Run with Browser AI · Chapter 17
Run Chapter 17: Capability Contract Workbench
Compare ambiguous controls with a typed search_book capability, then trace discovery, validation, policy admission, bounded invocation and result verification.
← Read From Buttons to Capabilities
Execution
Not inspected
Observed state machine
What “built-in” means in this browser
No capability call has been made in this page yet.
- 01Not inspected
- 02Unsupported
- 03Unavailable
- 04Downloadable
- 05Downloading
- 06Available
- 07Session ready
- 08Running
- 09Completed
- 10Failed
Derived from events
Observatory measurements
Missing evidence stays missing. The dashboard never estimates an absent measurement.
Application instrumentation
Cross the boundary without erasing it
The page can validate what it sends. Extension receipt is confirmed only in the attached DevTools panel.
- 01Application SDKBuild a sanitized envelope
- 02Same-origin bridgeValidate schema and size
- 03Extension transportRoute by inspected tab
- 04DevTools panelConfirm receipt and correlate
To test end to end, load the Observatory extension, attach DevTools to this tab and enable instrumentation for this origin.
Shared lifecycle · distinct contracts
Browser AI capability switchboard
No interface has been inspected. Each check will use that interface's declared creation options.
| Interface | Global | Exposed | Availability | Options |
|---|
Canonical fixture · live task API
Summarization contract
Exposed Not inspected
Availability —
Session None
Load the canonical fixture, then inspect the current browser.
Generated artifact
No summary yet.
Contract evaluation
- No evaluation yet.
Ranked evidence · explicit routing policy
Language routing laboratory
Choose a fixture, then inspect Language Detector.
Ranked detector evidence
| Rank | Language | Confidence | Use |
|---|---|---|---|
| No ranked candidates yet. | |||
Translated artifact
No translation yet.
Translation evaluation
- No translation evaluation yet.
Resource state · measured lineage
Session lineage laboratory
Prompt API Not inspected
Availability —
Inspect the current browser before creating a session.
Original session
Not created- ID
- —
- Parent
- None
- Usage
- —
- Quota
- —
- Remaining
- —
- Clone / destroy
- —
No output yet.
Cloned session
Not created- ID
- —
- Parent
- —
- Usage
- —
- Quota
- —
- Remaining
- —
- Clone / destroy
- —
No output yet.
Shared-history acknowledgement
No shared-history run yet.
Lifecycle invariants
- No invariants evaluated yet.
Finite budget · explicit discontinuity
Context budget laboratory
Prompt API Not inspected
Availability —
Session None
Inspect the current browser before creating a measured session.
Latest runtime result
No turn has run.
Observed deltas
| Turn | Before | After | Δ usage | Outcome |
|---|---|---|---|---|
| No measured turns yet. | ||||
Application-created state transfer
Compaction checkpoint
No checkpoint built.
Checkpoint and lifecycle invariants
- No invariants evaluated yet.
Separate clocks · matched fixture
Latency decomposition laboratory
Prompt API Not inspected
Availability —
Session None
Progress callbacks are reported as monitor observations. They are not relabelled as downloaded bytes.
Inspect the browser, then create a session under an explicit operational label.
Raw observations
| Path | Session | Create | First chunk | Generation | Total | Chars | Chars/s | Outcome |
|---|---|---|---|---|---|---|---|---|
| No latency observations yet. | ||||||||
Latest partial or completed output
No prompt has run.
Protocol checks
- No checks evaluated yet.
Versioned profiles · truthful identity
Model contract compatibility laboratory
Evidence source —
Browser attested —
Profile version —
Label this browser configuration, inspect the profiles, then run the matched compatibility suite.
| Versioned profile | Option SHA-256 | Availability | Creation | Asset callbacks | Prompt | Destroyed | Exact error |
|---|---|---|---|---|---|---|---|
| No compatibility observations yet. | |||||||
Latest local fixture output
No compatible profile has run.
Evidence invariants
- No invariants evaluated yet.
Two timelines · one authority gate
Validation pipeline laboratory
Prompt API Not inspected
Availability —
Session None
Decision Not evaluated
Operational timeline
- 01InspectNot run
- 02CreateNot run
- 03PromptNot run
- 04DestroyNot run
Evaluation and effect timeline
- 01ParseNot run
- 02InvariantsNot run
- 03Human reviewAwaiting candidate
- 04DecisionNot evaluated
- 05CommitNot authorized
Protected source policy
Inspect the browser for a live run, or load a labelled specimen to exercise the evaluator immediately.
Immutable candidate · No candidate
No candidate has been produced or loaded.
Automatic evaluation
- No checks evaluated yet.
Human rubric · —
No candidate is ready for review.
No human judgment recorded.
Authority boundary
Nothing committedAcceptance only enables a separate in-memory commit. This laboratory performs no external action.
| Stage | Outcome | What this establishes | Duration |
|---|---|---|---|
| No candidate evaluated yet. | |||
Seven fixtures · paired evidence
Feature evaluation and release gate
Suite —
Capture —
Gate Not evaluated
Classify the seven interfaces, run the non-AI baselines, then collect the current browser observations.
Paired feature matrix
| Feature / evidence path | API state | Slices | Baseline | Live automatic | Human rubric | Current | Transition |
|---|---|---|---|---|---|---|---|
| No fixture matrix loaded. | |||||||
Latest raw candidate · metrics-only trace
No live candidate yet.
Risk-based release gate
- No gate evaluated yet.
Raw repetitions
| Case | Rep | Session | Operational | Automatic | Total |
|---|---|---|---|---|---|
| No live observations yet. | |||||
Slice outcomes
| Slice | Accepted | Evaluated | Rate |
|---|---|---|---|
| No slice evidence yet. | |||
Explicit route · declarative jobs
Fallback router and local worker coordinator
Policy —
Prompt API Not inspected
Availability —
Selected route Not decided
Inspect the current browser or select a failure state, then apply the explicit degradation policy.
Decision explanation
No route decision yet.
Rejected alternatives
- No alternatives evaluated.
In-page contract simulator
Local worker coordinator
The production owner is a loopback service. This page does not watch a directory or contact an AI service.
Registered worker specimens
| Worker | Tags | Status | Model evidence | Source |
|---|---|---|---|---|
| No workers registered. | ||||
Validation result
- No job validated yet.
Lease controls
No job accepted.
Queue and attempts
| Job | State | Worker | Attempt | Lease |
|---|---|---|---|---|
| Queue is empty. | ||||
Append-only audit
- No coordinator events.
Chapter 16 laboratory
Structured output firewall
Compare constrained and unconstrained model output, then make every trust transition inspectable. The final action is a page-memory dry run with no external effect.
Inspect the generation constraint and candidate schema
Loading schema…
Loading the structured-output experiment…
| Stage | Outcome | Evidence | What it establishes |
|---|---|---|---|
| No candidate validated yet. | |||
Dry-run job preview
No dry run executed.
Chapter 17 laboratory
Capability contract workbench
Inspect the difference between a typed software capability and a guessed interface action. The only executable path is a bounded, read-only search over a fixed in-page corpus.
Select and inspect a route.
| Observed surface | Visible label | Available semantics | Laboratory action |
|---|---|---|---|
| Inspect a route to see its evidence. | |||
Inspect the application-provided capability definition
Loading definition…
Lifecycle controls
Loading the capability workbench…
No capability result yet.
Invocation ledger
| Call | Route | Permission | Result | Matches | External effect |
|---|---|---|---|---|---|
| No invocations recorded. | |||||
Chapter 18 laboratory
WebMCP search_book
Inspect the experimental browser surface, register one bounded read-only capability, test its deterministic contract, and observe replacement and removal. No model-selection claim is inferred from a manual test.
Inspect the browser before choosing a registration surface.
Inspect the registration definition and effect contract
Loading definition…
Bounded result
No capability result yet.
Registration history
| At | Action | Surface | Version | Registration | Outcome |
|---|---|---|---|---|---|
| No registration events. | |||||
Tool-call ledger
| Call | Source | Surface | Arguments | Permission | Result | External effect |
|---|---|---|---|---|---|---|
| No tool calls. | ||||||
Chapter 19 laboratory
Tool-choice behavioral evaluator
Change what the model can discover, alter the metadata it sees, introduce catalog pressure, and diagnose the exact stage where a candidate stops matching the task.
Registered tool visibility
Task
Loading fixture…
Run controls
Loading the tool-choice evaluator…
Live selection and result-use output
No live model output.
Deterministic tool result
No deterministic tool result.
Evaluation ledger
| Run | Source | Fixture | Metadata | Visible | Passed | Failed | Diagnosis |
|---|---|---|---|---|---|---|---|
| No evaluations. | |||||||
Chapter 20 laboratory
Prompt-injection containment laboratory
Mix trusted policy with hostile page text, tool metadata and tool results. Observe whether the model follows the attack, then independently verify whether deterministic policy prevents an external effect.
Capability scopeLoading…
Explicit trust domains
Visible tool catalog and application policy
| Tool | Untrusted description | Normalized effect | Authority | Provenance |
|---|---|---|---|---|
| Loading catalog… | ||||
Run controls
Loading the containment laboratory…
Raw live model output
No live model output.
Bounded execution result
No deterministic result.
Security evaluation ledger
| Source | Scenario | Attack source | Model | Policy | Execution | System |
|---|---|---|---|---|---|---|
| No security evaluations. | ||||||
Chapter 22 laboratory
Personal browser policy engine
Extract bounded content units, collect typed evidence, compile an inspectable policy, and mediate the fixture feed locally. A model may supply evidence; deterministic rules select the presentation action.
Pipeline controls
Loading the personal policy engine…
This contained page demonstrates presentation control without deleting source content. Re-run the same policy to observe origin/provider/version-scoped cache hits.
Contained sample feed
Editorial · reading
A calm explanation of browser capability boundaries
The browser can expose a capability without deciding how an application should use it. Policy remains visible, versioned and under the reader's control.
Sponsored · declared by fixture adapter
Act now—this offer disappears in minutes
Unlock the exclusive upgrade immediately. Do not miss the countdown.
Analysis · long reading unit
Why evidence and policy must remain separate
A provider reports observations under a declared contract. Those observations can be direct declarations, deterministic measurements, model assessments or unavailable signals. The policy compiler then applies ordered predicates outside the provider. This separation matters because replacing a runtime should not quietly replace the user's rule. It also preserves unknown evidence rather than treating missing output as proof that a unit is harmless. A presentation decision therefore names the extractor, provider, policy version, matching rule and reversible action. The resulting trace is useful both for debugging one surprising decision and for comparing policy behaviour across many units.
Media · autoplay declared
Breaking video begins automatically
The fixture marks this unit as autoplaying so deterministic evidence can act before model inference.
Private message composer
Synthetic private region
This text exists only to prove that the extractor excludes the region before reading it.
Payment form
Synthetic payment region
The policy engine must never ingest this fixture content.
Below simulated viewport
Deferred content unit
This unit demonstrates viewport budgeting: the extractor identifies its boundary, but evidence collection is deferred.
Unit decisions
| Unit | Status | Evidence | Provider | Policy | Action | Rule | Cache |
|---|---|---|---|---|---|---|---|
| No policy decisions. | |||||||
Decision audit
| Time | Unit | Provider | Policy | Action | Reason | Cache | Data boundary |
|---|---|---|---|---|---|---|---|
| No policy events. | |||||||
Chapter experiment
From Buttons to Capabilities
Loading the chapter experiment…
No model output yet.
Inspect the context supplied by this chapter
What this experience knows
This experience is grounded in Chapter 17 and treats a capability as an explicit software contract.
Identity boundary
A tool name is not globally unique. The effective specimen identity combines origin, name, version and registration ID. Its description and effect declaration are application-provided, not browser-attested facts.
Discovery boundary
Discovery snapshots the exact definition and its schema fingerprint. Persuasive manifest text cannot increase trust.
Route boundary
The laboratory labels three routes: structured capability, DOM-derived action and visual action. Only the structured route has a declared contract and implementation. The two fallback routes are evidence-only and never clicked.
Argument boundary
Arguments are parsed as one complete JSON value and checked again by the implementation. The schema rejects unknown fields, short or oversized queries and limits outside 1–10.
Effect boundary
search_book is classified as a read within the current book. The policy can admit that narrow effect, but it does not grant write, purchase, publication or cross-origin authority.
Invocation boundary
The implementation searches a fixed in-page corpus and returns at most the requested number of known chapter references. Excerpts are capped at 180 characters.
Result boundary
Returned chapter IDs, URLs, count and excerpt sizes are validated after invocation. A resolved promise is not accepted blindly.
WebMCP boundary
No tool is registered with document.modelContext in this chapter. The workbench builds and tests the durable capability contract first; Chapter 18 exposes it through the evolving browser surface.
Evidence boundary
Observatory events record hashes, counts, decisions and durations in metrics-only mode. Query text and excerpts remain in page memory.
This workbench compares two interfaces to the same page: ambiguous controls intended for people and an explicit capability intended for software. It records the complete lifecycle of a bounded, read-only search_book invocation.
The capability is an application-provided specimen, not a live WebMCP registration. Chapter 18 will connect the same contract to the browser API. DOM-derived and visual routes remain inspectable here, but the laboratory never actuates them.