Scope task actors and handoff concurrency

docs/adr/0001-agenttab-runtime.md

@@ -28,7 +28,7 @@ A task workspace is visible in Chrome. Task-owned tabs are grouped for display,
 
 **Your Turn** is the human-only input boundary. AgentTab MUST hand control to the user for passwords, passkeys, two-factor authentication, CAPTCHA, payment secrets, and other input that automation must not observe or synthesize.
 
-While any Your Turn handoff is active, AgentTab MUST enforce a global observation blackout across every task and client. The extension and host each fail closed. AgentTab MUST NOT capture human keystrokes. Handoff clears only after its declared completion condition or explicit Done, capture scrubbing, and host acknowledgement.
+While Your Turn is active, AgentTab MUST enforce an observation and mutation blackout for its exact task/tab binding across every client. Other tabs MAY continue. The extension MUST detach the handed-off tab before focus, and the host MUST fail closed globally only while the extension's durable binding is unavailable during reconciliation. AgentTab MUST NOT capture human keystrokes. Handoff clears only after its declared completion condition or explicit Done, tab capture scrubbing, and host acknowledgement.
 
 ### Commit
 
@@ -108,15 +108,15 @@ Ownership can be granted only by:
 2. a child tab with an owned `openerTabId`
 3. explicit `browser_open({ mode: "adopt_active" })`
 
-Adoption MUST be visible. It groups the active tab and shows a brief non-blocking indicator. If grouping fails, creation or adoption rolls back with `outcome: "not_started"`. AgentTab MUST NOT retain invisible ownership with `groupId: null`.
+Adoption MUST show a brief non-blocking indicator and SHOULD group the active tab. Grouping is a best-effort presentation step: a failure MUST NOT roll back creation or adoption, and `groupId: null` remains valid authoritative ownership state.
 
-Dedicated-window eligibility MUST be derived from the persisted task record, never from a caller-supplied ownership claim. `placement: "new_window"` MUST fail after the task owns a tab, MUST reject foreground creation, and MUST roll back the created tab if visible grouping fails. Standard mode MUST NOT expose generic focus, resize, move, state-change, or close-window operations. `browser_handoff` remains the sole normal focus transition.
+Dedicated-window eligibility MUST be derived from the persisted task record, never from a caller-supplied ownership claim. `placement: "new_window"` MUST fail after the task owns a tab and MUST reject foreground creation. A cosmetic grouping failure does not revoke the created tab. Standard mode MUST NOT expose generic focus, resize, move, state-change, or close-window operations. `browser_handoff` remains the sole normal focus transition.
 
-Tab groups are display-only. Manual grouping never grants ownership. Ungrouping or moving a tab out of its task group immediately revokes ownership, cancels queued mutations, and notifies the host.
+Tab groups are display-only. Manual grouping never grants, transfers, or revokes ownership. The persisted task ledger remains authoritative when a tab is ungrouped or moved; closing the tab or task revokes it and cancels queued mutations.
 
-Each tab has one serialized writer queue. Separate-tab mutations may overlap. Reads may overlap only when they cannot observe half-applied mutation state. Ordered task mutations preserve delivery order. Browser-global state uses a separate automatic lock. Agent-facing global lease operations do not exist.
+Each tab has one serialized writer queue. Separate-tab mutations may overlap even within one task. Reads may overlap only when they cannot observe half-applied mutation state. Task lifecycle operations preserve per-task delivery order. Explicit global Pause remains a barrier; routine browser work has no browser-global lock. Agent-facing global lease operations do not exist.
 
-Task cleanup persists deletion before calling `chrome.tabs.remove` so `tabs.onRemoved` cannot recreate an empty task record.
+Task cleanup installs a durable tombstone, rejects queued task lifecycle work, and persists deletion before calling `chrome.tabs.remove` so queued opens or `tabs.onRemoved` cannot recreate an empty task record. Durable numeric tab bindings also carry a browser-session epoch mirrored in `chrome.storage.session`; a mismatch clears every old tab-bound capability before startup authorization.
 
 ## Page revisions and references
 

docs/launch/chrome-web-store.md

@@ -32,7 +32,7 @@ Standard MCP access exposes exactly seven tools: `browser_open`, `browser_snapsh
 
 ### Human controls
 
-**Your Turn** is for passwords, passkeys, two-factor authentication, CAPTCHA, payment secrets, and other human-only input. During a handoff, AgentTab applies an observation blackout: standard capture and observation requests for every task return `needs_user`. The runtime clears the blackout only after the declared completion condition or explicit Done and its recovery checks. AgentTab does not capture human keystrokes.
+**Your Turn** is for passwords, passkeys, two-factor authentication, CAPTCHA, payment secrets, and other human-only input. During a handoff, AgentTab blackouts the exact handed-off tab while unrelated task tabs continue. The runtime clears that blackout only after the declared completion condition or explicit Done and its recovery checks. AgentTab does not capture human keystrokes.
 
 **Commit** is a best-effort review barrier for recognizable sends, publishes, purchases, deletes, uploads, authorizations, and permission grants. Before acting, AgentTab prepares, classifies, and revalidates the target. A recognizable consequential action is staged with a preview, then requires approval in a human popup and the requesting agent's one-use token. The record expires after a short interval, cannot be replayed, and is invalidated if the page or target changes. Harmless actions proceed without Commit review. Commit reduces recognizable risk; it cannot prove that a page has no hidden external effect.
 
@@ -51,7 +51,7 @@ This section is draft review copy for the v2 contract. It must be reconciled aga
 | `nativeMessaging` | Required permission | Connects the MV3 extension to the user-installed local AgentTab host. It is the extension-to-host link for task ownership, lifecycle reconciliation, handoff state, Commit staging, and command results. It does not connect the extension to a cloud service. |
 | `debugger` | Required permission | Supports the task-scoped browser capabilities required for accessibility snapshots, precise click, type, fill, select, scroll, key press, inactive screenshots, network-idle observation, and exact download completion attribution. AgentTab attaches lazily only to task-owned tabs, reuses the task connection while needed, and exposes no generic CDP method in Standard mode. |
 | `tabs` | Required permission | Lets AgentTab create and visibly adopt task tabs, track their lifecycle and document revision, focus a handoff tab when the user asks, and clean up a closed task. It is not used to make unrelated tabs owned by an agent. |
-| `tabGroups` | Required permission | Shows task-owned tabs as a visible workspace with working, needs-you, or finished status. Group membership is display-only and never authorizes an operation. Removing or moving a tab out of its task group revokes its ownership. |
+| `tabGroups` | Required permission | Shows task-owned tabs as a visible workspace with working, needs-you, or finished status. Group membership is display-only and never grants, transfers, or revokes ownership; grouping failure does not block task work. |
 | `storage` | Required permission | Persists the minimum extension state needed to recover task status, pause state, handoff blackout state, revision floors, and user interface preferences across MV3 service-worker restarts. It is not an analytics store and is not used to collect browsing history. |
 | `alarms` | Required permission | Schedules bounded MV3 lifecycle work such as reconnect, expiry, and recovery checks after service-worker suspension. It is not used for tracking, advertising, or remote scheduling. |
 | `scripting` | Optional permission | Requested only after the user explicitly clicks **Enable AgentTab automation** in the AgentTab popup. It is not a required install-time permission, denial leaves the extension visibly disabled, and it does not add a Standard raw-script API. |

docs/launch/directory-listings.md

@@ -26,14 +26,14 @@ AgentTab is a local browser runtime for AI agents. It gives each agent task-owne
 
 AgentTab is for browser tasks that need the Chrome profile already on a user's computer. Its promise is: **Give an agent a tab, not the keys to your browser.**
 
-Each agent begins with a task workspace. AgentTab creates or visibly adopts a tab for that task, permits child-tab inheritance from owned tabs, and serializes writes to the same tab. Task groups make active work visible but are display-only: they never grant ownership. A tab moved out of its task group is no longer available to that task.
+Each agent begins with a task workspace. AgentTab creates or visibly adopts a tab for that task, permits child-tab inheritance from owned tabs, and serializes writes to the same tab. Task groups are a best-effort visual aid: they never grant, transfer, or revoke the ownership recorded in the task ledger.
 
 The runtime is local-only. One minimal MV3 extension connects through Chrome Native Messaging to a local Rust host. MCP and other local adapters connect to the host through a user-owned Unix socket on macOS and Linux or a current-user named pipe on Windows. There is no cloud relay, hosted browser session, telemetry service, or routine remote control plane.
 
 The Standard MCP surface has exactly seven tools: `browser_open`, `browser_snapshot`, `browser_act`, `browser_wait`, `browser_tabs`, `browser_handoff`, and `browser_commit`. A separate `browser_developer` tool exists only after a persistent, explicit Developer mode opt-in. Standard mode does not expose raw cookie, storage, arbitrary script, CDP, or network APIs.
 AgentTab declares the `<all_urls>` host permission so its defined `chrome.scripting` text, HTML, selector, wait, and scroll paths can operate in task-owned pages that the user directs an agent to use. This supports those bounded paths across sites; it does not add raw cookie, storage, arbitrary JavaScript, CDP, or network APIs to Standard mode.
 
-**Your Turn** is the human handoff state for passwords, passkeys, two-factor authentication, CAPTCHA, payment secrets, and other human-only input. During handoff, AgentTab applies an observation blackout across every task, so standard observations return `needs_user`; it does not capture human keystrokes.
+**Your Turn** is the human handoff state for passwords, passkeys, two-factor authentication, CAPTCHA, payment secrets, and other human-only input. During handoff, AgentTab blackouts the exact handed-off tab while unrelated task tabs continue; it does not capture human keystrokes.
 
 **Commit** is a best-effort review barrier for recognizable send, publish, purchase, delete, upload, authorization, and permission-grant controls. It stages a recognizable action with a preview, requires a human popup approval and the requesting agent's one-use token, and revalidates the page and target before execution. It is not a guarantee that every page-triggered external effect is recognizable.
 

docs/launch/reddit-posts.md

@@ -12,18 +12,18 @@ AgentTab: Give an AI agent a tab, not the keys to your browser
 
 I am working on AgentTab, a local browser runtime for AI agents built around a simple boundary: **Give an agent a tab, not the keys to your browser.**
 
-The starting point is a task workspace rather than general browser control. An agent creates or visibly adopts a tab for its task. Child tabs can inherit the workspace from an owned opener, same-tab writes are serialized, and the task sees only its own tabs. The colored Chrome task group is there to make work visible, not to authorize it. Moving a tab out of the group revokes that task's ownership.
+The starting point is a task workspace rather than general browser control. An agent creates or visibly adopts a tab for its task. Child tabs can inherit the workspace from an owned opener, same-tab writes are serialized, and the task sees only its own tabs. The colored Chrome task group is a best-effort visual aid; the persisted task ledger authorizes ownership, so moving or ungrouping a tab does not interrupt the task.
 
 The runtime is local-only: one minimal MV3 extension, a local Rust host, Chrome Native Messaging between them, and per-user operating-system-native IPC for local clients. MCP is an adapter to that local runtime. On macOS and Linux the host uses a user-owned Unix socket; on Windows it uses a current-user named pipe. There is no cloud browser, cloud relay, telemetry service, or routine remote control plane.
 
 The Standard MCP surface is intentionally small: `browser_open`, `browser_snapshot`, `browser_act`, `browser_wait`, `browser_tabs`, `browser_handoff`, and `browser_commit`. The only additional tool is `browser_developer`, and it requires a persistent explicit Developer mode opt-in. Standard mode does not hand agents raw cookies, browser storage, arbitrary scripts, raw CDP, or raw network APIs.
 The extension declares the `<all_urls>` host permission so its defined `chrome.scripting` text, HTML, selector, wait, and scroll paths can work in task-owned pages a person directs the agent to use. This broad site reach does not expose raw cookie, storage, arbitrary JavaScript, CDP, or network APIs in Standard mode.
 
-Two controls define the human boundary. **Your Turn** is for passwords, passkeys, two-factor authentication, CAPTCHA, payment secrets, and other human-only input. During that handoff, AgentTab blackouts standard observation for every task, so captures return `needs_user`; it does not capture the person's keystrokes. **Commit** is a best-effort review barrier for recognizable sends, publishes, purchases, deletes, uploads, authorizations, and permission grants. It stages the action, shows a human popup preview, and requires that human's approval plus the requesting agent's one-use token before execution. It revalidates the page and element first.
+Two controls define the human boundary. **Your Turn** is for passwords, passkeys, two-factor authentication, CAPTCHA, payment secrets, and other human-only input. During that handoff, AgentTab blackouts the exact handed-off tab while unrelated task tabs continue; it does not capture the person's keystrokes. **Commit** is a best-effort review barrier for recognizable sends, publishes, purchases, deletes, uploads, authorizations, and permission grants. It stages the action, shows a human popup preview, and requires that human's approval plus the requesting agent's one-use token before execution. It revalidates the page and element first.
 
 This is not profile isolation. An owned tab still runs in the signed-in Chrome profile the person uses. A hostile page can contain prompt injection, and a control can produce an effect that is not recognizable from its visible label. Your Turn and Commit reduce bounded risks but cannot remove them. The local agent and the local software attached to the profile must still be trusted.
 
-AgentTab `v2.0.0-rc.1` is unreleased and this is not a launch post. I am preserving the draft for later feedback on task ownership, the global handoff blackout, Commit's best-effort semantics, and the seven-tool MCP default.
+AgentTab `v2.0.0-rc.1` is unreleased and this is not a launch post. I am preserving the draft for later feedback on task ownership, the tab-scoped handoff blackout, Commit's best-effort semantics, and the seven-tool MCP default.
 
 ## Local-first and privacy community variant
 
@@ -35,11 +35,11 @@ AgentTab: Local task workspaces for AI agents in a signed-in browser
 
 I have been designing AgentTab for the case where an agent genuinely needs the browser session already on a computer, but should not receive broad browser control by default.
 
-AgentTab is a **Local browser runtime for AI agents**. It gives each agent a visible task workspace in the signed-in Chrome profile and keeps ownership on the runtime side. A task can create a tab, inherit a child tab from one it owns, or visibly adopt the active tab. Grouping does not create authority. An ungrouped or moved tab is immediately unavailable to that task.
+AgentTab is a **Local browser runtime for AI agents**. It gives each agent a visible task workspace in the signed-in Chrome profile and keeps ownership on the runtime side. A task can create a tab, inherit a child tab from one it owns, or visibly adopt the active tab. Grouping does not create, transfer, or revoke authority; the runtime's task ledger does.
 
 The architecture is deliberately local. A minimal MV3 extension connects to one Rust host through Chrome Native Messaging. Local MCP clients use per-user operating-system-native IPC to reach the host, rather than a network listener or remote service. The runtime has no cloud relay, hosted browser session, analytics, or telemetry.
 
-The handoff model is called **Your Turn**. If a task reaches a password, passkey, two-factor challenge, CAPTCHA, payment secret, or another human-only step, the person takes over. AgentTab persists that state and blackouts observation for every task while the person works. Once the person signals Done or the declared completion condition is reached, the runtime scrubs the handoff path before normal observation resumes.
+The handoff model is called **Your Turn**. If a task reaches a password, passkey, two-factor challenge, CAPTCHA, payment secret, or another human-only step, the person takes over. AgentTab persists the exact task/tab binding and blackouts that tab while unrelated tabs continue. Once the person signals Done or the declared completion condition is reached, the runtime scrubs the handoff path before observation resumes on that tab.
 
 For recognizable consequential actions, **Commit** stages instead of acting. It is designed for sends, publishes, purchases, deletes, uploads, authorizations, and permission grants. Approval happens in a human popup and is bound to the requesting agent's one-use token, the task, the tab, the target fingerprint, and the current page state. The final execution checks those bindings again. That reduces recognizable risk, but it cannot guarantee that a page has not attached a hidden effect to an innocent-looking control.