# Human takeover and progress messages

## Implemented

- Opening acknowledgements and results remain chat messages. Routine updates use
  `report_progress`, which emits `user_progress` and replaces the current status
  text. Progress is not a final answer and is omitted from the saved transcript.
- Raw model scratchpad and tool statuses do not become conversational progress.
  A collapsed execution-details panel contains only tool names and completion
  status, not arguments, model scratchpad or captured credentials.
- `browser_handoff` and `request_box_help` create an identified question. The UI
  automatically embeds the existing shared desktop in the conversation. It does
  not move Cloudflare widgets or create a different login session.
- The shared viewer appears once, can be expanded, and does not expose restart/
  update controls during takeover. The ordinary message composer is disabled
  during takeover; passwords and verification codes are entered on the original
  website, not in chat.
- The human presses Done to return control. The authenticated endpoint accepts
  only task ID, question ID and an enumerated done/cancel action. Completion is
  delivered directly to the original worker without a coordinator model round.
  Owner, pending question and task status are checked; duplicate submissions are
  idempotent. Cancel affects only that task and its children.
- Waiting tasks retain their tool context/browser session. New AI desktop,
  browser and external-execution requests are rejected while a human holds the
  shared computer. Other public research can continue.
- Hand-back is a request to inspect the original page, not proof of login success.
  Bounded research permits one verification read after hand-back even when its
  collection limit has been reached.

## Security boundary and deferred integrations

This version deliberately uses the original website in the embedded desktop.
It does **not** provide a separate password/OTP text field or independent CAPTCHA
image relay, and does not claim that AI can never observe credentials. Existing
in-flight operations and privileged host access are not a cryptographic
isolation boundary.

A future secret-input broker needs separate authorization, destination binding,
protected browser observation, disabled sensitive logging, expiration and
end-to-end tests before displaying a "not sent to AI" claim. Installing 1Password
alone does not establish that boundary. No password manager or vault connection
is installed by this change.

## Verification

- `cargo test --workspace`
- `npm --prefix web run build`
- With local Vite running: `node tests/handover_ui.mjs`

The browser test uses an isolated profile, mocked API and fake credential. It
checks automatic takeover, one viewer, paused animation, direct task hand-back,
and that credentials/raw scratchpad are not sent as ordinary chat messages.