Add scoped native history and window agent controls

docs/agent-history-window.md

@@ -0,0 +1,56 @@
+# Managed agent history and window controls
+
+Administrators independently enable `history:list`, `history:go`, `window:state`
+and `window:control` in the signed baseline and approved individual grant. All
+four start unchecked. User-profile restrictions, global agent disable, grant
+expiry, credential generation and destination restrictions continue to apply.
+Use the existing locally paired DPAPI/PQ agent client; there is no new plaintext
+or unauthenticated endpoint.
+
+| Action | Arguments | Returned data |
+| --- | --- | --- |
+| `history:list` | Native `sessionId` | `snapshotId`, entries with opaque `entryId`, sanitized title, optional inspected URL and active flag |
+| `history:go` | Same `sessionId`, returned `snapshotId` and `entryId` | `completed` |
+| `window:state` | Empty object | Bounded dimensions and visible/focused/minimized/maximized/fullScreen booleans |
+| `window:control` | `command`: minimize, maximize, restore or focus | `completed`; query state separately |
+
+For history navigation, first request a list, select a returned entry and use its
+handles within 60 seconds. The snapshot is consumed once. Refresh the list after
+navigation or a stale-snapshot refusal; do not automatically repeat a mutation.
+Agents never supply a raw native history index or URL to the history-go action.
+
+History is limited to 100 entries and current native tab ownership. Complete DLP
+inspection precedes title/URL export. Credential-bearing entries are masked and
+cannot be selected for navigation, even with sensitive-read permission. Other
+classified confidential entries retain opaque handles while hiding their title
+and URL. Entries outside the actor's destination scope are excluded.
+
+Private snapshots bind the actor/generation, session, native contents, policy,
+navigation token and complete bounded inventory. Native Chromium `pageState`
+can contain form values: it is never exported or retained in the snapshot.
+Only a private comparison checksum is used to detect replacement even when URL
+and title stay the same; this checksum also never leaves the privileged process.
+The final native comparison occurs immediately before dispatch. Scroll/form-state
+updates can legitimately make a snapshot stale. This is active-tab history
+navigation, not persistent session restoration.
+
+Window control operates only on S Browser's own window. It rechecks policy,
+principal authorization, cancellation and native window identity before effects
+and before returning state. Closing the application, arbitrary resizing,
+positioning and general OS automation are not provided by this scope. A failure
+after an effect does not imply undo, and never triggers a retry.
+
+Every action retains durable pre-execution and completion/failure audit with
+verified actor attribution. Ordinary events contain no history titles, URLs,
+serialized page state or arguments. Debug spans name the action and native
+navigation/window phase under the protected RPC parent. Administrators retain
+central control of diagnostic export independently of these capabilities.
+
+Actual Windows/Electron proof exercises two individually paired actors,
+cross-actor/stale/replayed history refusal, DLP/credential masking, host exclusions,
+one exact indexed navigation, native maximize/restore/minimize/focus, targeted
+revocation and global disable. Named OTLP stages correlate with completed audit
+events (`artifacts/extended-agent-controls-native-proof.json`). Same-URL/title
+page-state replacement has unit-boundary evidence; a separate native mutation
+experiment is not claimed. Same-user Windows DPAPI trust and production identity
+custody remain separate limitations.

docs/agent-observability-requirements.md

@@ -34,3 +34,13 @@ requests, including durations and named code stages. Debug collection is central
 managed, bounded and disableable. Operational spans do not silently become a raw
 content or credential archive. Backend tracing and collector/SIEM permissions,
 encryption and retention must complete the end-to-end pipeline.
+
+## Current implementation evidence
+
+Earlier status sentences above are superseded by individual DPAPI/PQ identities,
+targeted revocation, scoped library/bookmark controls, protected download/gesture
+metadata and the history/window capabilities described in
+[agent-history-window.md](agent-history-window.md). The broader requirements remain.
+History and window debug stages are now named children of completed protected RPC
+actions, with durable actor attribution. Full replay/content capture, safe visual
+export, persistent restoration and broader secured administration are still open.

docs/requirements-audit.md

@@ -564,3 +564,48 @@ tests pass (`artifacts/human-windows-build.log`, `human-package-proof.log`,
    These require independent deployment evidence, not only mocked local tests.
 
 Mac/Linux/mobile remain explicitly deferred by the user's Windows-first scope.
+
+## Secured history and window agent capabilities
+
+Four separately signed, default-unchecked capabilities now cover inspected
+history listing, opaque snapshot navigation and bounded native window state/control.
+Baseline, profile and individual-grant restrictions apply together. Native history
+output excludes pageState; private bounded comparison checksums detect changed
+state without retaining or exporting form values. Snapshots expire, are actor-
+and session-bound and consumed once. Credential-bearing entries are masked and
+cannot navigate; destination scope filters apply before metadata export and
+immediately before native navigation. See `docs/agent-history-window.md`.
+
+Actual Windows/Electron proof covers two individual actors, host exclusions,
+cross-actor/replay/stale denial, one exact indexed target, native maximize,
+minimize, restore and focus, targeted revocation and global disable. Completed
+history trace `d331f2f223782a94c9b99b7b6c7c6b6c` contains its named native navigation
+child; window trace `2fc7b43bea197f4bd7fada08b81ed30e` contains its named window child.
+Missing action names were found in the diagnostic allowlist and corrected rather
+than relying on generic dispatch timing. Ordinary audit excludes content and
+native state (`artifacts/extended-agent-controls-native-proof.json`).
+
+Central admin controls and individual grant defaults were verified in the actual
+UI. The fixture now records real network outcomes and requires correlated backend
+spans for every completed request and all mutations. 148 completed requests and
+seven mutation attempts have trace evidence; three failed GET attempts are
+reported separately. An earlier attempted request's missing trace is absent even
+from protected archives and remains unproven, not retroactively passed. No
+enforcement assertion was relaxed (`artifacts/control-scopes-admin-ui-current.log`).
+
+The current full suite passes 569 tests. Native browser and syntax checks pass.
+These controls do not complete full first-class agent access: persistent session
+restoration, safely inspected screenshots, vault/file/admin operations, arbitrary
+widgets and worker ownership remain open, together with the production/integration
+limits listed above. Same-state native page-state mutation is unit-proven only.
+
+Final current Windows build and packaged-source verification pass, including the
+new history-state and window-control modules, contained scanners, offline semantic
+inference, upload leases and both shipped agent clients. Syntax and the native
+tab/DLP/revocation proof pass. Logs: `artifacts/extended-controls-windows-build.log`,
+`extended-controls-package-proof.log`, `extended-controls-syntax.log`,
+`extended-controls-native-tabs.log`. Executable Authenticode remains `NotSigned`.
+Next control milestones are persistent session restoration and scoped vault/file
+operations; history inventory/navigation and the four bounded window operations
+are now implemented, rather than remaining wholly absent. The overall objective
+remains active and unachieved.