# ADR-0077: Eve browser and native computer-use ownership **Status**: Proposed — engineering direction agent-adopted; named production ratification pending **Date**: 2026-09-08 **Authors**: Eve SOTA gap-closure task 6.1 **Reviewers**: _pending_ — Product owner, Eve workbench/platform owner, Security owner, Evaluation owner, Reliability owner > This ADR is effective for implementation and CI on merge. It chooses owners > and fail-closed boundaries; it does not admit native computer use, approve > live browser autonomy, or fabricate named human review. ## Context The repository contains three browser-shaped paths. The Eve/Hermes assistant has five real Playwright tools behind `createPlaywrightPageController`. `@psyche/browser-automation` is a second, broader Playwright state machine still imported by the Teams and Webex conferencing adapters. `@psyche/computer-use-core` is an unwired screenshot/reason/act loop that reaches the OS through `@oshun/iris-computer-use-native`; Task 6.2 moved its planning and vision paths behind the shared model registry/provider interfaces, and Task 6.3 made missing native capabilities fail closed while isolating doubles behind testing subpaths. Without an ownership decision, admitting the third path could create two ways to drive the browser, two session models, and two security/evaluation surfaces. Browser Playwright evidence would also be easy to mislabel as proof of OS-level desktop control. ## Decision ### One Eve browser driver `@oshun/assistant` owns Eve browser driving through `createPlaywrightPageController` and `createBrowserTools` in [`libs/oshun/assistant/src/tools/browser.tool.ts`](../../libs/oshun/assistant/src/tools/browser.tool.ts). Its engine is the real `playwright` package. - Eve runtime code may consume that owner; it may not import Playwright directly from another production module. - Playwright test projects and repository verification scripts are evidence drivers, not product-runtime owners. - A second browser state machine, wrapper, CDP client, or native pixel loop aimed at a browser window is rejected by default. - Browser launch, contexts/pages/profiles, DOM selectors, navigation/history, cookies/storage, network interception, and browser transfer all stay with this owner. The current Eve production-source census has 1424 files, 1 direct Playwright importer, and 0 import of the legacy Psyche browser package. The sole direct importer is: - `libs/oshun/assistant/src/tools/browser.tool.ts` ### A sharply bounded native owner `@psyche/computer-use-core` has value only at the operating-system boundary: native display/window pixels, accessibility, application/window identity and focus, pointer, keyboard, scrolling/dragging, governed clipboard, and governed native file dialogs. It must not launch or connect a browser engine, own browser contexts/pages/profiles, operate the DOM, navigate URLs/history, intercept browser traffic, manage browser storage or transfers, or drive a recognized browser window through native input. Detecting that pixels belong to a browser is allowed only so the native path can refuse and hand the task to the Playwright owner. The source census finds 2 native-binding importers, 0 prohibited browser imports, and 0 browser-driving syntax hits. It also records provider ownership and the post-audit absence of production fallback/test-double surfaces without treating the package as admitted: - Direct provider importers: none (Task 6.2 completed the shared-provider rebind). - Production fallback-bearing files: none (Task 6.3 completed). - Production test-double-exporting files: none (Task 6.3 completed). ### Existing Psyche browser machine `@psyche/browser-automation` is frozen as a legacy, non-Eve adapter. Its two current production source consumers may remain until migration, but they are not precedent for a new consumer or for Eve admission: - `libs/psyche/teams-integration/src/teams-ui-automation.ts` - `libs/psyche/webex-integration/src/webex-ui-automation.ts` Deleting or migrating either consumer is allowed. Adding a consumer, dependency, or Eve import fails the static gate. ### A measured exception cannot create two owners The default answer is no. Before implementation, an exception needs a successor ADR, a named decision owner, and a preregistered same-task/same-budget/same-environment comparison covering at least 10 independent cases across at least 3 task families. It must report verified-task-success, human-intervention-rate, unsafe-action-rate, false-success-rate, latency, cost, and show no security, privacy, or reliability regression. A win transfers or extends the single owner; it never permits two browser machines to coexist. An exception receipt that merely shows a demo, synthetic mock, or browser emulation is inadmissible. ## Rejected options | Option | Reason | | ------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------- | | Admit `computer-use-core` for browser and desktop work | It duplicates the Playwright owner and makes browser evidence indistinguishable from native proof. | | Make `@psyche/browser-automation` the Eve owner | Its broad session, page-object, network, cookie, and storage machine is already legacy and exceeds Eve's existing minimal tool contract. | | Treat every Playwright test as a browser owner | Test harnesses verify products; they are not product runtime authority. | | Permit both drivers and select dynamically | A router does not remove duplicate state, policy, security, and evaluation surfaces. | | Allow an undocumented special case | "Measured" requires a preregistered comparison and an accountable decision, not an implementation-first waiver. | ## Governance and downstream gates Implementation posture is `effective-on-merge`. Live admission is `blocked`. Named ratification remains `pending`. | Task | Obligation retained | | ---- | ----------------------------------------------------------------------------- | | 6.2 | Completed: shared provider bindings and governed screenshot-input contract. | | 6.3 | Completed: production paths fail closed and doubles are test-confined. | | 6.4 | Prove OS-level control in a separate real native fixture. | | 6.5 | Enforce per-run native authority, freshness, budgets, and verified end state. | | 6.6 | Admit native computer use only after all preceding gates pass. | ## Consequences - Eve browser work has one code owner and one engine surface to secure and evaluate. - Native desktop proof must use a separate OS-level fixture; Playwright can verify browser composition but cannot substitute for it. - Browser recognition in the screen analyzer remains useful as a refusal/handoff signal, not authority to drive the browser. - The two frozen conferencing consumers remain visible migration debt instead of silently becoming approved architecture. - The machine record is [`docs/audits/eve-sota-computer-use-ownership/2026-09-08.json`](../audits/eve-sota-computer-use-ownership/2026-09-08.json), digest `4a0c65f3f16e716c293ece4e921571eb33455cdbad41b36f8cbc79bf3f7fdade`. ## Limitations - This is a source-derived ownership and admission contract. It does not execute a browser or native desktop and does not admit computer-use-core to Eve. - The existing @psyche/browser-automation state machine remains in two non-Eve conferencing adapters as frozen migration debt; this decision prevents expansion but does not remove those consumers. - Task 6.2 removed the direct Anthropic binding and added separate registry/provider contracts for planning and vision with governed screenshot inputs; this ownership record does not itself prove the retained live provider calls. - Task 6.3 removed native-unavailable false successes, isolated test doubles behind explicit testing subpaths, and retained the simulated Iris desktop prototype only as a production-unreachable test-only package. - Named product, platform, security, evaluation, and reliability ratification is pending. Live native admission remains blocked through task 6.6.