Browser: complete human and agent workflows on the same Engine page #290

A person and an authorized agent use the same Browser page and permission model, hand control over and take it back, including headless operation and a later viewer attachment.

Goal: operator parity. Lane: Contract and source. Own B04.A1–A7; supply B05.A4/B13.A4 operator contributions and remote diagnostics/authority conformance.

Scope and milestones

Complete the current tool-neutral native Runtime operator workflow first. Use bounded DOM/accessibility inspection, generation-scoped references, semantic actions/events/waits and the existing page lifecycle. Browser screenshots/inspection remain granted operator effects; product display remains decoded WebRTC.

Adapt declared Playwright and Camofox API clients to that contract; certify the compatible Camoufox/Firefox Engine path separately. Providers/tool dependencies ship through their existing signed capsule delivery owners. Exposing a raw debug endpoint or inspecting the outer video element does not supply operator parity.

Accepted M0 supports native local work. An accepted ordinary remote service/session result supplies remote/headless integration. The remote task can establish its first service result with authorized human controls before the complete operator task passes. #173/#177/#178/#179 supply authority/approval/peer milestones.

Done means

• The complete shared workflow passes through human UI, native agent, declared Playwright/Camofox adapters and the qualified Camoufox/Firefox provider with exact versions.
• An authorized agent attaches to the actual existing Engine page; human handoff/takeback retains the same page/profile and correct ownership.
• Headless use works with no open viewer; permitted viewer attachment and detach preserve the same session.
• Navigation invalidates document-scoped references; stale/foreign references, unsupported methods and incompatible versions fail with typed errors before effects.
• Equal grants produce equal human/agent decisions, including inspect/capture/files/Wallet boundaries and real approval outcomes. Untrusted page text cannot grant authority.
• All original B04 operations, meaningful waits and adapter conformance tests pass, with applicable input/latency and installed/manual proof.

Next experiment: compare one controlled semantic workflow through existing native client and human UI on the same acquired page. Reuse existing contract fixtures; close one missing operation at a time.

Ownership and acceptance

Product owner: Anders (@andersalm). Part of Browser mission #283, acceptance revision Browser-2026-10-07-R1. The complete original criterion text and numerical budgets in #283 remain authoritative. This task supplies the stated contribution; shared-producer and full-mission acceptance remain open.

Record one execution owner, lane, approved task base/PR target, file scope, exact candidate and resource lease before implementation. Planning uses fetched develop 1828919980b1af1d60895c6cee178f769daed74c; existing branches retain their approved bases/history. Keep at most one active task per Browser lane. New tasks start in Backlog; #131 remains the installed-product task.

Runtime owns admission, principal/grants, placement, routing, resource limits, lifecycle and audit. Engine executes and renders websites and owns website TLS; the selected Exit performs authorized DNS and destination streams. Carrier carries off-box traffic below the same contract. Immutable signed capsule/dependency identity and separately rooted mutable profiles retain their distinct owners.

Verification and closeout

Use the smallest behavior tests that exercise the changed boundary. Freeze the affected input closure, then batch one needed build under the shared Mac lease. Reuse the verified image/helpers when inputs match. Source presence and prepared fixtures provide bounded evidence; installed acceptance binds source commit/tree, built/installed/served hashes, package/image/helper manifests, device/client/adapter versions, selected Engine/Exit, placement/network, commands, failures, cleanup and matching media/manual evidence.

Use one isolated Mac test owner and the authorized Mac/Jetson targets; existing Namespace is an optional x86 fallback. Other physical role/network rows remain unverified until their evidence exists. OMP and existing Homes keep their owners. Disposable fixture signing uses separate trust; production signing, existing-Home changes, release and deployment retain their approval gates.

Before reporting, update this issue with passed, failed, pending, exact candidate and next experiment; use 30-minute checkpoints during sustained execution. Full closure requires accepted behavior, resolved findings, required independent review, applicable irzhywau/security/signing review and human UX/media review, and a merged implementing PR. Applicable #173 changes retain its approval and different-model-family adversarial review gate. All #283 hardware/media/soak/second-maintainer gates remain intact.

Related Browser outputs: #291 ordinary remote service milestone; #292 profile contract; #293 adapter/target qualification.