docs: goal 0044 capture-path research recorded + two ADR corrections (#85)

Research verdict source-hardens ADR-0030's two-tier answer
(save-page floor shipped; allowlisted self-hosted extension as the
gated end-state) and lands the owner's 7-item at-work checklist.
ADR-0030's developer-mode-policy 'unconfirmed' upgraded to confirmed-
separate; ADR-0003 gains the native-messaging admin-rights scope note
(rejection is protocol-authorship-only).


Claude-Session: https://claude.ai/code/session_01FJ8wStsHyu7XPLTspNjMnQ

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: alicoding

docs/adr/0003-browser-bridge-architecture.md

@@ -96,6 +96,14 @@ itself (~30 lines of `encoding/binary` + `encoding/json`) would have to
 be Mill-authored either way — exactly what the rule excludes, regardless
 of how trivial the protocol is.
 
+Scope note (goal 0044 research, 2026-08-13): this rejection is about
+protocol authorship ONLY — it was never an admin-rights problem.
+Native-messaging-host manifests register per-user with no admin/root
+on both Windows (`HKEY_CURRENT_USER\...\NativeMessagingHosts`) and
+macOS (`~/Library/Application Support/.../NativeMessagingHosts/`),
+per Chrome's own native-messaging docs. If an adequate Go library
+ever appears, admin rights would not be the blocker.
+
 ### B. Direct localhost fetch/WebSocket from the extension
 Extension calls `http://localhost:8080` directly via `fetch()` or the
 `@wailsio/runtime` client with `setTransport()` pointed at that origin.

docs/adr/0030-confluence-capture-mechanism-matrix.md

@@ -49,10 +49,11 @@ flagged inline rather than presented as settled.
 per-tab session identity — everything §2.1 and the multi-tab problem
 need. Two distinct ways in, gated by different policies: (1) unpacked
 "Load unpacked" via developer mode — gated by
-`ExtensionDeveloperModeSettings` (a dedicated policy; whether
-`ExtensionInstallBlocklist "*"` also blocks unpacked loading is
-unconfirmed — the dedicated policy's existence suggests they're
-separate code paths); (2) the enterprise-legit route — IS&C allowlists
+`ExtensionDeveloperModeSettings` (a dedicated policy — CONFIRMED
+separate from `ExtensionInstallBlocklist` by goal 0044's research
+pass, 2026-08-13, against Edge's own policy docs: once set, the
+dedicated policy fully governs the Developer Mode toggle, independent
+of the install blocklist); (2) the enterprise-legit route — IS&C allowlists
 Mill's extension ID, optionally force-installed from a self-hosted CRX,
 no Chrome Web Store listing required. Route 2 is strengthened by Mill
 being open-source: IS&C can review the exact code being allowlisted —

docs/goals/0044-m365-bridge-dry-run.md

@@ -34,12 +34,71 @@ extension-policy references). No Mill code changes expected beyond
 possibly a seed tweak; if the dry run finds a small fixable gap, it
 rides per the below-goal-granularity rule.
 
+## Capture-path research — DELIVERED 2026-08-13 (deliverable 2)
+
+Re-verified ADR-0030 against primary sources (Chrome Enterprise /
+Edge policy docs, MV3 docs, Chromium's own save-page design doc);
+the ADR's matrix held. New confirmations beyond it, each recorded at
+its home: `ExtensionDeveloperModeSettings` confirmed a separate
+policy from the install blocklist (ADR-0030 updated from
+"unconfirmed"); per-user native-messaging registration needs NO
+admin rights on either OS (ADR-0003 scope note added — its
+rejection stays protocol-authorship-only); self-hosted CRX
+allowlisting via `ExtensionSettings`/`ExtensionInstallForcelist`/
+`ExtensionInstallSources` is standard, documented practice with a
+live financial-sector precedent (an engineering blog documenting
+exactly this internal-CRX flow); `activeTab` is the
+permissions-minimal review story for an IT ask (no install-time
+warnings, user-gesture-scoped); `DownloadRestrictions=3` (the only
+policy that would kill the save-page floor) is explicitly
+rare/not-recommended per Google's own guidance; bookmarklets fight
+the SITE's CSP (real browser behavior, a documented spec-vs-impl
+gap), not just IT policy — last-resort verdict confirmed; a local
+TLS-interception proxy is rejected as an architectural non-starter
+(collides with the enterprise MITM CA; sees network bytes, never
+rendered DOM).
+
+**Verdict (unchanged from ADR-0030, now source-hardened): two-tier.**
+Save-page-then-parse is the guaranteed floor and is already shipped;
+the ADR-0003 extension (allowlisted, self-hosted) is the target
+end-state, gated on one specific IT ask whose outcome is genuinely
+unknowable without asking.
+
+**Owner's at-work checklist (the unknowables — nothing here is
+researchable further from outside):**
+1. Chrome or Edge? (Policies identical either way — just scopes
+   which console.)
+2. `chrome://extensions` / `edge://extensions`: is the Developer
+   Mode toggle present and flippable? Try "Load unpacked" with a
+   trivial extension.
+3. The precise IS&C ask: "Can an internally-reviewed, open-source
+   extension be added via `ExtensionSettings`
+   (`installation_mode: allowed`), self-hosted via
+   `ExtensionInstallSources` if not store-listed?"
+4. Bookmarklet probe on a real Confluence page — CSP refusal in the
+   console, or a policy block?
+5. ⌘S a Confluence page ("Webpage, Complete") — does the saved
+   `.html` carry the rendered body including dynamic macros/panels?
+   (The one Confluence-specific fidelity unknown in the save-page
+   floor.)
+6. `chrome://version` build number (Local-Network-Access enforcement
+   status; affects the bookmarklet path only).
+7. Copy a full page and a small selection; run the seeded
+   "Example: Clipboard inspector" — which `text/html` flavors
+   actually land?
+
+Full comparison table with per-row confidence and all source URLs is
+in the session's research report; the rows' conclusions are the ADR
+updates + verdict above.
+
 ## Acceptance (checkable)
 
 - [ ] The dry run's gap list is written into this file, each gap
       named with what it would take.
-- [ ] The capture-path comparison (extension vs. fallback ladder,
+- [x] The capture-path comparison (extension vs. fallback ladder,
       with policy precedent and sources) is written into this file,
-      decision-ready for the owner.
+      decision-ready for the owner — delivered above, 2026-08-13,
+      with the ADR-0030/ADR-0003 corrections landed in the same
+      change.
 - [ ] Goal 0021's Phase 4 bullet points here and 0021's archival is
       unblocked (owner call remains its bar).