LazyBoy2/docs/HUMAN-HANDOVER.md

Human takeover and progress messages

Implemented

• Opening acknowledgements and results remain chat messages. Routine updates use report_progress, which emits user_progress and replaces the current status text. Progress is not a final answer and is omitted from the saved transcript.
• Raw model scratchpad and tool statuses do not become conversational progress. A collapsed execution-details panel contains only tool names and completion status, not arguments, model scratchpad or captured credentials.
• browser_handoff and request_box_help create an identified question. The UI automatically embeds the existing shared desktop in the conversation. It does not move Cloudflare widgets or create a different login session.
• The shared viewer appears once, can be expanded, and does not expose restart/ update controls during takeover. The ordinary message composer is disabled during takeover; passwords and verification codes are entered on the original website, not in chat.
• The human presses Done to return control. The authenticated endpoint accepts only task ID, question ID and an enumerated done/cancel action. Completion is delivered directly to the original worker without a coordinator model round. Owner, pending question and task status are checked; duplicate submissions are idempotent. Cancel affects only that task and its children.
• Waiting tasks retain their tool context/browser session. New AI desktop, browser and external-execution requests are rejected while a human holds the shared computer. Other public research can continue.
• Hand-back is a request to inspect the original page, not proof of login success. Bounded research permits one verification read after hand-back even when its collection limit has been reached.

Security boundary and deferred integrations

This version deliberately uses the original website in the embedded desktop. It does not provide a separate password/OTP text field or independent CAPTCHA image relay, and does not claim that AI can never observe credentials. Existing in-flight operations and privileged host access are not a cryptographic isolation boundary.

A future secret-input broker needs separate authorization, destination binding, protected browser observation, disabled sensitive logging, expiration and end-to-end tests before displaying a "not sent to AI" claim. Installing 1Password alone does not establish that boundary. No password manager or vault connection is installed by this change.

Verification

• cargo test --workspace
• npm --prefix web run build
• With local Vite running: node tests/handover_ui.mjs

The browser test uses an isolated profile, mocked API and fake credential. It checks automatic takeover, one viewer, paused animation, direct task hand-back, and that credentials/raw scratchpad are not sent as ordinary chat messages.