Implement managed browser security, individual agents and observability

docs/header-dlp.md

@@ -0,0 +1,47 @@
+# Outgoing header DLP
+
+The managed browser intercepts final outgoing HTTP headers in its privileged
+session `onBeforeSendHeaders` listener. This stage runs before HTTP data is sent,
+according to the [Electron WebRequest contract](https://www.electronjs.org/docs/latest/api/web-request#webrequestonbeforesendheadersfilter-listener).
+It supplements the existing URL, body, DNS and destination gates.
+Chromium may already have opened a TCP connection before this callback; the
+guarantee concerns release of HTTP data, not preventing a connection attempt.
+
+All fields are inspected, including custom headers, Cookie, Authorization,
+Proxy-Authorization and Referer. There is no credential-field exemption. Ordinary
+opaque session cookies, Basic credentials and JWT bearer strings remain usable
+unless they match a central rule. Recognizable `sk-` or GitHub API tokens match
+the existing generic secret detector even when used as direct API credentials;
+approved AI integrations should use the controlled gateway.
+
+The browser copies and validates at most 128 fields and 64 KiB, bounded further
+by the signed DLP byte limit. Invalid fields, inaccessible snapshots and scanner
+failures block. Each value is scanned separately for exact document fingerprints;
+joined values catch literals split across fields; the serialized complete snapshot
+is also inspected. Existing core percent decoding and phrase normalization apply.
+This is not a claim of decoding arbitrary compression, encryption or encodings.
+
+Signed-policy semantic and YARA inspection runs locally on the complete header
+snapshot when enabled. An enabled upload ICAP connector also inspects this snapshot,
+including credential fields: administrators must treat the configured company
+scanner as trusted infrastructure. Scanners require a complete allow result.
+Revocation, expiry, policy replacement, source navigation or the 40-second deadline
+prevent release. Chromium receives the exact frozen snapshot approved by the gate.
+Mutable byte buffers are wiped after inspection; JavaScript string copies are
+garbage-collected and cannot be reliably overwritten.
+
+Ordinary audit receives only the existing rule ID and destination hostname on
+block. `browser.request.headers` exports field count, byte count, timing and request
+type under a `browser.request` parent. Header values, names, token hashes and cookie
+contents are not added to security audit or diagnostic traces.
+The native deadline cancels exactly once and records the static
+`headers-inspection-timeout` reason. A late scanner approval cannot release the
+request, and a failed audit write cannot turn the cancellation into an allow.
+
+This covers the final header fields exposed by Electron for the managed session.
+For WebSockets, this stage inspects handshake headers only; it does not inspect
+subsequent frames. WebSockets remain disabled by the baseline policy, and a
+delegated exception does not establish full frame-level DLP coverage.
+It does not establish protection against arbitrary transformed covert channels,
+other OS applications or every network layer generated internally by Chromium.
+Native receiver tests must prove prohibited requests never reach their destination.