Capture guarded human gestures and verify agent administration

docs/development-observability.md

@@ -96,3 +96,15 @@ browser exports stay at 18 across revocation while backend collection remains
 independent. The earlier aggregate assertion conflated the two services; its
 failed run is retained rather than presented as successful. Do not retroactively
 assign the original extra batch to a service without its original payload.
+
+Foreground gesture development used actual traces to find a second attribution
+gap: a queue flusher started by one event delivered the next event under the first
+async context. `withCorrelation` now validates each durable record's own IDs and
+`audit.deliver` creates a recording delivery child under that source parent.
+Malformed IDs clear unrelated context, and current signed sampling/disable still
+applies. Real OTLP regression tests and three actual human-event traces prove
+distinct parents and complete evidence phase correlation. Trace
+`b7783f42197d0cff83957b0ee96e8296` has 17 spans, capture 19.50 ms and send 13.20 ms;
+`62e09413b9a42f4a58bd7f99485176ac` and
+`545ddac025113e50effed4e9a2ac87ee` each also have 17 spans. Collector rejected writes
+were zero. These are local reproduction timings, not throughput guarantees.

docs/individual-agent-grants.md

@@ -24,4 +24,12 @@ reliable ownership support. Actual exported agent request traces carry named chi
 phases and link to attributable durable events. The package verifier runs the
 shipped individual client. A separate backend integration test exercises distinct
 reviewer publication and history restore; grant-specific native publication UI
-coverage remains an open acceptance gate.
+coverage is now verified by `scripts/agent-grants-history-admin-smoke.mjs`.
+It exercises the actual author and independent-reviewer UI, denied self-approval,
+read-only auditor, rotation and draft-only history restoration while preserving
+an unrelated unpublished draft. Exported requests have verified parent trace
+correlation; screenshots were visually inspected. The history summary warns
+that restoring a lower generation cannot revive invalidated credentials: publish
+a generation greater than every previously issued value and pair again.
+
+![Agent history review with credential-generation warning](media/screenshots/admin-agent-history.png)

docs/interaction-evidence.md

@@ -2,20 +2,25 @@
 
 Administrators separately enable `evidence.enabled`, `captureDownloads` and
 `captureInteractions` through reviewed signed policy. All are off by default.
-Interaction capture currently covers confirmed guarded copy/cut/paste and
-completed agent clicks. It is not a recording of every physical user click.
+Interaction capture covers confirmed guarded copy/cut/paste, completed agent
+clicks and trusted clicks/gesture-associated form events on the active main-frame
+page. Human events are marked `observed`, including prevented events; this never
+claims transmission or completion of a page's asynchronous effect.
 
 Ordinary clipboard audit distinguishes authorization before the effect from
 completion after the effect. Protected completion metadata contains website
 origin, opaque session ID, action, structural target tag/role, bounded viewport
 coordinates and optional byte count. Paths, queries, fragments, field values,
 document text, selectors, labels and content hashes are excluded. Sensitive
-fields do not produce this capture.
+fields do not produce this capture. Sensitive forms are excluded as a whole,
+including password/file/hidden controls and bounded credential/card markers.
+Form observation also requires a recent trusted click or Enter gesture and active
+user activation; `requestSubmit()` alone does not establish a human gesture.
 
 Agent completion capture is a separate audit phase from RPC completion; two
 events do not mean two clicks. The native fixture verifies one click effect.
 The server binds evidence to the accepted device event, action, source, session
-and completed outcome. New writes reject raw interaction content. Existing
+and the correct observed/completed outcome. New writes reject raw interaction content. Existing
 encrypted legacy evidence remains readable through restricted audited access.
 
 The source event and typed protected payload are persisted in one DPAPI-protected
@@ -27,10 +32,22 @@ ordinary audit and separately allowed download evidence. Existing retained
 records still follow retention, legal-hold and purpose-bound analyst access.
 
 Debug traces measure capture, challenge, encryption, send and acknowledgement,
-with correlated server decrypt/store phases. These timing spans carry no raw
+with correlated server decrypt/store phases. Queue delivery resumes each record's
+own trace parent rather than inheriting a different event's flusher context.
+Observer install/drain/dispose phases have separate bounded debug spans.
+These timing spans carry no raw
 interaction contents. Evidence retention is independent of diagnostics.
 
-Remaining coverage includes general physical interaction observation, controlled
-content capture, all browser convenience clipboard paths and a proven scoped
+The private isolated-world observer has no page-visible bridge. It expires after
+1.5 seconds without a privileged drain, caps its queue at 16, allows a burst of
+20 and replenishes at 10 events per second. Main validates every drained record
+and rejects changed documents, activation, policy, ownership and overlays. A
+visual reinspection of the same document does not invalidate captured metadata.
+Rate/queue losses emit a durable bounded-capture warning and a diagnostic count;
+capture is not a complete forensic replay. Subframes, shadow internals, all
+keyboard actions and asynchronous effect reconstruction remain outside coverage.
+
+Remaining coverage includes controlled content capture,
+all browser convenience clipboard paths and a proven scoped
 credential-submission exception. Do not assume this feature is full page replay
 or blanket password-field authorization.

docs/requirements-audit.md

@@ -501,3 +501,66 @@ service-attributed native diagnostics tests passes 522 tests. The actual native
 browser proves diagnostic export stops on revocation; Windows build and packaged
 source/runtime verification pass. Production completeness
 and the broader original open requirements are not implied.
+
+## Foreground gesture evidence and reviewed agent history
+
+The browser now observes trusted foreground main-document clicks and
+gesture-associated submit events in a private isolated world. Signed evidence
+policy controls collection; sensitive forms, synthetic events and raw values
+are excluded. New server event/source validation accepts only matching observed
+click/submit facts. ECS explicitly reports an unknown outcome rather than claiming
+successful transmission. Bounded collection and coverage limitations are described
+in `docs/interaction-evidence.md`; this is not full replay or content capture.
+
+Actual native proof verifies seven protected records, seven audited analyst
+reveals, synthetic `click`/`dispatchEvent`/`requestSubmit` exclusion, password-form
+exclusion, independent reviewed disable and continued scanned download evidence.
+First failures identified the missing server event enum; subsequent trace checks
+identified shared flusher context attributing two queued records to one source.
+Both are fixed and negative/real-OTLP tests added. Each queued record now resumes
+its own validated trace parent. All three actual human events have 17 correlated
+spans each (`artifacts/human-interaction-trace-proof.json`). A visual DOM
+reinspection does not imply another document; true document, activation, policy,
+URL and native ownership changes still invalidate observation.
+
+The native admin workflow now verifies grant creation, separate review,
+self-approval refusal, auditor read-only controls, generation rotation and history
+restoration without discarding an unrelated draft. The history view warns that
+old credential generations cannot be resurrected and require a higher generation
+plus re-pairing. Screenshots were visually inspected; real backend OTLP parents
+verified (`artifacts/agent-grants-history-admin-proof.json`).
+
+The separately evidenced shutdown cleanup error is fixed using an immutable,
+non-enumerable native WebContents reference; destroyed views are removable and
+closing does not reactivate remaining tabs. This does not establish the cause of
+the earlier startup timeout. The current suite passes 546 tests. Production key
+custody, signed installer/update distribution, worker/session ownership, full
+secured agent capabilities, content capture, external customer integrations and
+independent assessment remain open. The full objective is not complete.
+
+Final Windows build and packaged-source/runtime verification pass, including
+the new observer, contained scanner, immutable upload leases, offline semantic
+inference and shipped protected agent clients. Syntax and actual native tab/DLP
+tests pass (`artifacts/human-windows-build.log`, `human-package-proof.log`,
+`human-final-syntax.log`, `human-native-tabs.log`). Authenticode is still
+`NotSigned`; an unpacked build is not a signed production installer.
+
+### Next priorities against the original requirements
+
+1. Complete controlled agent capabilities: history/session restoration, window
+   management, safe visual capture, vault/file operations and administrative
+   actions need dedicated scopes, principal ownership, central disable, DLP and
+   durable attribution. Do not supply a generic JavaScript/DevTools bypass.
+2. Support legitimate background workers in individual mode with provable native
+   ownership/session isolation; ownerless requests currently remain blocked.
+3. Prove legitimate credential submission without exempting arbitrary password
+   controls or bypassing inspection of other form fields and changed targets.
+4. Expand protected evidence to remaining interactions and controlled content
+   workflows with collection-gap visibility and purpose-bound analyst access.
+   Existing observed gestures do not establish full reconstruction.
+5. Verify streaming/ranged/native upload paths and main/network-service crash
+   semantics, then production enrollment/device key custody/rotation, signed
+   installer/update delivery and real customer SSO/ICAP/SIEM/HA integrations.
+   These require independent deployment evidence, not only mocked local tests.
+
+Mac/Linux/mobile remain explicitly deferred by the user's Windows-first scope.