docs(security): track bundled browser URI parser exposure

BACKLOG.md

@@ -49,6 +49,7 @@ records, generated release manifests, or the owning docs named above.
 | Status | ID | Scope | Completion condition |
 |---|---|---|---|
 | BLOCKED | BROWSER-TOOLCHAIN-01 | Qualify a stable browser-test successor to the pinned 1.63.0 SDK that contains the Firefox channel-identity repair ([microsoft/playwright@e5d880b](https://github.com/microsoft/playwright/commit/e5d880b05f9a1d7fb5d17dd031b53739e5e39c0e), Firefox r1551, first released in 1.64.0; 1.63.0 ships r1543 and lacks it) and lacks the native WebKit select/CSP regression first shipped in 1.64.0: WebKit commit `ef67848e5875` (bug 322676) sets a style attribute on a select element's internal slot before that slot is in the user-agent shadow tree, so the page's `style-src` refuses it and logs a console error (open as WebKit bug 327212). | Unblocked only by a stable Playwright release whose Firefox is r1551 or later and whose WebKit no longer reproduces that select/CSP regression (a native `select` under the workspace CSP logs no console or security-policy error); as of 2026-10-13, 1.64.0, the only stable successor, still has the regression. The complete Chromium, Firefox and WebKit gate must then pass with native navigation, exact engine evidence, strict CSP, console and security-policy checks and zero retries. Keep Firefox site-origin process isolation: on 1.63.0, Firefox runs without it reproduced the navigation completion failure under host load. Remove it only when at least five complete Firefox runs of the successor without it, interleaved with control runs that keep it and including runs under host load at least as high as the 1.63.0 complete run that reproduced the failure (1-minute load average median 19 on 8 CPUs), all pass with zero retries and no navigation completion failure; update its fixture and contributor explanation together with the policy change. Do not substitute a custom engine or ignore console/security-policy failures. |
+| BLOCKED | BROWSER-BUNDLE-01 | Replace the fast-uri copy that the pinned browser-test SDK inlines into `playwright-core/lib/utilsBundle.js`: 3.1.3, affected by every fast-uri advisory fixed after it (12 in OSV on 2026-10-24, seven rated high). The lock cannot change it, and the OSV and npm-audit scans do not see it. Only the SDK's Model Context Protocol client and server call its functions; this repository uses neither, and the browser suite runs only its module initializers. No Playwright release inlines a fixed fast-uri: 1.64.1 and the 2026-10-24 prerelease inline 3.1.7, which still has five advisories, and adopting 1.64.x is itself blocked by BROWSER-TOOLCHAIN-01. | The pinned browser-test SDK inlines a fast-uri version for which OSV reports no advisory, and that SDK passes the BROWSER-TOOLCHAIN-01 qualification. Any use of the SDK's Model Context Protocol client or server in this repository before then reopens this row as NEXT. |
 | NEXT | UI-DESIGN-01 | Make every rendered requirement page functional and visually polished under one design system: the static source, proof, coverage and specification-tree views (styles owned by `internal/kernel/browserdoc`) and the `requirement-browser-server` workspace (styles owned by `internal/command/requirementbrowser/assets/workspace.css`) currently keep separate palettes, type and spacing. Renderings stay derived, self-contained and offline: no external fonts, scripts or assets, and no weaker CSP. | One shipped set of design tokens (type scale, spacing, light and dark palettes, radii, border widths, layout widths, target sizes and focus indicator) is defined once and used by both style owners; a test over those two style owners refuses a literal color or size outside the token set, except media-query breakpoints, which CSS cannot read from tokens and which the test requires to equal their tokens, as it also requires of every `matchMedia` query in the workspace scripts, and graph geometry, which stays with its geometry owner. In Chromium, Firefox and WebKit, light and dark, at 320 and 1440 CSS px, and at 200% text size produced both by root font-size scaling at those widths and by full-page zoom, emulated as a 720 CSS px viewport with device scale factor 2 (a 1440 px window at 200%): every view passes axe with zero violations, color-contrast (WCAG 2.2 AA) and target-size each apply to at least one node, target-size has no incomplete result, and every node with an incomplete color-contrast result passes the computed-contrast oracle; the document reflows without horizontal scrolling or lost content, and only labelled graph and table regions may scroll horizontally, as REQ-PROOFKIT-QUALITY-022 admits; keyboard operation, visible focus, Unicode selection and the existing CSP, console and security-policy checks hold with zero retries. Task tests prove that a reader can find a requirement, read its scenarios, follow its proof binding, see coverage gaps and read a diff in every engine. Reference screenshot digests for each view, engine, color scheme and width are committed for one recorded reference environment (the CI ubuntu-24.04 runner image version, its installed font, fontconfig, FreeType and HarfBuzz package versions and the pinned browser engines, or a digest-pinned container image that fixes them), in which the screenshots are reproducible, and the gate compares them with a fixed pixel threshold, never writes missing references and fails on a missing or changed one; a host whose recorded environment differs reports the comparison as unverified, and any change of that environment, including an engine upgrade, needs re-admitted references. The owner reviews the references before and after and admits the visual result; the README screenshot is refreshed from the admitted references. Who reviewed a reference change, a human usability study and WCAG conformance certification remain non-claims. |
 | DEFERRED | GATE-DIFF-01 | Let a closeout gate inherit the verdicts of unchanged steps from a passing parent tree instead of rerunning every step. Inheritance is unsound today: `proofkit/witness-plan.json` input selectors do not declare every path some gate steps read (`go:test` and `self:coverage` read every tracked file, and `browser:check` and the Go format, vet and staticcheck steps read paths outside their selectors), and `go:vulncheck` is not deterministic because it consults a network vulnerability database. Deferred on its measured cost (2026-10-24). Over 40 consecutive first-parent commits, the rules of this row would have saved a mean of at most 2.1 s per commit, 0.2 % of a 22.7-minute hosted gate, even with an admitted traced receipt for every parent and a free trace check: 34 of the 40 commits change a gate-definition file or an input of `self:receipt` or `release:closeout` and so run the full gate (32, for a mean saving of 2.2 s, without the `release:closeout` inputs, which no selector declares yet), and the costliest steps cannot be inherited. The trace check that every gate needs multiplied median wall time by 1.5 for file reads and by 11 for process spawns in Linux micro-benchmarks, in its cheapest mode that sees reads, enumerations and failed lookups (`strace --seccomp-bpf`). Premises found false: `browser:check` lists the whole worktree with `git status` and reads the commit identity, the `./...` steps (`go:test`, `go:vet`, staticcheck and govulncheck) enumerate every directory, and the compact, receipt and boundary contract steps build the CLI with Go's VCS stamping, which runs `git status` too, so none of these steps can have narrow selectors; `browser:check` and `boundary-contract:check` each gave both verdicts on one unchanged tree, on three and five trees; on macOS the only unprivileged mechanism found that also covers failed lookups, `sandbox-exec`, hangs Firefox unless Firefox's own sandboxes are disabled, so it cannot trace `browser:check` unchanged; `release:closeout` has no witness command and so no selector for the full-gate trigger to match; the toolchain list named only Go, Node, npm and the browser engines, while gate steps also run git, Python and the shellcheck found on `PATH` and look up pyflakes there; and the full gate replayed cached `go:test` verdicts until `go:test` ran with `-count=1`. The known causes of the `boundary-contract:check` flips are fixed since: an early-refusal EPIPE race by the shared CLI transport assertion, and a lost macOS Unix-socket wake-up behind `spawnSync`'s `input` option by giving spawned CLI children their input as a file. In the `browser:check` flips, twice a WebKit navigation in one test of `tests/browser/workspace.spec.mjs` did not reach its target document and six page operations did not complete (three clicks, a page evaluation and a focus assertion in Firefox, one click in Chromium), each at the 30-second test timeout with zero retries and in a local full gate whose browser tests took 2.6 to 4.6 times as long as on the passing rerun of the same tree; no load was sampled during those runs, so none of these failures is known to lie inside the reopen condition's load envelope. | Reopen only when all of these hold: 20 consecutive full gates of one unchanged tree pass `browser:check` and `boundary-contract:check` with zero retries inside a load envelope, at least five of them with a median load per CPU of at least 3; fewer than half of the last 40 first-parent commits hit a full-gate trigger; and a trace overhead measured on the real hosted gate is below the mean saving then measured. Load per CPU is the 1-minute load average divided by the logical CPU count, sampled at least once a minute during those two steps and kept with the gate's record; inside the envelope its median is at most 6 and its maximum at most 12. A failure inside the envelope restarts the count; a gate that leaves the envelope is recorded with its verdict and samples and neither counts nor restarts the count; no timeout is raised, no retry is added and no CSP, console or security-policy check is weakened. A reopened row first traces every step's file reads, directory enumerations and failed lookups on its own tree, recomputes the saving over its own recent first-parent commits and resolves each false premise in its scope. Its requirement: every gate, full or differential, traces each step it runs and fails when a file read, directory enumeration or failed path lookup is not covered by that step's declared selectors (an enumerated directory only by a selector over its whole subtree, a failed lookup only by a selector that matches the probed path), and every step declares in its `proofkit/witness-plan.json` policy, validated by `witness-scheduler-plan`, whether its verdict is a deterministic function of its inputs, pinned toolchain and platform; the witness plan's cache policies, environment-class vocabulary and reuse non-claims are reconciled with that reuse in the same change. Only then does `AGENTS.md` admit differential closeout: a step's verdict is inherited from the parent's passing gate, run on a clean materialization of the parent's exact tree, only when the run that produced it passed that trace check, the step is deterministic, none of its selectors matches a changed path (a rename counts both paths), and the toolchain (Go, Node, npm, Python, git, shellcheck, pyflakes and the browser engines), operating system, architecture and the step's environment are identical; nondeterministic steps and steps without selectors always run, and the full gate runs for release objects, for changes to the gate definition (`package.json`, `package-lock.json`, `go.mod`, `go.sum`, `go.work`, `proofkit/witness-plan.json`, `playwright.config.mjs`, `tsconfig.browser.json`, `.github` and the sources of the trace check and the inheritance decision) and for changes that match a selector of `self:receipt` or of a witness command for `release:closeout`, which must first be added; both run only in a full gate. Mutation tests show that an undeclared read, a new file in an enumerated directory, a previously absent probed path (for example `vendor/modules.txt`), a read added by a step rerun in a differential gate, a rename, a nondeterministic step, a step without selectors, a toolchain or platform change, a gate-definition change, a change to a `self:receipt` input and a release object each force a rerun or the full gate. Until then every publishable object runs the full gate. |
 | BLOCKED | GOVERNANCE-01 | Evaluate a generic explicit-inventory governance-observation command without promoting one consumer's policy into Proofkit; detailed candidate contract is retained in [issue #64](https://github.com/research-engineering/agentic-proofkit/issues/64). | A sanitized reproducible fixture detects one named failure without classifying its false-positive counterexample, existing owners are proven insufficient, and either a second independent consumer reproduces the predicate or the owner admits recurring first-consumer cost; otherwise retire the candidate. |