Harden Windows DLP enforcement and Electron runtime packaging

docs/worker-ownership.md

@@ -1,25 +1,47 @@
-# Native worker ownership: verified boundary and next implementation
+# Attributed agent background workers
 
-Current individual-agent mode blocks requests without a guarded native tab owner. This deliberately prevents service workers from borrowing an actor's authority through origin, Referer, renderer messages or a guessed tab. It also limits compatibility with worker-dependent applications.
+The central `browser.allowAgentBackgroundWorkers` gate defaults false. The
+permission-only `network:background` scope is also explicit in both the agent
+baseline and individual grant; it is not a callable agent RPC. User profiles can
+inherit or deny this feature (`features.agentBackgroundWorkers`); they cannot
+allow it beyond baseline or grant. Applicable denials accumulate.
 
-## Native evidence
+Development support is restricted to immutable, nonpersistent native browser
+partitions owned by the enrolled device, individual principal and credential
+generation. Human/default shared partitions, legacy callers and unattributed
+worker traffic remain blocked. Enabling this feature is not general human browser
+worker compatibility, persistence or cross-device worker roaming.
 
-A local Windows feasibility experiment used Electron 44.7.0 / Chromium 152.0.7977.130, two independent in-memory native sessions, and the same synthetic loopback origin. Each session registered a service worker and initiated a POST from that worker. Each session's native webRequest listener received only its own request.
+Before network release the owner registry must prove the worker's partition,
+registration/source and native context; current policy, grant generation/expiry,
+destination and DLP remain mandatory. The foreground tab or a renderer-provided
+identity cannot establish ownership. Revocation must deny existing worker traffic,
+not merely prevent new registrations. No cloud inspection or extra worker scope
+bypasses local mandatory inspection.
 
-The worker requests had no webContentsId or requesting frame. Both had the same initiator origin. Their request objects carried no worker version ID or process ID. ServiceWorkers.getAllRunning exposed different renderProcessIds, but those identifiers were absent from webRequest events. Runtime worker version IDs were available as dictionary keys; the worker information values omitted the versionId field advertised in the installed type definition.
+## Verification status
 
-Local ignored evidence: `artifacts/worker-partition-feasibility.json` and `.log`. This isolated API experiment did not run production browser guards or establish an OpenTelemetry integration proof.
+The current real Electron admin workflow exercised typed login-rule editing,
+independent signed publication and auditor read-only access. All 193 completed
+API requests had exported traces; one canceled read had no failed mutation.
+The collector reported zero rejected writes. Trace examples:
+`a0f881d3c99650c53bacf547a191b216` and
+`4416533c41ffe3e2adb81af46a30e0d4`.
 
-Electron documents native [webRequest events](https://www.electronjs.org/docs/latest/api/web-request), [service-worker inventory](https://www.electronjs.org/docs/latest/api/service-workers), and [session partitions](https://www.electronjs.org/docs/latest/api/session). The installed `node_modules/electron/electron.d.ts` was checked against the actual runtime.
+Focused policy tests verify the disabled default, preservation through signed
+publication, strict boolean validation and rejection of `network:background`
+as an executable RPC. Eleven registry tests cover immutable ownership,
+installation-before-network-use, revocation and retryable failed cleanup.
 
-## Defensible design
+The central gate/scope controls start unchecked, and profile schema/enforcement
+prove inherit/deny-only behavior. The actual Windows/Electron admin fixture also verifies the worker gate/scope
+start off, auditor controls are disabled, and typed login-rule creation goes
+through exact signed independent review and policy-history restoration. Its 193
+completed API requests export parent-correlated spans; one canceled GET during
+identity reload is recorded separately, with no failed mutation. See
+`artifacts/agent-grants-history-admin-proof.json`,
+`artifacts/agent-grants-history-admin-traces.json` and
+`artifacts/credential-submission-admin-controls.png`.
 
-Allocate a separate native session for each immutable device/principal/generation identity. Assign ownership in the main process before creating any native tab or initiating a request. Install the full network, DLP, download, permission, proxy, DNS and preload controls before the partition is used. A worker's owning principal then comes from the listener's native session closure, not page-supplied claims.
-
-Never reassign a partition to another actor or newer generation. Check the current signed grant, device status, policy expiry and destination scopes before inspection, after every awaited stage and immediately before release. Revocation must quarantine the owner's partition and close its connections. Cookies and authentication state should remain isolated unless a separate explicitly authorized sharing design is implemented.
-
-This attributes requests to a principal, not to a specific tab. Shared workers can serve multiple tabs, and service workers may outlive their clients. Any operation requiring an unavailable tab, exact document or visual approval must remain blocked until an independently verified context is available. Worker downloads, immutable streamed request-body inspection, background lifetimes, restart ownership and complete revocation behavior need native proofs.
-
-## Migration surface
-
-The current main process uses one `browserSession` for proxy updates, DNS resolution, permission handlers, upload terminal events, download fetching and will-download, webRequest gates, developer-tools frontends, preload registration, native tab construction, revocation cleanup and VPN quarantine. All relevant uses must become session-aware together. Merely selecting a new session for a tab while leaving these controls global would create an enforcement gap.
+Runtime owner-registry migration, actual native worker attribution/revocation
+tests, runtime traces and final Windows/package proof are pending. Do not claim worker support solely from a stored policy flag.