Add policy-bound encrypted agent session restoration and audit traces

docs/agent-session-controls.md

@@ -0,0 +1,82 @@
+# Managed saved sessions for local agents
+
+Administrators separately opt into `sessions:save`, `sessions:list` and
+`sessions:restore` in the signed baseline and individual grant. All three controls
+start unchecked. These are separate from `sessions`, which inventories currently
+open native tabs. Existing pairing, expiry, generation, destination, feature and
+user-profile restrictions still apply. Saving browser tabs never preserves or
+reactivates agent authority.
+
+| Action | Purpose |
+| --- | --- |
+| `sessions:save` | Save selected native tab IDs as a named collection, optionally replacing an owned collection with its current revision. |
+| `sessions:list` | Inspect the current actor's approved saved collections and storage revision. |
+| `sessions:restore` with collection ID | Prepare a short-lived restoration plan without opening tabs. |
+| `sessions:restore` with returned plan ID | Consume the plan once and restore its approved destinations. |
+
+The local collection store accepts at most 16 collections and 32 tabs per
+collection. Its revision prevents stale replacement. Collection ownership binds
+to the enrolled device and verified actor; ownership includes the actor's credential generation. Rotation makes old-generation
+collections inaccessible; no implicit migration restores them. Collections belong to the local device, not a central cross-device
+sync service. Windows DPAPI encrypts the stored bytes before atomic replacement.
+Plaintext buffers are cleared. Corrupt files, hard links and unexpected file types
+fail closed.
+
+Only collection name, approved HTTP(S) URLs, titles, optional group metadata and
+active-tab index belong in a saved collection. No cookies, authentication tokens,
+passwords, form values, navigation history or serialized Chromium page state are
+accepted. Benign query strings and fragments are preserved. URL userinfo, recognized
+authentication paths, authentication query/fragment parameters and credential-shaped
+metadata are rejected rather than silently rewritten.
+Names, titles and URLs also pass current local/enterprise DLP before saving or
+exporting. Unavailable or incomplete inspection blocks the operation.
+
+Restoration plans expire after 60 seconds, are bounded, and are consumed before
+use. Policy changes, actor/generation changes, cancellation, changed storage
+revision and changed collections invalidate plans. Preparing and applying both
+check current destinations and classify saved metadata. The native implementation preserves existing tabs, applies current navigation
+enforcement to new tabs, and closes only the tabs created by a failed restoration.
+Closing failed restoration tabs cannot undo network requests already sent. Restoring URLs does not
+restore login sessions; a website may require normal authentication again.
+
+Do not retry a mutating action merely because its response or diagnostic export
+failed. Check current tabs and collections first. Security audit and OpenTelemetry
+are separate from saved collection contents; diagnostics should contain fixed
+operation names and timings, never saved URLs, titles or collection names.
+
+## Verification status
+
+The adapter and encrypted-store tests cover classification failures, one-use
+plans, policy/generation/revision changes, ciphertext alteration, ownership and
+structural bounds. Central admin controls are implemented and tested as explicit
+opt-in. The actual Windows/Electron admin fixture verified all three scopes in
+baseline and individual grants, separate-author review, self-approval denial,
+auditor read-only controls, rotation and policy-history restoration. Its 154
+completed API requests exported parent-correlated traces; three GET requests
+canceled during identity reload are recorded separately and no policy mutation
+failed (`artifacts/agent-grants-history-admin-proof.json`).
+
+The actual browser fixture runs two Windows/Electron processes against the same
+enrolled device and local profile. It saves two tabs with benign query strings,
+fragments and group metadata, then verifies encrypted storage survives restart.
+Private decryption inside the isolated fixture checks exact metadata keys without
+printing plaintext. Edited password/form values and renderer history state are
+absent; restored pages receive their fresh server defaults. Existing tabs remain
+and restored groups are verified. Cross-actor plan use, replay and stale revision
+are denied. After signed central disable, host restriction and targeted revocation
+reach the browser, a refused commit sends no additional navigation request.
+Legitimate policy-triggered page reloads are outside that post-policy measurement.
+
+A controlled delayed HTTPS receiver also proves an actual away-and-back activation
+race: the first restored tab begins navigation, the trusted UI activates an
+original tab and then the new tab, and restoration fails. Only newly created tabs
+are removed, existing tabs survive, and the second saved destination is never
+requested. The first already-started request cannot be undone. Actual trace
+`583a1d4dbc80fb2cbcb135b1622a4993` records native work (1410.0137 ms), rollback
+(0.7242 ms) and the failed restoration (1412.796 ms).
+
+Actual exported save/list/restore traces contain correlated named inspection,
+storage, preflight and native stages, plus all five audit serialization/encryption/
+write/fsync/commit stages beneath their audit parent. Proof is in
+`artifacts/session-agent-controls-native-proof.json`. These proofs do not establish
+production key custody, cross-device session sync or a complete browser backup.

docs/development-observability.md

@@ -108,3 +108,34 @@ distinct parents and complete evidence phase correlation. Trace
 `62e09413b9a42f4a58bd7f99485176ac` and
 `545ddac025113e50effed4e9a2ac87ee` each also have 17 spans. Collector rejected writes
 were zero. These are local reproduction timings, not throughput guarantees.
+
+On 2026-10-13, the running protected collector and the actual exported trace
+`fd47bcfc8b259712101ad3c81c1d95c1` were inspected again. The request took
+724.3133 ms, its first audit phase 682.6577 ms, and dispatch 2.0827 ms.
+Its correlated audit delivery took 52.7383 ms. The audit phase alone does not
+establish whether serialization, DPAPI, filesystem synchronization or scheduling
+caused the delay. New synchronous persistence spans separate `audit.serialize`,
+`audit.encrypt`, `audit.write`, `audit.fsync` and `audit.commit`, without changing
+the synchronous persistence boundary or retrying a write. Only fixed operation
+identifiers and timings enter diagnostic attributes; no audit payload or paths.
+Previously collected traces cannot supply these newly added stages.
+
+The subsequent actual Electron vault fixture passed with the added stages.
+Trace `e98cac3e18c6bd7b0e0442f033a7fa2d` exports all five persistence
+children under `agent.audit`: serialization 0.0544 ms, encryption 0.0501 ms,
+write 7.2461 ms, fsync 2.3703 ms and close/rename 14.7423 ms. These timings
+describe this new run; they do not resolve the previous 683 ms observation.
+The five-stage parentage was checked against the live collector for both list
+and fill requests, with zero rejected writes. Twelve existing diagnostics tests
+and four dedicated real OTLP tests pass, including central disable, secret
+redaction, synchronous return/throw preservation and no replay on instrumentation
+failure. At that stage, session adapter exports were proven in a fixture;
+native browser restoration required the subsequent integration proof below.
+
+The actual two-process Windows session proof now exports save/list/restore stages
+and their audit persistence children. A delayed HTTPS receiver also verifies
+that manually switching away and back aborts restoration, preserves existing tabs
+and never requests the second saved destination. Trace
+`583a1d4dbc80fb2cbcb135b1622a4993` records the failed native stage at 1410.0137 ms
+and owned-tab rollback at 0.7242 ms. The delay was intentional fixture behavior;
+it is not a production performance result. Collector rejected writes were zero.

docs/requirements-audit.md

@@ -1,5 +1,20 @@
 # S Browser: Anforderungsabgleich und offene Arbeit
 
+## Aktuelle nächste Abnahmen
+
+Die gespeicherte Agent-Sitzung ist inzwischen nativ integriert; die detaillierten
+Nachweise stehen in `docs/agent-session-controls.md`. Der volle Produktumfang bleibt
+offen. Als nächste Implementierungsarbeiten gelten sicher geprüfter visueller
+Agent-Export, legitime kontrollierte Credential-Übertragung und nachvollziehbare
+Ownership für Hintergrund-Worker. Danach folgen breitere lokale Medienprüfung und
+Analysten-Evidence-Flows. Jede neue Freigabe braucht aktuelle Policy-/Identitäts-
+Prüfungen sowie einen echten Receiver-/Browser-Nachweis und korrelierte Traces.
+
+Produktionsabnahmen bleiben separat: signierter Installer/Updatekanal, unabhängige
+Sicherheitsprüfung, Geräteschlüssel/Enrollment-Vertrauen und Rotation, getestete
+Wiederherstellung/HA sowie tatsächliche Kunden-IdP-, ICAP-/SIEM-/Netzwerkintegrationen.
+Mock- und lokale Fixtures schließen diese externen Gates nicht.
+
 
 
 Stand: 2026-10-13. Diese Prüfung vergleicht die Anforderungen aus dem Chat mit vorhandenem Quellcode und benannten Testfällen. Ein vorhandener Test ist ein begrenzter Nachweis für sein Szenario, kein Sicherheitszertifikat. Laufende Änderungen anderer Agenten müssen nach Integration erneut geprüft werden.
@@ -64,7 +79,8 @@ Windows zuerst: einen zentral verwalteten Browser mit lokaler Inhaltsprüfung, f
 
 | KI als First Class, kontrolliertes Gateway | Teilweise | `apps/server/app.mjs`, `inspection.mjs`, Browser-AI-UI, `tests/enterprise-gateway.test.mjs`: freigegebene lokale Ollama/kompatible Provider, serverseitige Credentials, Prompt-/Outputprüfung. Kein vollständiges Berechtigungs-RAG, Modellinventar, Provider-Tenantnachweis oder umfassendes KI-Tool-Autorisierungsmodell. |
 
-| Lokale Agenten steuern Sessions | Umgesetzt für begrenzte kryptografisch geschützte API | `apps/browser/agent-control.cjs`, `tests/agent-control.test.mjs`, `tests/agent-adapters.test.mjs`, `scripts/agent-client.cjs`: Loopback, DPAPI-Pairing, zentrale Scopes und feste Aktionen; ML-KEM-1024/AES-256-GCM, gepinnte Ed25519/ML-DSA-87-Challenge, HMAC-SHA384-Requestbindung und Replay-Abwehr. Kein freies JS/CDP, Passwort-/Cookieexport. Stabile native Tab-UUIDs, Kontextbindung sowie explizite App-/Einstellungs-/Bookmark-/Tab-Rechte sind ergänzt und mit echtem CLI geprüft. Freigaben bleiben zentral begrenzt. Inspect/Scroll und tabgebundene Seitenaktionen sind ergänzt; sieben Agent-Phasen mit 124 tatsächlich exportierten Timing-Spans in `artifacts/agent-pq-trace-proof.json`. Vollständige UI-/History-/Screenshot-/Formularsteuerung und individuelle delegierte Agent-Identitäten bleiben offen. |
+| Lokale Agenten steuern Sessions | Teilweise; geschützte unterstützte Aktionen geprüft | Individuelle zentral genehmigte Identitäten, Generation/Expiry, Zielhostbindung, DPAPI-Pairing, ML-KEM-1024/AES-GCM und gepinnte Ed25519/ML-DSA-87-Challenges, HMAC/Replay-Abwehr. Native Tab-UUIDs, Seiteninteraktion, Inspektion, Bookmarks, Appearance, gruppierte Tabs, geprüfte History-Navigation und begrenzte Fenstersteuerung sowie menschenentsperrtes Vault-Autofill implementiert. `docs/individual-agent-grants.md`, `docs/agent-history-window.md`, `docs/agent-vault-controls.md`, jeweilige echte Native-Proofs. Sichere Screenshots, Datei-/Vault-Mutationen, umfassende Widgets und attribuierte Worker-Steuerung bleiben offen; keine freie JS/CDP- oder Credential-Export-API. |
+| Verschlüsselte gespeicherte Sitzungen | Native Integration und finales Windows-Paket geprüft | `session-snapshot.cjs`, `agent-session-adapters.cjs`, `session-restore.cjs`, `docs/agent-session-controls.md`: benannte lokale URL/Titel/Gruppen-Sammlungen, Gerät/Principal/Generation-Bindung, DLP vor Save/List/Restore, CAS und einmalige Restore-Pläne. Echter Zwei-Prozess-Windows-Proof mit erhaltenen bestehenden Tabs; keine Formulare, Passwörter oder pageState. Kein Cross-Device-Sync oder vollständiges Session-Backup. |
 
 | Passwortmanager mit Post-Quantum-Kryptografie | Teilweise | `apps/browser/vault.cjs`, `password-fill.cjs`, `tests/vault.test.mjs`, `tests/password-fill.test.mjs`: ML-KEM-1024/AES-GCM/scrypt und Windows-DPAPI, Idle-/Blur-Lock, gebundene HTTPS-Formfüllung. Kein Sync/Recovery/Passkeys, keine unabhängige Kryptografieprüfung oder FIPS-Modulvalidierung. |
 
@@ -650,3 +666,12 @@ The native tab/DLP/revocation proof passes. Logs:
 `artifacts/vault-agent-final-windows-build.log`, `vault-agent-final-package-proof.log`,
 `vault-agent-native-tabs.log`, `vault-agent-syntax.log`.
 The executable remains unsigned; no signed production installer is claimed.
+
+
+## Gespeicherte Agent-Sitzungen und Debug-Stufen, verifizierter Stand
+
+624 Tests bestehen. Der echte Zwei-Prozess-Windows/Electron-Test speichert lokale DPAPI-geschuetzte Sammlungen, prueft Metadaten privat nach Entschluesselung und stellt URLs/Titel/Gruppen als neue verwaltete Tabs wieder her. Formular-, Passwort- und Chromium-pageState-Werte werden nicht gespeichert. Ein verzoegertes HTTPS-Ziel prueft den manuellen Tabwechsel weg und zurueck: Abbruch, nur eigene Tabs geschlossen, kein zweites gespeichertes Ziel gesendet. Dies beweist keinen Rueckruf bereits gesendeter Requests.
+
+Die zentrale Admin-UI verifiziert separate standardmaessig ausgeschaltete Rechte, unabhaengige Freigabe, Auditor-Read-only und Policy-History-Restore. 154 abgeschlossene API-Requests exportierten korrelierte Traces; drei abgebrochene GETs sind getrennt dokumentiert. Save/List/Restore und Audit-Serialisierung/Verschluesselung/Write/fsync/Commit exportieren benannte echte OTLP-Stufen. Die fruehere 683-ms-Audit-Beobachtung bleibt ursachenseitig ungeklaert; neue Traces ersetzen keine fehlende historische Messung.
+
+Finaler stabiler Windows-Build und exakter Paketvergleich bestehen: artifacts/session-release-windows-build.log und artifacts/session-final-package-proof.log. Der erste Build wurde wegen geaenderter Quellen verworfen; nur der finale stabile Build gilt. Das Executable ist weiterhin NotSigned. Native Proofs: artifacts/session-agent-controls-native-proof.json und artifacts/agent-grants-history-admin-proof.json. Vollstaendige Produkt-/Produktionsabnahme bleibt offen.