Add scoped native history and window agent controls

docs/agent-history-window.md

@@ -0,0 +1,56 @@
+# Managed agent history and window controls
+
+Administrators independently enable `history:list`, `history:go`, `window:state`
+and `window:control` in the signed baseline and approved individual grant. All
+four start unchecked. User-profile restrictions, global agent disable, grant
+expiry, credential generation and destination restrictions continue to apply.
+Use the existing locally paired DPAPI/PQ agent client; there is no new plaintext
+or unauthenticated endpoint.
+
+| Action | Arguments | Returned data |
+| --- | --- | --- |
+| `history:list` | Native `sessionId` | `snapshotId`, entries with opaque `entryId`, sanitized title, optional inspected URL and active flag |
+| `history:go` | Same `sessionId`, returned `snapshotId` and `entryId` | `completed` |
+| `window:state` | Empty object | Bounded dimensions and visible/focused/minimized/maximized/fullScreen booleans |
+| `window:control` | `command`: minimize, maximize, restore or focus | `completed`; query state separately |
+
+For history navigation, first request a list, select a returned entry and use its
+handles within 60 seconds. The snapshot is consumed once. Refresh the list after
+navigation or a stale-snapshot refusal; do not automatically repeat a mutation.
+Agents never supply a raw native history index or URL to the history-go action.
+
+History is limited to 100 entries and current native tab ownership. Complete DLP
+inspection precedes title/URL export. Credential-bearing entries are masked and
+cannot be selected for navigation, even with sensitive-read permission. Other
+classified confidential entries retain opaque handles while hiding their title
+and URL. Entries outside the actor's destination scope are excluded.
+
+Private snapshots bind the actor/generation, session, native contents, policy,
+navigation token and complete bounded inventory. Native Chromium `pageState`
+can contain form values: it is never exported or retained in the snapshot.
+Only a private comparison checksum is used to detect replacement even when URL
+and title stay the same; this checksum also never leaves the privileged process.
+The final native comparison occurs immediately before dispatch. Scroll/form-state
+updates can legitimately make a snapshot stale. This is active-tab history
+navigation, not persistent session restoration.
+
+Window control operates only on S Browser's own window. It rechecks policy,
+principal authorization, cancellation and native window identity before effects
+and before returning state. Closing the application, arbitrary resizing,
+positioning and general OS automation are not provided by this scope. A failure
+after an effect does not imply undo, and never triggers a retry.
+
+Every action retains durable pre-execution and completion/failure audit with
+verified actor attribution. Ordinary events contain no history titles, URLs,
+serialized page state or arguments. Debug spans name the action and native
+navigation/window phase under the protected RPC parent. Administrators retain
+central control of diagnostic export independently of these capabilities.
+
+Actual Windows/Electron proof exercises two individually paired actors,
+cross-actor/stale/replayed history refusal, DLP/credential masking, host exclusions,
+one exact indexed navigation, native maximize/restore/minimize/focus, targeted
+revocation and global disable. Named OTLP stages correlate with completed audit
+events (`artifacts/extended-agent-controls-native-proof.json`). Same-URL/title
+page-state replacement has unit-boundary evidence; a separate native mutation
+experiment is not claimed. Same-user Windows DPAPI trust and production identity
+custody remain separate limitations.