Browser: use independently selected remote Engine and Exit through ordinary controls #291

Two fresh owners can offer, request, approve and select a Browser Engine through ordinary Runtime/Home controls. Browser independently selects its authorized Exit and keeps those identities visible through use, recovery, revocation and Close.

Goal: ordinary remote service and placement. Lane: Contract and source. Own B08.A1–A4, B09.A1–A4, B10.A1–A4 and applicable remote B03/B05/B06/B13 contributions. Local Mac/Wallet acceptance remains #87; operator/profile/platform contributions retain their task owners.

Scope and milestones

Establish the first ordinary two-identity Engine/Exit service result using existing authorized human controls and accepted M0. Then consume native operator, private-profile and provider-side authority milestones for complete remote workflows. The first remote result and local operator work proceed independently; full task closure does not form a dependency cycle.

Runtime resolves/adopts service identities and grants; Engine performs website execution and TLS, while the selected Exit owns authorized DNS/destination streams. Carrier carries off-box requests/media below those same contracts. Default selection uses existing trust/locality/profile/resource policy; explicit selection and independent faults remain observable. Reuse shared #173/#177/#178/#179 outputs.

Current prerequisites — 3 November 2026

The published 2.0.0 release hides Services. Prove the first ordinary two-owner Browser journey through the approved People/Runtime controls. This issue owns the minimum Browser selection and consent flow; #179/#178 retain peer/approval authority. Exercise #485 with two real passkeys for one owner and an approved Engine/Exit grant. #173 owns the enforcing B14 revocation and partition bounds. The relay-required WAN row consumes the accepted #345 Carrier output and its iroh prerequisite; start the same-device/LAN slice when its own inputs are ready. #290 can prove O0 locally before R0. Preserve the physical #456 viewer row and all five placements below.

Done means

• Two fresh independent identities offer/request/approve/select/use/revoke/close through ordinary human controls; native agent uses the same selection contract.
• Same-device, physical LAN and supported WAN/relay-required profiles pass discovery, admission, display/input/media, recovery, revocation and cleanup. Logical same-host tests supply bounded preliminary evidence.
• All five A/A/A, A/B/A, A/A/B, A/B/B and A/B/C placements pass applicable navigation/input/media/operator/network/profile/Wallet/cleanup workflows with one Browser capsule and ordinary configuration.
• Controlled DNS and destination evidence identify the selected Exit for page and subordinate traffic, especially A/B/A, A/A/B and A/B/C. TLS stays at Engine; redirect/rebinding/private-destination/bypass/backpressure/cancel/timeout tests meet B09.
• Stop/revoke Engine and Exit independently. Clear typed stages identify the failed owner; retries keep the approved Exit and satisfy B06/B14 lease and recovery bounds.
• Unavailable/full/incompatible/expired/revoked offers fail before unauthorized effects. Authorized remote headless/handoff, files/accessibility and Wallet outcomes pass with the operator and trusted-approval milestones.

Next experiment: establish ordinary offer/admission/selection with two isolated Runtime identities on the authorized Mac/Jetson pair, after capability and source/target ownership checks. Prove selected Exit routing before expanding the placement matrix.

Ownership and acceptance

Product owner: Anders (@andersalm). Part of Browser mission #283, acceptance revision Browser-2026-10-07-R1. The complete original criterion text and numerical budgets in #283 remain authoritative. This task supplies the stated contribution; shared-producer and full-mission acceptance remain open.

Record one execution owner, lane, approved task base/PR target, file scope, exact candidate and resource lease before implementation. Planning uses fetched develop 1828919980b1af1d60895c6cee178f769daed74c; existing branches retain their approved bases/history. Keep at most one active task per Browser lane. New tasks start in Backlog; #131 remains the installed-product task.

Runtime owns admission, principal/grants, placement, routing, resource limits, lifecycle and audit. Engine executes and renders websites and owns website TLS; the selected Exit performs authorized DNS and destination streams. Carrier carries off-box traffic below the same contract. Immutable signed capsule/dependency identity and separately rooted mutable profiles retain their distinct owners.

Verification and closeout

Use the smallest behavior tests that exercise the changed boundary. Freeze the affected input closure, then batch one needed build under the shared Mac lease. Reuse the verified image/helpers when inputs match. Source presence and prepared fixtures provide bounded evidence; installed acceptance binds source commit/tree, built/installed/served hashes, package/image/helper manifests, device/client/adapter versions, selected Engine/Exit, placement/network, commands, failures, cleanup and matching media/manual evidence.

Use one isolated Mac test owner and the authorized Mac/Jetson targets; existing Namespace is an optional x86 fallback. Other physical role/network rows remain unverified until their evidence exists. OMP and existing Homes keep their owners. Disposable fixture signing uses separate trust; production signing, existing-Home changes, release and deployment retain their approval gates.

Before reporting, update this issue with passed, failed, pending, exact candidate and next experiment; use 30-minute checkpoints during sustained execution. Full closure requires accepted behavior, resolved findings, required independent review, applicable irzhywau/security/signing review and human UX/media review, and a merged implementing PR. Applicable #173 changes retain its approval and different-model-family adversarial review gate. All #283 hardware/media/soak/second-maintainer gates remain intact.

Related Browser outputs: #290 native operator milestone; #292 granted profiles; #293 physical placement qualification.