[Frontier] [BROW16-01] Complete a modern website task through a useful protected general browser #397

Parent

S16 #392 — #392

Model tier

Frontier: integration changes cross authority, data custody, replay/recovery and client/service contracts.

Context to read

AGENTS.md, CONTEXT.md, docs/agents/workflow.md, docs/specs/S16-rakazo-experience.md, ADRs 0064/0074, the relevant implemented S15 contracts, #392/#393/#394, and pinned Rakazo abf3c08145a05cba92a912d6c24fdfb5f569d0e0.

Deliverable

Move beyond the current static approved-origin GET-only browser: execute a representative modern public-site task through actual page interaction with protected effect/disclosure semantics. Investigate simpler browser architectures and propose an alternative when a current internal constraint prevents the product outcome.

Verified starting paths

src/s15/browser/{types,engine,gateway,sites,provisioned,egress,tools}.ts; src/s15/effects/conversation.ts; src/s15/disclosure/; docs/contracts/s15-protected-browser-v1.md; tests/s15-browser*.test.ts. Rakazo packages/adapters/src/computer-browser.ts and computer-screens.ts are reference/adaptation candidates, not preapproved authority.

Implementation steps

1. Inspect the existing static browser support boundary and pinned upstream browser/screen architecture; document the exact real-world tasks blocked by incidental restrictions.
2. Compare a simpler protected-browser/session/request-mediation design with extending the current broker. Select the smallest design that supports modern interaction and name its residuals.
3. Implement public page/script interaction using only observed generation-bound targets, with actual request/effect classification and no uncontrolled raw CDP/JS/network alternate route.
4. Complete a deterministic modern-site task requiring interaction; add protected-input/session handoff contract needed for the subsequent desktop/takeover slice without claiming generic login already works.
5. Test background fetch/navigation/frame/worker/socket/upload/disclosure and stale-input paths; unsupported effect classes remain explicitly unavailable.
6. Provide a real-browser local-fixture evidence record. Named public-site/login live acceptance stays opt-in with protected owner inputs.

Acceptance criteria

• A real Chromium fixture site requiring JavaScript and interaction produces an evidenced task result through the composed browser tool.
• Ordinary supported reads do not require a new approval per page; current purpose/recipient policy still governs actual data flow.
• Protected sends/payments/private-data recipients cannot bypass their gate through scripts/background traffic, alternate shell/network or stale targets.
• Cancellation/takeover generations fence later input and publication; uncertain effects reconcile before retry.
• The implementation reports precise unsupported classes and does not declare static GET-only navigation to be general-browser completion.
• Existing protected session credentials remain outside the working guest and model/ordinary exports.

Tests and evidence

1. Real Chromium controlled modern-site interaction → task result/evidence without external accounts.
2. Script/frame/worker/socket/beacon/form/navigation/upload attempts across allowed/denied destinations and exact held effects.
3. Stale generations, takeover/cancel races, expired policy, private lineage/new-recipient hold and redirect/DNS rebinding cases.

Requirements

FR-07/10/14/15/17/18/35/36/37/38/40/41; NFR-01/02/05/06/07/10/11/12/14; S16-AC06.

Blocked by

#393 baseline; #394 experience handoff for rendered interaction. Current browser/VM/policy/disclosure contracts must be reconciled at the tested base. No speculative Schway blocker; create one only for a demonstrated missing supported host contract.

Contracts used/delivered

Use implemented S15 owning-service contracts and supported Schway public exports. Freeze the exact new versioned seam in the implementation issue/PR before treating it as supported. Existing schemas/defaults/private data are not silently reinterpreted.

Out of scope

Live owner credentials, production/host activation, hosted SaaS/billing, unrelated native clients, replacing Schway, migration of S14/legacy data.

Do not

Do not treat old stack choices as fixed, copy a second upstream authority/runtime, weaken protected gates, log credentials, add model attribution, use implement-parallel, or merge the implementation PR yourself. Imported code must retain license, provenance, applicable notices and modified-file notices.

Definition of done

bun install --frozen-lockfile, bun run typecheck, relevant deterministic/composed tests and git diff --check pass. Run browser tests for rendered behavior. PR body Closes the exact implementation issue; record SHA/contracts/evidence and honest live pending items. Parent #392 remains open.

Complete backlog publication — 2026-11-05

Retain the original modern-browser outcome. Native children #408 (bounded mediation/feasibility contract) and #409 (composed useful modern website workflow) replace an unsplit implementation dispatch. #410 owns graphical watch/takeover. Existing general-mode types and static provisioned GET do not prove useful modern browser/effect enforcement. Keep this broad issue out of ready-for-agent.

Owner revision 2026-11-06

Grok-style autonomy (S16-D06–D11, ADR 0084) and Telegram removal (ADR 0085) apply. Only the S16-D07 human-required list waits for the owner, approved by a one-press in-chat card; GitHub push/PR/review replies/merge after required checks are the product default; trusted sites may keep sessions in the working VM browser while sensitive sites stay in the protected browser. Jit has no messaging channel; notifications use Web Push (#441). Policy/approval changes belong to #442.

Scope narrowed: public and trusted-site browsing use the working VM browser with full JavaScript; request-level mediation and the protected browser are required only for sensitive sites (S16-D09).