Capture guarded human gestures and verify agent administration

docs/requirements-audit.md

@@ -501,3 +501,66 @@ service-attributed native diagnostics tests passes 522 tests. The actual native
 browser proves diagnostic export stops on revocation; Windows build and packaged
 source/runtime verification pass. Production completeness
 and the broader original open requirements are not implied.
+
+## Foreground gesture evidence and reviewed agent history
+
+The browser now observes trusted foreground main-document clicks and
+gesture-associated submit events in a private isolated world. Signed evidence
+policy controls collection; sensitive forms, synthetic events and raw values
+are excluded. New server event/source validation accepts only matching observed
+click/submit facts. ECS explicitly reports an unknown outcome rather than claiming
+successful transmission. Bounded collection and coverage limitations are described
+in `docs/interaction-evidence.md`; this is not full replay or content capture.
+
+Actual native proof verifies seven protected records, seven audited analyst
+reveals, synthetic `click`/`dispatchEvent`/`requestSubmit` exclusion, password-form
+exclusion, independent reviewed disable and continued scanned download evidence.
+First failures identified the missing server event enum; subsequent trace checks
+identified shared flusher context attributing two queued records to one source.
+Both are fixed and negative/real-OTLP tests added. Each queued record now resumes
+its own validated trace parent. All three actual human events have 17 correlated
+spans each (`artifacts/human-interaction-trace-proof.json`). A visual DOM
+reinspection does not imply another document; true document, activation, policy,
+URL and native ownership changes still invalidate observation.
+
+The native admin workflow now verifies grant creation, separate review,
+self-approval refusal, auditor read-only controls, generation rotation and history
+restoration without discarding an unrelated draft. The history view warns that
+old credential generations cannot be resurrected and require a higher generation
+plus re-pairing. Screenshots were visually inspected; real backend OTLP parents
+verified (`artifacts/agent-grants-history-admin-proof.json`).
+
+The separately evidenced shutdown cleanup error is fixed using an immutable,
+non-enumerable native WebContents reference; destroyed views are removable and
+closing does not reactivate remaining tabs. This does not establish the cause of
+the earlier startup timeout. The current suite passes 546 tests. Production key
+custody, signed installer/update distribution, worker/session ownership, full
+secured agent capabilities, content capture, external customer integrations and
+independent assessment remain open. The full objective is not complete.
+
+Final Windows build and packaged-source/runtime verification pass, including
+the new observer, contained scanner, immutable upload leases, offline semantic
+inference and shipped protected agent clients. Syntax and actual native tab/DLP
+tests pass (`artifacts/human-windows-build.log`, `human-package-proof.log`,
+`human-final-syntax.log`, `human-native-tabs.log`). Authenticode is still
+`NotSigned`; an unpacked build is not a signed production installer.
+
+### Next priorities against the original requirements
+
+1. Complete controlled agent capabilities: history/session restoration, window
+   management, safe visual capture, vault/file operations and administrative
+   actions need dedicated scopes, principal ownership, central disable, DLP and
+   durable attribution. Do not supply a generic JavaScript/DevTools bypass.
+2. Support legitimate background workers in individual mode with provable native
+   ownership/session isolation; ownerless requests currently remain blocked.
+3. Prove legitimate credential submission without exempting arbitrary password
+   controls or bypassing inspection of other form fields and changed targets.
+4. Expand protected evidence to remaining interactions and controlled content
+   workflows with collection-gap visibility and purpose-bound analyst access.
+   Existing observed gestures do not establish full reconstruction.
+5. Verify streaming/ranged/native upload paths and main/network-service crash
+   semantics, then production enrollment/device key custody/rotation, signed
+   installer/update delivery and real customer SSO/ICAP/SIEM/HA integrations.
+   These require independent deployment evidence, not only mocked local tests.
+
+Mac/Linux/mobile remain explicitly deferred by the user's Windows-first scope.