Implement managed browser security, individual agents and observability

docs/agent-observability-requirements.md

@@ -8,9 +8,9 @@ and overriding a centrally locked setting are not alternate control paths.
 
 Agent authentication must support cryptographic client identity, narrowly scoped
 revocable credentials, bounded requests, replay protection and attributable audit.
-Current loopback capability tokens and Windows DPAPI are a foundation; delegated
-per-agent identities, request proof of possession and individual revocation remain
-required work. Full UI automation, history/library, safe screenshots and broader
+The local transport now uses DPAPI pairing, HMAC proof of possession, replay
+protection and pinned signed post-quantum encrypted requests/replies. Delegated
+per-agent identities and individual revocation remain required work. Full UI automation, history/library, safe screenshots and broader
 application capabilities remain separately tracked from the implemented controls.
 
 Security analysts need enough detail to reconstruct what happened: navigation,

docs/ai-browser-control.md

@@ -0,0 +1,41 @@
+# AI browser control
+
+Central `agents.enabled` controls the entire local interface. Actions also require
+individual policy scopes and approved destinations; changes and expiry are checked
+again around asynchronous work. Revocation aborts active requests and stops access.
+
+Implemented application controls: list sessions, open/activate/close/group tabs,
+navigate, read approved visible content, inspect non-sensitive form values and
+selectors, scroll, click, type, use the approved AI gateway, read/change permitted
+appearance settings, organize personal bookmarks, and propose/apply AI library
+organization when separately enabled. Company bookmarks and locked settings retain
+their central restrictions. `inspect` and `scroll` are opt-in scopes.
+
+Use the trusted local Electron helper with an absolute DPAPI pairing file and a
+JSON action file:
+
+```powershell
+npx electron scripts/agent-client.cjs --connection C:/path/agent-connection.json --request C:/path/action.json
+```
+
+Example action:
+
+```json
+{"action":"inspect","args":{"sessionId":"managed-session-id"}}
+```
+
+The helper unwraps the pairing capability through Windows DPAPI. The local channel
+uses pinned Ed25519 and ML-DSA-87 identities, ML-KEM-1024 key establishment and
+AES-256-GCM request/reply protection, with one-use challenges and HMAC-SHA384 proofs bound to the exact body, route, timestamp and nonce. The capability token is never sent on the wire. Plaintext action
+requests and successful plaintext replies are rejected. Never copy pairing secrets
+into chat, source files or ordinary logs. Restart/revoke requires fresh pairing.
+
+OpenTelemetry measures authorization, audit, action dispatch, result projection and
+encryption separately in debug mode. Durable security events remain distinct from
+operational traces. Administrators independently control diagnostics and SIEM
+export; ECS/CEF forwarding can be stopped centrally without deleting queued audit.
+
+This remains under heavy development. A shared local capability is not yet a full
+per-agent identity/consent system. History, safe screenshots, frame-aware controls,
+select menus and other richer interactions need additional typed actions and tests.
+Arbitrary JavaScript, cookies and secret extraction are not control APIs.

docs/audit-integrity.md

@@ -0,0 +1,24 @@
+# Security audit integrity
+
+Security events and their SHA-256 chain records are committed in the same SQLite savepoint. Sigma child events are covered too. The event digest covers the exact stored event ID, timestamp, device, kind and metadata string. The chain binds its installation identity, sequence and preceding hash.
+
+By default the chain is unsigned. It detects inconsistent changes but cannot authenticate against someone able to rewrite the database. For authenticated records, configure `AUDIT_SIGNING_KEY_FILE` before creating the audit chain. This is an absolute path to an external ML-DSA-87 PKCS8 PEM private key, with owner-only permissions (Windows also permits SYSTEM and Administrators). Linked paths are rejected. Private signing material is never stored in SQLite. Missing or changed signing keys fail startup; automatic key rotation is not implemented. A nonempty unsigned chain cannot be silently upgraded: plan a separately archived deployment migration.
+
+Existing event rows at first migration become explicitly unverified legacy baselines. A signed baseline seal commits to that prefix without retroactively establishing its provenance. Existing corrupt chains fail startup rather than being reconstructed.
+
+## Analyst workflow
+
+The central Admin console offers an explicit **Verify stored audit records** action. It reports internal consistency, signature authentication and independent external anchoring separately. The console performs a local check; it does not claim an independent external anchor exists.
+
+Authenticated `audit.read` APIs:
+
+- `GET /api/admin/audit/integrity`: full local verification and limitations.
+- `GET /api/admin/audit/entries?after=0&limit=100`: reconstructable records including baseline and retention entries, public key, installation ID and current head. Sequence pagination is distinct from event-ID pagination. Maximum batch size is 1,000.
+
+ECS exports include the event entry envelope under `safetynet.audit`, excluding event contents. CEF carries the entry hash and sequence; use the proof API for signatures, baseline and deletion records. An independent receiver must archive those records plus a trusted public-key pin and accepted checkpoint (sequence/hash). Neither delivery success nor a database-held cursor establishes independent cryptographic anchoring. Full database rollback or removal of a valid suffix requires comparison with such externally retained checkpoints. A compromised signing process remains outside this guarantee.
+
+## Retention and operations
+
+Only exported, unreferenced events are eligible for existing deployment retention. Before removal, exact current event digests are checked and a chained authorization lists the specific IDs and hashes. Chain records and authorization events remain; event plaintext can be deleted without losing the verification linkage. Incident/evidence holds and replay deduplication continue to apply.
+
+Verification scans the chain synchronously and currently loads it into memory. Very large production installations need incremental verification, bounded jobs, independently durable checkpoint delivery and archive compaction. The retained proof chain is not yet compacted and grows over time. `audit.verify` is an OpenTelemetry stage with timing and outcome, without event content or signing material.

docs/automatic-download-evidence.md

@@ -0,0 +1,13 @@
+# Centrally managed download evidence
+
+Automatic collection is opt-in through signed `policy.evidence.enabled` and `policy.evidence.captureDownloads`, both off by default. Publishing an enabled policy requires the management service to have a separately protected `EVIDENCE_KEY_FILE`. The Admin console changes a draft through the normal signed publication and independent review workflow. Employees cannot override these controls.
+
+The native download gate captures terminal allow/block decisions only when complete inspected file facts and the original managed context are available. The protected payload contains source URL with user information, query and fragment removed, sanitized filename, actual SHA-256, byte count, MIME claim and verdict/rule. Recognizable credential paths/names are excluded. File bytes, extracted text and OS save path are not collected. Interrupted/oversized/unfetched downloads do not invent file hashes; scan-only or cancelled saves do not create terminal evidence.
+
+The source event UUID and protected payload share one DPAPI-encrypted audit-queue record. Queue updates use an exclusive temporary file, fsync and replacement. Delivery posts the ordinary event first, then evidence with that UUID. A failed evidence acknowledgement retains the pair for retry. The server treats identical replay as success and conflicting replay as an error, validates device ownership/source facts, and rechecks the fresh effective policy. Evidence never enters ordinary event metadata or SIEM exports.
+
+Global disablement or expiry purges pending evidence while retaining security events and aborts in-flight evidence requests. Temporary managed-context unavailability pauses delivery. Already accepted evidence remains available under its separate audited access/retention rules; switching collection off does not erase an investigation. A request accepted before disablement cannot be retrospectively retracted.
+
+Storage uses AES-256-GCM with authenticated record identity and an external owner-restricted key. Network upload now uses a dedicated application-layer PQ evidence channel over authenticated HTTPS (loopback HTTP is limited to development fixtures). It uses the pinned management signing identity, a distinct protocol domain, dual Ed25519/ML-DSA-87 challenge signatures, ephemeral ML-KEM-1024, HKDF-SHA384 and directional AES-256-GCM. Both the payload and its acknowledgement are encrypted. Device bearer authentication still depends on TLS; application encryption does not establish an individually signed device identity. The browser's DPAPI queue is scoped to the Windows user, not an isolated per-agent identity.
+
+This increment automates download metadata only. Native click coordinates, clipboard excerpts, content-bearing forensic capture, consent/retention rollout by user profile, protected evidence key rotation and archive deletion require further implementation and deployment review. It does not imply full forensic replay or complete Chromium coverage.

docs/company-branding.md

@@ -0,0 +1,32 @@
+# Company white label and start page
+
+Administrators configure the company name, color and PNG logo in the central
+console. Logo upload is decoded and re-encoded, bounded to 128 KiB and 1024 × 1024.
+SVG, remote image URLs and active content are not accepted. Publishing uses the
+existing signed versioned policy and independent review when configured.
+
+Branding appears on the browser start/new-tab page, sidebar, settings, enrollment,
+AI and password views; the native window title follows the company name. Website
+content remains unchanged. Remove the logo and publish to remove the custom artwork.
+Installer/executable branding remains the existing deployment build configuration;
+this policy changes the running browser UI without replacing the signed binary.
+
+Start page controls provide a heading, company message and optional RSS/Atom URL.
+News is centrally fetched, cached for one minute and refreshed by devices within
+five minutes or on policy changes. The shell displays at most 12 plain-text items
+and opens articles through normal managed navigation. Feed HTML and scripts are
+never inserted into the shell. Failures clear news without pausing browsing.
+
+Feeds require HTTPS on port 443, no embedded credentials, no redirects and bounded
+UTF-8 XML. Query parameters are supported. Do not put authentication tokens in feed
+URLs or policy. Private corporate feed hosts require exact deployment entries in
+`COMPANY_NEWS_ALLOWED_HOSTS` (comma separated). DNS addresses are validated and
+pinned per connection; loopback and mapped loopback destinations remain forbidden.
+Authenticated/SSO-only feeds need a future separately protected server credential
+integration; the current reader consumes feeds accessible to the management server.
+
+Policy fields: `brand.logoDataUrl` and `startPage.{title,subtitle,newsEnabled,feedUrl}`.
+News is obtained through the authenticated device route `/api/device/start-page/news`,
+bound to the effective policy version. The response contains title, HTTPS link and
+optional publication date, never raw XML. `startpage.news` exports timed backend
+OpenTelemetry spans without feed URL/body fields.

docs/development-collector-retention.md

@@ -0,0 +1,24 @@
+# Protected development collector retention
+
+The Windows development collector retains encrypted OTLP batches in bounded segments. This receiver is for debugging; its retention must never be used as the retention policy for security audit or forensic evidence.
+
+The AES-256-GCM envelope, `safetynet-debug-v1` associated data and DPAPI-bound key are unchanged. The collector directory grants access to the current Windows user and generated files inherit that restriction. No plaintext archive is created.
+
+By default the active segment is at most 50 MiB. The collector retains two generated rolling retired segments, each at most 50 MiB. Before an append, it checks the complete encoded line's byte length and rotates if necessary. An individually oversized batch is rejected with HTTP 507. Storage or retention failures also return 507; successful export counters advance only after the encrypted append is flushed.
+
+The first previous active archive is moved to `signals.legacy.encrypted.ndjson`. This segment is pinned and **never automatically deleted**, including after restart. Existing developer data therefore survives migration. The disk budget is the pinned legacy size plus 150 MiB of rolling data; normally this is at most 200 MiB. The pinned size can exceed 50 MiB if the older collector previously overshot its cap. Any manual disposal of the pinned segment requires a separately verified protected backup and an explicit operator decision.
+
+Generated rolling segments are named `signals.rolling.<timestamp>.<uuid>.encrypted.ndjson`; oldest generated segments are removed once retention is exceeded. Directory ancestors, entries and mutation targets are checked for symlinks, junction resolution, non-files and hardlinks. Unexpected entries make storage fail closed, rather than permitting deletion of an unrelated file. This protects accidental path substitution; an administrator or process already controlling the same Windows account remains outside this developer receiver's threat boundary.
+
+`/health` and `/api/summary` expose active (`storedBytes`/`activeBytes`), pinned (`legacyBytes`) and retired bytes, limits, rotations, dropped segment/byte counts and rejected writes. Request/signal counters and these operational counters start anew per process; retained files persist. Recent trace lookup remains a bounded in-memory view of this process and does not rehydrate retired batches.
+
+Optional development configuration:
+
+- `DEBUG_COLLECTOR_DIRECTORY`: isolated receiver directory, default `data/observability`.
+- `DEBUG_COLLECTOR_SEGMENT_BYTES`: per-segment limit, default 52428800; minimum 1024.
+- `DEBUG_COLLECTOR_RETIRED_SEGMENTS`: generated retired segment count, default 2; range 0–10.
+- `DEBUG_COLLECTOR_PORT`: loopback port, default 4318.
+
+The tests use a separate temporary owner-restricted Windows directory and alternate loopback port. They demonstrate real encrypted HTTP exports, rotation, retirement, preservation of the pinned archive, absent plaintext markers and HTTP 507 for oversized batches. They do not restart the live development collector.
+
+Diagnostic indexing is validated before encryption or append: nested signal arrays, span identifiers, unsigned 64-bit timestamp strings and nonnegative durations within JavaScript's exact integer range. Empty SDK batches are accepted. Invalid batches return HTTP 400 without changing files, export counters or recent spans. The actual HTTP test confirms these invariants, then verifies a valid span's measured duration through trace lookup.

docs/development-observability.md

@@ -0,0 +1,66 @@
+# Development observability
+
+Run `npm run debug:collector` and verify `http://127.0.0.1:4318/health`.
+Start the management service with `OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:4318`.
+Enable browser diagnostics through a normally published signed policy: `enabled: true`,
+`mode: debug`, endpoint above, and debug sampling of 1 for controlled reproduction.
+Administrators can disable diagnostics centrally; mandatory review still applies.
+
+Reproduce the feature, inspect `/api/summary` for slow stages and inspect
+`/api/trace/<traceId>` for parent/child timings. Browser management requests carry
+W3C trace context into backend HTTP spans. AI inspection, provider requests,
+response reading/decoding and library organization have separate backend stages.
+Use the native tabs smoke fixture to verify real Electron exports and correlation.
+
+The receiver listens only on numeric loopback, rejects foreign origins and hosts,
+and stores encrypted batches under ignored `data/observability`. AES-256-GCM keys
+are protected by Windows DPAPI. The summary contains bounded timing metadata;
+it is a local developer tool accessible to the same machine's users, not a
+production SIEM or an authenticated remote service. Recent trace lookup is held
+in memory and resets on restart. Each encrypted segment has a 50 MiB development
+limit. The collector retains an active segment and at most two generated retired
+segments, plus a separately pinned previous archive. Inspect `activeBytes`,
+`legacyBytes`, `retiredBytes` and `rejectedWrites`; investigate collection failures
+instead of assuming exports succeeded. See [retention](development-collector-retention.md).
+
+Ordinary traces never contain passwords, tokens, prompt bodies or document text.
+Security audit and restricted encrypted forensic evidence are separate pipelines.
+Debug mode now exports eight internal inspector stages: inspect, parse, OCR, OCR model initialization, YARA, macro extraction, semantic inference and semantic model initialization. The worker sends bounded in-memory timing records through its existing private pipe; it gains no network capability. Browser/backend import creates child spans with original timestamps under the active request trace. Invalid/off/stale metadata is discarded without changing the verdict. These named stages do not trace every function or native-model kernel. Add named stages when investigating further gaps, without weakening DLP or retrying protected actions.
+
+The repository's AGENTS.md requires this workflow for subsequent development.
+
+## Coverage verification, 2026-10-13
+
+The live collector reported 3,147 spans, 2,482 log records and 36 metric records,
+with zero rejected storage writes. Twenty focused diagnostics, OTLP export,
+inspector timing, collector validation/retention and failure-path tests passed.
+These counts are a process snapshot, not a completeness claim.
+
+Agent RPC instrumentation now wraps each request in `agent.request`; decrypt,
+authorization, audit, dispatch, projection and encryption run beneath that parent.
+The browser diagnostic operation allowlist accepts the new name. A real protected
+RPC test verifies asynchronous parent/child nesting without recording arguments
+or response content. The combined transport/diagnostics suite passes 38 tests;
+A subsequent actual Electron run verifies exported parent/child phases linked to an attributable durable agent event; Windows packaged verification remains a separate gate.
+
+The actual native agent audit proof links `browser.agent` to
+`browser.management` and `server.request` under trace
+`f8e35fd442e718995d9274c646fb8e08`. The native upload helper-failure proof links a
+recording `browser.upload.fault` span, its lease parent, two logs and the durable
+audit event under trace `e6d26d4edf738a7b4f6f562ab2112f5b`. Older traces may be in
+the protected pinned archive rather than the current in-memory index.
+
+A sampled slow `browser.parser` scan lasted 1,049 ms but contained only the outer
+span in the live index. Do not infer which parser or model stage caused that
+duration from an outer span alone: reproduce with signed debug mode enabled and
+verify the expected inspector children before attributing a performance issue.
+
+The current individual native proof links principal `reader-a` to
+trace `3a0c31cbf53d7808e39a91daf2aaa3d7`. Its request took 81.019 ms,
+the two durable audit phases totaled 77.598 ms and adapter dispatch took
+0.313 ms. This single local run points to audit persistence as the dominant
+stage; it is not a throughput benchmark. Preserve pre-execution durable audit
+when investigating latency. Do not optimize by removing an audit gate or retrying
+an action. The proof is in `artifacts/individual-agent-native-proof.json`.
+The final Windows package verifier checks current source and runs both shipped
+legacy and individual DPAPI/PQ clients successfully.

docs/evidence-pq-channel.md

@@ -0,0 +1,22 @@
+# Protected evidence upload channel
+
+Automatic browser evidence now uses a dedicated `safetynet-evidence-mlkem1024-mldsa87-v1` channel. It shares the enrollment-pinned management signing identity while separating its protocol version, HKDF domain, AES-GCM AAD and pending challenges from policy delivery. Existing policy wire format remains compatible.
+
+The browser verifies the signed device/expiry/KEM challenge using Ed25519 and ML-DSA-87, encapsulates an ephemeral ML-KEM-1024 secret, derives separate request/response AES-256-GCM keys with HKDF-SHA384, and encrypts the evidence object. The acknowledgement is encrypted and bound to the same challenge and random request ID. Unauthenticated status/body cannot become a delivery acknowledgement. Application plaintext is limited to 64 KiB plus envelope overhead; plaintext buffers and response keys are wiped on completion and failure.
+
+Routes (device authentication required):
+
+- `POST /api/device/channel/evidence/challenge` with an empty JSON object.
+- `POST /api/device/channel/evidence` with the KEM/AEAD envelope.
+
+Challenges expire after 60 seconds and are consumed before decryption, including invalid ciphertext submissions. Other devices cannot use or consume a device's pending challenge. The server rechecks current evidence policy at storage, verifies the source event and preserves exact-payload idempotency. Thus a lost acknowledgement can be retried with a fresh challenge without creating another evidence row.
+
+The automatic browser has no plaintext fallback. Production/required-PQ configurations reject `/api/device/evidence`. Legacy raw submission is limited to local development when the configured URL and actual socket are loopback and protected management is not required. Official startup binds development HTTP to loopback. Central collection disablement aborts pending evidence protocol requests and preserves ordinary audit events. Already accepted records retain their investigation access/retention rules.
+
+## Operational limits
+
+Authenticated HTTPS is still required for remote deployment. Device bearer tokens remain protected by TLS, not individually signed by a device PQ key. Server signing keys currently remain in the existing SQLite-backed management key store; external key custody, rotation and independently deployed initial pins need production hardening. `SAFETYNET_CHANNEL_SIGNATURE_KEY_FILE` and `SAFETYNET_REQUIRE_CHANNEL_PIN` provide the existing deployment pin controls. A compromised authorized server can decrypt evidence by design.
+
+Pending challenges are process-local. A restart discards them and clients obtain fresh challenges; existing stored evidence supports idempotent retry. Multiple management instances require request affinity or a suitable shared challenge service. Global authenticated rate limits and a 10,000-pending challenge ceiling bound the current service, but this is not a completed HA design.
+
+OpenTelemetry records `evidence.challenge`, `evidence.decrypt`, `evidence.store` and `evidence.encrypt` with timing/outcome under the HTTP request span. Evidence contents, ciphertexts, credentials and key material are not trace attributes.

docs/header-dlp.md

@@ -0,0 +1,47 @@
+# Outgoing header DLP
+
+The managed browser intercepts final outgoing HTTP headers in its privileged
+session `onBeforeSendHeaders` listener. This stage runs before HTTP data is sent,
+according to the [Electron WebRequest contract](https://www.electronjs.org/docs/latest/api/web-request#webrequestonbeforesendheadersfilter-listener).
+It supplements the existing URL, body, DNS and destination gates.
+Chromium may already have opened a TCP connection before this callback; the
+guarantee concerns release of HTTP data, not preventing a connection attempt.
+
+All fields are inspected, including custom headers, Cookie, Authorization,
+Proxy-Authorization and Referer. There is no credential-field exemption. Ordinary
+opaque session cookies, Basic credentials and JWT bearer strings remain usable
+unless they match a central rule. Recognizable `sk-` or GitHub API tokens match
+the existing generic secret detector even when used as direct API credentials;
+approved AI integrations should use the controlled gateway.
+
+The browser copies and validates at most 128 fields and 64 KiB, bounded further
+by the signed DLP byte limit. Invalid fields, inaccessible snapshots and scanner
+failures block. Each value is scanned separately for exact document fingerprints;
+joined values catch literals split across fields; the serialized complete snapshot
+is also inspected. Existing core percent decoding and phrase normalization apply.
+This is not a claim of decoding arbitrary compression, encryption or encodings.
+
+Signed-policy semantic and YARA inspection runs locally on the complete header
+snapshot when enabled. An enabled upload ICAP connector also inspects this snapshot,
+including credential fields: administrators must treat the configured company
+scanner as trusted infrastructure. Scanners require a complete allow result.
+Revocation, expiry, policy replacement, source navigation or the 40-second deadline
+prevent release. Chromium receives the exact frozen snapshot approved by the gate.
+Mutable byte buffers are wiped after inspection; JavaScript string copies are
+garbage-collected and cannot be reliably overwritten.
+
+Ordinary audit receives only the existing rule ID and destination hostname on
+block. `browser.request.headers` exports field count, byte count, timing and request
+type under a `browser.request` parent. Header values, names, token hashes and cookie
+contents are not added to security audit or diagnostic traces.
+The native deadline cancels exactly once and records the static
+`headers-inspection-timeout` reason. A late scanner approval cannot release the
+request, and a failed audit write cannot turn the cancellation into an allow.
+
+This covers the final header fields exposed by Electron for the managed session.
+For WebSockets, this stage inspects handshake headers only; it does not inspect
+subsequent frames. WebSockets remain disabled by the baseline policy, and a
+delegated exception does not establish full frame-level DLP coverage.
+It does not establish protection against arbitrary transformed covert channels,
+other OS applications or every network layer generated internally by Chromium.
+Native receiver tests must prove prohibited requests never reach their destination.

docs/immutable-upload-feasibility.md

@@ -1,6 +1,11 @@
 # Immutable native upload binding: Electron 44.7 feasibility
 
-This proof is **not a production upload implementation**. Existing managed browser file/data-pipe upload rejection must remain in place.
+The protocol-forwarding proof below is **not a production upload implementation**
+and its credential widening remains a blocker. A separate native-handle path is
+now implemented for ordinary Windows NTFS files; see
+[Windows file upload enforcement](windows-file-uploads.md). Unsupported data-pipe,
+range and streaming paths remain blocked. The earlier candidate/prototype sections
+below describe the experiments that preceded that implementation.
 
 Run `node scripts/immutable-upload-probe.cjs`. It launches a finite, hidden, CPU-rendered, sandboxed Electron fixture against a loopback HTTP receiver. No managed browser configuration, actual credentials, OS clipboard, or website code is changed. The fixture uses a real HTML file input populated through test-only native CDP, then submits Chromium-generated multipart FormData.
 
@@ -30,3 +35,40 @@ The anonymous-only fallback was not implemented. A deployable solution must pres
 - [Electron session.fetch documentation](https://www.electronjs.org/docs/latest/api/session#sesfetchinput-init): Chromium network stack, response limitations, custom-protocol bypass and continuing webRequest callbacks.
 
 This test concerns one in-memory multipart upload. It does not prove full DLP coverage for streaming, WebSockets, WebRTC, browser uploads, or downloads.
+
+## Windows file-handle alternative: actual native proof, 2026-10-13
+
+A separate sandboxed Electron 44.7.0 fixture now demonstrates a viable path for
+ordinary file-backed multipart uploads without forwarding or rewriting requests.
+It holds restrictive Win32 handles for all eight normal ancestor directories and
+the leaf file, reads the candidate scan bytes through that same held file handle,
+then lets the original Chromium request continue. The real receiver saw original
+file bytes; attempted overwrite, hardlink overwrite, leaf rename and parent rename
+were refused. Chromium's reader could coexist with the handles. Fetch
+`credentials: omit` remained anonymous and `include` retained its cookie. Both
+handle sets were released only after their corresponding native `onCompleted`
+events. Proof: `artifacts/upload-lock-native-proof.json`; reproducible ignored
+fixture: `artifacts/upload-lock-native.cjs` and `upload-lock-helper.py`.
+
+Separate Windows experiments verified that a pre-existing writable mapping causes
+restrictive lock acquisition to fail. A lock failure must block; the mapping can
+still mutate the underlying file. These observations use synthetic files on this
+Windows machine and are not a general filesystem or privileged-attacker guarantee.
+
+This is **not enabled in the product**. The fixture knows its synthetic paths and
+does not implement production reparse rejection or identity verification. The
+next gate must restrict eligibility to supported local fixed-volume files, retain
+the complete normal ancestor chain, verify final path/volume/file identity, and
+bound whole-file reads through the held handle. Whole-file inspection avoids
+trusting the exposed offset/length conversion for large ranges. It must inspect
+both each actual file and the other multipart segments, preserve request order,
+and keep handles until the matching native terminal event. Helper death, policy
+changes, cancellation, redirects, retries and uncertain lifecycle state require
+explicit safe handling before release of either handles or requests. Data pipes,
+streaming and other operating systems remain separate requirements.
+
+The existing public-API forwarding bridge remains unsuitable because of its
+credential widening. This proof advances ordinary Windows file binding through
+native operating-system handles while preserving the original network request.
+See [Microsoft CreateFileW](https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-createfilew)
+for the underlying access and sharing contract.

docs/individual-agent-grants.md

@@ -0,0 +1,27 @@
+# Individual local agent grants
+
+Configure **Security rules & agents → Individual agent identities** in the management console. This editor stores public authorization policy only. Tokens and private identity keys remain in the device's protected local pairing store.
+
+Existing installations default to `legacy` shared pairing for compatibility. Select `individual` to require separate local identities. A matching enabled and unexpired grant is mandatory; an empty grant capability list permits no actions. Each action remains limited by the browser baseline, user profile, device group, destination rules and DLP. Grant permissions cannot unlock hidden settings or grant management privileges.
+
+1. Add a grant. It begins disabled, expires in one day and has no capabilities.
+2. Choose its stable identifier, name, UTC expiry, allowed capabilities and optional additional destination allowlist.
+3. Enable the grant only after reviewing its scope.
+4. Review and publish through the normal signed policy approval workflow.
+5. Pair the matching identity locally once the published policy has reached the device.
+
+Published identifiers are read-only in the editor. To revoke one identity, disable its grant and publish. To invalidate its existing credentials while retaining its identifier, advance **Credential generation** and publish; local pairing must then be performed again. Neither action is immediate on an offline device: application is gated by signed policy receipt and expiry.
+
+The schema accepts at most 32 grants, requires unique identifiers and rejects private-key/token properties. Global agent disable and restrictive user profiles/device groups still disable all grants. Legacy mode and individual mode are explicit central choices; the editor does not issue credentials or bypass independent approval.
+
+Development proof: `artifacts/agent-grants-ui-proof.json` records an actual Electron admin workflow, unchanged server policy, read-only published identifiers, draft revocation/generation changes, auditor-denied controls and a real exported correlated backend request span. The screenshot is local and ignored. Production enrollment and per-identity transport behavior require their separate integration tests.
+
+The integrated native browser now proves selection/pairing of two distinct
+identities, targeted revoke with an unaffected peer, host/redirect blocking before
+transmission, and persisted generation rollback protection across restart.
+Unowned background-worker requests remain blocked in individual mode pending
+reliable ownership support. Actual exported agent request traces carry named child
+phases and link to attributable durable events. The package verifier runs the
+shipped individual client. A separate backend integration test exercises distinct
+reviewer publication and history restore; grant-specific native publication UI
+coverage remains an open acceptance gate.

docs/individual-agent-identities.md

@@ -0,0 +1,87 @@
+# Individual local agent identities: implementation contract
+
+Status: **implemented in source; native integration and Windows packaged-source/client checks pass; remaining acceptance gates are listed below**. This closes part of the individual agent identity/control gap recorded in [the requirements audit](requirements-audit.md). The current implementation and supported commands remain documented in [AGENT-API.md](../AGENT-API.md).
+
+## Original baseline that motivated this increment
+
+`apps/browser/agent-control.cjs` creates one random HMAC token per browser service instance. Every client shares that credential; challenges identify `local-agent`. The service checks signed global action scopes, browser destinations and current policy through `main.cjs`, but cannot distinguish individual callers. `agent-connection.json` stores the connection capability using Windows DPAPI CurrentUser. `agent-transport-client.cjs` verifies the browser's Ed25519/ML-DSA identity and uses ML-KEM/AES-GCM protected requests and authenticated response status.
+
+`packages/core/security.mjs` originally exposed only global enabled/scopes/allowedHosts/allowSensitiveRead settings. `apps/server/public/admin.js` reconstructs that object during draft serialization. Browser audit records action/outcome in `ruleId`; the strict event ingestion schema has no principal field. This describes the previous baseline. The current source includes signed grants, the admin editor, individual transport, structured attribution and the privileged browser integration; the acceptance gates below remain authoritative.
+
+## Permission and identity model
+
+Add a reviewed, centrally signed individual mode and a bounded array of grants. Each grant has a stable, unique identifier, display name, enabled state, absolute expiry, action-name scopes and allowed destination hosts. Identifiers use a strict bounded character set; names are presentation only. An empty individual scope list grants nothing. Host permissions intersect global agent and browser destination restrictions; an individual allowlist cannot override any denial. Existing sensitive-content and settings restrictions continue to apply.
+
+The effective authority is the intersection of current unexpired signed policy, global agent controls, matching enabled unexpired grant, current browser readiness, destination restrictions and the supported action adapter. Neither user input nor a pairing file can add scopes. Group and user-profile restrictions continue to reduce authority. Grant expiry must never exceed the enclosing policy's effective validity at execution time.
+
+Each locally issued credential carries its principal ID and an opaque credential generation. Its authentication secret stays exclusively in trusted local storage and the separately DPAPI-protected pairing descriptor. The management backend receives grant metadata, never local tokens or private pairing secrets. Stable principal IDs survive display-name changes; a generation changes on credential replacement so an old credential cannot become valid again accidentally.
+
+DPAPI protects a capability for the Windows user. It does **not** establish executable identity or protect against a compromised process running as that user. Separate grants distinguish possession of credentials; do not advertise executable-bound isolation without a separate verified mechanism.
+
+## Migration and bootstrap boundary
+
+In required individual mode, the existing shared full-permission endpoint and master pairing file must be disabled and removed from active use. Do not retain a compatibility credential that bypasses individual grants. A privileged bootstrap/master capability must not be able to mint arbitrary locally chosen identities or broaden centrally approved rights.
+
+Legacy mode, if retained for an explicit migration period, must be a separately reviewed central choice with clear UI/audit labeling. Switching into required individual mode must invalidate legacy proofs, challenges and running operations before exposing the new service. Missing grants, malformed configuration or unsupported client versions fail closed. Existing clients are not silently converted into a universal principal.
+
+Credential issuance is a trusted shell operation for an existing centrally approved grant, subject to the current policy. Never expose secrets to remote pages, ordinary renderer state, logs or management responses. Use atomic protected descriptor persistence and explicitly invalidate the previous generation before publishing a replacement. The existing trusted Agent connection control must select a named permitted grant rather than reveal a shared master path.
+
+## Exact request lifecycle
+
+1. Validate the bounded principal identifier and credential generation before authenticating the request. Bind the HMAC proof to route, principal, generation, timestamp, nonce and exact wire-body digest using a versioned unambiguous encoding.
+2. Apply per-principal and aggregate rate/capacity limits. Replay caches must not permit one principal to exhaust all peers without aggregate containment.
+3. Issue a fresh signed one-use challenge bound to that principal/generation and the browser service instance. The client verifies these bindings and the pinned browser identity before encrypting an action.
+4. At submission, check challenge ownership **before consumption**. Principal A must not consume B's challenge. Consume a correctly owned challenge before decrypting, including invalid ciphertext; replay is refused.
+5. Validate the action envelope, then re-evaluate current signed policy, grant generation, enabled state, expiry and action/destination authority immediately before adapter execution. Captured authorization alone is insufficient.
+6. Track the running operation against principal/generation. Reconciliation, revocation and expiry abort its signal. Existing adapter context checks must observe that signal before consequential side effects and before returning protected content.
+7. Recheck authority before releasing an encrypted response. Authenticate principal/generation and status in the response contract. A revoked caller receives no previously computed sensitive result.
+8. Clear cryptographic buffers, release challenge state and record bounded attribution. Diagnostic export failure must not retry a protected action or weaken authorization.
+
+Revocation cannot undo an already committed external action. Document this limit; test prevention before commit and suppression of results after revocation separately. Adapters that ignore cancellation cannot satisfy this contract.
+
+## Policy reconciliation and restart
+
+Every accepted signed policy refresh must reconcile all principals, including service-enabled policies. Removed, disabled, expired or narrowed grants invalidate pending challenges and abort affected running operations; global disable and policy expiry affect all principals. Do not rely solely on the current global service close condition. Schedule expiry checks independently of incoming requests and keep final execution/release checks as the authoritative boundary.
+
+Same-version policy equivocation remains rejected. Policy rollback must not resurrect credentials. Browser restart must explicitly reconcile surviving descriptors with the new service instance and current signed grants; stale descriptors cannot authenticate an old or unrelated listener. Specify whether credentials are reissued or securely recovered, and test the chosen behavior rather than leaving stale capabilities apparently active.
+
+## Central review and administration
+
+Provide grant creation, scope selection, host restrictions, expiry and targeted disable/revoke in the admin console. Edits remain drafts until the existing independent publication review completes. Show principal additions, removals, permission widening/narrowing and expiry changes in review/history restore. Stable published IDs are immutable; replacement uses a new ID or explicit credential generation workflow.
+
+Update all policy serializers, presets, group overlays and draft refresh paths to preserve grants. In particular, the current `p.agents = ...` reconstruction in `public/admin.js` must not silently drop them. Read-only roles cannot mutate grants. Actual UI tests must prove draft retention, explicit publication, reviewer visibility and targeted revocation without disabling unrelated agents.
+
+## Durable audit, SIEM and observability
+
+Add a strict structured agent attribution object to durable browser events and backend ingestion, with principal ID, credential generation, action and outcome. Preserve existing trace/span correlation and policy version. Use fixed bounded reasons for scope denial, expiry and revocation; never store tokens, proofs, plaintext action arguments, private keys or arbitrary exception text. Keep existing action semantics usable for forensic evidence matching rather than encoding the identity into `ruleId`.
+
+Propagate attribution to authorized event views and ECS/CEF exports using documented mappings. Legacy unattributed events stay explicitly legacy; do not invent a principal. Ensure denial, successful execution and targeted revocation are attributable. Operational spans should cover authentication, grant evaluation, challenge ownership, dispatch and reconciliation with safe bounded attributes and real parent/child correlation. Durable security audit remains distinct from debug telemetry.
+
+## Acceptance gates
+
+- Two real clients with different credentials can perform only their intersected rights; one cannot consume another's challenge, replay proofs or substitute identity/generation.
+- Expired, removed, disabled and replaced grants fail at authentication/execution/response boundaries. Targeted revocation aborts the affected adapter while an unrelated grant remains usable.
+- Global disable, policy expiry, user-profile denial, policy rollback and restart cannot resurrect authority or permit legacy bypass in required individual mode.
+- Invalid configuration and missing principal bindings fail closed. Bounded retries preserve existing action/CAS semantics and never repeat uncertain side effects.
+- DPAPI descriptors contain separate local credentials; wire, ordinary logs, SIEM and backend storage contain no secret material. Tests explicitly retain the same-user capability threat boundary.
+- Actual admin UI publication/review/history tests and native browser integration tests exercise the shipped path, not an isolated primitive.
+- Actual exported OTEL traces show the lifecycle and revocation timing, linked to attributable durable events. Windows packaged-source verification covers every new module and client protocol.
+
+Do not mark the feature complete until all of these gates are met in the integrated product. A disconnected token registry or schema addition is insufficient.
+
+## Current integrated evidence
+
+496 tests pass, including forged-authentication attribution, per-principal lifecycle,
+stored proposal authorization and native ownership gates. Two real Electron
+processes prove UI pairing, two actors, targeted revoke with unaffected peer,
+forbidden direct/redirect receivers seeing zero requests and a generation floor
+that survives restart. Real exported RPC phase spans share an `agent.request`
+parent and a durable principal audit event. The Windows package is built and
+verified against source, its contained parser/offline model, and both legacy and
+individual shipped agent helpers. Authenticode remains NotSigned.
+
+Unattributed worker HTTP requests are temporarily blocked in individual mode;
+full worker compatibility requires reliable ownership/session isolation. Expanded
+individual-grant central independent-review/history tests remain open, alongside
+other full-browser and production requirements. These results do not satisfy every
+acceptance gate in this contract or the complete product goal.

docs/library-ai.md

@@ -0,0 +1,17 @@
+# Centrally governed AI library organization
+
+AI organization is disabled by default. Administrators can enable `policy.library.aiSuggestionsEnabled` through the existing signed policy publication and independent review workflow. `aiAutoApplyEnabled` is a separate permission; automatic application also requires an approved local AI endpoint. The ordinary `policy.ai.enabled`, approved model/endpoint, policy expiry, library visibility and personal bookmark edit permissions remain authoritative.
+
+The service uses the same approved OpenAI-compatible or Ollama gateway as the browser AI workspace. Its input contains only personal bookmark/tab IDs, titles and hostnames. Paths, query strings, fragments, credentials, page contents and managed company bookmarks are not sent. Titles are untrusted model input. Input and output pass the existing local DLP, optional semantic/YARA and configured enterprise ICAP checks. Confidential-local exceptions retain the existing restrictions; credentials and malware cannot be exempted.
+
+`POST /api/device/library/propose` accepts `{policyVersion, bookmarkRevision, tabs, snapshotHash}` using an authenticated, active device credential. `snapshotHash` is SHA-256 of the normalized tab array produced by `librarySnapshotHash`. A model response must be a strict JSON object with `bookmarks: [{id, folder}]` and `tabs: [{id, group}]`. Every existing personal bookmark and supplied tab ID must appear exactly once. No new URLs, deleted items, commands or additional fields are accepted. Folder labels are limited to 80 characters and tab group labels to 40, without control characters.
+
+Proposals expire after five minutes and are held only in bounded service memory. No model prompt or answer is persisted. Audit records contain counts, policy generation, revision and application mode. Restarting the service invalidates pending proposals. One generation request can run per device, with at most three pending proposals per device and 1,000 pending/in-flight proposals globally.
+
+`POST /api/device/library/apply` accepts `{proposalId, policyVersion, expectedRevision, snapshotHash, mode}`. Mode is `manual` by default. Current policy permission, generation, exact personal bookmark revision, device ownership and snapshot binding are rechecked. Personal bookmark ordering and folder changes commit together in a SQLite transaction; company bookmarks are never mutated. The service returns a freshly signed bookmark snapshot and the tab grouping plan. A second application of the same proposal fails.
+
+The browser must hold a native tab mutation reservation and verify its current snapshot before applying a returned tab grouping plan. The server cannot independently attest browser tab state. The returned signed bookmark snapshot must be verified with the enrolled management key. Native tab and central bookmark storage are separate boundaries: an unexpected browser interruption after a central bookmark commit requires reconciliation, rather than claiming cross-process atomicity.
+
+The feature provides organization of existing personal bookmarks and browser tabs. It does not grant arbitrary JavaScript, CDP, secret export, policy bypass, model-generated navigation or modification of company bookmarks.
+
+Validation: `node --test tests/library.test.mjs` checks default disablement, strict output, metadata minimization, signed batch application, stale bindings, permission denial, protected metadata, managed IDs and immutable company bookmarks.

docs/office-macro-inspection.md

@@ -0,0 +1,33 @@
+# Office macro download inspection
+
+With central YARA enabled, `security.yara.scanOfficeMacros` defaults to true.
+The contained local scanner matches the same administrator rules against original
+bytes, unpacked VBA projects, contiguous OLE streams (including compiled data),
+and decompressed VBA source. It does not execute macros or retain source code.
+
+Admins can turn this additional extraction off independently of YARA. ICAP remains
+mandatory when enabled; all enabled scanners must approve the exact downloaded
+bytes before the browser offers to save them. A matching rule blocks the file.
+Benign VBA is not blocked simply because a macro exists. Archive, stream, module,
+code and runtime budgets bound parsing; failures do not become clean results.
+
+The default incoming document-DLP requirement remains conservative. Office rendered
+content is not completely classified. To allow incoming Office after malware
+inspection, an admin can explicitly disable `fileTransfers.download.requireDocumentDlp`
+in Download inspection and publish the policy. This affects incoming document DLP;
+upload checks remain enforced. At least one malware scanner is still required.
+Explicit no-antivirus mode continues to require complete document DLP.
+
+Supported local extraction targets ordinary VBA projects in OOXML and OLE. XLM,
+XLSB, encrypted/corrupt projects and embedded Office containers remain unsupported
+and block when extraction is enabled. Source matching cannot establish source/p-code
+equivalence or detect every obfuscated macro; ICAP/AV remains a complementary layer.
+
+A pinned benign XlsxWriter fixture verifies that a source-only YARA marker absent
+from original ZIP bytes blocks after extraction, while an unmatched benign project
+allows the malware gate. The same two outcomes are tested inside Windows AppContainer.
+Dependencies are four curated hash-pinned wheels in requirements-macros.lock.txt;
+optional p-code/XLM tools are not installed or invoked.
+
+Extraction follows [olevba's source extraction API](https://github.com/decalage2/oletools/blob/master/oletools/doc/olevba.md)
+and bounded [MS-OVBA compression](https://learn.microsoft.com/en-us/openspecs/office_file_formats/ms-ovba/ec1bc788-27de-47d9-8db4-6be2b5cff52b).

docs/protected-evidence-viewer.md

@@ -0,0 +1,36 @@
+# Protected incident evidence
+
+The incident console lists linked evidence metadata without decrypting content.
+Administrators and the dedicated analyst role can choose incident-response,
+investigation or compliance as an access purpose and explicitly reveal a record.
+`OIDC_ANALYST_GROUP` grants evidence read and incident triage without policy, device,
+SIEM or session administration. It remains a server-defined role, not a permission
+supplied by the browser. Operator membership takes precedence over analyst when
+both are configured; administrators retain full access.
+
+Plaintext uses textContent, never HTML, and is cleared after one minute, selection
+changes, refresh, permission/identity changes, logout and page hiding. Delayed
+responses cannot restore older content. Reveals are restricted to the available
+records shown for the selected incident and checked against source-event identity.
+Every successful plaintext response follows a durable purpose-bound access audit.
+
+Evidence is device-reported information, not an independent truth attestation.
+Incoming action, decision, host, file digest/size and supplied content digest are
+compared with available source facts. Legacy events without those facts cannot
+supply the same verification. Encryption authenticates the evidence row; a fully
+tamper-evident source audit chain remains a separate production requirement.
+
+Configure the external 32-byte `EVIDENCE_KEY_FILE` before enabling storage. On
+Windows, startup verifies owner and read/write ACLs and rejects shared key access;
+protect the file to the service identity, SYSTEM and Administrators. POSIX requires
+an owner-only file. No key is exposed through the console. Key rotation, external
+KMS/HSM custody and production backup/recovery remain deployment work.
+
+Tests exercise actual encrypted storage, RBAC, audit failure, mismatched facts,
+expiry/active incident hold and integrity failure. The genuine Electron console
+proof covers purpose-bound reveal, literal script text and clearing, while backend
+OpenTelemetry exports normalized metadata/discovery/reveal route timings.
+
+Automatic native browser capture and centrally signed collection rules remain
+open. This viewer completes the existing protected storage/API-to-analyst path;
+it does not yet collect every click or confidential clipboard fragment itself.

docs/request-audit-privacy.md

@@ -0,0 +1,11 @@
+# Outbound request audit privacy
+
+Generic request bodies may contain passwords, tokens and binary credential envelopes. SafetyNet audits their byte count and detected type under `request`, without a body hash. This applies even to binary and multipart bodies; merely detecting a binary type does not prove a payload is a safe independent file. DLP classification, YARA, local parsing and required ICAP run as before.
+
+Actual download files continue to use file facts with size, magic-byte detected type and SHA-256. These remain valuable for malware investigations. Generic upload request facts are deliberately separate from file evidence.
+
+Encrypted browser event queues from older versions are scrubbed before replay, preserving event identities and decisions. Central event ingestion accepts old upload file facts and normalizes them to hash-free request facts before storage. The strict request schema rejects hashes and arbitrary content. ECS/CEF exports suppress hashes from historical upload file facts while preserving byte counts and detected type. Legacy download hashes are unchanged.
+
+Previously committed central audit rows are immutable and are not rewritten by this migration. Their original hashes can remain visible to authorized reviewers in raw event views until normal approved retention applies. Previously delivered SIEM copies, backups and archives have their own retention. This change prevents future body-hash collection and further SIEM disclosure; it does not claim historical erasure.
+
+The current Electron upload boundary still blocks file/data-pipe paths whose scanned bytes cannot be bound to transmitted bytes. The metadata fix does not expand upload support or bypass that enforcement.

docs/requirements-audit.md

@@ -1,144 +1,479 @@
 # S Browser: Anforderungsabgleich und offene Arbeit
 
+
+
 Stand: 2026-10-13. Diese Prüfung vergleicht die Anforderungen aus dem Chat mit vorhandenem Quellcode und benannten Testfällen. Ein vorhandener Test ist ein begrenzter Nachweis für sein Szenario, kein Sicherheitszertifikat. Laufende Änderungen anderer Agenten müssen nach Integration erneut geprüft werden.
 
+
+
 ## Ziel
 
+
+
 Windows zuerst: einen zentral verwalteten Browser mit lokaler Inhaltsprüfung, freigegebenem KI-Zugang und einer verständlichen, abgesicherten Admin-Weboberfläche liefern. Vor einer Produktionsfreigabe müssen die unten genannten Sicherheits- und Betriebsgrenzen geschlossen oder ausdrücklich im erlaubten Produktumfang ausgeschlossen sein.
 
+
+
 ## Statusmatrix
 
+
+
 | Anforderung | Stand | Nachweis und verbleibende Grenze |
+
 |---|---|---|
+
 | Chromium/Electron, Windows-Build | Teilweise | `apps/browser/main.cjs`, `scripts/package.mjs`, `scripts/verify-package.mjs`; sandboxierter Electron-Browser und geprüftes unpacked Windows-Paket. Kein eigener Chromium-Fork mit umfassenden nativen DLP-Hooks; kein signierter Produktionsinstaller oder Updatekanal. |
+
 | Safari-artige Oberfläche, Light/Dark, Themes, kompakte/getrennte Tabs | Umgesetzt für Browser-Chrome | `apps/browser/index.html`, `style.css`, `renderer.js`, `scripts/ui-showcase.cjs`, `artifacts/sbrowser-ui-layout.json`. Websiteinhalte werden nicht umgestaltet. Echte native Tabs mit eigener DOM-/Scroll-/History-/Security-State-Verwaltung sind jetzt integriert; Tabwechsel lädt nicht neu. Tatsächliche DLP-/Revocation-Prüfung in `artifacts/native-tabs-proof.json`. Gemeinsame Unternehmens-Cookies bleiben absichtlich geteilt. |
-| White Label | Teilweise | Zentrale Marke/Farbe in `packages/core/policy.mjs`; Paketprodukt/App-ID in `scripts/package.mjs`. Eigene Icons, rechtliche Hinweise, signierte Kundendistribution und vollständige Asset-Themes fehlen. |
+
+| White Label und Firmenstartseite | Umgesetzt für laufende Browser-UI | Zentral signierte Firmenname/Farbe/PNG-Logo und Startseitenüberschrift/-mitteilung, authentisierter RSS-/Atom-News-Pfad, sichere serverseitige XML-Verarbeitung mit DNS-Pinning und expliziter Intranet-Freigabe. `docs/company-branding.md`, `tests/branding.test.mjs`, `tests/company-news.test.mjs`, `artifacts/company-branding-admin-proof.json` und `sbrowser-company-branding.png`. Websiteinhalte unverändert; authentisierte Feeds, kundenspezifische signierte Installer/Executable-Assets und rechtliche Hinweise bleiben offen. |
+
 | Zentrale Verwaltung und erzwungene/verborgene Einstellungen | Umgesetzt für unterstützte Einstellungen | `packages/core/managed-settings.mjs`, `apps/browser/managed-settings.cjs`, `main.cjs`, `tests/managed-settings.test.mjs`, `scripts/managed-settings-smoke.mjs`. Native IPC prüft Berechtigungen; UI-Verstecken ist nicht die Autorität. Lokale Administratoren/OS-Manipulation bleiben außerhalb dieser Garantie. |
+
 | Sichere Policy-Verteilung | Teilweise | `packages/core/policy-channel.cjs`, `apps/server/policy-channel.mjs`, `apps/browser/management-channel.cjs`, `tests/policy-channel.test.mjs`: ML-KEM-1024/AES-GCM und ML-DSA/Ed25519, Replay-/Versions-/Ablaufprüfung. HTTPS und unabhängiges initiales Pinning bleiben nötig. Kein HSM, Schlüsselrotation oder unabhängiges Kryptografieaudit; keine behauptete „doppelt quantensichere“ Zertifizierung. |
+
 | SSO | Teilweise | `apps/server/auth.mjs`, `tests/server.test.mjs`: OIDC-PKCE, Signatur/Issuer/Audience/Nonce, Admin-Gruppen. Mock-IdP getestet; echter Kunden-IdP noch nicht integriert. Drei serverseitige Managementrollen (Admin, Operator, Auditor) aus OIDC-Gruppen in `apps/server/admin-access.mjs`; kein direktes SAML/SCIM. Remote-Shared-Bootstrap-Token wird verweigert; Bootstrap nur HTTP-Loopback. |
+
 | Admin-Management-Oberfläche | Teilweise | `apps/server/public/index.html`, `admin.js`, `style.css`; funktionierende Enrollment-, Policy-, Integrations-, Teaching-, Bookmark- und Event-Formulare. `scripts/enterprise-admin-smoke.mjs`, `scripts/bookmarks-admin-smoke.mjs`. In dieser Iteration ergänzt: gruppierte Navigation, Fleet-/Auditfilter, Draft-/Änderungsprüfung, Dark/Light-Konsole, responsive Layouts und rollengerechte Aktionen. Tatsächliche Electron-DOM-/Screenshot-Proofs in `artifacts/enterprise-admin-proof.json` und `admin-console-*.png`. Gruppen-/Pilotverwaltung, effektive Vorschau, Versionsmeldungen und verpflichtende Zweitfreigabe sind inzwischen mit echten UI-Proofs ergänzt. Incident-Verwaltung mit Rollen, Verlauf, Zuständigkeit und Revisionsprüfung ist ergänzt und im echten UI geprüft. Einige Security-/Agentenfelder bleiben Advanced JSON; externe Tickets, automatische Fälle und vollständiger Daten-Lifecycle bleiben offen. |
+
 | Fleet, Gruppen, Rollout | Teilweise | Gerätebestand, widerrufbare Credentials, globale signierte Policy, per-Gerät Dokument-/Bookmark-Steuerung und serverseitige Rollen vorhanden. `policy-history.mjs` liefert Historie/Diff/Restore als neue Version. `policy-review.mjs` erzwingt bei aktiviertem Deploymentflag unterschiedliche Autor-/Prüferidentität für alle Veröffentlichungswege, einschließlich Teaching und Gerätescan. Restriktive Gerätegruppen, explizite Pilot-Ausweitung und gerätgebundene effektive Policies sind inzwischen implementiert (`docs/group-policy-rollout.md`). Dynamische IdP-Gruppen, automatische Gesundheitsgates, prozentuale Rolloutringe und Mandantenisolation bleiben offen. |
+
 | Admin-Bookmarks lesen/bearbeiten, Firmenlinks und erlaubte persönliche Links | Umgesetzt innerhalb des aktuellen Fleet-Modells | `packages/core/bookmarks.mjs`, `apps/server/bookmarks.mjs`, `apps/browser/bookmarks.cjs`, `tests/bookmarks.test.mjs`, `tests/bookmarks-native.test.mjs`, beide Bookmark-Smokes und Proof-Artefakte. Signierte Firmenlinks, per-Gerät persönliche Revisionen, native und Backend-Rechte. Kein geräteübergreifendes Benutzerroaming oder Gruppenzuweisung. |
+
 | Eigener Proxy, VPN, DNS | Teilweise | `apps/browser/network-posture.cjs`, `packages/core/enterprise.mjs`, `tests/network-posture.test.mjs`, `scripts/enterprise-browser-smoke.mjs`: Windows-DNS, Corporate DoH, Proxy/PAC, VPN-Adapter/DNS-Prüfung. Adapterpräsenz ist keine kryptografische Tunnel-/Routenattestation; Erkennung hat Polling-Latenz. Reale Kundentopologien müssen getestet werden. |
+
 | Live Domain/IP-/Inhaltsblockierung, YARA/Sigma | Teilweise | `packages/core/security.mjs`, `tests/security.test.mjs`, `tests/dns-alias.test.mjs`, `apps/inspector/engine.py`: Domain/IP-Regeln und echte lokale YARA. Sigma unterstützt nur genaue Event-Metadaten-Selektion, keine vollständige Sprache/Korrelation. OS-weit andere Anwendungen werden nicht kontrolliert. |
+
 | ICAP zu eigener AV/Sandbox | Teilweise | `apps/browser/icap-client.cjs`, `enterprise-inspection.cjs`, `apps/server/inspection.mjs`, `tests/icap-client.test.mjs`, `tests/enterprise-gateway.test.mjs`: vollständige unveränderte Bodies, OPTIONS, ICAPS, fail closed. Kein verzögertes Detonations-/Polling-Protokoll, Vendor-REST oder sichere Freigabe adaptierter Inhalte. |
+
 | Downloads mit zentraler YARA vor OS-Dateischreiben | Umgesetzt für unterstützte GET-Downloads | `apps/browser/main.cjs`, `inspection.cjs`, `tests/download-gate.test.mjs`, `scripts/smoke.mjs`: native Downloads gestoppt, bounded Memory-Scan, SHA-Bindung vor Save-Dialog/Schreiben. POST-/Blob-/andere Downloads nicht unterstützt und blockiert. Ein YARA-Allow ersetzt keine DLP-Klassifikation. |
-| Vollständige Upload-/Text-DLP | Teilweise, wichtige Grenze | `main.cjs`, `packages/core/policy.mjs`, `tests/policy.test.mjs`: unterstützte immutable HTTP-Body-/URL-Pfade geprüft. Dateibasierte/Data-Pipe-Uploads blockiert statt race-anfälliger Freigabe. WebSocket-Nachrichten bei Freigabe, WebRTC, Streaming und codierte/covert Exfiltration nicht vollständig geprüft. Native Chromium-Enforcement-Arbeit erforderlich. |
+
+| Vollständige Upload-/Text-DLP | Teilweise, wichtige Grenze | Unterstützte immutable HTTP-Body-/URL-Pfade und normale Windows-NTFS-Dateiuploads sind geprüft; letztere halten native Handles bis zum Request-Ende und prüfen tatsächliche Dateien und Multipart-Segmente. `docs/windows-file-uploads.md`, `tests/upload-lease.test.mjs`, `tests/file-upload-gate.test.mjs` und native Receiver-/Absturz-Proofs. Data-Pipes, Teilbereiche und Upload-Redirects bleiben blockiert; WebSocket-Nachrichten bei Freigabe, WebRTC, Streaming und codierte/covert Exfiltration sind nicht vollständig geprüft. |
+
 | Copy/Paste/Cut und ClickFix | Teilweise | `packages/core/clipboard.mjs`, `apps/browser/page-clipboard-guard.cjs`, `site-preload.cjs`, `tests/clipboard.test.mjs`, `tests/page-clipboard-guard.test.mjs`, `scripts/smoke.mjs`: echte Tastatur-/Kontextmenü-Pfade, Policy-/Ziel-/Selektionsbindung; Seiten-Clipboard/Legacy-Pfade geschützt. Richtext, Dateien, contenteditable und Subframe-Transfers blockiert. ClickFix-Regeln erfassen ausgewählte gefährliche Ausführungsketten, nicht sämtlichen Schadcode von GitHub. Kein OS-weiter Clipboard-/Print-/Screenshot-Schutz. |
-| Lokales OCR und Parsing ohne Cloud | Teilweise, Windows-Isolation implementiert | `apps/inspector/engine.py`, `requirements.lock.txt`, `CAPABILITIES.md`: gepinnte RapidOCR/ONNX-Modelle, begrenzte Parser, kein Modellnachladen. Der Broker importiert keine Parser; pro Anfrage führt `windows_appcontainer.py` einen attestierten Worker mit null Fähigkeiten, privaten Pipes und freigegebenen Runtime-Leserechten aus. Job-Limits und Nachfahrenbeendigung bleiben aktiv. Zwölf native Isolationstests sowie echtes YARA/OCR/Gemma im Broker bestanden (`artifacts/windows-appcontainer-proof.json`). PDF/OOXML-/Mediencoverage bleibt unvollständig. Installer-ACLs für Program Files und unabhängige Sandbox-Bypass-Prüfung fehlen weiterhin. |
+
+| Lokales OCR und Parsing ohne Cloud | Teilweise, Windows-Isolation implementiert | `apps/inspector/engine.py`, `requirements.lock.txt`, `CAPABILITIES.md`: gepinnte RapidOCR/ONNX-Modelle, begrenzte Parser, kein Modellnachladen. Der Broker importiert keine Parser; pro Anfrage führt `windows_appcontainer.py` einen attestierten Worker mit null Fähigkeiten, privaten Pipes und freigegebenen Runtime-Leserechten aus. Job-Limits und Nachfahrenbeendigung bleiben aktiv. Zwölf native Isolationstests sowie echtes YARA/OCR/Gemma im Broker bestanden (`artifacts/windows-appcontainer-proof.json`). PDF/OOXML-/Mediencoverage bleibt unvollständig. Das separate ACL-Provisionierungstool ist implementiert; geschützte Program-Files-Installation unter separatem Standardbenutzer und unabhängige Sandbox-Bypass-Prüfung bleiben offen. |
+
 | Echtes semantisches GemmaEmbed2 | Umgesetzt als lokaler Klassifikationsbaustein | `apps/inspector/semantic.py`, `test_semantic_real.py`, `packages/core/semantic.mjs`, `scripts/provision-semantic-runtime.py`, `scripts/semantic-browser-smoke.mjs`, `artifacts/semantic-browser-proof.json`: reale gepinnte EmbeddingGemma-2 Q8_0-Gewichte, CPU, 768 Dimensionen, vollständige Tokenfenster. Kundenspezifische Schwellen, Accuracy-/False-Negative-Evaluation und Driftkontrolle fehlen. Das ist kein Fine-Tuning. |
+
 | Bilder, Medien, Video | Teilweise | Lokales OCR und native Bildembeddings; begrenztes mono16kHz PCM16-WAV-Embedding in `semantic.py`/Realtests. Keine vollständige Audio-Transkription, Video-Frame-/Audiocoverage. Ein Medienvektor allein erlaubt keine unvollständig geprüfte Datei. |
+
 | Internes Dokument „anlernen“, keine vollständige Speicherung | Umgesetzt für Features und konfigurierbare Zweitfreigabe | SHA-/Fragmenthashes und begrenzte semantische Vektoren, keine dauerhafte Quelldokument-/Plaintextspeicherung. Deploymentflag erzwingt unabhängigen Administrator für Veröffentlichung; Reviewer sieht Abdeckung/Modus und unveränderlichen Vorschlag. Hashes/Vektoren sind sensible Metadaten. Held-out Evaluation und automatisches Fine-Tuning fehlen. Forensisches Löschen von Prozess-/Paging-Speicher ist nicht garantiert. |
+
 | Dokument-Scan je Browser aktivierbar | Umgesetzt | `app.mjs`, `main.cjs`, Fleet-UI; per-Gerät supplemental Scan. Pflicht-DLP/YARA bleibt davon unabhängig. Nachweise in Server- und Native-Smoke. |
+
 | KI als First Class, kontrolliertes Gateway | Teilweise | `apps/server/app.mjs`, `inspection.mjs`, Browser-AI-UI, `tests/enterprise-gateway.test.mjs`: freigegebene lokale Ollama/kompatible Provider, serverseitige Credentials, Prompt-/Outputprüfung. Kein vollständiges Berechtigungs-RAG, Modellinventar, Provider-Tenantnachweis oder umfassendes KI-Tool-Autorisierungsmodell. |
-| Lokale Agenten steuern Sessions | Umgesetzt für begrenzte API | `apps/browser/agent-control.cjs`, `tests/agent-control.test.mjs`, `tests/agent-adapters.test.mjs`, `scripts/agent-client.cjs`: Loopback, Capability-Pairing, Scopes und feste Aktionen. Kein freies JS/CDP, Passwort-/Cookieexport. Stabile native Tab-UUIDs, Kontextbindung sowie explizite App-/Einstellungs-/Bookmark-/Tab-Rechte sind ergänzt und mit echtem CLI geprüft. Freigaben bleiben zentral begrenzt. Vollständige UI-Steuerung, sichere Screenshots und delegierte kryptografische Agent-Identitäten bleiben offen. |
+
+| Lokale Agenten steuern Sessions | Umgesetzt für begrenzte kryptografisch geschützte API | `apps/browser/agent-control.cjs`, `tests/agent-control.test.mjs`, `tests/agent-adapters.test.mjs`, `scripts/agent-client.cjs`: Loopback, DPAPI-Pairing, zentrale Scopes und feste Aktionen; ML-KEM-1024/AES-256-GCM, gepinnte Ed25519/ML-DSA-87-Challenge, HMAC-SHA384-Requestbindung und Replay-Abwehr. Kein freies JS/CDP, Passwort-/Cookieexport. Stabile native Tab-UUIDs, Kontextbindung sowie explizite App-/Einstellungs-/Bookmark-/Tab-Rechte sind ergänzt und mit echtem CLI geprüft. Freigaben bleiben zentral begrenzt. Inspect/Scroll und tabgebundene Seitenaktionen sind ergänzt; sieben Agent-Phasen mit 124 tatsächlich exportierten Timing-Spans in `artifacts/agent-pq-trace-proof.json`. Vollständige UI-/History-/Screenshot-/Formularsteuerung und individuelle delegierte Agent-Identitäten bleiben offen. |
+
 | Passwortmanager mit Post-Quantum-Kryptografie | Teilweise | `apps/browser/vault.cjs`, `password-fill.cjs`, `tests/vault.test.mjs`, `tests/password-fill.test.mjs`: ML-KEM-1024/AES-GCM/scrypt und Windows-DPAPI, Idle-/Blur-Lock, gebundene HTTPS-Formfüllung. Kein Sync/Recovery/Passkeys, keine unabhängige Kryptografieprüfung oder FIPS-Modulvalidierung. |
+
 | UI+pHash+korrekte Login-URL gegen unbekannte Domains | Teilweise | `packages/core/visual-hash.cjs`, `visual-image.cjs`, `apps/browser/visual-phishing.cjs`, `visual-capture.cjs`, `tests/visual-*.test.mjs`, Native-Smoke: echte Pixel, DCT-pHash, exakte erlaubte HTTPS-Origins, Quarantäne/Audit. Admin muss vertrauenswürdige Referenzen liefern; keine voreingestellte Google-Bibliothek. Kein Pre-Render-Block; Layout-/Sprache-/Iframe-/Evasion-Abdeckung und Fehlalarmrate nicht ausreichend evaluiert. |
-| OpenTelemetry und SIEM-Standardexport | Teilweise | `apps/server/telemetry.mjs`, `siem.mjs`, `packages/core/siem.mjs`, `tests/telemetry.test.mjs`, `tests/siem.test.mjs`: OTLP Signals, dauerhafte Audit-/Dedup-Pfade, ECS/CEF-Cursor und HTTPS/mTLS-Push. Keine Dokument-/Promptinhalte in regulären Events. Incident-Triage und standardmäßig deaktivierte Datenbank-Aufbewahrung implementiert. Incident-Belege und ausstehende SIEM-Exporte bleiben erhalten. Zentral signierte Browser-OTLP-Traces/Logs mit Laufzeiten und Trace-/Span-Korrelation sind jetzt integriert und mit realem Electron/Collector geprüft. Separater verschlüsselter Belegspeicher serverseitig vorhanden; Browser-Erfassung/Analystenansicht, detaillierte Python-Phasen, automatische Fälle, externe SIEM-/Datei-/Backup-Aufbewahrung und reale Kunden-SIEM-Tests bleiben offen. |
+
+| OpenTelemetry und SIEM-Standardexport | Teilweise | `apps/server/telemetry.mjs`, `siem.mjs`, `packages/core/siem.mjs`, `tests/telemetry.test.mjs`, `tests/siem.test.mjs`: OTLP Signals, dauerhafte Audit-/Dedup-Pfade, ECS/CEF-Cursor und HTTPS/mTLS-Push mit zentralem SIEM-Exportschalter. Keine Dokument-/Promptinhalte in regulären Events. Incident-Triage und standardmäßig deaktivierte Datenbank-Aufbewahrung implementiert. Incident-Belege und ausstehende SIEM-Exporte bleiben erhalten. Zentral signierte Browser-OTLP-Traces/Logs mit Laufzeiten und Trace-/Span-Korrelation sind jetzt integriert und mit realem Electron/Collector geprüft. Separater verschlüsselter Belegspeicher serverseitig vorhanden; Browser-Erfassung/Analystenansicht, detaillierte Python-Phasen, automatische Fälle, externe SIEM-/Datei-/Backup-Aufbewahrung und reale Kunden-SIEM-Tests bleiben offen. |
+
+| Frei anlegbare Nutzerprofile und Funktionsrechte | Umgesetzt für unterstützte Profileigenschaften | `tests/user-profiles.test.mjs`, native DevTools-Prüfung und `artifacts/profiles-admin-proof.json`, `profiles-review-admin-proof.json`, `devtools-profile-proof.json`: beliebige Profile, verifizierte SSO-Subjekte oder Geräte, Kategorien/Allow-/Denylists, restriktive Konfliktregeln, explizite DevTools-Delegationsobergrenze, Dokumentpflicht und Download-/AI-/Agentenrechte. Kategorien sind administrierte Domainlisten; keine umfassende kommerzielle URL-Kategorisierungsdatenbank. Freigegebene DevTools sind ein privilegierter Vertrauensbereich mit bekanntem Clipboard-Ausnahmepfad. |
+
+| Bibliothekskomfort und KI-Organisation | Teilweise | Suchbarer Bookmark-Manager, geschützte Firmenlinks, persönliche Ordner und native Tabgruppen. `apps/browser/library-organization.cjs`, `apps/server/library.mjs`, `tests/library.test.mjs`, `tests/library-organization-native.test.mjs`: kontrollierter Gateway, Minimalmetadaten, lokale/serverseitige DLP, versions-/revisionsgebundene Vorschläge, ausdrückliches Anwenden; zentrale Vorschlags-/Autoapply-Schalter und eigene Agent-Scopes. Atomare persönliche Backend-Bookmarks ersetzen keine verteilte Atomarität mit lokalen Tabs: Kontextwechsel nach Commit verlangt ausdrücklich Reconciliation. Leere Gruppenverwaltung, Bulk-Operationen und vollständiger nativer Gateway-End-to-End-Nachweis bleiben zu prüfen. |
+
+| Office-Makrocode im Download-Scan | Umgesetzt für unterstützte VBA-Container | `docs/office-macro-inspection.md`, `apps/inspector/office_macros.py`, `artifacts/office-macro-flow-proof.json`: originale Bytes, entpackte VBA-Projekte/OLE-Streams und dekomprimierter VBA-Code werden gegen zentrale YARA-Regeln im AppContainer geprüft; Makros werden nie ausgeführt. Unmatched benign VBA erlaubt, Quellcode-Treffer blockiert. Zusatzextraktion zentral abschaltbar; aktiviertes ICAP bleibt Pflicht. XLM/XLSB, verschlüsselte/beschädigte Projekte, eingebettete Container, p-code/source-Äquivalenz und umfassende Obfuskationsanalyse bleiben Grenzen. |
+
 | Cross Platform und Mobile | Bewusst später | Benutzer hat Windows priorisiert. macOS/Linux/Mobile sind keine jetzt fertigen Produkte, auch wenn Paketkonfiguration Zielnamen enthält. |
 
+
+
 ## Priorisierte To-do-Liste und Abnahmekriterien
 
+
+
 ### P0: aktuell sichere Bedienung und überprüfbare Verwaltung
 
+
+
 - [x] Admin-Weboberfläche in klare Arbeitsbereiche aufteilen: Übersicht, Fleet, Policies, DLP/Teaching, KI, Infrastruktur, Bibliothek, Ereignisse. Aktive Navigation, Suche/Filter, leere/Fehler-/Ladezustände und verständliche Entwurf-/Veröffentlichungszustände. Abnahme: echte DOM-/Screenshot-Tests durchlaufen Template, Änderung, Veröffentlichung und Geräteaktion; Backend-Rechte bleiben unabhängig von UI.
+
 - [x] Admin-Authentifizierung und Workflow serverseitig überprüfen: Session-Lifecycle, Schreibschutz gegen fremde Origins, sichere Header und minimaler Bootstrapbetrieb. Abnahme: nicht authentifizierte/fremde/abgelaufene Requests scheitern; erlaubte SSO-Session arbeitet über denselben kontrollierten API-Pfad.
+
 - [x] Produktionsgrenzen in Konsole/README sichtbar machen. Abnahme: kein „gesund/sicher“-Status nur wegen gespeicherter Konfiguration; aktueller Device-/Scanner-/Policy-Nachweis und tatsächliche Bereitschaft werden unterschieden.
+
 - [x] Windows-Parser-Isolation als AppContainer mit echten Token-, privaten Datei-/Runtime-Schreib-, TCP-/UDP-, Kindprozess-, Deadline- und Pipe-Grenztests implementiert. Broker/Worker getrennt, keine Parser im Broker; zwölf native Tests und echte lokale YARA/OCR/Gemma-Operationen bestanden. Freigegebene Systemressourcen und Windows-Paketprivatspeicher bleiben nutzbar. Das schließt keine unbekannten Sandbox-Exploits aus.
+
 - [x] Separates Installer-/Service-Provisionierungstool und native lesende Prüfung vorhandener Package-SID-ACLs implementiert. Normaler Scannerstart ändert keine Rechte; fehlende/writable/konfliktierende ACLs scheitern. Paketierung provisioniert erst nach vollständigem Kopieren. Native Tests prüfen echten Workerstart bei verbotenem Provisionierungs-Unterprozess.
+
 - [ ] Geschützte Program-Files-Installation unter einem separaten Standardbenutzer sowie unabhängiger Sandbox-Bypass-Test. Ein eigener Entwickleraccount-Nachweis ersetzt diese Produktionsabnahme nicht.
 
+
+
 ### P1: Unternehmensbetrieb und Umfang erweitern
 
+
+
 - [x] Verbindliche unabhängige Policy-Freigabe über Deploymentflag, dauerhafte unveränderliche Entwürfe, Hash/Diff/Basisversion und unterschiedliche Administrator-Identität implementiert. Alle Veröffentlichungswege einschließlich Teaching, Blocklisten, Gerätescan und Wiederherstellung durchlaufen denselben Publisher. Eigenfreigabe, falscher Hash, veraltete Versionen und doppelte Freigabe scheitern; echte Admin-/Operator-UI-Prüfung bestanden.
+
 - [x] Restriktive Gerätegruppen mit expliziter Mitgliedschaft, deterministischen Konfliktregeln, gruppenspezifischen Firmenbookmarks und signierter gerätgebundener effektiver Policy implementiert. Baseline bleibt zwingend; Browser, AI-Gateway und Bookmark-APIs prüfen die effektive Policy. Dynamische SSO-/SCIM-Gruppenzuweisung bleibt offen.
+
 - [x] Unveränderliche Policy-Historie, Versionsvergleich und explizit geprüfte Wiederherstellung als neue Version implementiert. CAS, aktuelle Schema-/Bookmark-Prüfung, frisches Ablaufdatum und Backend-Rollen gelten; sechs Backendtests und echter Admin-UI-Workflow bestanden.
+
 - [x] Expliziter Pilot-/Expanded-/All-Members-Rollout mit zentraler Vorschau, versionsgebundener Zweitfreigabe und gemeldeten Geräteversionen implementiert. Gruppenstände werden historisiert und als neue Generation wiederhergestellt. Gemeldete Versionsgleichheit ist keine Gesundheitsattestation.
+
 - [ ] Automatische Rollout-Freigabe-/Stop-Regeln, prozentuale Ringe und dynamische IdP-/SCIM-Mitgliedschaft.
+
 - [ ] Sichere immutable Freigabe von Dateiuploads und vollständige unterstützte Netzwerkkanäle im nativen Browser. Abnahme: kontrollierter Receiver erhält niemals nach dem Scan ausgetauschte Bytes; Frames/Worker/WebSockets/Streams sind explizit abgedeckt oder gesperrt.
+
 - [ ] Vollständige Dokument-Render-/Attachmentprüfung, Audio-Transkription und Video-Frames im isolierten lokalen Worker. Abnahme: bekannte Secrets in jeder unterstützten Modalität und im Dateiende werden erkannt; unvollständige Coverage kann nicht freigegeben werden.
+
 - [ ] Semantische Teaching-Evaluation mit erlaubten/verbotenen/adversarial Beispielen, Schwellen und Review. Abnahme: messbarer Kunden-Testdatensatz, kein automatisches Abschwächen durch Benutzerfeedback, Policy-/Modellrevision pro Entscheidung.
+
 - [x] Echte native Tabs mit unabhängigen Inhalten/Historien, gepinnten Agent-Kontexten und Aktivierungsepochen integriert. Native Tests zeigen DOM-/Scroll-Erhalt, keine Reloads, DLP in beiden Tabs, Schließen und zentralen Widerruf aller Views.
+
 - [ ] Unerwartete WebContents-Crashes, atomare Renderer-Aktionsfreigaben über den Dispatch-Zeitpunkt und weitergehende Native-Race-Proofs härten. Sichtbarkeits-/Fokusprüfung bei Passwortfüllung mit echten Views bestanden.
+
 - [x] Incident-Administration mit Ereignisreferenz, Rollen, revisionsgebundener Triage, unveränderlichem Verlauf und reinen Metadaten-Audits implementiert; tatsächliche UI-/HTTP-Prüfung bestanden.
+
 - [x] Opt-in Datenbank-Ereignisaufbewahrung mit aktuellem SIEM-Cursor, Incident-/Sigma-Referenzschutz und erhaltener Replay-Deduplication implementiert; atomarer Fehler-Rollback und echter abgeschlossener Incident geprüft.
+
 - [ ] Vollständiger Daten-Lifecycle: Fall-/Notizablauf, Exportdateien, SIEM, Dedup-Ledger, Backups und sichere Wiederherstellung; Benutzer-/Geräte-Lifecycle und automatische Fallbildung.
 
+
+
 ### P2: Produktionsfreigabe mit externen Voraussetzungen
 
+
+
 - [ ] Reale OIDC-, VPN-/Proxy-/DNS-, ICAP-/AV- und SIEM-Kundenumgebungen testen. Keine synthetische Fixture als Kundennachweis verwenden.
+
 - [ ] Windows-Code-Signing, signierte Installer und verifizierter Updater mit Release-Ringen und Recovery. Zertifikat/Signierservice und Betrieb müssen bereitgestellt werden.
+
 - [ ] Schlüsselcustody/Rotation und optional HSM; unabhängige Prüfung von Policykanal und Vault; keine Zertifikatsbehauptung ohne Prüfung.
+
 - [x] Implementierungs-Threat-Model mit Vertrauensgrenzen, Angriffsfällen und konkreten Abnahmekriterien in `docs/threat-model.md` erstellt.
+
 - [ ] Unabhängiges Penetrations-/Bypass-/Tenant-Isolation-Testprogramm, Chromium-Update-SLA und Incident-Reaktion.
+
 - [ ] Modell-/OCR-/Drittsoftware-Lizenzen und vollständige Notices vor Distribution prüfen.
+
 - [ ] Nach Windows-Abnahme: Plattformdesign für macOS/Linux, später Mobile; native Schutzgrenzen pro OS neu nachweisen.
 
+
+
 ## Admin-Architekturentscheidung
 
+
+
 Eine getrennte Weboberfläche ist die vorhandene und sinnvolle Verwaltungsarchitektur: Kunden betreiben sie hinter HTTPS und Enterprise-SSO. Adminrechte entstehen ausschließlich im Management-Backend, nicht aus dem Browser-Client oder ausgeblendeten UI-Elementen. Ein zusätzlicher nativer Admin-Browser würde die fehlenden Rollen-, Transport-, Session- oder Auditkontrollen nicht ersetzen. Der Verwaltungszugang sollte kundenseitig auf berechtigte Benutzer/Netze beschränkt werden; Konfiguration allein ist keine Produktionsabnahme.
 
+
+
 ## In dieser Iteration umgesetzt
 
+
+
 - Admin/Operator/Auditor-RBAC in `apps/server/admin-access.mjs`, `auth.mjs` und `app.mjs`: explizite Route-Permissions, neu berechnete Sessionrechte und default-deny für unbekannte Adminrouten. Operatoren können Geräte betreuen und Teaching-Entwürfe erstellen, aber keine signierte Policy veröffentlichen. Auditoren lesen ohne Schreibrechte. Nachweise: `tests/server.test.mjs`.
+
 - Remote Shared-Token-Anmeldung abgeschaltet; lokale HTTP-Loopback-Entwicklung behält Bootstrap. Enterprise-SSO bleibt für echte Deployments erforderlich.
+
 - Sessionübersicht und sofortige Sessionwiderruf-API im aktuellen Code; IDs sind opake UUID-Handles, keine Cookies/Tokenhashes. Nur Admin darf inventarisieren/widerrufen. Origin-geschütztes Logout. Neue Servertests enthalten Rechte, Token-Nichtoffenlegung und sofortige Ablehnung widerrufener Cookies; endgültiger Gesamtlauf wird vom Root berichtet.
+
 - Admin-Konsole mit Navigation, Suchfiltern, Änderungenprüfung und eigenem Theme; tatsächlicher Electron-Proof bestätigt Review ohne Veröffentlichung, Filter, Theme-Persistenz, mobile Breite und Read-only-Controls.
+
 - Windows Inspector-Job-Containment mit echtem Prozessbaum-/Owner-Exit-Nachweis. Dies verbessert Ressourcenbegrenzung, ist aber ausdrücklich keine Parser-Sicherheits-Sandbox.
 
+
+
 ## Verifikation
 
+
+
 ### Aktueller Integrationsstand: Windows-Isolation, Historie und Zweitfreigabe
 
+
+
 - `npm test`: 196 bestanden, keine Fehler (`artifacts/governance-unit-tests.log`).
+
 - Python: 47 insgesamt, 43 ausgeführt und bestanden, vier optionale Modelldateitests im Routinelauf übersprungen (`artifacts/governance-python-tests.log`).
+
 - Zwölf echte Windows-Isolationstests plus tatsächliches YARA, RapidOCR und Gemma im isolierten Broker bestanden (`artifacts/windows-appcontainer-proof.json`). Beinhaltet verweigerten Broker-Speicherzugriff und normalen Start ohne ACL-Provisionierungsprozess.
+
 - Vollständiger nativer Browser-Smoke nach isolierter YARA-Integration bestanden (`artifacts/governance-native-smoke.log`).
+
 - Tatsächlicher semantischer Browser-Clipboard-Test bestanden (`artifacts/isolation-history-semantic-browser.log`), einschließlich erlaubtem öffentlichen Text und blockierter Paraphrase.
+
 - Tatsächliche Admin-Historien-/Wiederherstellungs- und unabhängige Freigabe-Workflows bestanden; einschließlich Geräteaktion vor/nach Freigabe, Operator-Beschränkung und verweigerter Eigenfreigabe (`artifacts/policy-history-admin-proof.json`, `artifacts/independent-review-admin-proof.json`).
+
 - JavaScript-Syntax geprüft. Windows-Paket neu erstellt, spezifische Runtime-ACLs nach dem Kopieren provisioniert und finale Paketprüfung bestanden (`artifacts/governance-package-verification.log`): aktuelle Sicherheitsmodule, echter isolierter Kaltstart ohne neue Bytecode-Dateien, lokale CPU-Inferenz, DPAPI und nativer Agent-Helper. Hauptprogramm weiterhin `NotSigned`.
 
+
+
 Die erste isolierte YARA-Integration scheiterte an geschützten DLL-Dateirechten. Explizite vorhandene Datei-ACLs und ein echter YARA-Upload-/Download-Test schließen diese konkrete Lücke. Beim Clipboard-Test wurde eine dynamisch eingefügte Testauswahl korrekt abgelehnt, wenn ihre noch laufende visuelle Revision den Kontext änderte; der Harness wartet jetzt auf Dokument-/Visual-Prüfung, ohne Produktionskontrollen abzuschwächen. Normale Laufzeitprovisionierung wurde inzwischen durch rein lesende ACL-Prüfung ersetzt. Ein geschützter Standardbenutzer-Installer und unabhängige Sicherheitsbewertung bleiben offen.
 
+
+
 Vor Integration existieren die Unit-/Native-Testdateien und Proof-Artefakte oben. Diese Audit-Arbeit hat selbst keine neue Gesamttestsuite ausgeführt; die oben genannten neuen Nachweise stammen aus tatsächlichen Agentenprüfungen oder werden als noch zu integrierender Gesamtlauf bezeichnet. Der orchestrierende Agent muss geänderte Features mit passenden Tests, tatsächlicher Admin-DOM-/Screenshot-Prüfung und Windows-Paketvergleich verifizieren und die endgültigen Ergebnisse separat berichten.
 
+
+
 ### Integrationsprüfung durch Root, 2026-10-13
 
+
+
 - `npm test`: 183 bestanden, keine Fehler (`artifacts/audit-unit-tests.log`).
+
 - Python-Tests: 34 insgesamt, 30 ausgeführt und bestanden, 4 optionale echte Modelltests in diesem Routinelauf übersprungen (`artifacts/inspector-audit-tests.log`). Enthält zwei echte Windows-Prozessbaum-/Breakaway-Tests.
+
 - `npm run check` und Syntaxprüfung des korrigierten Semantic-Testharness: bestanden.
+
 - Vollständiger nativer Browser-Smoke: bestanden (`artifacts/audit-native-smoke.log`), einschließlich Clipboard, Frame-Bypass, YARA vor Save, pHash, Teaching und Revocation.
+
 - Separater realer Gemma-Browser-Test: bestanden (`artifacts/audit-semantic-smoke-retry.log`); paraphrasierter vertraulicher Inhalt blockiert (0,843945), öffentlicher Text zugelassen (0,509778), keine Rohtexte im zentralen Audit.
+
 - Tatsächliche Admin-Electron-UI-Prüfung: bestanden; Nachweis `artifacts/enterprise-admin-proof.json`, Light/Dark/Mobile-Screenshots und Bookmark-UI-Smoke.
+
 - Windows-Paket neu erstellt und geprüft: aktueller Sicherheitsquellstand, wirklich gestarteter Job-begrenzter Paket-Inspector, lokale CPU-Modellinferenz, DPAPI und nativer Agent-Helper (`artifacts/audit-package-verification.log`). Authenticode-Status des Hauptprogramms weiterhin `NotSigned`.
 
+
+
 Ein korrigierter erster Scanner-Smoke deckte den isolierten Python-Importpfad auf: Sibling-Module werden jetzt vom tatsächlichen Service-Verzeichnis geladen. Der erste separate semantische UI-Test scheiterte beim Sichern einer leeren Zwischenablage; der Harness behandelt leere MIME-Listen und synchrone Cleanup-Aufrufe jetzt korrekt. Beide gezielten Wiederholungen bestanden. Produktionsgates oben bleiben ausdrücklich offen; diese Ergebnisse gelten für die ausgeführten Szenarien.
 
+
+
 ### Gruppen-Integration, 2026-10-13
 
+
+
 - 203 JavaScript-Tests bestanden (`artifacts/groups-unit-tests.log`); vollständiger nativer Browser-Smoke bestanden (`artifacts/groups-native-smoke.log`).
+
 - Echter Admin-Gruppenworkflow mit Pilot, Vorschau und ausdrücklicher Ausweitung bestanden (`artifacts/groups-admin-proof.json`).
+
 - Native Upload-Probe zeigt unveränderte Bytes nach Dateiänderung, aber unsichere Cookie-Erweiterung beim Electron-Protocol-Forwarding. Deshalb keine Produktionsfreigabe dieses Ansatzes; Details in `docs/immutable-upload-feasibility.md`.
 
+
+
 - Verpflichtende Gruppen-Zweitfreigabe im echten Operator-/Admin-UI-Workflow bestanden: Vorschlag unveröffentlicht, Mitglieder/Kohorte/Regeln sichtbar, unterschiedliche Identität veröffentlicht (`artifacts/groups-review-admin-proof.json`).
 
+
+
 - Neuer Windows-Build mit Gruppenpolicy-Empfangsbindung erstellt; finale Paketprüfung einschließlich aktuellem Quellvergleich, isoliertem Scanner, lokalem Gemma, Agent-Helper und DPAPI bestanden (`artifacts/groups-package-verification.log`). Authenticode weiterhin `NotSigned`.
 
+
+
 ### Incident-Integration, 2026-10-13
 
+
+
 - 220 JavaScript-Tests bestanden (`artifacts/incidents-unit-tests.log`), Syntaxprüfung bestanden. Zehn gezielte Incident-/Retention-Tests zeigen Rollen, CAS, atomaren Rollback und Belegschutz.
+
 - Echter Incident-Admin-Workflow inklusive Auditor-403, erhaltener Konflikteingaben und literal dargestellter HTML-Notiz bestanden (`artifacts/incident-admin-proof.json`). Gruppen- und Historien-UI nach Integration erneut bestanden.
+
 - Lokaler Managementdienst auf Port 4310 mit aktuellem Backend neu gestartet. Datenbank-Aufbewahrung standardmäßig aus; Details in `docs/audit-retention.md` und `docs/incident-management.md`.
+
 - Native Tab-Registry mit sieben Lifecycle-/Kontexttests vorbereitet (`docs/native-tabs-integration.md`), aber noch nicht in Hauptprozess, Renderer, Clipboard und Agenten integriert. Echte Tabs bleiben offen.
 
+
+
 ### Native Tabs, First-Class-Agenten und Observability, 2026-10-13
 
+
+
 - 253 JavaScript-Tests bestanden (`artifacts/first-class-agent-unit-tests.log`). Vollständiger nativer Browser-Smoke inklusive echter Agent-App-/Settings-/Bookmark-/Tab-Aktionen bestanden (`artifacts/first-class-agent-native.log`, `artifacts/smoke-entry.txt`).
+
 - Echte Tab- und OTLP-Collector-Proofs bestanden (`artifacts/native-tabs-proof.json`, `artifacts/native-tabs-receiver-proof.json`, `artifacts/native-browser-diagnostics-proof.json`). Parent/Child, Laufzeiten, korrelierte Logs und Deaktivierung nach Widerruf geprüft.
+
 - Zentrale Diagnostik-Felder und neue Agent-Berechtigungen im echten Admin-UI veröffentlicht und Auditor-Schreibschutz geprüft (`artifacts/enterprise-admin-proof.json`).
+
 - Verschlüsselter forensischer Server-Belegspeicher mit Deployment-Key, authentisierten Ereignisreferenzen, auditierter Entschlüsselung, Ablauf/Incident-Hold und neun HTTP-Tests implementiert (`docs/protected-evidence.md`). Nicht automatisch aktiviert: Browser-Erfassung, zentrale Sammelregeln und Analystenansicht fehlen.
+
 - [ ] Vollständige forensische Browser-Erfassung: Downloadname/Quelle/Hash, menschliche Klickziele und Clipboard-/Form-Abläufe; relevante vertrauliche Inhalte kontrolliert verschlüsseln, Passwort-/Authentisierungsfelder nativ ausnehmen; Analystenansicht, SIEM-Belegreferenzen und physischer Daten-Lifecycle.
-- [ ] Per-Agent-Identitäten, kryptografischer Request-Besitznachweis, Replay-Schutz, individuelle Widerrufe und umfassendere UI-/History-/Screenshot-Funktionen. Aktuelle DPAPI-/Loopback-Capabilities sind noch nicht das vollständige Delegationsmodell.
+
+- [ ] Per-Agent-Identitäten, individuelle Widerrufe und umfassendere UI-/History-/Screenshot-Funktionen. Kryptografischer Request-Besitznachweis und Replay-Schutz sind inzwischen ergänzt; DPAPI-/Loopback-Pairing vertraut weiterhin Prozessen desselben Windows-Benutzers und ersetzt kein individuelles Delegationsmodell.
+
 - [ ] Durchgehende Python-interne OCR-/YARA-/Gemma-Spans und Control-Plane-Codepfade instrumentieren; gegenwärtige Browser-Spans messen den lokalen Inspector-Aufruf, nicht alle internen Phasen.
+
 - Anforderungen aus der jüngsten Nutzerpräzisierung stehen in `docs/agent-observability-requirements.md`: Vertraulichkeit darf relevante Security-Belege nicht unterdrücken; operationales Debug und geschützte Forensik sind getrennte Pfade.
+
 - Windows-Paket mit stabilem Quellstand neu erstellt und vollständig geprüft (`artifacts/native-tabs-package-verification.log`), weiterhin `NotSigned`. Der erste parallele Build hatte eine während der ASAR-Erstellung geänderte Datei; neue Vor-/Nach-Quellprüfung verhindert die Abnahme solcher Artefakte.
+
+
+
+
+
+### Aktualisierung: Agenten, Makros, Firmenbranding und Profile, 2026-10-13
+
+
+
+Diese Nachprüfung hat aktuelle Quellen, benannte Tests und gespeicherte echte Laufzeit-Proofs gelesen. Sie hat keine neue Gesamttestsuite und keinen neuen Windows-Build ausgeführt; vorherige numerische Testergebnisse weiter oben sind historische Stände.
+
+
+
+- `artifacts/native-browser-diagnostics-proof.json`: 98 Browser-/Backend-Spans, 88 Logs, sieben nachgewiesene Browser→Backend-Trace-Ketten, Laufzeiten und korrelierte Logs; sensible Testmarker nicht exportiert. Dies beweist die gemessenen Pfade, keine vollständige Instrumentierung sämtlicher Codezeilen.
+
+- `artifacts/agent-pq-trace-proof.json`: sieben getrennte Agent-Stufen, insgesamt 124 Timing-Spans. Der Transport bietet hybride Signaturen, PQ-Key-Establishment, AEAD und Replay-Abwehr; das ist kein unabhängiges Kryptografieaudit.
+
+- `artifacts/office-macro-flow-proof.json`: echter enthaltener Scan eines benignen VBA-Projekts erlaubt und desselben Projekts mit Source-YARA-Marker blockiert; jeweils fünf Module und vollständiger Extraktionsstatus.
+
+- `artifacts/company-branding-admin-proof.json`: echte Admin-DOM-Prüfung für Logo, News und korrekt eingeordneten Startseitenbereich. `tests/branding.test.mjs` prüft signierte Geräteverteilung und authentisierte News. Feed-SSRF/DNS-/XML-Grenzen liegen in `tests/company-news.test.mjs`; Screenshots allein beweisen sie nicht.
+
+- `tests/user-profiles.test.mjs` deckt freie Profile, verifizierte Identität, restriktive Konflikte, Delegationsobergrenze, Zweitfreigabe/CAS/Historie und gefälschte Enrollment-Subjekte ab; native UI-/DevTools-Proofs ergänzen die Quelltests.
+
+- `tests/library.test.mjs` deckt kontrollierte Vorschläge/Apply, zentrale Abschaltung, schädliche Modellantworten, Policywechsel, CAS und begrenzte parallele Vorschläge ab. Vollständige verteilte Browser-/Backend-Atomarität wird ausdrücklich nicht behauptet.
+
+- Dauerhafte Entwicklungsanweisung in `AGENTS.md`: Collector und tatsächliche Exporte/Trace-Ketten für weitere Änderungen nutzen. Python-interne OCR/YARA/Gemma-Phasen bleiben instrumentierungsbedürftig.
+
+
+
+### Die nächsten drei Funktionslücken
+
+
+
+1. **Vollständige sichere KI-Steuerung:** History, sichere Screenshots, komplexere Formularaktionen und individuelle Agent-Pairings mit separatem Widerruf. Abnahme mit echten Native-Aktionen, zentraler Abschaltung während laufender Aktionen, Passwort-/Token-Ausnahme, DLP vor Ausgabe und Replay-/Cross-Agent-Negativtests.
+
+2. **Geschützte Security-Rekonstruktion:** native Erfassung relevanter Klick-/Download-/Clipboard-Abläufe, zentrale Sammelregeln, verschlüsselte Content-Belege und Analystenansicht. Der vorhandene Server-Belegspeicher ist kein vollständiger Browser-Erfassungsweg. Abnahme mit Security-relevanter Vertraulichkeit, nativer Authentisierungsfeld-Ausnahme, auditierter Entschlüsselung, Retention/Hold und SIEM-Belegreferenzen.
+
+3. **Lokale Prüfcoverage und genaue Debug-Phasen:** Python-interne Parser/OCR/YARA/Gemma/Makrospans plus explizite Attachment-/Media-Coverage; unvollständige Prüfung bleibt blockiert. Abnahme durch reale isolierte Requests und exportierte gekoppelte Laufzeiten, sowie dokumentierte unterstützte Modalitäten. Immutable Dateiuploads bleiben parallel eine wesentliche native Enforcement-Lücke.
+
+
+
+Ein aktueller Windows-Build muss nach Abschluss der Quellenänderungen separat neu paketiert und gegen den Quellstand geprüft werden. Kein Paketnachweis wird aus früheren Builds abgeleitet.
+
+
+
+## Aktueller Windows-Paketnachweis
+
+
+
+Am 2026-10-13 wurde der aktuelle Quellstand erneut mit `npm run package:win` paketiert und mit `npm run verify:package` geprüft. Beide Befehle bestanden. Die Paketprüfung vergleicht die neuen Agent-/Branding-/Bibliotheks-/Transfer-Komponenten exakt mit dem Quellstand und führt enthaltene Dokumentprüfung, fünf echte VBA-Module mit Allow-/Block-Regeln, Offline-EmbeddingGemma-2-CPU-Inferenz sowie den gepackten DPAPI-/PQ-Agent-Client aus. Nachweis und SHA-256: `artifacts/current-windows-build-proof.json`; vollständiger Lauf: `artifacts/current-windows-package-proof.log`. Die Binärdatei ist laut Windows-Authenticode-Prüfung **NotSigned**. Das ist ein geprüftes unpacked Entwicklungspaket, keine Produktionsfreigabe. Frühere Abschnitte, die den neuen Build als ausstehend bezeichnen, werden durch diesen konkreten Nachweis ersetzt.
+
+
+## Formularsteuerung: aktuelle Iteration
+
+Select/check und begrenzte Options-/Checkbox-Metadaten sind zentral einzeln freizugeben. 49 gezielte Agent-Tests und 323 Regressionstests bestanden. Im nativen Lauf bestanden die Formularaktionen; die längere Suite erreichte danach das Rate-Limit. Der Test wurde an das bestehende Budget angepasst, ohne Produktionslimits zu lockern. Ein neuer Windows-Build ist separat in Prüfung.
+
+Formulariteration: aktueller Windows-Build und Paketprüfung bestanden (`artifacts/forms-package-proof.log`). Acht reale select/check-Timing-Spans sind in `artifacts/forms-trace-proof.json` belegt. Die Binärdatei ist weiterhin unsigniert.
+
+Der abschließende tatsächliche Electron-Smoke-Lauf bestand mit aktivierten Traces (`artifacts/forms-native-final.log`), einschließlich select/check, sensibler Optionsverweigerung, Clipboard-/Download-DLP, Proxy, Teaching und zentralem Widerruf. Das Request-Limit wurde unverändert gelassen; der Test verteilt seine PQ-Aufrufe innerhalb des Budgets.
+
+## Native KI-History-Navigation
+
+Die zentral einzeln freizugebenden Aktionen back/forward/reload verwenden Chromiums native navigationHistory, ohne frei vorgegebene Ziele oder Seiten-JavaScript. Snapshot-Prüfung vor Dispatch und erneute Identitäts-/Policy-/Zielprüfung nach Navigation sind integriert. 335 Regressionstests, zehn gezielte Native-History-Tests und der echte Electron-Lauf bestanden (`artifacts/history-native-smoke.log`); exportierte Agent-Timings stehen in `artifacts/history-trace-proof.json`. Das ersetzt nicht persistente History-Suche/-Verwaltung, die weiter offen bleibt. Ein aktueller Windows-Paketnachweis wird separat geprüft.
+
+Windows-Build und Paketprüfung für diese History-Iteration bestanden (`artifacts/history-windows-build.log`, `artifacts/history-package-proof.log`), einschließlich exaktem Vergleich des neuen History-Helpers. Windows-Authenticode: weiterhin NotSigned.
+
+## Python-interne Debug-Traces
+
+Acht feste Worker-Stufen (inspect/parse/ocr/ocr.load/yara/macros/semantic/semantic.load) liefern Debug-only-Timings über die vorhandenen privaten Pipes. Browser und Backend erzeugen historische Child-Spans unter der aktiven Trace-Kette, ohne Python-Netzwerkrechte. Vier Python-Timing-Tests, neun tatsächliche SDK-/OTLP-Tests und 339 Regressionstests bestanden. Ein echter AppContainer-Lauf mit OCR, VBA und Offline-Gemma lieferte 19 nachgewiesene Export-Spans (`artifacts/inspector-stages-real-proof.json`, `artifacts/inspector-stages-export-proof.json`). Der aktuelle Windows-Build wird separat geprüft. Einzelne native Modellkernels und sämtliche Parser-Unteroperationen sind weiter keine vollständig instrumentierte Call-Graph-Ansicht.
+
+Windows-Build und Paketprüfung dieser Inspector-Trace-Iteration bestanden (`artifacts/inspector-stages-windows-build.log`, `artifacts/inspector-stages-package-proof.log`). Der gepackte Scanner liefert inspect/parse/yara/macros als geprüfte Metadaten; aktuelle Browser-/Core-/Python-Dateien stimmen exakt überein. Authenticode weiterhin NotSigned.
+
+## Geschützte Incident-Belege und Analystenansicht
+
+Metadata-Discovery und expliziter zweckgebundener Viewer sind jetzt verbunden. OIDC_ANALYST_GROUP liefert eine begrenzte Analystenrolle. Windows-Schlüssel-ACLs werden vor dem Laden geprüft; Quelle/Action/Decision/Hash/Größe und Inhaltshash werden auf verfügbare Widersprüche geprüft. 353 Tests, tatsächlicher Electron-Beleg-Viewer (`artifacts/evidence-ui-proof.json`) und acht exportierte HTTP-Spans (`artifacts/evidence-telemetry-proof.json`) sind verifiziert. Der neue Windows-Build/Paketcheck bestand, einschließlich korrigierter OLE-Transfer-Fakten. Binärdatei weiterhin NotSigned. Native automatische Belegerfassung, zentrale Sammelregeln und eine manipulationsnachweisbare Audit-Kette bleiben offen.
+
+
+### Audit integrity implementation, 2026-10-13
+
+Security event/Sigma commits now include chained exact-row digests. Optional externally protected ML-DSA-87 signing, explicit legacy seal, integrity API/admin verification, ECS envelopes and authorized retention proofs are implemented. Missing/different signing keys and corrupt chains fail startup. See [audit-integrity.md](audit-integrity.md). Independent checkpoint delivery, key rotation, large-scale incremental verification and chain compaction remain open; local verification alone does not prove resistance to whole-database rollback.
+
+Verification for this increment: 367 tests passed in artifacts/audit-full-tests.log; final store integration focused tests passed; real Electron success/manipulation UI and exported parent/child trace IDs in artifacts/audit-ui-proof.json; Windows package and packaged security/native offline model verification passed in artifacts/audit-windows-build.log and artifacts/audit-package-proof.log. Management service restarted on current source. Installer Authenticode remains unsigned pending a production signing identity.
+
+
+### Outbound request audit privacy, 2026-10-13
+
+Generic outbound bodies now emit only request size/type, without SHA-256 fingerprints. Browser legacy encrypted queues and central legacy ingestion remove old upload fingerprints before replay/storage; ECS/CEF suppress historical upload hashes while preserving counts/type. Download file hashes remain. Historical immutable central records and already exported archives are not retrospectively erased. See [request-audit-privacy.md](request-audit-privacy.md). Independent review and 376 tests pass; native/runtime proof is being exercised separately.
+
+Verification completed: 376 tests passed (artifacts/request-full-tests.log), native Electron smoke passed after correcting a fixture-only header initialization error (artifacts/request-privacy-smoke.log), actual synthetic credential request no-content/no-hash audit proof in artifacts/request-privacy-native-proof.json. Collector trace ac8660ae584e3ab502d53d304823861e shows browser.request 165.13 ms, local scan 155.54 ms, nested inspector/YARA stages and enterprise scan; saved in artifacts/request-privacy-trace-proof.json. Windows build and packaged native/offline-model verification passed (artifacts/request-windows-build.log, artifacts/request-package-proof.log). Management restarted with current ingestion code.
+
+
+### Centrally managed automatic download metadata evidence, 2026-10-13
+
+Signed default-off evidence controls, native terminal download metadata builder, atomic DPAPI event/evidence tuple, event-first replay, fresh server policy checks and exact-payload idempotency are implemented. Admin draft controls have actual Electron UI/OTEL proof. Full native capture verification is in progress; automatic interaction/content evidence and PQ evidence-upload transport remain open. See [automatic-download-evidence.md](automatic-download-evidence.md).
+
+Verification completed for this increment: 395 tests passed (artifacts/evidence-capture-full-tests.log), JavaScript syntax checks passed, latest full Electron smoke completed successfully (artifacts/evidence-capture-native.log), actual allow/block encrypted download evidence and audited access proved (artifacts/download-evidence-native-proof.json), centrally signed disablement preserving ordinary audit proved in a focused native run with exit code 0 (artifacts/download-evidence-focused-proof.json). Actual admin draft/role UI and OTEL request proof in artifacts/evidence-policy-ui-proof.json; screenshot visually reviewed. Windows build and packaged native/offline-model verification passed; installer still unsigned. Earlier full attempts exposed premature test navigation before save completion and intermittent bookmark/vault readiness failures; save fixture now waits for terminal completion and static agent diagnostics are more precise. The latest full pass does not establish absence of all timing races.
+
+
+### PQ evidence transport and authenticated agent status, 2026-10-13
+
+The previously open PQ evidence-upload transport now has a distinct ML-KEM-1024/ML-DSA-87 + Ed25519/AES-GCM/HKDF-SHA384 profile. Browser submission and acknowledgement are encrypted, one-use challenges are device-bound, current collection policy is checked after decrypt, and automatic submission never falls back to plaintext. Production/required-PQ configurations refuse legacy plaintext ingestion. Device bearer authentication and current SQLite-backed server signing-key custody remain production limits. See [evidence-pq-channel.md](evidence-pq-channel.md).
+
+Agent response status is now authenticated inside the encrypted response. The previously observed bookmark synchronization busy case permits at most three fresh-challenge retries only when the mutation has not begun, preserving exact CAS/policy inputs; all other failures remain nonretryable. Real cryptographic HTTP-header manipulation tests verify status binding. Native/package verification is in progress.
+
+Verification completed: 416 tests passed (artifacts/evidence-pq-full-tests.log); full native browser smoke passed (artifacts/evidence-pq-native.log). Actual native wire inspection confirmed two encrypted evidence submissions with no source URL, filename or file hash in the outer request body, while plaintext submission was disabled (artifacts/evidence-pq-wire-proof.json). Eight exported crypto spans cover all four named phases with their actual normalized HTTP parents (artifacts/evidence-pq-trace-proof.json): first challenge 2.70 ms, decrypt 1.02 ms, store 7.10 ms. Windows build and packaged security/native-model verification passed; binary remains NotSigned. Source and integration review found no blocking channel-binding or downgrade defect; this is not a substitute for an independent production security assessment.
+
+### Outgoing HTTP headers and complete restore review, 2026-10-13
+
+The privileged session now inspects the bounded final header snapshot, including Cookie and Authorization, before HTTP data release. Individual values, joined values and the complete serialized snapshot pass the existing central detectors; enabled local semantic/YARA and upload ICAP checks require complete coverage. Context, policy, expiry and deadline changes block release. The approved immutable snapshot is returned to Chromium. No header values, names or credential fingerprints enter ordinary audit or traces. See [header-dlp.md](header-dlp.md). This proves exposed HTTP headers, not arbitrary transformed covert channels or subsequent WebSocket frames. A timed-out scan blocks but currently lacks a distinct durable timeout audit reason.
+
+Policy-history restoration now renders user-profile/category differences as well as baseline and groups. Missing or truncated profile differences prevent approval; verified-subject/device assignments, website access and DevTools grants are visible before restoration. Six focused shipped-code tests and the actual Electron admin UI prove rendering and draft-only review (artifacts/history-profile-ui-proof.json and history-profile-ui.png); request trace ec25d702216af46ee29660f4c5bf6620 took 2.14 ms.
+
+Verification: 428 tests passed (artifacts/header-dlp-full-tests.log), syntax checks passed, and the full actual Electron smoke passed (artifacts/header-dlp-native.log). The isolated receiver saw no prohibited header request and exactly one clean request; ordinary audit retained no header names/values (artifacts/request-headers-native-proof.json). Exported browser.request.headers span b31ea58c84c72ba8 took 0.27 ms beneath its actual browser.request parent in trace 85f181677440aaa821b9dca0050dc3ce (artifacts/request-headers-trace-proof.json). Windows build and packaged source/security/offline-model verification passed (artifacts/header-dlp-windows-build.log, artifacts/header-dlp-package-proof.log). Authenticode remains NotSigned. These checks do not close the remaining native upload binding, full agent identity/control, automatic interaction evidence, key custody, customer integration and production deployment requirements.
+
+### Structured category management and Windows upload binding proof, 2026-10-13
+
+Website categories now have accessible name, stable-ID and hostname controls instead of mandatory JSON. Draft edits survive refresh with their original CAS version; publication/independent approval remains explicit. Published IDs are read-only, referenced removal is refused and explained, and read-only roles cannot edit. The actual Electron UI verifies explicit backend publication and refreshed profile choices, draft retention, reference restrictions and responsive layout (artifacts/category-ui-proof.json and category-ui.png/category-ui-responsive.png). Actual configuration PUT trace c93f6e18e16fc8644f23bad169e33123 took 28.91 ms with its expected parent. See [website-categories.md](website-categories.md).
+
+Header timeout cancellation now adds a static durable audit reason. Three tests execute the shipped native hook and prove exactly-once cancellation, rejection of late scanner approval, and no release when audit fails. This supersedes the preceding timeout-audit limitation.
+
+434 tests, syntax checks and the full native Electron smoke passed (artifacts/category-admin-full-tests.log, category-admin-syntax.log, category-admin-native.log). A fresh actual header trace c1e027d9456b107e8f766e4f115f3443 proves its exported parent/child timing (artifacts/category-admin-header-trace-proof.json). Current Windows build and packaged source/security/offline-model verification passed (artifacts/category-admin-windows-build.log, category-admin-package-proof.log); binary remains NotSigned.
+
+For the native upload gap, an isolated actual Electron 44.7.0 multipart experiment proved that restrictive Windows leaf plus ancestor handles can preserve file bytes while Chromium reads and sends its original request. Overwrite/hardlink/rename attempts failed; receiver bytes and omit/include cookie semantics remained correct; handles stayed held until matching terminal events (artifacts/upload-lock-native-proof.json). This is an implementation candidate, not product support: production reparse/path identity checks, bounded scanning of each file and multipart segment, cancellation/helper-death/redirect lifecycle and negative native tests are still required. Data-pipe and streaming paths remain separately open. See [immutable-upload-feasibility.md](immutable-upload-feasibility.md). The next implementation priority is this verified Windows ordinary-file path, alongside individual agent identity/control and protected interaction evidence; the full original objective remains incomplete.
+
+### Managed Windows file uploads and actionable debug reasons, 2026-10-13
+
+Ordinary canonical local NTFS full-file uploads are now integrated in the managed browser. The bounded private helper rejects reparse/network/device/alternate-stream paths and incompatible writable handles/mappings, verifies handle-derived path/volume/file identity and reads through the held handle. Main-process DuplicateHandle copies keep the locks alive independently of the helper. File magic, per-file and multipart DLP, enabled local scanners and upload ICAP precede release of the original Chromium request. Only matching native terminal events permit one-shot remote handle cleanup; helper/protocol or uncertain cleanup failures remain fatal across policy refresh. Range/data-pipe/streaming and changed-destination upload redirects remain blocked. See [windows-file-uploads.md](windows-file-uploads.md). This supersedes earlier statements that all ordinary file uploads remain blocked or are merely a prototype.
+
+454 tests pass (artifacts/native-upload-full-tests.log), including real Windows overwrite/hardlink/rename/mapping/junction tests, helper-death parent-lock survival and strict cleanup, gate binding and native deadline tests. Actual managed Electron receiver tests prove exact allowed bytes once, confidential-file non-arrival and no content/body fingerprints in ordinary audit (artifacts/native-file-upload-proof.json). The full native smoke passed after narrowing top-level empty GET source binding to the same live guarded tab owner, preserving document-generation binding for data-bearing requests and all target/policy/DNS/header checks (artifacts/native-upload-final.log). Earlier long runs failed in visual/clipboard transitions; exact fixture diagnostics and request-context audit reasons were added, and the source-owner fix has three focused tests. This is not proof that every timing race is absent.
+
+Subsequent observability changes have an additional actual-product helper-death/redirect/terminal-cleanup run with exit 0 and fatal quarantine surviving policy refresh (artifacts/upload-lifecycle-native-proof.json). Fixed safe reasons now export in spans and correlated logs; arbitrary rule strings, exception details and injected secrets are rejected. Trace e6d26d4edf738a7b4f6f562ab2112f5b contains browser.upload.fault span d1340482efba0711 under its original lease parent, reason upload-lease-lost, two matching logs and the actual durable event correlation; fault phase 36.27 ms (artifacts/native-upload-fault-trace-proof.json). Ordinary file lease/part stages and separate terminal cleanup timings are also exported (artifacts/native-upload-trace-proof.json). Durable security audit and protected forensic evidence remain distinct from diagnostic logs.
+
+The final Windows build and packaged runtime/source verification passed, including the shipped upload helper's actual immutable snapshot/write/rename/cleanup checks (artifacts/native-upload-windows-build.log, native-upload-package-proof.log). Syntax checks pass; Authenticode remains NotSigned. Browser-main/network-service crash semantics, other filesystems, external customer integrations, individual agent identities/full control, automatic interaction evidence and production key custody remain unproven or incomplete. Development collector storage is finite and nearing its local budget; retention/rotation is a next observability maintenance task, not a claimed production SIEM capability.
+
+### Structured agent audit and protected collector rotation, 2026-10-13
+
+Existing local agent actions now carry strict action/scope/outcome facts and an optional requested session UUID. Scope must match the fixed action map; arguments, selectors, prompts, tokens and fabricated principal IDs are rejected. Legacy rule IDs remain for compatibility. Completion/failure audit phases have recording spans, and native control distinguishes failed requests from policy denials without claiming that a completed side effect was undone. ECS includes safetynet.agent and reports failed outcomes as failure; CEF uses existing standard custom-string slots without overwriting trace or audit-integrity references. Native proof confirms read completion scope/session and blocked sensitive-field execution with the field unchanged and no argument content in audit (artifacts/structured-agent-audit-native-proof.json). The blocked adapter in this fixture reports an untyped error, so its outcome is truthfully failed. The first fixture incorrectly waited only for denied; it was corrected to check both legitimate unsuccessful outcomes, retaining strict non-mutation/API-failure assertions. Trace f8e35fd442e718995d9274c646fb8e08 contains the recording completion-audit span and backend parent/child path (artifacts/structured-agent-audit-trace-proof.json).
+
+The protected development collector now rotates before exceeding exact segment bytes, keeps two generated retired segments and pins the previous encrypted archive permanently. Default rolling budget is 150 MiB plus the pinned legacy size. Unsafe/reparse/hardlinked/unexpected files fail closed, and malformed span/hierarchy input is rejected before storage or counter changes. This is development telemetry retention, not security-evidence deletion policy. The live collector was upgraded after a verified encrypted backup. Real SDK traffic caused a rotation; SHA-256 comparison confirmed all 47,201,892 original encrypted bytes remain as the unchanged prefix of the 52,424,920-byte pinned segment, with zero rejected writes (artifacts/collector-live-rotation-proof.json). Readiness/trace lookup is process-local and does not rehydrate archive history. See [development-collector-retention.md](development-collector-retention.md).
+
+468 regression tests, the full actual Electron smoke, syntax checks, Windows build and packaged runtime/source verification passed (artifacts/agent-audit-full-tests.log, agent-audit-native.log, agent-audit-syntax.log, agent-audit-windows-build.log, agent-audit-package-proof.log). Management and the protected collector run the updated sources. Installer Authenticode remains NotSigned.
+
+Individual agent identity/expiry/targeted revocation is still absent: all current callers share the paired browser capability. The verified source audit and integrated acceptance contract are in [individual-agent-identities.md](individual-agent-identities.md). The next implementation must connect signed grants, individual protected credentials, principal-owned challenges, running-operation revocation, central admin review and structured principal attribution together; a disconnected registry or a surviving full-permission legacy capability would not satisfy that requirement. Other original production and full-browser-control gaps remain open; this increment does not complete the overall objective.
+
+
+### Individual agent grants and correlated RPC diagnostics, 2026-10-13
+
+This supersedes the preceding shared-capability-only status. Source integration
+now includes signed individual grants, central draft editor, separate DPAPI
+pairing descriptors, principal-owned challenges/proofs, per-identity revocation,
+expiry/generation checks, persistently remembered generation floors, intersected
+scope/host checks and verified principal attribution in audit/ECS/CEF. Forged
+proofs remain unattributed. Legacy compatibility is an explicit central mode;
+individual mode has no shared master credential. The trusted shell selects an
+existing approved identity. Main policy reconciliation preserves unchanged peers
+while invalidating changed authority. Stored AI organization proposals are checked
+against the applying actor before central commit.
+
+Actual Electron proof exercises both rendered grant selections, two different
+credentials, forbidden actions, targeted revocation with unaffected peer,
+allowed navigation, forbidden direct/redirect targets with zero receiver
+requests, generation rollback rejection across two browser processes, stale
+pairing rejection, and native OTEL request parent/child correlation linked to
+structured actor audit. Screenshot was visually reviewed. Proof:
+`artifacts/individual-agent-native-proof.json` and `individual-agent-pairing-ui.png`.
+Admin draft/auditor workflow has separate `agent-grants-ui-proof.json` evidence.
+
+Individual mode currently blocks browser-session requests lacking a guarded
+native tab owner. Native proof confirms zero ownerless receiver requests even
+after human address navigation, while owned tab fetch still succeeds. This is
+containment, not complete actor attribution for service workers. Reliable
+background-worker ownership or actor session isolation remains an open task.
+The same-user DPAPI capability boundary remains; no executable identity is claimed.
+A real management-server integration test now proves distinct reviewer publication, author self-approval denial, auditor denial, grant review diffs, signed publication, generation rotation and historical restore; the device floor rejects older generations. Expanded grant-specific native admin publication/history UI coverage remains open. Windows build and packaged-source/runtime verification pass, including the shipped individual DPAPI/PQ client. The final suite passes 496 tests; the contained parser, native upload leases and offline semantic inference were verified. Authenticode remains NotSigned. Logs: `artifacts/individual-final-tests.log`, `individual-windows-build.log`, `individual-package-proof.log`.
+
+Other original production and full-control requirements remain open, including
+protected interaction/content forensic capture, broader agent capabilities,
+native streaming/ranged uploads, device authentication/key custody and rotation,
+signed production distribution, external customer integrations and platform
+expansion. This increment does not complete the overall goal.
+
+Final current-source full Electron smoke passed in
+`artifacts/individual-integration-native-final.log`. The local management service
+was restarted only after process/listener identity verification and its health
+check passes; the protected collector remains healthy with zero rejected writes.
+Grant publication integration is covered by `tests/agent-grants-publication.test.mjs`.

docs/website-categories.md

@@ -0,0 +1,34 @@
+# Manage website categories
+
+Open **User classes & website access** in the administrator console. Under
+**Website categories**, add a category and enter:
+
+- A stable identifier, such as `social-sites`.
+- A display name for administrators.
+- One hostname per line, such as `social.example` or `*.social.example`.
+
+Enter hosts without a scheme, path or port. Wildcards cover subdomains; they do
+not also include the bare hostname. Up to 100 categories and 500 unique hosts
+per category are accepted by the category schema; effective signed-policy limits
+are also validated by the server before publication.
+
+Edits remain a local draft until **Publish categories and delegation** is selected.
+Deployments requiring independent approval prepare a proposal for another
+administrator instead. After publication, select the category in the relevant
+user profile and explicitly publish that profile assignment.
+
+Published identifiers are read-only because profiles refer to them. To change an
+identifier, create a new category, update the profile assignments, and then remove
+the old category. A referenced category cannot be removed in the editor; its
+referencing profiles are shown next to the removal control. The backend validates
+references independently of the interface.
+
+Refreshing preserves unsaved category and delegation edits and their original
+policy version. If another administrator publishes changes, the server refuses a
+stale publication. Review the current configuration before preparing a new draft.
+**Discard category draft** explicitly reloads the current published configuration.
+Read-only roles cannot edit or publish categories.
+
+Real Electron UI verification covers draft retention, explicit publication,
+refreshed profile choices, stable IDs, reference restrictions, read-only controls
+and responsive layout. Evidence: `artifacts/category-ui-proof.json`.

docs/windows-file-uploads.md

@@ -0,0 +1,70 @@
+# Windows file upload enforcement
+
+Ordinary file-backed uploads now use the original Chromium request with protected
+Windows handles. The browser scans the complete actual files and the ordered
+multipart byte segments before releasing the request. File magic, central DLP,
+enabled local semantic/YARA checks and configured upload ICAP inspection apply.
+This preserves Chromium's credential, cookie and CORS handling; requests are not
+forwarded through a second fetch operation.
+
+Eligible paths are canonical absolute local NTFS paths, at most 240 characters,
+without alternate streams, device paths or reparse points. The gate supports full
+file descriptors with offset zero and length minus one. It bounds the complete
+request by the signed DLP byte limit, supports at most 16 file descriptors per
+lease and eight outstanding leased requests. Partial file ranges, UNC paths,
+data pipes, blobs without file descriptors, streams and changed-destination
+upload redirects remain blocked pending their own safe integrations.
+
+The private helper opens each normal ancestor and the file with read-only sharing,
+verifies handle-derived path, volume and file identity, and reads through that
+same handle. Writable mappings and incompatible handles cause refusal. Each lock
+is also duplicated into the browser main process before acknowledging acquisition.
+Killing the helper therefore does not remove the browser-owned locks.
+
+Handles stay held until the matching native completion/error event. Policy
+changes, scanner denial, timeouts, redirect or helper failure alone never release
+them. A confirmed terminal event permits explicit cleanup, including a trusted
+replacement helper after helper death. Remote handle closure is one-shot: an
+uncertain close is never retried because Windows may recycle a handle value.
+Unexpected helper/protocol failure disables acquisition and keeps the browser in
+quarantine across policy refresh until restart. Unknown handle receipts remain
+locked until the owning browser process exits.
+
+Snapshot buffers are cleared after inspection. File content is not persisted by
+this gate. Ordinary transfer audit retains hash-free total request bytes and type,
+decisions, policy version and trace correlation; it does not fingerprint an entire
+multipart credential envelope. JavaScript/base64 string copies cannot be reliably
+overwritten and are garbage-collected.
+
+## Actual verification
+
+- Real Windows tests reject writes, hardlink writes, renames, junctions, excessive
+  sizes, pre-existing write handles and writable mappings.
+- Actual managed Electron uploads deliver exact allowed file bytes once and keep
+  a confidential file from reaching the receiver.
+- Actual redirect/helper-death tests confirm denied redirect targets, terminal
+  cleanup, and persistent fatal quarantine.
+- Package verification exercises the shipped helper and Python runtime, including
+  blocked overwrite/rename followed by explicit cleanup.
+
+Evidence: `artifacts/native-file-upload-proof.json`,
+`artifacts/upload-lifecycle-native-proof.json`, `tests/upload-lease.test.mjs` and
+`tests/file-upload-gate.test.mjs`.
+
+These checks concern the tested ordinary NTFS file path. They do not establish
+every filesystem/filter-driver behavior, browser-main crash behavior while a
+network service survives, protection against privileged OS manipulation, or all
+remaining streaming/native Chromium enforcement requirements.
+
+## Debug observability
+
+`browser.upload.lease`, `browser.upload.part`, `browser.upload.release` and
+`browser.upload.fault` provide phase timings. Local worker stages are children of
+the relevant inspection span. Fixed `safetynet.reason` values identify context
+changes, deadlines, invalid ownership and lost/failed handle leases. Arbitrary
+rule strings and exception contents cannot become reason attributes.
+
+A real helper termination exported `upload-lease-lost` in a fault span and two
+correlated logs, linked to its original lease parent and the durable audit event:
+trace `e6d26d4edf738a7b4f6f562ab2112f5b` (fault stage 36.27 ms). Proof:
+`artifacts/native-upload-fault-trace-proof.json`.