54 lines
3.4 KiB
Markdown
54 lines
3.4 KiB
Markdown
# Protected interaction evidence
|
|
|
|
Administrators separately enable `evidence.enabled`, `captureDownloads` and
|
|
`captureInteractions` through reviewed signed policy. All are off by default.
|
|
Interaction capture covers confirmed guarded copy/cut/paste, completed agent
|
|
clicks and trusted clicks/gesture-associated form events on the active main-frame
|
|
page. Human events are marked `observed`, including prevented events; this never
|
|
claims transmission or completion of a page's asynchronous effect.
|
|
|
|
Ordinary clipboard audit distinguishes authorization before the effect from
|
|
completion after the effect. Protected completion metadata contains website
|
|
origin, opaque session ID, action, structural target tag/role, bounded viewport
|
|
coordinates and optional byte count. Paths, queries, fragments, field values,
|
|
document text, selectors, labels and content hashes are excluded. Sensitive
|
|
fields do not produce this capture. Sensitive forms are excluded as a whole,
|
|
including password/file/hidden controls and bounded credential/card markers.
|
|
Form observation also requires a recent trusted click or Enter gesture and active
|
|
user activation; `requestSubmit()` alone does not establish a human gesture.
|
|
|
|
Agent completion capture is a separate audit phase from RPC completion; two
|
|
events do not mean two clicks. The native fixture verifies one click effect.
|
|
The server binds evidence to the accepted device event, action, source, session
|
|
and the correct observed/completed outcome. New writes reject raw interaction content. Existing
|
|
encrypted legacy evidence remains readable through restricted audited access.
|
|
|
|
The source event and typed protected payload are persisted in one DPAPI-protected
|
|
local queue record. Delivery acknowledges the ordinary event first and uses the
|
|
protected post-quantum management evidence channel. Policy and enrollment are
|
|
rechecked throughout delivery. Disabling interaction capture aborts matching
|
|
in-flight delivery and removes pending interaction evidence while preserving
|
|
ordinary audit and separately allowed download evidence. Existing retained
|
|
records still follow retention, legal-hold and purpose-bound analyst access.
|
|
|
|
Debug traces measure capture, challenge, encryption, send and acknowledgement,
|
|
with correlated server decrypt/store phases. Queue delivery resumes each record's
|
|
own trace parent rather than inheriting a different event's flusher context.
|
|
Observer install/drain/dispose phases have separate bounded debug spans.
|
|
These timing spans carry no raw
|
|
interaction contents. Evidence retention is independent of diagnostics.
|
|
|
|
The private isolated-world observer has no page-visible bridge. It expires after
|
|
1.5 seconds without a privileged drain, caps its queue at 16, allows a burst of
|
|
20 and replenishes at 10 events per second. Main validates every drained record
|
|
and rejects changed documents, activation, policy, ownership and overlays. A
|
|
visual reinspection of the same document does not invalidate captured metadata.
|
|
Rate/queue losses emit a durable bounded-capture warning and a diagnostic count;
|
|
capture is not a complete forensic replay. Subframes, shadow internals, all
|
|
keyboard actions and asynchronous effect reconstruction remain outside coverage.
|
|
|
|
Remaining coverage includes controlled content capture,
|
|
all browser convenience clipboard paths and a proven scoped
|
|
credential-submission exception. Do not assume this feature is full page replay
|
|
or blanket password-field authorization.
|