Implement managed browser security, individual agents and observability

docs/protected-evidence-viewer.md

@@ -0,0 +1,36 @@
+# Protected incident evidence
+
+The incident console lists linked evidence metadata without decrypting content.
+Administrators and the dedicated analyst role can choose incident-response,
+investigation or compliance as an access purpose and explicitly reveal a record.
+`OIDC_ANALYST_GROUP` grants evidence read and incident triage without policy, device,
+SIEM or session administration. It remains a server-defined role, not a permission
+supplied by the browser. Operator membership takes precedence over analyst when
+both are configured; administrators retain full access.
+
+Plaintext uses textContent, never HTML, and is cleared after one minute, selection
+changes, refresh, permission/identity changes, logout and page hiding. Delayed
+responses cannot restore older content. Reveals are restricted to the available
+records shown for the selected incident and checked against source-event identity.
+Every successful plaintext response follows a durable purpose-bound access audit.
+
+Evidence is device-reported information, not an independent truth attestation.
+Incoming action, decision, host, file digest/size and supplied content digest are
+compared with available source facts. Legacy events without those facts cannot
+supply the same verification. Encryption authenticates the evidence row; a fully
+tamper-evident source audit chain remains a separate production requirement.
+
+Configure the external 32-byte `EVIDENCE_KEY_FILE` before enabling storage. On
+Windows, startup verifies owner and read/write ACLs and rejects shared key access;
+protect the file to the service identity, SYSTEM and Administrators. POSIX requires
+an owner-only file. No key is exposed through the console. Key rotation, external
+KMS/HSM custody and production backup/recovery remain deployment work.
+
+Tests exercise actual encrypted storage, RBAC, audit failure, mismatched facts,
+expiry/active incident hold and integrity failure. The genuine Electron console
+proof covers purpose-bound reveal, literal script text and clearing, while backend
+OpenTelemetry exports normalized metadata/discovery/reveal route timings.
+
+Automatic native browser capture and centrally signed collection rules remain
+open. This viewer completes the existing protected storage/API-to-analyst path;
+it does not yet collect every click or confidential clipboard fragment itself.