after both independent readback reviews and correction of their two wording findings. Thirty existing issues were reconciled, and six executable tasks (#288–#293) were created. All 29 refreshed owning-issue bodies retain their prior acceptance checkboxes; #122 updates its dated census while preserving the status contract. #283's complete original acceptance section remains byte-identical: 70 unique unchecked criteria, SHA-256 3d49e55c5ed0bb74862898803c48228a35a9c1bcd807c81afc410e19eff9b16c.

Project #3 readback has 114 items, including exactly one issue item per new task, all assigned to Anders and Backlog. #288 remains 0.8.0; #289–#293 remain After 0.8.0. Native hierarchy matches #283 → #87 → #131/#288 and #283 → #289–#293. Existing owners, milestones and statuses are preserved, with the intended #131 change to In progress. #89 retains its aggregate status.

Product and harness remain clean, 0 behind and 12/6 ahead of fetched develop. Primary historical/dirty media and OMP checkouts retain their protected state. Final private lifecycle inventory remains 197 branches/45 worktrees, with about 22% development-volume free space. The shared heavy-build lease is held by another worker at this observation. Browser requested no build or installed mutation.

This is plan/record acceptance. Current decoded-frame journey, active fault settlement, normal signed Browser delivery, physical placement/media/soak and required human/approval gates remain open. The next experiment is #131's current bounded Reset diagnosis.

Recommended Browser milestone priority — 7 October 2026

This is the delivery order following the bounded first-principles/Occam review. It preserves Browser-2026-10-07-R1 and all 70 criteria. Within each lane, select the lowest-numbered eligible task with accepted producer outputs and an available owner/resource; keep #131 active and all existing owners/statuses.

Trustworthy installed Engine and profile ownership — Gateway SIGTERM leaves orphan browser-vm-control-service #131. Diagnose the actual Reset click/dialog/readiness first. Complete Home → sign-in → Browser → controlled page → decoded WebRTC frame → navigate/type/scroll → Close. Repair exact native terminal/lifetime, caller retention, transactional first-use profile publication and durable complete settlement as one ownership boundary. Then separately prove graceful stop, active SIGTERM, crash/restart, orphan cleanup and committed-profile reopening.
Responsive local controls and private committed state — Browser: keep controls responsive during launch and enforce session capacity #289/G5 Private Browser: Browser on Apple Silicon Mac #87, local Browser: preserve private profile state through reopen, transfer and deletion #292 contributions. A stalled Open must leave status/input/Close responsive with exact response correspondence and quota admission. Fix observed continuous wheel, horizontal/unit semantics, IME/focus/clipboard/ordering. Prove principal separation and single-writer durability before broader delegation/transfer.
Ordinary signed installation, update and repair — Wrap third-party software as capsules served over Carrier; never download from other servers #217/Browser: prepare the selected local Engine during normal installation and repair #288 with existing delivery owners. The complete selected Engine role closure enters through the canonical Runtime writer/content path. Empty-Home install.sh, progress/cancel/retry, missing/corrupt/incompatible/denied-access/interrupted/low-disk cases and supported update/repair must pass with matching installed artifacts.
Complete local daily use on Mac and actual Jetson — G5 Private Browser: Browser on Apple Silicon Mac #87/G5 Private Browser: Jetson support #90. Finish audio/video, reload/reconnect/sleep, daily sites/files/accessibility and trusted Wallet outcomes. Jetson host eligibility, KVM access and missing managed dependencies are checked early; actual signed ARM64/host/profile/media/Close proof supplies its claimed role.
Native operator and ordinary remote service cores — Browser: complete human and agent workflows on the same Engine page #290/Browser: use independently selected remote Engine and Exit through ordinary controls #291. Use one real Engine page and authority model for native semantic workflows/handoff/headless, then ordinary two-identity independent Engine/Exit selection with observed destination/DNS. These cores can start beside local feature work after a stable page and compatible authority exist; neither waits for the other's full issue closure.
Complete adapters, remote profiles and placement coverage — Browser: complete human and agent workflows on the same Engine page #290/Browser: use independently selected remote Engine and Exit through ordinary controls #291/Browser: preserve private profile state through reopen, transfer and deletion #292. Finish declared Playwright/Camofox and Camoufox/Firefox conformance, protected granted profile transfer/deletion, all five placements, independent faults and physical network cases.
Frozen full qualification — Browser: qualify the frozen candidate and maintain the supported role matrix #293. Reuse accepted exact-candidate receipts, then complete capacity/100-cycle and 100 cold/100 warm launch measurements, 30-minute A/V, eight-hour soak, applicable hardware/viewer/network rows, manual UX and second-maintainer repetition.

Parallel priority: #217's producer interfaces/closure can progress now in the source lane while #131 owns the installed lane, after current file-owner coordination. Detect Jetson prerequisites now. Matrix/receipt/CVE ownership work can be light early work; expensive final qualification consumes the frozen behavior. One owner controls each Mac target run and the shared heavy-build lease; reuse verified matching image/helpers and batch affected builds after the source closure is frozen.

Authority, truthful isolation, private diagnostics and exact cleanup accompany every stage. Shared #173/#177/#178/#179 platform/design/review outputs and signing/installed-Home/human/hardware/soak gates retain their existing scope. Milestone acceptance unblocks compatible consumers while broader acceptance remains open. No build, source edit, installed mutation or new product proof is implied by this priority record.

Immediate next experiment: #131's real Reset diagnosis and exact installed page/frame/input/Close, using the current candidate rather than another broad source batch.

Historical mission checkpoint and analysis through 8 October 19:59 UTC. The current 0.8.0 scope is the smallest #87 reload repair; these records keep their original candidate and acceptance limits.

Current execution checkpoint - 2026-10-08

19:59 UTC: the user selected local usability while external delivery inputs wait. #87 is the sole In progress Contract/source task. #217 is Backlog with its two prepared producer commits preserved. Shared release scope awaits the #89 owner agreement; #281 retains acquisition compatibility findings. #288 ordinary installation remains open. Only #131 currently has human approval and merge left; priority 2 is incomplete.

Codex owns one isolated direct-local Mac fixture and the new #87 installed experiment. The shared nonblocking build lease remains required for heavy work. This Mac and Jetson are execution targets; public server work remains outside scope. Existing Homes and OMP resources keep their owners.

Active source is fix/87-browser-continuous-input, approved base/target develop. Current HEAD 62458e33435956c51d6fc3701ab3717c1bd6d40a, tree 7f9fc919449141169a16a2f86c7fc3ee74c5c365, is unpublished, 54 ahead and zero behind fetched develop 5f56bb8c. Normal integration of all 13 newer base commits passed without conflict; reviewed paths remain byte-identical. #87 owns exact source, checks and installed results. Backend 7af6d160, frontend be47d96d, typed observer 713ce8bb and cache integration f9589ed1 have scoped review passing, with 59 Node/18 Python backend fixtures, 292 frontend fixtures and 34 typed observer fixtures. Source checks establish their bounded source result; installed input timing and complete local usability remain open. The next zero-build media/reload/IME repeat uses frozen 91e5e55c assets with unchanged verified native/image/helpers. The newer guest input writer receives one complete producer batch after source freeze. #217 branch feat/217-browser-role-closure stays protected at c5c317a5be6a3f763462c901c59bac741afa0bc3, tree c403b889003428c722c726b88333230d7d849c9f, with 27 focused fixtures and independent reviews passed.

Installed timing-4 at 94fd6424 and web composition 839e0f38… passed strict event-origin p95 17 ms against unchanged 32 ms: all twenty trusted events/sends, guest movement during gesture, decoded frames 126→148, all eight profile bindings and committed cookie/localStorage/IndexedDB reads, normal Close with all thirteen effects, and complete owned resource absence. Independent raw review passes. Earlier 34.5/40.8 ms attempts remain failed history. #87 owns exact hashes/receipts.

The same-artifact media/reload run decoded actual 440 Hz WebRTC PCM (49 samples) and wheel passed at 16.3 ms. Viewer frames returned by 952 ms with the same binding, but further text failed the original five-second input deadline. Close and cleanup passed. First-failure receipt d8e0bb6373967f4e341f48feed982baa98379b99497ca412b73345b70994c3f7. Reviewed harness fdbb53f7 repairs a separately reproduced click-before-scroll-settlement defect and retains actual post-lift/post-paste diagnostics; attribution of the original failure stays provisional until observed. The reviewed frozen UI/observer is prepared for its isolated installed repeat. The verified image, matching helpers and native Runtime stay unchanged; native/image build count is zero.

Staging uses direct local Mac commands and durable SSH to Jetson. The original Mac SSH rule was added for the historical public-server reverse-tunnel topology and was applied too broadly here. Independently reviewed f02195a1 clarifies local versus remotely operated targets while retaining exact receipts, one test owner, the shared lease and complete owned cleanup. Extra account setup was superseded; the unused fixture key was removed with zero account/authorized-key changes. Jetson SSH passes, but KVM permissions, crosvm/Cargo/Runtime and adequate producer headroom remain missing. Source inputs will freeze before one complete guest image batch; Mac container service remains off.

The coherent input repair uses one already permitted typed Runtime input path for human and operator effects, WebRTC display, the existing Engine FIFO, captured CDP ACK and no-replay fencing. This avoids renewable human authority and native/CDP release reconciliation. Disable guest native product input effects, move remaining wheel/keys/clipboard through existing typed operations, and prove pointer/key phases and uncertain ACK/restart barriers. A changed guest closure gets one complete verified image producer batch; direct local Mac access permits the isolated test now. Full horizontal/pixel, media/recovery, files/accessibility, Wallet and bounded controls remain open.

#131 remains QA / Review. PR #295 is ready at exact ff4c9e468a592de44fc2cb2caa54b7cee134af45, tree affc2e5c4530f2542cf7c219e44eb6dd49fedb53, remote divergence 0/0. It targets develop; source is 21 behind/26 ahead of fetched develop. All ten CI jobs passed in run 37776290146; the posted independent Opus review passes without blocking findings. The required irzhywau approval and normal merge remain. Preserve that candidate and integrate dependent work after its gate passes.

The stable installed composition f86171b87b40e11d3fbdd6d4849e329ce34a9b5cc399208806afcf85de67e8f2 contains ff4 Runtime SHA-256 53e389668fccc886402ecb1525afeab20edc298c8bbdb5876fcffbed74fb3f89, with 26 bindings retaining their actual artifact origins, including signed VZ 074a13e1abd1a2ca65a0f4bf5b4d2b5654b8106e9a35155454803475b11af363, matching verified image and helpers. #131 owns full build/input/installation receipts. Its installed Home → sign-in → Browser → controlled decoded WebRTC page → navigate/type/scroll → Close passed. Separate active SIGTERM, SIGKILL/crash and managed Home stop passed natural cleanup in 6594 ms, 4577 ms and 6744.75 ms within declared 60000 ms bounds, all thirteen terminal effects, restart reads of all eight profile bindings and committed cookie/localStorage/IndexedDB, retired-page rejection and distinct closed new generations. Independent raw/live review accepted the four runs and final resource absence. The fixture is stopped before the new #87 composition. Historical Reset/2e/0d receipts keep their exact original provenance in #131; their failures and repairs remain recorded there.

The final ff4 canonical gate passed 2589 server tests (27 existing ignored), 228 Runtime binary tests, 115 VZ library tests, 70 supervisor tests, four stream-bridge tests, formatting, product-data, all-target checks and Clippy. Raw log SHA-256 22c63ed3c46d7c56c654b349e334ea85163fd76f7635efe57841171d5e0149a7. The prior E22 stream fixture failure remains historical; the frozen correction and final gate pass are in #131. Source checks do not replace target evidence.

Coherent order remains dependable lifecycle → ordinary signed delivery → local usability/bounded controls → operator/remote roles → profiles → qualification. The user's safe parallel instruction allows #87's accepted-lifecycle consumer work while #217's named external inputs wait. After #87's current source slice reaches its review boundary, #289 can own the next measured short-control repair. Keep one active issue per lane. #290 local O0 and #291 human-driven R0 exchange accepted outputs before their broader closures. #292 owns broad profile policy/transfer/delete; #293 owns frozen integrated Mac/Jetson/media/physical placements, 100 cycles and cold/warm samples, 30-minute A/V, eight-hour soak, second-maintainer installation and human evidence. #173 authority applies to every slice, including unresolved two-second enforcement and 30-second partition bounds.

Build only at a coherent input boundary. Use light refusal/behavior checks first, freeze the changed closure, compile changed native outputs once under the lease, and reuse exact unchanged image/helpers. Record native, web, installed and served origins separately. Use Capsule UI, Runtime authority/reconciliation, Engine page operations and native resource retirement through existing Browser/Net/Exit/Wallet contracts. Keep Runtime-only networking and WebRTC display. All 70 B01–B16 criteria retain their text and status; ordinary installation, media, Wallet, hardware, soak, human review and approval gates remain open.

Fresh-session start instructions

Use $development-loop. Read this checkpoint, the preserved B01–B16 baseline, G5 Private Browser: Browser on Apple Silicon Mac #87/Browser: keep controls responsive during launch and enforce session capacity #289/Gateway SIGTERM leaves orphan browser-vm-control-service #131, relevant delivery/security owners, AGENTS.md and PRINCIPLES.md. Fetch refs and reconcile exact source/dirt/divergence, current owners, target receipts and local lifecycle inventory. Preserve histories and local work.
Read G5 Private Browser: Browser on Apple Silicon Mac #87's current Acceptance record. Use direct commands on this Mac and verified durable SSH to Jetson, then freeze/review the UI and observer batch and repeat the failed media/reload/IME journey under the lease. Timing-4's strict 32 ms check already passed at 17 ms. Continue canonical Runtime input with exact ACK/restart fencing and one coherent guest producer batch when inputs change. Keep the unchanged native ff4/image/helper origins and preserved profile. Existing Gateway SIGTERM leaves orphan browser-vm-control-service #131 private controllers remain frozen; use the public restart, controlled fixture and journey harness. Capture first failure, repair its smallest responsible component and repeat. No native or guest build is needed for unchanged inputs.
Confirm one Mac fixture owner, direct local access or durable SSH for a remote target, disk reserve and the same shared lease inode before serious testing. Keep OMP and unrelated Homes outside owned resources. Stop owned Runtime/VM/observer/fixture groups after each run; retain exact bounded evidence and profile protection.
Preserve Gateway SIGTERM leaves orphan browser-vm-control-service #131's accepted Reset, Close, active shutdown, crash/restart, orphan cleanup and committed-profile evidence. Complete required human approval and normal merge of PR fix(browser): retain Engine ownership until cleanup settles #295 before integrating its dependent PR. Ordinary delivery remains Wrap third-party software as capsules served over Carrier; never download from other servers #217 then Browser: prepare the selected local Engine during normal installation and repair #288 once G1 Install and update: Signed update #89 scope and Anyone can host signed capsules: the seed is one provider among many (free and paid) #281 compatible acquisition outputs are available.
Continue G5 Private Browser: Browser on Apple Silicon Mac #87 actual input/media/recovery/files/accessibility/trusted Wallet workflows and Browser: keep controls responsive during launch and enforce session capacity #289 measured bounded controls. Full media/UX acceptance requires the exact candidate and applicable human reviews. Then proceed through O0/R0/A0/P0 and qualification owners using accepted contract outputs while full acceptance stays open.
Update the owning issue before reports and at most 30 minutes apart: passed, failed, pending, exact candidate and next experiment. Continue authorized work after reporting. Close only when complete acceptance, required reviews and merge are proven. Reconcile touched refs/worktrees/artifacts and stop each fixture before handoff.

First-principles and Occam review — 2026-10-08

Historical review from 00:44 UTC. The candidate, first-failure observations and estimates in this section describe that earlier checkpoint. The current installed result and publication state are above and in #131.

Anders requested a second challenge of the Browser plan and executable GitHub ownership. Two bounded independent reviewers checked current principles/contracts, source seams, all open issue titles and direct producer records. The plan is accepted with four refinements:

Default eligible local Home setup triggers the same Runtime preparation operation as Repair/Open. Check trusted platform/device/resource facts before acquisition; then admit the staged signed helper and verify virtualization, entitlement/library and image compatibility. Installer: clear steps, ElastOS banner and plain output for pipes #252 displays the typed stages. Install verification, host readiness and execution offers remain separate facts under one authoritative preparation result.
Wrap third-party software as capsules served over Carrier; never download from other servers #217 compares a verified empty ext4 template with guest initialization of an unpublished sibling before selecting the smaller complete crash-safe path. Socket readiness alone cannot attest profile identity/filesystem/flush. The template is provisional and the verified four-member image retains its compatibility/reuse contract.
Exact native state, worker/TURN/profile leases, caller termination and durable settlement replay remain one Gateway SIGTERM leaves orphan browser-vm-control-service #131 repair. Runtime retains a pending writer barrier through process death until exact reconciliation permits reuse. Browser: keep controls responsive during launch and enforce session capacity #289 owns independent controls/quotas; response correspondence must survive concurrency.
Accepted producer outputs unblock consumers while full acceptance/review stays open. Browser: complete human and agent workflows on the same Engine page #290 local operator work and Browser: use independently selected remote Engine and Exit through ordinary controls #291's ordinary human remote milestone proceed independently; profile transfer later consumes that remote result. Each task retains its original criteria and current owner gates.

The simplest coherent design keeps the existing signed capsule/content path, one installation writer/generation, one Runtime preparation/lifecycle path, one tool-neutral Browser contract and separately rooted profiles. Engine owns website execution/TLS, Exit owns selected authorized DNS/streams, and Carrier owns off-box carriage below Runtime routing. VM, opaque GUI and native-provider confinement remain distinct tested boundaries. The source/runtime/installed/offer records describe different facts rather than competing controllers.

Six missing executable slices now exist: #288 ordinary install/repair under #87; #289 responsive sessions; #290 operator parity; #291 independent remote Engine/Exit; #292 profiles; #293 qualification/maintenance under #283. All are Backlog; #131 is In progress in the installed lane. Shared delivery/security/target work keeps its existing issues and owners. Native sub-issue creation succeeded, resolving the historical API limitation. Full acceptance stays Browser-2026-10-07-R1, with every criterion preserved.

Current product/harness/installed receipt remain the checkpoint candidate. M0 and the prior 245 passing source/offline cases remain accepted at their recorded scope; four publisher checks remain skipped. Current Reset/normal failure is still beb00120…, before Engine open, with cause unknown. This review changed GitHub records only: zero source edits, builds, installs or product launches. Final local inventory remains 197 branches/45 worktrees; clean product/harness stay 0 behind and 12/6 ahead. The shared heavy-build lease is held by another worker; Browser requested no build. Next installed experiment remains #131's bounded real Reset diagnosis and decoded-frame journey, followed by separate active faults. The Mac 2–4, Mac/Jetson 3–7 and full 6–12 engineering-week estimates remain low-confidence ranges, with human/signing/hardware/physical-network/soak gates outside engineering effort. Re-estimate at current decoded frame, uncertain-cleanup injection and empty-Home signed-closure proof.

Browser-only tested plan and ETA — 2026-10-08 00:14 UTC

Historical plan and evidence from 00:14 UTC. Its pre-Engine failure and absence-of-decoded-frame observations describe the earlier candidate; the current installed Mac result above supersedes those execution claims. The remaining plan and full acceptance criteria retain their owners.

The detailed Browser-only plan answers Anders's fresh-install and vision-alignment request. It supersedes the earlier broad review's execution plan; its original evidence remains in #131. All 70 B01–B16 criteria below remain byte-identical.

Design decision: keep one Browser app, Runtime authority/routing/lifecycle/audit, Engine page execution, explicitly selected Exit networking and Carrier off-box transport/content delivery. Signed Digital Capsules identify complete immutable manifest/payload closures. Source projections, package availability, installed inventory and execution offers have distinct claims. Profiles remain separately owned mutable principal state. Browser VM isolation, opaque UI isolation and native-provider host rights retain separate proof. The plan read PRINCIPLES, Architecture, Capsule Model/Authoring, Carrier, Content Distribution and the Browser contracts. It extends the existing installation writer and typed effects.

Main delivery gap: install.sh already invokes plain Runtime setup and Home already selects Browser/adapter. The ordinary template/producer lacks the image, Mac VZ/common VM host helpers, managed dependency closure and normal configuration; an empty adapter inventory cannot start Browser. Consumer image verification/streaming/atomic replacement exists for an exact configured local Engine, but private source-home preparation supplies missing inputs. The template, producer, verifier, signer and setup must agree on the same role closure. An image overlay alone fails current inventory/profile parity.

New-user behavior: default Home setup checks trusted local platform/device/resource facts, stages/adopts the signed host probe/helper, verifies actual VZ/KVM/permissions/entitlements/dependencies and image compatibility, then prepares the eligible selected local role through the existing content/Carrier path with narrow configuration, progress/cancellation/retry. Setup and later Repair/Open consume one readiness/preparation result. Linux's one-time privileged KVM/TAP/firewall setup retains approval; ordinary launch stays unprivileged. Viewer/remote-consumer roles retain explicit Engine/Exit approval and avoid local VM dependencies. This meets the install requirement through Runtime setup, rather than a separate Browser shell downloader.

Fundamental repairs: existing native owner lifetime and exact terminal observation, caller retention through uncertain cleanup, rooted unpublished profile preparation/atomic publication, full-effect journal/tombstone replay, and short controls independent of long Open. #217 compares a verified empty-profile template with guest initialization of an unpublished sibling and selects the smaller complete crash-safe compatible path after bounded proof. Current four-member image reuse remains bound to its unchanged inputs. Current source findings await failure-injection proof.

Observed failures: current Reset/normal journey failed before Engine open waiting for a dialog. The categorical opaque-origin cause is withdrawn: exact Chrome151 emitted confirmation in matching nested opaque frames. Capture real Reset enabled/loading state, asset/token/handler readiness, ancestor flags, console and click/dialog outcomes before repair. Real current input-surface wheel probe confirmed zero dispatches during a 344.5 ms continuous gesture; one batch arrived 64 ms after it ended. Repair continuous wheel dispatch/horizontal-unit handling and IME/shortcuts before latency qualification.

Passed evidence: previous 46 native regressions/build/install parity and current retained-profile containment remain accepted at their exact scope. This review passed 245 source/offline cases, with four retained-publisher checks explicitly skipped: installer 62, focused Browser66, Linux network15, product-data102. Current product-data, diff and both format checks passed. Obsolete entropy script names are absent; current source uses product-data/behavior gates. Real browser probes establish feasibility and an input defect, not current Home/Engine/media acceptance. The exact #131 candidate/composition still has no decoded-frame or active-VM fault proof.

Order / milestone	Work and producer	Proof that unblocks the next claim
M1a	#131 exact Reset diagnosis and smallest responsible repair	Current installed Home/sign-in/page/decoded-frame/navigate/type/scroll/Close
M1b/P0-local	#131 lifetime, first-use transaction and full durable settlement; #289 independent short controls	Separate graceful stop, active SIGTERM, crash/restart, natural orphan cleanup and committed-profile read; all 13 effects within numeric bounds
M2, alongside M1 source work	#217 role closure/config/image and optional template; #288 Runtime preparation consumer with existing install/update/content owners	Actual empty-Home install.sh journey, upstream dependency hosts blocked; corruption, absence, incompatible platform, denied virtualization, interruption, low disk, update/repair
Local features	#87 input, media/recovery, files/accessibility/Wallet	Controlled daily workflows, actual media/transaction result and matching human UX
O0/R0/A0/P0-remote	#290 operators, #291 ordinary Engine/Exit, #173 authority and #292 profiles	Same-page handoff/headless, all five placements, DNS/destination/revocation, state transfer/reopen/delete and independent faults
Q0	#293 and named target maintainers	Frozen compatible set; 100 cycles, 100 cold/100 warm samples, 30-minute A/V, eight-hour soak, actual hardware/viewer/network rows, second maintainer and required reviews

Two independent reviewers challenged the plan. Diagnostics/privacy/authority checks accompany each slice. Producer contracts unblock implementation while full acceptance stays open. O0 can establish its local core before R0; R0 can use existing human controls before complete O0. Linux persistent profile parity and Jetson admission/reboot proof remain explicit target work.

ETA: cumulative active engineering estimates from 7 October, with roughly eight focused hours/day, one effective implementation owner and independent review help:

Reset diagnosis and next prepared-fixture baseline attempt: 4–12 hours.
Dependable local Mac lifecycle/profile baseline: 4–9 engineering days.
Normal fresh Mac installation plus tested update/repair candidate: 2–4 engineering weeks.
Same basic ordinary-install journey on Mac and Jetson: 3–7 engineering weeks.
Full Browser mission: complete stable local and remote browsing with human and agent parity #283 / all 70 criteria: 6–12 engineering weeks (about 240–480 active hours), low confidence until remaining target proofs.

Calendar completion also depends on signed publication/release decisions, required human reviews, second-maintainer repetition, physical hardware/viewer rows and real WAN/relay conditions. Only this Mac and Jetson are execution targets; other physical qualification rows retain their gates. Re-estimate after the next decoded frame, first uncertain-cleanup injection and first empty-Home producer-closure proof. A firm full completion date is premature.

Build policy: light behavior/producer-closure checks first; freeze affected input closure; one lease-protected batch; reuse verified unchanged outputs/image; bind built/installed/served hashes; then target proof. Consume completed CI receipts without repeated unchanged polling. The cached native continuation took about nine minutes; lifecycle/delivery correctness and target evidence dominate the schedule.

This analysis ran zero builds, source edits, reinstallations, product Home/VM launches, public-host actions, pushes/merges or production signing. Diagnostic browser/server processes were closed. Product/harness remain clean, the fixture stays stopped, retained profile/copy and OMP work remain preserved. Hardware/media/soak/human/review/approval gates stay open. Continue #131 from its exact first failure.

Moved here from #87 (#87 (comment)): in the Browser, double-click to select a word, right-click Copy and Shift+Arrow selection. The 0.8.0 fix candidate covers mouse-drag selection and Cmd/Ctrl+A only. A click count for double-click on the Runtime click route changes guest and Runtime code; a data-channel route for it is not checked yet.

Browser mission: complete stable local and remote browsing with human and agent parity #283

Description

Acceptance ownership

Execution rules

Accepted prerequisite outputs and later qualification

Proof and closeout gate

Elastos boundaries and shared work

Delivery dependencies

Current checkpoint — 3 November 2026

Local acceptance contribution moved from #87

#87 local release contribution

Complete preserved B01–B16 acceptance

B01. One Browser contract and an explicit support matrix

B02. A fresh installation opens a usable Browser

B03. Every failure has an actionable diagnosis

B04. People and agents have equal Browser capabilities

B05. Input and navigation feel like a browser

B06. Sessions recover from normal interruptions

B07. One slow session cannot block the others

B08. Remote Engine is an ordinary Runtime service

B09. Exit has identical local and remote network semantics

B10. Prove independent placement of UI, Engine, and Exit

B11. Meet measured responsiveness and media budgets

B12. Profiles and user state survive safely

B13. Complete daily browser workflows and accessibility

B14. Preserve authority, privacy, and bounded revocation

B15. Updates and repair preserve a working installation

B16. Release only from repeatable product evidence

Preserved work after the 0.8.0 Browser finish line

Activity

andersalm commented on Oct 8, 2026

Browser-only first-principles plan and ETA — 2026-10-08 00:14 UTC

Principles and design decision

What is proven now

Root causes and evidence limits

Ordinary new-user journey

Tested execution plan and gates

Verification performed for this plan

ETA and uncertainty

andersalm commented on Oct 8, 2026

First-principles and Occam review — 2026-10-08

Executable task cards and existing owners

andersalm commented on Oct 8, 2026

Final record verification — 2026-10-08 00:48 UTC

andersalm commented on Oct 8, 2026

Recommended Browser milestone priority — 7 October 2026

andersalm commented on Oct 8, 2026

Current execution checkpoint - 2026-10-08

Fresh-session start instructions

First-principles and Occam review — 2026-10-08

Browser-only tested plan and ETA — 2026-10-08 00:14 UTC

andersalm commented on Oct 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions