Add protected interaction evidence and measured debugging phases

docs/browser-diagnostics.md

@@ -34,7 +34,9 @@ The privileged browser instruments fixed operation families: IPC, local agent ac
 
 Attributes are explicitly typed and allowlisted: registered operation/component enums, UUID session/device IDs, policy version, bounded byte/count fields, duration, decision, request type and status. Failure spans receive a status and a fixed exception category (`Error`, `TypeError` or `RangeError`), never an exception message or stack. Arbitrary operation names are not recorded. Returned model answers, credential values and inspected content are never inferred as diagnostic attributes.
 
-Detailed timing within Python parsing, OCR, YARA or model inference is not yet exported as its own child spans; the browser records the local-inspector call boundary. Renderer paint/layout and Chromium internal tracing are also separate future work. This is explicit application instrumentation, not a claim to trace every Chromium function.
+Signed debug mode imports validated private-pipe timing records as inspector child spans: inspection, parsing, OCR, OCR model initialization, YARA, macro extraction, semantic inference and semantic model initialization. Operational mode retains the call boundary. Renderer paint/layout, individual model kernels and Chromium internal tracing remain separate future work. This is explicit application instrumentation, not a claim to trace every Chromium function.
+
+Protected evidence delivery has separate capture, challenge, encryption, send and acknowledgement stages, correlated with backend decrypt/store spans. Startup before enrollment or before a verified diagnostics policy cannot export telemetry; local smoke fixtures record bounded startup phase, window loading state and resource snapshots without URLs or credentials. Do not attribute an early startup timeout to a model or CPU pressure without measurements.
 
 ## Lifecycle and security behavior
 
@@ -42,6 +44,16 @@ Only verified policy configures the provider. Reconfiguration immediately invali
 
 Export failure never repeats the protected operation, changes its result or authorizes blocked data. Successful and failing functions retain their original results/errors. Normal shutdown attempts a bounded flush; diagnostics are intentionally nondurable and can be lost in a crash. Durable audit and forensic evidence require their separate pipelines.
 
+Local status distinguishes current-generation `failedExports` from process-lifetime
+`lifetimeFailedExports`. Disabling or changing policy resets the former but retains
+the latter until process restart. This counter does not export after disable.
+
+Policy reconciliation now names signature verification, bookmark verification,
+agent reconciliation, page configuration and durable audit phases. Same-version
+refreshes preserve correlated child spans under the policy request. A new policy
+deliberately disables the previous provider during proxy/DNS changes; only phases
+after verified new diagnostics activation can export. That gap is intentional.
+
 ## Verification
 
 `node --test tests/diagnostics.test.mjs` exercises a real local OTLP receiver: parent/child traces, measured durations, correlated logs, typed attributes, password/token/URL/error sentinels absent, environment headers/resources excluded, disable/reconfigure queue invalidation, expiry, bounded batches and failed export without operation retry.

docs/development-observability.md

@@ -64,3 +64,35 @@ when investigating latency. Do not optimize by removing an audit gate or retryin
 an action. The proof is in `artifacts/individual-agent-native-proof.json`.
 The final Windows package verifier checks current source and runs both shipped
 legacy and individual DPAPI/PQ clients successfully.
+
+## Latest interaction and session measurements
+
+The actual protected interaction proof uses trace
+`32cbbb58088d193301c5f6ac530284af`: 30 spans, verified parent correlation,
+capture 0.3353 ms, challenge 8.1735 ms, encryption 0.4718 ms, send 62.1817 ms
+and acknowledgement 0.4234 ms. The backend store stage took 54.2629 ms.
+Collector rejected writes were zero. These are one local reproduction's
+measurements, not performance guarantees.
+
+After session-title classification was added, the actual native session inventory
+proof uses trace `64013e27cfc37bc3792983bc06149c87`: request 85.675 ms,
+session adapter 1.0637 ms and durable audit phases 33.3975 and 47.2472 ms.
+This fixture did not enable the semantic model; it cannot establish semantic-model
+latency. The native proof confirms a confidential title is masked while preserving
+its opaque session ID.
+
+A parallel fixture timed out before enrollment and therefore before signed
+diagnostics activation. Its isolated rerun and restart reached the shell in
+794/806 ms. Safe local startup snapshots were added; the original timeout's cause
+is unresolved. Do not describe that failure as a traced DLP/model regression.
+The current Windows package proof and 515-test suite passed before the subsequent
+export-counter refinement. Ignored proof artifacts remain local.
+
+After the refinement and policy child stages, the final suite passes 522 tests.
+Real signed policy/bookmark fixtures verify actual OTLP child spans and disabled
+transitions. Windows build, packaged-runtime verification and the native tabs
+proof pass. The native receiver attributes exports by actual `service.name`:
+browser exports stay at 18 across revocation while backend collection remains
+independent. The earlier aggregate assertion conflated the two services; its
+failed run is retained rather than presented as successful. Do not retroactively
+assign the original extra batch to a service without its original payload.

docs/interaction-evidence.md

@@ -0,0 +1,36 @@
+# Protected interaction evidence
+
+Administrators separately enable `evidence.enabled`, `captureDownloads` and
+`captureInteractions` through reviewed signed policy. All are off by default.
+Interaction capture currently covers confirmed guarded copy/cut/paste and
+completed agent clicks. It is not a recording of every physical user click.
+
+Ordinary clipboard audit distinguishes authorization before the effect from
+completion after the effect. Protected completion metadata contains website
+origin, opaque session ID, action, structural target tag/role, bounded viewport
+coordinates and optional byte count. Paths, queries, fragments, field values,
+document text, selectors, labels and content hashes are excluded. Sensitive
+fields do not produce this capture.
+
+Agent completion capture is a separate audit phase from RPC completion; two
+events do not mean two clicks. The native fixture verifies one click effect.
+The server binds evidence to the accepted device event, action, source, session
+and completed outcome. New writes reject raw interaction content. Existing
+encrypted legacy evidence remains readable through restricted audited access.
+
+The source event and typed protected payload are persisted in one DPAPI-protected
+local queue record. Delivery acknowledges the ordinary event first and uses the
+protected post-quantum management evidence channel. Policy and enrollment are
+rechecked throughout delivery. Disabling interaction capture aborts matching
+in-flight delivery and removes pending interaction evidence while preserving
+ordinary audit and separately allowed download evidence. Existing retained
+records still follow retention, legal-hold and purpose-bound analyst access.
+
+Debug traces measure capture, challenge, encryption, send and acknowledgement,
+with correlated server decrypt/store phases. These timing spans carry no raw
+interaction contents. Evidence retention is independent of diagnostics.
+
+Remaining coverage includes general physical interaction observation, controlled
+content capture, all browser convenience clipboard paths and a proven scoped
+credential-submission exception. Do not assume this feature is full page replay
+or blanket password-field authorization.

docs/requirements-audit.md

@@ -477,3 +477,27 @@ Final current-source full Electron smoke passed in
 was restarted only after process/listener identity verification and its health
 check passes; the protected collector remains healthy with zero rejected writes.
 Grant publication integration is covered by `tests/agent-grants-publication.test.mjs`.
+
+## Protected interaction and debugging increment
+
+Default-off signed interaction capture now records confirmed guarded clipboard
+operations and completed agent clicks as protected metadata, with exact
+device/event/action/session binding. Native proof verifies analyst decryption,
+audited access, independent review, live selective disable and continuing download
+metadata capture. General physical-click replay and controlled content capture
+remain open. See `docs/interaction-evidence.md`.
+
+Agent session titles now pass aggregate DLP inspection before export; credential
+titles are masked and an actual native confidential-title proof preserves the
+session ID. Legitimate credential form-submission exceptions remain unverified.
+
+Evidence delivery has correlated capture/challenge/encrypt/send/ack/store phases.
+Policy reconciliation adds fixed named verification/bookmark/page/agent/audit
+phases. Export failure totals survive disable/reconfiguration within the process.
+Signed policy continues to govern telemetry; pre-enrollment startup uses bounded
+local snapshots rather than unauthorized export. These changes have 520 passing
+tests, including actual OTLP and signed policy fixtures. Final verification after
+service-attributed native diagnostics tests passes 522 tests. The actual native
+browser proves diagnostic export stops on revocation; Windows build and packaged
+source/runtime verification pass. Production completeness
+and the broader original open requirements are not implied.