Add policy-bound credential submission and native DLP audit proofs

AGENT-API.md

@@ -36,6 +36,10 @@ Use `agent-transport-client.cjs` or the trusted Electron helper. The generated n
 | sessions:save | name, sessionIds, optional id and expectedRevision | sessions:save | sessions:save | owned collection ID, revision, tabCount |
 | sessions:list | none | sessions:list | sessions:list | revision and DLP-inspected owned collections |
 | sessions:restore | id OR planId | sessions:restore | sessions:restore | one-use plan, then restored native tab IDs |
+| vault:status | optional sessionId | vault:status | vault:status | bounded exists/locked/enabled/autofill flags |
+| vault:list | optional sessionId | vault:list | vault:list | approved origins and one-use credential references |
+| vault:fill | sessionId, credentialRef | vault:fill | vault:fill | `{completed}`; does not authorize submission |
+| vault:prepare-submit | sessionId, credentialRef | vault:prepare-submit | vault:prepare-submit | `{completed,prepared}`; never submits the form |
 | navigate | sessionId, url | navigate | browser:navigate | `{completed}` |
 | back | sessionId | back | browser:navigate | `{completed}` |
 | forward | sessionId | forward | browser:navigate | `{completed}` |
@@ -74,7 +78,7 @@ Inventory works on the start page. Read and AI can target an explicitly identifi
 
 Prefer `persistCredential({address,token,edPublic,pqPublic,protocol})` backed by protected trusted storage; Windows integration uses DPAPI. Plaintext `credentialFile` persistence is rejected; use the protected persistence callback. Never accept callback/path configuration from pages. Audit contains action/scope/session/outcome metadata, not raw content. Audit failure prevents API adapter execution. Optional trusted `onError` reports static allowlisted reasons only. `revoke()` permanently disables the instance; `close()` shuts it down. Node deadlines cannot forcibly stop adapters that ignore cancellation.
 
-Debug spans separately measure challenge, decryption, authorization, audit, dispatch, projection and encryption. Separate named per-agent identities and individual delegated revocation remain open; current pairing trusts processes of the paired Windows user.
+Debug spans separately measure challenge, decryption, authorization, audit, dispatch, projection and encryption. Individually signed grants, generation rotation and targeted revocation are implemented below; protected pairing still trusts processes of the paired Windows user.
 
 `select` and `check` are separate opt-in policy scopes and require a visible interactive foreground tab. Selection chooses one existing enabled option; sensitive/hidden options or groups are excluded. Checkbox control is idempotent, uses page interaction semantics and verifies the requested state after handlers. Duplicate selectors, unknown options, radio inputs and credential targets are denied. Inspect exposes up to 20 safe options per select and checkbox states; option values longer than 128 characters are omitted instead of truncated. All returned metadata passes the existing DLP gate.
 
@@ -92,8 +96,8 @@ failure audit phases now have explicit recording spans and trace correlation.
 ECS preserves these fields under `safetynet.agent`; CEF uses bounded standard
 custom-string fields without overwriting trace or audit-integrity references.
 Legacy events without this object remain readable; they are not retroactively
-attributed. Individual credential identities and targeted revocation remain
-planned in [individual-agent-identities.md](docs/individual-agent-identities.md).
+attributed. Individual credential identities and targeted revocation are implemented in
+[individual agent administration](docs/individual-agent-grants.md).
 
 
 ## Individually managed local identities
@@ -143,3 +147,45 @@ guarded native tab owner, including unattributed service-worker/background traff
 This containment remains after human navigation clears an agent tab restriction.
 Supporting such traffic requires reliable actor ownership or isolated sessions;
 that compatibility work is open and is not satisfied by inferring the active tab.
+
+## Controlled credential preparation
+
+All vault scopes require explicit central permission. Unlock the vault through the
+trusted human UI, then obtain a fresh `vault:list` reference for the exact native
+login tab. `vault:fill` fills only. The separate `vault:prepare-submit` consumes its
+reference, fills the approved form and issues a single-use local allowance; its
+reply contains only completion/preparation booleans. Neither action submits the
+form, unlocks the vault or exports username/password values. A later explicit
+website submission still needs normal interaction permission and network checks.
+
+An administrator must additionally enable
+`passwordManager.controlledSubmission` and approve exact canonical HTTPS action
+URLs plus distinct username/password field names. The current allowance expires
+after 15 seconds and covers one bounded native main-frame, same-origin POST using
+`application/x-www-form-urlencoded` (64 KiB, at most 128 distinct fields).
+Exact credential values, document/frame, actor/generation, foreground activation,
+policy and vault state are checked again. Other fields, request destination and
+headers retain mandatory inspection. A mismatched candidate consumes permission;
+never retry automatically. JS fetch/XHR, JSON, multipart and arbitrary login
+protocols are outside this allowance. A 302-style GET receives ordinary inspection;
+307/308 credential-body replay is blocked.
+
+The approved website receives credentials in its DOM, where its JavaScript can
+read them. The lease is a narrow network authorization mechanism, not password
+isolation, form attestation or a guarantee against phishing. Website authentication
+success is not returned by preparation or inferred from HTTP completion.
+
+Security audit separates prepared, authorized, denied, HTTP-completed and
+transaction-failure events. Authorization does not prove transmission; completion
+means the native HTTP transaction finished, including error responses. Ordinary
+metadata excludes credential values, form IDs, hosts, action URLs and body hashes.
+Protected debug spans name `credential.issue`, `credential.claim`,
+`credential.headers`, `credential.authorize`, `credential.redirect`,
+`credential.complete` and `credential.failure`, with correlated inspection/audit
+phases. Diagnostics remain centrally disableable and are not durable security audit.
+
+The isolated native fixture has exercised approved delivery, safe 302, blocked307,
+residual/duplicate/action/header refusals, human handoff and central revocation.
+The latest source increment's final native rerun, full suite and Windows package
+verification are pending; historical green builds do not prove this source state.
+See [controlled credential policy](docs/controlled-credential-policy.md).