Add inspected agent viewport export with policy-bound final release

AGENT-API.md

@@ -1,6 +1,6 @@
 # Local browser agents
 
-The administrator enables `policy.agents.enabled`, chooses action-name scopes, and optionally restricts `allowedHosts`. Empty hosts inherits browser destination policy. Each native tab has a stable UUID for its lifetime. Obtain these IDs with `sessions`; an omitted sessionId captures the foreground tab once and pins the operation to it. Closed IDs are invalid. Screenshot scope is reserved but no screenshot API is implemented.
+The administrator enables `policy.agents.enabled`, chooses action-name scopes, and optionally restricts `allowedHosts`. Empty hosts inherits browser destination policy. Each native tab has a stable UUID for its lifetime. Obtain these IDs with `sessions`; an omitted sessionId captures the foreground tab once and pins the operation to it. Closed IDs are invalid. The separately approved `screenshot` action exports an inspected foreground webpage viewport under the limits below.
 
 ## Windows pairing and CLI
 
@@ -40,6 +40,7 @@ Use `agent-transport-client.cjs` or the trusted Electron helper. The generated n
 | vault:list | optional sessionId | vault:list | vault:list | approved origins and one-use credential references |
 | vault:fill | sessionId, credentialRef | vault:fill | vault:fill | `{completed}`; does not authorize submission |
 | vault:prepare-submit | sessionId, credentialRef | vault:prepare-submit | vault:prepare-submit | `{completed,prepared}`; never submits the form |
+| screenshot | optional sessionId | screenshot | browser:screenshot | `{mime:"image/png",width,height,data}`; canonical bounded base64 PNG |
 | navigate | sessionId, url | navigate | browser:navigate | `{completed}` |
 | back | sessionId | back | browser:navigate | `{completed}` |
 | forward | sessionId | forward | browser:navigate | `{completed}` |
@@ -189,3 +190,41 @@ residual/duplicate/action/header refusals, human handoff and central revocation.
 The latest source increment's final native rerun, full suite and Windows package
 verification are pending; historical green builds do not prove this source state.
 See [controlled credential policy](docs/controlled-credential-policy.md).
+
+## Inspected foreground visual export
+
+`screenshot` starts unchecked in central policy and requires the scope in both the
+baseline and the individual grant. It accepts only an optional native session ID;
+omission pins the current foreground tab. It cannot target a background/loading
+page, full desktop, other windows or browser chrome. The supported HTTPS viewport
+reply contains exactly MIME, dimensions and canonical base64 PNG data. Limits are
+2 MiB, dimensions≤4096 and pixels≤8 Mi. There is no clip, resizing or full-page
+scroll mode. It never exposes CDP or arbitrary capture configuration.
+
+Mandatory local image/OCR complete coverage precedes export, together with enabled
+YARA/semantic checks and configured upload ICAP. Sensitive-read permission is no
+override. All credential/card/authentication-bearing controls are refused, even
+hidden/offscreen ones. Open shadow roots are observed recursively and pending
+mutation records drained; newly encountered roots advance the revision. Closed/
+declarative shadow roots and child frames are refused. Active media/animations
+remain a compatibility/security limitation; classifiers are not proof against
+rendered secrets or steganography.
+
+Privileged code keeps an opaque private release guard outside the API result.
+After audit, encryption and final authorization, it rechecks the original policy,
+frame/process/routing identity, loading state, context token, actor and foreground
+activation immediately before returning the encrypted reply. This applies to
+legacy and individual callers. The PNG is byte-bound through inspection; bounded
+PNG validation excludes arbitrary text/EXIF/profile chunks and allows only required
+image chunks plus the supported standard sRGB marker. No image/OCR payload enters
+ordinary audit or diagnostic fields. Buffers are wiped best effort; returned
+base64 strings and caller copies cannot be guaranteed erased from managed memory.
+
+The protected channel encrypts the reply on the wire; the trusted helper decrypts
+its result for the caller. Treat received pixels and stdout/request artifacts as
+sensitive. This scope does not authorize sending an image onward to a cloud model.
+See [agent visual export](docs/agent-visual-export.md) for native proof scope and
+current validation status. The current native late-policy, final foreground and open-shadow mutation/revert
+proof passes with all eight named visual phases and final request parentage.
+695 tests and syntax checks pass; current Windows build/package verification
+remain pending.