free-computer-use 0.1.0

package/docs/LOCAL_DATA.md

@@ -0,0 +1,98 @@
+# Local data
+
+FreeComputerUse stores run history, learned workflows, the local profile, browser
+session data and downloaded files in its data directory. By default this is
+`.fcu` under the directory from which the CLI starts. `FCU_DATA_DIR` overrides
+that path; relative overrides are also resolved from the starting directory.
+Choose a dedicated directory. The app rejects a symlink or shared system/workspace
+root at this configured path and restricts it to owner access on POSIX systems.
+Direct library use of `TraceStore` requires a private parent directory (mode
+`0700`); it refuses a shared parent without changing that directory's permissions.
+
+The project-root `.env` file is separate. It can contain provider credentials
+and is not included when you copy `.fcu`.
+
+## Inspect
+
+Stop the browser task first. In the project directory, inspect `.fcu` with your
+file manager or list its contents in a terminal. The `profile.json` file stores
+the values you entered; `history.sqlite` stores run traces and learned workflows;
+`browser/` contains the persistent browser session; `downloads/` contains files
+saved by tasks. These files are local and are not encrypted.
+
+Before a URL is sent in model context, saved in a new trace, or shown in
+dashboard state and CLI history, credentials in URL queries/fragments and
+bearer-shaped tokens are replaced with `REDACTED`. The browser still opens the
+original URL. A replay that depended on a hidden URL credential needs a fresh
+starting URL. This name-based filter cannot recognize every secret; review local
+data and screenshots before sharing.
+
+To inspect run summaries and learned workflows from a source checkout:
+
+```sh
+npm run agent -- history
+npm run agent -- workflows
+```
+
+Treat full traces, profile values, browser data and downloads as private. Do not
+attach them to an issue or share them without reviewing their contents.
+
+## Retention
+
+There is no automatic expiry or pruning. Run history, learned workflows, browser
+sessions and downloads remain in the data directory until you remove it. The
+CLI/dashboard history limits only limit how many summaries they display; they
+do not delete older traces.
+
+## Export
+
+Stop FreeComputerUse, then copy the entire data directory to a private backup
+location. Include hidden files. For a custom `FCU_DATA_DIR`, copy that directory
+instead of `.fcu`. Keep the backup on storage protected by your OS account; it
+contains browser sessions and may contain personal information.
+
+macOS:
+
+```sh
+ditto .fcu /path/to/private-backup/fcu-data
+```
+
+Linux:
+
+```sh
+cp -a .fcu /path/to/private-backup/fcu-data
+```
+
+Windows PowerShell:
+
+```powershell
+Copy-Item -LiteralPath .fcu -Destination C:\path\to\private-backup\fcu-data -Recurse
+```
+
+## Delete
+
+Stop FreeComputerUse and confirm the exact data directory before deleting it.
+The following removes the default `.fcu` directory from the current project; it
+does not remove `.env` or a custom `FCU_DATA_DIR` elsewhere.
+
+macOS/Linux:
+
+```sh
+rm -r -- .fcu
+```
+
+Windows PowerShell:
+
+```powershell
+Remove-Item -LiteralPath .fcu -Recurse
+```
+
+To delete data stored at a custom `FCU_DATA_DIR`, substitute its resolved path
+after checking that it is the intended directory. Removing this folder deletes
+profiles, history, workflows, browser cookies/session data and task downloads.
+
+On macOS 26.6 with Node 25.9.0, the `ditto` backup and `rm -r --` deletion
+commands were checked against a disposable directory containing synthetic
+profile/history files. The copied contents matched; after deletion, the app's
+directory initializer recreated an empty data directory. Linux and Windows
+commands have not been run here.

package/docs/LOCAL_VALIDATION.md

@@ -0,0 +1,87 @@
+# Local validation only
+
+The project has no GitHub CI workflow. The former validation workflow is disabled
+on GitHub, and its source definition has been removed at the owner's request.
+Do not enable or dispatch GitHub validation runs.
+
+## Full local gate
+
+Use a clean checkout with Git history, Node `>=22.13.0`, npm, and an installed
+Chrome or Edge browser. No provider key is needed. From the checkout root:
+
+```bash
+npm ci
+FCU_BROWSER_CHANNEL=chrome npm run validate
+```
+
+`npm ci` installs package dependencies; it does not download a browser. The
+installed-browser channel is best-effort because Playwright may not match that
+browser build. Use `FCU_BROWSER_CHANNEL=msedge` if Edge is installed instead.
+
+`npm run validate` runs these checks in order:
+
+1. `lab:build` regenerates `docs/lab` and preserves the product landing page at
+   `docs/index.html`.
+2. `check` type-checks source, tests, fixtures, and scripts.
+3. `test` runs the serial unit, provider-contract, CLI, and browser suite against
+   local fixtures; it does not make live model-provider calls.
+4. `build` compiles the package and copies its UI assets.
+5. `security` scans tracked worktree files and unique blobs and paths reachable
+   from Git refs for known credential patterns and private-state paths. This is
+   a pattern scan, not a complete security audit.
+6. `npm audit --omit=dev --audit-level=high` checks production dependencies and
+   needs registry access.
+
+A passing run exits with code `0`, all tests passing, a `Security scan passed`
+summary, and no high-severity production dependency findings. Test totals and
+scan counts vary with repository contents. Keep the terminal output with the
+commit hash and environment when recording a validation result; never record API
+keys, cookies, or user data.
+
+On 24 September 2026, a clean checkout completed `npm ci --offline
+--no-audit --no-fund` without a browser download, then passed the complete gate
+on macOS `26.6`, Node `25.9.0`, and system Chrome `154.0.8037.57` at commit
+`1ca1006`: 101/101 tests in 151.35 seconds, 157.19 seconds total, build passed,
+the scan checked 248 worktree files plus 250 unique historical paths and 948
+unique blobs, and npm audit reported zero vulnerabilities. The latest full
+validation at commit `d978b06` passed 102/102 tests, build, the security scan
+(255 worktree files, 257 historical paths, 980 blobs) and npm audit with zero
+vulnerabilities, using an empty `LLM_API_KEY`. The latest run on `main` at
+commit `aa9500d` passed 106/106 tests in 190.06 seconds, build, security scan
+(260 worktree files, 262 historical paths, 1,014 blobs) and npm audit with zero
+vulnerabilities. The latest run on `main` at commit `3fa3d6f` passed 106/106
+tests in 161.24 seconds, build, security scan (260 worktree files, 262
+historical paths, 1,020 blobs) and npm audit with zero vulnerabilities. Both
+runs used macOS `26.6`, Node `25.9.0`, and system Chrome `154.0.8037.57`; the
+test gate made no live provider calls and triggered no GitHub Actions workflow.
+An earlier run had been stopped after 2
+minutes 30 seconds in the former per-file history scan; the batched object scan
+and deleted-secret regression test resolved that bottleneck.
+
+One earlier clean run failed 100/101 on a transient dashboard `502`; the first
+assertion reported only Chrome’s generic console message. The test now asserts
+captured HTTP 5xx paths before generic console errors. A focused rerun and two
+subsequent complete suites passed, but the original failure did not recur, so
+its source remains unknown. See the [support matrix](SUPPORT_MATRIX.md) for
+platform limits.
+
+Live-provider benchmarks are separate, opt-in commands and may spend API
+tokens: `npm run benchmark -- --live`, `npm run benchmark:public`,
+`npm run benchmark:complex -- --live`, and `npm run benchmark:real`. The
+`security:wss` smoke makes a network request to Postman Echo but uses no model
+key. None of these commands is part of `npm run validate`.
+
+`FCU_BROWSER_CHANNEL=chrome npm run security:wss` is an optional live network
+check. It uses installed Chrome to connect to Postman Echo over WSS, relies on
+Chrome’s default TLS validation, and sends one fixed synthetic string. It does not
+use a model key and is excluded from `npm run validate`; endpoint availability
+can change.
+
+`FCU_BROWSER_CHANNEL=chrome npm run ui:smoke` is a local no-provider first-run
+smoke. It checks visible control names, text contrast (4.5:1 for normal text and 3:1
+for large text), approval before site navigation, a sandbox extraction and
+result, browser console output, and dashboard widths 320, 390, 768 and 1600 px.
+It does not validate a live model provider or screen-reader behavior.
+
+GitHub Pages is the existing host for the public static lab. Hosting publication
+is separate from the removed CI checks.

package/docs/MCP.md

@@ -0,0 +1,81 @@
+# MCP integration
+
+FreeComputerUse can run as a local Model Context Protocol server over `stdio`.
+It does not open an HTTP listener. A compatible MCP host starts the process and
+exposes four tools:
+
+| Tool | Purpose |
+| --- | --- |
+| `start_task` | Start one user-requested task with the configured provider and normal safety policy. |
+| `inspect_page` | Read the latest observed page for a task; does not navigate or act. |
+| `follow_task` | Follow progress and receive a human approval request when needed; reports the verified result. |
+| `stop_task` | Stop an active task without changing permissions. |
+
+`start_task` accepts only a goal and an HTTP(S) URL. It does not accept an
+approval policy, Ultra mode, arbitrary action list or permission override. The
+existing Agent handles site access and sensitive-action approvals. The MCP
+server asks the host to collect a human decision through form elicitation; it
+has no `approve` tool. Missing, invalid, declined or expired responses reject
+the pending operation. Approval expires after ten minutes, and only one browser
+task can run at a time.
+
+The host must support local `stdio` servers and form elicitation. Page content
+is untrusted. FreeComputerUse sends task/page context to the provider configured
+in its local environment; results also pass through the MCP host. Browser
+profiles, history and downloads stay in the configured local data directory.
+Do not add API keys to an MCP config or share the MCP process with an
+untrusted host.
+
+## Run from a source checkout
+
+Use Node.js 22.13 or later, npm and an installed browser. The checked platform
+is macOS 26.6 on Apple Silicon with Node 25.9.0 and system Chrome 154.0.8037.57.
+Other platforms and browser combinations remain unverified.
+
+```sh
+git clone https://github.com/OthmaneBlial/FreeComputerUse.git
+cd FreeComputerUse
+npm ci
+npm run build
+```
+
+Add the local command to the MCP host's server configuration. Replace both
+paths with the absolute path to your checkout:
+
+```json
+{
+  "mcpServers": {
+    "free-computer-use": {
+      "command": "node",
+      "args": ["/absolute/path/FreeComputerUse/dist/cli/index.js", "mcp"],
+      "cwd": "/absolute/path/FreeComputerUse",
+      "env": {
+        "FCU_BROWSER_CHANNEL": "chrome",
+        "FCU_DATA_DIR": "/absolute/path/free-computer-use-data"
+      }
+    }
+  }
+}
+```
+
+The `.env` file is read from `cwd`; follow [provider setup](PROVIDERS.md) to
+configure a provider. The `FCU_DATA_DIR` must be a dedicated local directory,
+not the workspace or a shared system directory. Restart the host after changing
+its MCP configuration.
+
+When asked to approve a site or sensitive action, inspect the displayed origin
+and operation. Explicitly confirm only actions you intended. A refusal stops
+the pending action. To stop a running task, call `stop_task`.
+
+## Validation status
+
+The local tests use the official TypeScript MCP client SDK. They cover bounded
+tool discovery, task execution against synthetic local pages, site and
+sensitive-form approvals, refusal before the site receives a request, malformed
+URL rejection, and the modern `stdio` transport. A live UI check also connected
+the built CLI to MCP Inspector 2.8.0 over `stdio`, displayed the site's form
+elicitation and declined it. The task failed safely with zero model calls and
+zero requests to the local fixture. This verifies the reference client only;
+compatibility with other desktop agent hosts remains unverified. The npm
+package is not published; use the source checkout until a public installation
+is verified.

package/docs/PROVIDERS.md

@@ -0,0 +1,150 @@
+# Model providers
+
+FreeComputerUse sends the page context and task to the configured model service.
+Browser actions still run locally. A ChatGPT or Claude subscription connection
+uses that provider's local CLI, but its model request is still processed by the
+provider and subject to the plan's limits. A consumer subscription is separate
+from API billing.
+
+## API key setup
+
+Copy `.env.example` to `.env`, restrict it to your account (`chmod 600 .env` on
+macOS/Linux), then set `LLM_API_KEY`, `LLM_MODEL` and `LLM_BASE_URL`. The local
+environment loader also strips group/other permission bits before reading a
+regular `.env` file on macOS/Linux and rejects symlinks. Never commit `.env` or
+paste a key into an issue, screenshot or log. Use the model ID shown in the
+provider account or current provider documentation.
+
+The default route is OpenAI Chat Completions-compatible:
+
+```dotenv
+LLM_PROVIDER=openai-compatible
+LLM_API_KEY=
+LLM_MODEL=
+LLM_BASE_URL=https://api.deepseek.com
+LLM_RESPONSE_FORMAT=json_object
+```
+
+Set the endpoint for the service you chose:
+
+| Service | `LLM_BASE_URL` | Notes |
+| --- | --- | --- |
+| OpenAI API | `https://api.openai.com/v1` | Use an API key and model enabled for that API project. |
+| xAI / Grok API | `https://api.x.ai/v1` | Use an xAI API key and model ID from the xAI API. |
+| Gemini API | `https://generativelanguage.googleapis.com/v1beta/openai/` | This is Google's OpenAI-compatible endpoint. |
+| DeepSeek API | `https://api.deepseek.com` | The repo default model is `deepseek-flash`; model aliases may change. |
+| Mistral API | `https://api.mistral.ai/v1` | Choose a model available to your API account. |
+| OpenRouter | `https://openrouter.ai/api/v1` | Set `LLM_MODEL` to an available `provider/model` slug. |
+
+The application appends `/chat/completions` and sends a bearer key, chat
+messages, a completion limit and JSON response format. It uses
+`max_completion_tokens` for `api.openai.com` and `max_tokens` for other
+OpenAI-compatible endpoints. Set `LLM_MAX_OUTPUT_TOKENS_PARAM` to override that
+choice for an endpoint with different requirements. The `json_schema` option
+converts optional fields to required nullable fields, `oneOf` to `anyOf`, and
+record selectors to a bounded list that is restored after the response;
+`json_object` remains the broader default. Provider compatibility does not
+guarantee every model accepts every parameter or returns the expected response
+shape. These examples are not live certifications; see the
+[support matrix](SUPPORT_MATRIX.md).
+
+For Anthropic Messages API, switch to its native route:
+
+```dotenv
+LLM_PROVIDER=anthropic
+LLM_API_KEY=
+LLM_MODEL=
+LLM_BASE_URL=https://api.anthropic.com/v1
+LLM_RESPONSE_FORMAT=json_object
+```
+
+Anthropic mode sends `POST /messages` with `x-api-key`, the Messages API version,
+`system`, one user message and `max_tokens`. JSON is requested in the prompt and
+then validated locally. `json_schema` is rejected because the action schema has
+dynamic record keys.
+
+### Check an API configuration
+
+```sh
+npm run agent -- doctor
+npm run agent -- doctor --api
+```
+
+`doctor` launches the configured Playwright browser and reports the runtime; it
+makes no provider request. Success exits with status 0. A failed check prints a
+short corrective error and exits nonzero. `doctor --api` additionally makes a
+network request: API modes request `/models` and look for the configured model;
+subscription modes check CLI authentication. It does not make a model
+completion. An endpoint whose model-list response is not compatible with this
+check can still require a separate provider-specific smoke test. Local CLI tests
+use only a loopback server and fake provider responses.
+
+## Existing ChatGPT or Claude subscriptions
+
+These modes require the official CLI to be installed and already authenticated.
+They do not use an API key and do not bypass account or plan limits.
+
+### ChatGPT through Codex CLI
+
+Install [OpenAI Codex CLI](https://github.com/openai/codex), authenticate with
+`codex login` using ChatGPT, then configure:
+
+```dotenv
+LLM_PROVIDER=codex-subscription
+# Optional if `codex` is not on PATH:
+# CODEX_CLI_PATH=/absolute/path/to/codex
+```
+
+Run `npm run agent -- doctor --api` to check the CLI version and login. Planning
+runs an ephemeral Codex request in a temporary directory, with a read-only
+sandbox, structured output and Codex tools/MCP disabled. The adapter maps action
+unions and optional fields to Codex's strict output schema, represents record
+selectors as a list for the model, then restores the local action shape before
+Zod validation. This provider restriction does not disable the separate local
+FreeComputerUse MCP server; see [MCP setup](MCP.md).
+
+A live smoke passed on 23 September 2026 with Codex CLI `0.156.1` and an existing
+ChatGPT login. One bounded request produced a valid plan for synthetic page
+content. The local budget estimated 7,022 input and 97 output tokens; the CLI
+route did not report a model ID or provider token usage. No browser action ran.
+This verifies one plan completion on the installed CLI/account only.
+
+### Claude Pro or Max through Claude Code
+
+Install [Claude Code](https://docs.anthropic.com/en/docs/claude-code/getting-started)
+and authenticate with `claude auth login` using the Claude account, not Console
+API credentials. The [CLI reference](https://code.claude.com/docs/en/cli-usage)
+documents `claude --version` and `claude auth status`. Configure:
+
+```dotenv
+LLM_PROVIDER=claude-subscription
+# Optional if `claude` is not on PATH:
+# CLAUDE_CLI_PATH=/absolute/path/to/claude
+```
+
+The project requires Claude Code `2.1.248+`; `doctor --api` checks and reports
+the CLI version before checking first-party authentication. If the CLI cannot
+start or report a version, update it before troubleshooting account login.
+Planning uses print mode, disables local tools and MCP, avoids session
+persistence, and limits the request to one turn. The fake-CLI tests do not
+authenticate against Anthropic. This restriction does not disable the separate
+local FreeComputerUse MCP server; see [MCP setup](MCP.md).
+
+## Current evidence
+
+Offline request-contract results and unverified vendor combinations are listed
+in the [support matrix](SUPPORT_MATRIX.md). Do not treat a successful `doctor
+--api` model-list lookup as proof that a completion, structured output or a
+browser task works. Live completions should be run explicitly against a
+sandboxed task, with the provider, model, date and budget recorded.
+
+## Official provider references
+
+- [OpenAI Chat Completions](https://developers.openai.com/api/reference/resources/chat/subresources/completions/methods/create)
+- [xAI API reference](https://docs.x.ai/developers/rest-api-reference/inference) and [OpenAI-compatible endpoint examples](https://docs.x.ai/developers/tools/advanced-usage)
+- [Gemini OpenAI compatibility](https://ai.google.dev/gemini-api/docs/openai)
+- [DeepSeek Chat Completions](https://api-docs.deepseek.com/api/create-chat-completion/) and [JSON output](https://api-docs.deepseek.com/guides/json_mode/)
+- [Mistral migration guide](https://docs.mistral.ai/resources/migration-guides)
+- [OpenRouter quickstart](https://openrouter.ai/docs/quickstart)
+- [Anthropic Messages API](https://docs.anthropic.com/en/api/messages)
+- [Claude Code CLI reference](https://docs.anthropic.com/en/docs/claude-code/cli-usage)

package/docs/RELEASE_CHECKLIST.md

@@ -0,0 +1,37 @@
+# Release checklist
+
+Use this checklist for every npm or GitHub release. npm and GitHub publication are separate steps. A local package build is not a public release.
+
+## Before packaging
+
+- [ ] Confirm the release version in `package.json`, `package-lock.json`, `CHANGELOG.md`, and the proposed Git tag.
+- [ ] Review the versioned notes in `release-notes/`; remove any draft-only wording only after each external publication gate passes.
+- [ ] Review the changelog against the exact commit; keep unverified providers, platforms, and workflows labelled accurately.
+- [ ] Start from a clean checkout of that commit and record Node, npm, Playwright, and system browser versions.
+- [ ] Run `npm ci` and `npm run validate` on the supported platform.
+- [ ] Review `npm pack --dry-run --json`; confirm runtime files, UI assets, license, security guidance, README-linked docs, and images are present. Confirm `.env`, profiles, traces, browser data, caches, and user reports are absent.
+
+## Verify the tarball
+
+- [ ] Create the tarball with `npm pack` and record its SHA-256 and npm integrity value.
+- [ ] Install that tarball into a new temporary directory, outside the checkout.
+- [ ] With no `LLM_API_KEY`, run `agent --help` and `FCU_BROWSER_CHANNEL=chrome agent doctor`.
+- [ ] Run the documented read-only practice workflow through the installed CLI and confirm its result, one browser action, and zero model calls.
+- [ ] Start the installed dashboard and complete its sandbox workflow; check the browser console and responsive layout.
+- [ ] Check the published installation instructions against the tarball and registry state. Do not present an unpublished package as installable from npm.
+
+## Publish and verify npm
+
+- [ ] Confirm the package name and version are not already published; check the registry owner and intended access.
+- [ ] Publish only the reviewed version from the clean release commit. Do not publish credentials or local user data.
+- [ ] Query the exact version from npm; record its tarball URL and integrity metadata.
+- [ ] Download and install the registry tarball in a fresh temporary directory; repeat the CLI, doctor, and sandbox checks.
+- [ ] Update installation instructions only after the registry install succeeds.
+
+## GitHub release
+
+- [ ] Create a version tag that points to the validated commit; verify the tag resolves to that commit.
+- [ ] Publish reviewed notes from `release-notes/` and attach only artifacts that passed the target-specific install checks.
+- [ ] Include SHA-256 checksums and platform requirements for every downloadable asset.
+- [ ] Download each release asset again, verify its checksum, and repeat its installation smoke test.
+- [ ] Verify the public release page, assets, links, and matching npm version before describing the release as complete.

package/docs/REQUIREMENTS.md

@@ -0,0 +1,39 @@
+# MVP requirement audit
+
+Provider and runtime claims are scoped by the dated [support matrix](SUPPORT_MATRIX.md).
+Historical benchmark evidence, repository test coverage and current live
+provider checks are separate evidence categories.
+
+This audit maps the original numbered brief to implemented behavior and explicitly
+planned work. Source files alone are not considered evidence: the repository has
+Chromium integration tests, real Flash runs and result-checked benchmark traces.
+
+| Brief requirements | Result and evidence |
+| --- | --- |
+| 1–5: DOM-first browser agent, real tasks, local execution, Playwright | Implemented in `Agent`, `Browser`, `Observer`, `Executor`; real API contact/job and free public scenarios |
+| 6–10: useful DOM, refs, selector ranking, compression, progressive context | Visible controls/forms/headings/tables/dialogs, frames/open shadow DOM, stable per-document refs, local ranking, bounded compression/diffs; accessibility and sanitized HTML escalation |
+| 11–18: action DSL, compiler, planning, execution, verification, repair, diffs | All listed actions implemented; strict Zod plans/repairs; deterministic conditions, receipts and targeted repairs; Chromium tests |
+| 19–20: caching and workflow learning | Bounded page/selector caches, local form aliases/strategies, SQLite semantic workflows; exact-compatible zero-provider repeats verified |
+| 21: optional adapters | Generic local adapter and replaceable interface implemented. Named platform adapters planned; no external platform integration claimed |
+| 22–25: metrics, budgets, inexpensive provider, routing | Actual usage/calls/timing, configured price estimates, conservative concurrent admissions, provider abstraction and live DeepSeek Flash. Multi-model routing planned as permitted for the first version |
+| 26–28: screenshot fallback, accessibility, regions | Local screenshots/preview and manual control, accessibility snapshot and region observation implemented. Model vision and visual-only control planned |
+| 29–35: forms, local vault/variables, sensitive actions, human control, sessions/auth | Required/options/errors/state extraction, aliases, normal website and action approvals, explicit Ultra, pause/resume/edit/manual/stop; persistent contexts, human security-check handoff; no CAPTCHA bypass |
+| 36–41: CLI, interactive CLI, local UI, debugging, replay, history | run/open/inspect/replay/workflows/history/config/doctor/ui; three-column dashboard, loaded browser preview, events/budgets, private SQLite traces and provider-disabled replay |
+| 42–48: modules, validation/security/injection, goal tracking, loops/hashes | Separate replaceable modules, fixed browser API, escaped untrusted content, preserved original goal, trusted criteria, max steps/repairs/repeated states/navigation checks |
+| 49–60: KPIs, benchmark suite, zero-call reuse, local intelligence, compact structured context | Metrics/reports; six local plus fourteen public scenarios; result oracles and provider-free compatible repeats; semantic workflows, local similarity/form mapping, JSON outputs, bounded completed-action summary |
+| 61–63: demo, README and diagrams | Real multi-page synthetic application plus contact/demo, broader free sandbox cases, runnable README and architecture diagram, actual UI screenshots |
+| 64–65: naming and developer experience | Existing workspace name retained; GitHub repo created; local npm install/config/dev, source and built CLI, browser install documented; public npm package not verified |
+| 66–68: real tests, local website, failures | Chromium unit/integration/UI checks with local lab; missing/replaced/duplicate controls, delayed content, validation, frame/tab changes, approval rejection, schema/budget failures and repair |
+| 69–70: incremental phases and working MVP | Incremental main commits pushed. Actual API tasks open/observe/compress/plan/execute/verify/repair, print metrics and store traces |
+| 71–74: deterministic-first philosophy and compiler-like vision | Local strategies and workflow matching precede provider calls. Arbitrary-site permanent workflow transfer remains a longer-term goal |
+| 77: usable end-to-end implementation | Built and exercised with real Flash, private traces, human gates and result-checked local/public tasks |
+| 75–76: no fabricated results and credentials | Scripted vs real runs labeled; benchmark outputs use independent correctness checks; no screenshot baseline claim; `.env` and `.fcu` ignored, known values redacted, tracked/history credential checks |
+
+## Boundaries
+
+The MVP automates browsers, not the full desktop. Compatibility is bounded by DOM
+access, model planning and site behavior. A successful completion condition is not
+a universal proof of natural-language task correctness. Human approvals and origin
+restrictions reduce risk but do not make an allowed website trustworthy. Vault
+storage is private by filesystem permissions, not encrypted. These limits are part
+of the product documentation, not hidden behind a passing build.