Add scoped human-unlocked vault agent autofill

docs/requirements-audit.md

@@ -609,3 +609,44 @@ Next control milestones are persistent session restoration and scoped vault/file
 operations; history inventory/navigation and the four bounded window operations
 are now implemented, rather than remaining wholly absent. The overall objective
 remains active and unachieved.
+
+## Controlled vault-agent capability increment
+
+Separately signed default-off status/list/fill scopes now extend the existing
+DPAPI/PQ agent interface. Inventory exports only approved inspected HTTPS origins
+and one-use references; username, label, record ID and password stay private.
+Human unlock is required. References bind exact actor, policy, native session,
+WebContents and internal vault generation. Lock/reopen and same-ID password
+changes invalidate them; metadata polling does not postpone idle locking.
+Shared inspection retains local/enterprise DLP and explicitly marks a missing
+required local inspector incomplete. See `docs/agent-vault-controls.md`.
+
+Actual native HTTPS field-fill proof covers separate actors, scoped inventory,
+reference replay, lock/reopen, password replacement, central autofill disable and
+targeted revocation with zero form submissions. Tab changes/policy updates lock
+the vault already; fixture corrections explicitly unlock through trusted UI rather
+than weakening enforcement. A separate unit test proves same-origin tab binding
+with the vault unlocked. Trace `fd47bcfc8b259712101ad3c81c1d95c1` contains inventory
+inspection; `51ce8d1d2bee33718b442197a044340b` contains visual/native fill phases with
+verified action parent correlation. Collector rejected writes were zero.
+
+Actual central UI verifies all three scopes unchecked initially, readonly auditor,
+independent publication and history restoration. All 149 completed API requests
+have correlated backend spans; two canceled GET requests remain separately
+reported. No mutation is treated as passed without completion/export evidence.
+The full suite passes 583 tests and syntax checks pass.
+
+This is not complete password-manager administration: no agent unlock/export or
+vault/file mutation, and inventory/reference pool is bounded at 32. Legitimate
+credential submission remains unverified and can still be blocked by normal DLP.
+Persistent sessions, safely inspected visual export, worker ownership and the
+previous production/external integration gates remain open. The overall goal is
+not complete.
+
+Final current Windows build and packaged-source/runtime verification pass,
+including the new vault broker and private generation, contained scanner,
+offline semantic engine, upload leases and both protected agent clients.
+The native tab/DLP/revocation proof passes. Logs:
+`artifacts/vault-agent-final-windows-build.log`, `vault-agent-final-package-proof.log`,
+`vault-agent-native-tabs.log`, `vault-agent-syntax.log`.
+The executable remains unsigned; no signed production installer is claimed.