@@ -52,6 +52,26 @@ Prayu 已具备企业级安全控制平面的部分基础，但还不是完整
 
 Prayu already has several foundations of an enterprise-grade safety control plane, but it is not yet a complete enterprise collaboration or identity platform. Git support is currently a bounded, local read path rather than a remote mutation workflow. External Skills are inert, explicitly selected packages rather than general executable plugins. HTTP bearer capabilities and operator audit records provide local authorization, not organizational IAM. A future native `.prayu/` project contract may support a read-only `.opencode/` compatibility importer, but repository configuration must remain untrusted evidence: it may narrow global policy and must never widen authority, store secrets, or execute scripts/hooks during load.
 
+## 内置浏览器状态 / Built-in Browser Status
+
+Prayu 已完成内置浏览器的第一批 Go 主控安全边界，但**当前还没有启动 Chromium、访问网络或向用户提供可操作的浏览器窗口**。现有 Wails WebView2 仍只负责渲染桌面界面，不会被复用为 CTF 浏览器，也不会加载靶场页面。
+
+The first Go-owned safety boundary for an Agent browser is complete, but **Prayu does not yet launch Chromium, access a target, or expose an interactive browser window**. The existing Wails WebView2 remains a Desktop renderer and is not reused for adversarial CTF pages.
+
+| 档位 / Profile | 用途 / Purpose | 当前固定边界 / Current fixed boundary |
+| --- | --- | --- |
+| `safe-web` | Code 模式网页开发、DOM 检查与截图 / Code-mode Web QA, DOM inspection, and screenshots | 只允许精确公网 Origin 与 localhost；保持同源、CSP 和 TLS / exact public origins and localhost; normal origin, CSP, and TLS policy |
+| `ctf-lab` | 已授权本地、Docker 或私网靶场 / authorized local, Docker, or private labs | 精确目标、代理、抓包、改包、Cookie 和重放候选；不允许浏览器安全放宽 / exact targets plus proxy, capture, mutation, cookie, and replay candidates; no browser-security relaxation |
+| `ctf-instrumented` | 必须显式确认的插桩实验 / explicitly acknowledged instrumented experiments | 只能候选容器后端；证书、混合内容和 Origin 放宽必须逐项请求，所有证据标记 `instrumented` / container-only candidate; each relaxation is explicit and all evidence is marked `instrumented` |
+
+所有档位都要求一次性 Profile、关闭个人资料/扩展/密码库、隔离下载，并在每次重定向及 DNS 解析后重新检查地址。云元数据、链路本地、组播、未指定地址、`file:`/`data:`、URL 内凭证和非授权 Origin 永久拒绝。代理配置只保留规范化端点与系统凭证名称，不保存用户名、密码或 URL userinfo。
+
+Every profile requires a disposable browser profile, forbids personal profiles, extensions, and password stores, quarantines downloads, and revalidates every redirect and resolved address. Cloud metadata, link-local, multicast, unspecified addresses, `file:`/`data:` URLs, URL credentials, and off-scope origins are always denied. Proxy plans retain only a normalized endpoint and a system-credential name, never plaintext credentials or URL userinfo.
+
+`browser_session_plan.v1` 当前仍固定 `start_blocked=true`，且 process/network/profile-write/request-mutation/replay/Artifact authority 全为 `false`。下一批将实现浏览器可执行文件发现与摘要、受控一次性 Profile 生命周期以及 Disabled/Fake CDP transport；真实导航只会在后续独立启动审查通过后开放。边界见 [ADR 0069](docs/adr/0069-go-owned-browser-profiles-target-scope-and-session-plan.md)。
+
+`browser_session_plan.v1` currently fixes `start_blocked=true`, with process, network, profile-write, request-mutation, replay, and Artifact authority all `false`. The next batch covers executable discovery and identity, disposable-profile lifecycle, and a Disabled/Fake CDP transport. Real navigation remains behind a later independent launch review. See [ADR 0069](docs/adr/0069-go-owned-browser-profiles-target-scope-and-session-plan.md).
+
 ## 开发历程 / Development History
 
 下表是唯一按时间排序的 schema 开发历程，完整保留了早期 `v1`、`v2`、`v3`，并连续列到当前 `v84`。这里的 `vN` 是不可变 SQLite schema/runtime 里程碑，不等同于产品发布版本；后面的架构说明按能力域组织，因此不再承担版本排序职责。
 
@@ -1782,10 +1782,39 @@ registry mutation 或新权限。双指标保持架构约 99%、完整产品可
 provenance/signature allowlist 候选、P10-F3 操作者复核的 resource/sandbox launch-plan 候选；三项继续
 不启动进程。本批开启新六片周期，F3 后跑统一功能门，下一批结束再跑完整健壮性门。
 
+## P11-A1/A2/A3 批次：浏览器档位、精确目标范围与无启动会话计划
+
+任务 ID：`P11-Go-Owned-Browser-Control-Foundation`。本轮不新增 migration、CLI、HTTP 或 Desktop
+入口，schema/OpenAPI 保持 v84 / 75 path / 83 operation / 182 schema。
+
+P11-A1 在 Go 内固定 `safe-web`、`ctf-lab`、`ctf-instrumented` 三档。三档都要求一次性 Profile，
+禁止个人资料、扩展、密码库和宿主文件系统；CTF Lab 才能候选抓包/改包/重放/Cookie，Instrumented
+才允许逐项请求 Origin/mixed-content/certificate 放宽并固定容器要求和 `instrumented` 证据标签。
+所有 process/network/profile-write/mutation/replay/Artifact authority 均为 false。
+
+P11-A2 完成最多八个 exact HTTP(S) Origin 的规范化和摘要，覆盖 IDNA、默认端口、IPv4/IPv6、
+重定向复核、DNS 解析地址复核和 literal-IP 固定。Safe Web 拒绝公网名字重绑定私网/回环；CTF
+可访问明确 scope 的私网，但云元数据、link-local、multicast、unspecified/reserved 地址在最高档
+也拒绝。`file:`/`data:`、URL 凭证、fragment、反斜线和越界 Origin 同样失败关闭。
+
+P11-A3 完成 Session/Run/Workspace/profile/scope/proxy/features/isolation/limits/backend/gates 精确绑定
+的 `browser_session_plan.v1`。代理只保留 endpoint 和系统 credential 名称；模型不拥有清理权。
+会话始终 `start_blocked=true`，真实浏览器、网络、凭证读取、改包和重放仍未授权。
+
+功能门通过最终依赖图 364.5 秒全仓 Go、全仓 vet、聚焦 race/staticcheck、约 820 万次 URL/代理 fuzz、38 文件
+137 项 React、strict TypeScript/Vite build 与 npm 零漏洞。首次 govulncheck 发现 IDNA 路径可达
+`x/text v0.37.0` 的 GO-2026-5970 无限循环风险，交付前升级到修复版 v0.39.0；复扫为零可达漏洞，
+并已在最终依赖图再次通过全仓 Go。未运行浏览器、网络请求、真实进程、Profile 目录、凭证、Docker、
+Shell、Provider 或 Store/Event/Artifact 写入。启用路径无已知未解决高/中风险，边界见 ADR 0069。
+
+双指标保持架构约 99%、完整产品可用度约 95-97%；通用 Coding Agent 约 95-96%，Cyber 自动化约
+20%。下一批 P11-B1/B2/B3 将做无启动可执行文件发现/摘要、一次性目录所有权计划和 Disabled/Fake
+CDP transport；真实导航仍另设启动门。P10-F 没有取消，只是排在浏览器控制批次之后。
+
 ## 八、仓库同步与恢复约定
 
 规范远程仓库：`https://github.com/Qiyuanqiii/CTF-CyberAgent-Workbench`。
 
 每三个聚焦切片组成一个交付批次；第三片后统一执行功能复核、普通/聚焦测试、组合差异审查、项目记忆更新、Git 提交、GitHub 推送和 CI 复核。每两个批次即六个切片再执行全仓 race、vet、staticcheck、govulncheck、依赖/隐私与完整构建健壮性门。当前仓库直接开发并推送 `main`；除非用户明确要求，不创建功能分支或 PR。
 
-长对话恢复时依次阅读：`README.md`、`docs/PROJECT_MEMORY.md`、`docs/PROJECT_STATUS.md`、本文件、`docs/TASK_BOOK.md`、`docs/http-api.md`、`docs/errors.md`，再按序阅读 `docs/adr/0001-*.md` 到 `docs/adr/0067-inert-analyzer-result-staging-and-product-adapter-threat-model.md`。
+长对话恢复时依次阅读：`README.md`、`docs/PROJECT_MEMORY.md`、`docs/PROJECT_STATUS.md`、本文件、`docs/TASK_BOOK.md`、`docs/http-api.md`、`docs/errors.md`，再按序阅读 `docs/adr/0001-*.md` 到 `docs/adr/0069-go-owned-browser-profiles-target-scope-and-session-plan.md`。
@@ -1654,15 +1654,48 @@ authoritative.
 没有接入 Run、事件、SQLite、Artifact writer、CLI、HTTP 或 Desktop。架构约 99%、完整产品可用度约
 95-97%、通用 Coding Agent 约 95-96%、Cyber 自动化约 20%。
 
+## Completed Browser Control Foundation (P11-A1/A2/A3)
+
+P11-A1 fixes three Go-owned browser descriptors: `safe-web`, `ctf-lab`, and
+`ctf-instrumented`. Code mode keeps normal browser security and excludes private targets;
+CTF Lab can describe exact private targets plus interception/mutation/replay/cookie tooling;
+Instrumented can additionally request three explicit security relaxations, requires risk
+acknowledgement and a future container, and marks evidence as instrumented. Every descriptor
+requires disposable state, forbids personal profiles/extensions/password stores/host files,
+and grants zero runtime authority.
+
+P11-A2 adds `browser_target_scope.v1` with at most eight canonical exact HTTP(S) origins,
+IDNA/default-port/IP normalization, redirect and DNS-result revalidation, literal-IP pinning,
+and a stable fingerprint. Safe Web rejects private/loopback rebinding. Every profile rejects
+cloud metadata, link-local, multicast, unspecified/reserved addresses, non-HTTP schemes, URL
+credentials/fragments/backslashes, and off-scope origins.
+
+P11-A3 adds `browser_session_plan.v1`. It binds Session/Run/Workspace, profile/scope digests,
+proxy endpoint and system credential name, requested tooling/relaxations, disposable isolation,
+limits, evidence class, backend, and sorted launch blockers. It stores no proxy secret or userinfo;
+the model cannot clean profiles. `start_blocked` is true and all process/network/profile-write/
+mutation/replay/Artifact plus proxy credential/network authority is false.
+
+The gate passed a final-dependency 364.5-second full Go run, full vet, targeted race/staticcheck, about 8.2
+million URL/proxy fuzz executions, 38 files/137 Web tests, strict TypeScript/Vite, and zero-
+vulnerability npm audit. A first targeted scan found reachable GO-2026-5970 through IDNA in
+`x/text v0.37.0`; v0.39.0 fixes it and the repeated scan has zero reachable findings. No real browser/network/process/
+profile directory/credential/Docker/Shell/Provider/Store/Event/Artifact path ran. Schema/OpenAPI
+remain v84 and 75/83/182. ADR 0069 is authoritative.
+
+中文交接：当前只有 Go 浏览器控制合同，没有可操作窗口、Chromium 启动、导航或抓包。Wails
+WebView2 继续只渲染 Prayu；不能把“Browser Session Plan 已完成”误写成“内置浏览器已可用”。
+架构仍约 99%，完整产品可用度约 95-97%，Coding 约 95-96%，Cyber 自动化约 20%。
+
 ## Next Slice
 
 The next three-slice candidates are:
 
-1. P10-F1: inspect caller-supplied executable bytes as a pure bounded PE/ELF format and target-architecture candidate, without a path, handle, loader, or process start.
-2. P10-F2: define a digest-pinned release-manifest and provenance/signature allowlist candidate; verification metadata must remain non-authorizing and body-free.
-3. P10-F3: define an operator-reviewed resource/sandbox launch-plan candidate covering identity, scope, limits, isolation, cleanup, and audit while every start capability remains false.
-4. This is the first batch in a new six-slice cycle. Run the integrated functional gate after F3; reserve the next full race/dependency/privacy robustness gate for the following three-slice batch.
-5. The manual Windows 10 matrix, signed distribution, real Sandbox release gate, xterm input, network grants, product analyzer execution, and CTF solving remain separate.
+1. P11-B1: discover installed Chromium/Edge candidates and bind bounded executable byte identity, version, and platform metadata without launching them or trusting PATH alone.
+2. P11-B2: define Go-owned disposable profile-directory ownership, collision, restart-recovery, and exact cleanup plans without creating or deleting a real profile directory.
+3. P11-B3: add a package-sealed Disabled/Fake CDP transport with bounded navigation, DOM, screenshot, and request-capture outcome contracts; product process and network authority remain false.
+4. This is the first batch in a new six-slice browser cycle. Run the integrated functional gate after B3; run the full race/dependency/privacy robustness gate after the following three slices.
+5. P10-F1/F2/F3 remain queued. The manual Windows 10 matrix, signed distribution, real Sandbox release gate, xterm input, real browser/network grants, product analyzer execution, and CTF solving remain separate.
 
 ## Local Machine Note
 
 
@@ -2036,14 +2036,46 @@ process/persistence/authority was added. Schema/OpenAPI remain v84 and 75/83/182
 authoritative. Architecture completion remains about 99%, complete product usability about
 95-97%, generic Coding Agent usability about 95-96%, and Cyber automation about 20%.
 
+## P11-A1/A2/A3: Browser Profiles, Exact Target Scope, And Inert Session Plan
+
+P11-A1 adds the fixed Go-owned `safe-web`, `ctf-lab`, and `ctf-instrumented` profile Registry.
+Code mode keeps normal browser security and excludes private targets; CTF Lab permits explicitly
+scoped private targets and request tooling; Instrumented additionally permits explicit security-
+relaxation requests, requires risk acknowledgement and a future container, and marks evidence as
+instrumented. All runtime authority is false, and every profile requires disposable state while
+forbidding personal profiles, extensions, password stores, and host filesystem access.
+
+P11-A2 adds `browser_target_scope.v1`: at most eight canonical exact HTTP(S) origins, IDNA/port/
+IPv4/IPv6 normalization, redirect and resolved-address revalidation, literal-IP pinning, and a
+default-deny fingerprint. Safe Web rejects private/loopback DNS rebinding. Even the highest CTF
+profile always blocks cloud metadata, link-local, multicast, unspecified/reserved addresses,
+credentials in URLs, fragments, backslashes, and non-HTTP schemes.
+
+P11-A3 adds `browser_session_plan.v1`, binding Session/Run/Workspace, profile and target digests,
+non-secret proxy endpoint plus system credential reference, requested capture/mutation/replay/
+cookie/security-relaxation features, fixed disposable isolation, evidence class, limits, backend,
+and launch blockers. Every plan remains `start_blocked=true`; process/network/profile-write/
+mutation/replay/Artifact authority and proxy credential/network authority remain false.
+
+The functional gate passed 364.5 seconds of full Go tests on the final dependency graph, full vet,
+targeted race/staticcheck, about 8.2 million URL/proxy fuzz executions, 38 files/137 React tests,
+strict TypeScript/Vite production build, and zero-vulnerability npm audit. The first targeted Go
+scan found reachable GO-2026-5970 through IDNA in `x/text v0.37.0`; upgrading to fixed v0.39.0
+removed the reachable finding. No real browser, network request, process, profile directory, credential,
+Docker, Shell, Provider, Store/Event, or Artifact path ran. ADR 0069 is authoritative.
+
+Architecture completion remains about 99%, complete product usability about 95-97%, generic
+Coding Agent usability about 95-96%, and Cyber automation about 20%. This batch makes future
+browser execution safer but does not yet give the user an operational browser.
+
 ## Recommended Next Batch
 
-Candidate slices are P10-F1 pure bounded PE/ELF format and target-architecture inspection from
-caller-owned bytes, P10-F2 a digest-pinned release-manifest and provenance/signature allowlist
-candidate, and P10-F3 an operator-reviewed resource/sandbox launch-plan candidate. All three
-must remain pathless or handle-free metadata boundaries with start, persistence, Artifact,
-Run/Event, CLI, HTTP, and Desktop authority false. This begins a new six-slice cycle, so run
-the integrated functional gate after F3 and the full robustness gate after the following batch.
+Candidate slices are P11-B1 bounded Chromium/Edge executable discovery and byte identity without
+launch, P11-B2 Go-owned disposable profile-directory ownership and exact cleanup planning without
+creating a profile, and P11-B3 a sealed Disabled/Fake CDP transport with navigation/capture outcome
+contracts. Process and network authority must remain false through B3. P10-F1/F2/F3 remain queued
+after this browser-control batch rather than being discarded. This starts a new six-slice browser
+cycle, so the full robustness gate is due after P11-B3 plus the following three browser slices.
 
 Keep the Local profile disabled until a real
 OS sandbox makes protected host roots unavailable or read-only; never map it to
 
@@ -502,6 +502,13 @@ schema v65 已增加不可变 `sandbox_docker_production_evidence.v1`：Go 固
 
 状态：最后阶段
 
+- [x] P11-A1：Go 固定 `safe-web`、`ctf-lab`、`ctf-instrumented` 三档浏览器描述和全 false 运行权限。
+- [x] P11-A2：精确 Origin、私网/回环/元数据分类、重定向与 DNS 结果复核、literal-IP 固定。
+- [x] P11-A3：一次性隔离、代理 credential 引用、抓包/改包/重放/安全放宽候选和无启动会话计划；边界见 ADR 0069。
+- [ ] P11-B1/B2/B3：无启动 Chromium/Edge 发现与摘要、一次性 Profile 目录所有权计划、Disabled/Fake CDP transport。
+- [ ] P11-C：经独立审批和生命周期审计后才实现 Safe Web 真实启动、导航、DOM 与截图；不得复用 Wails renderer 或个人 Chrome Profile。
+- [ ] P11-D：CTF Lab 抓包/改包/重放、Cookie 与代理；所有请求继续绑定 exact scope、预算和事件审计。
+- [ ] P11-E：仅容器内开放 Instrumented 安全放宽并强制证据标记，默认档永久保持浏览器原生安全。
 - [ ] 在 Profiles/Skills/Finding/Sandbox 稳定后实现 CTF Mission Profile。
 - [ ] 支持 challenge metadata、附件导入、类别识别和 writeup 投影。
 - [ ] 将二进制、流量、Web、Crypto 分析映射到受控 Skills/Analyzers。