[alvarohulse]

Summary

• Support concurrent proof sessions with durable registry-backed ownership, lifecycle serialization, explicit session selection, and recovery-safe cleanup.
• Isolate the pinned agent-browser 0.34.0 runtime, contain browser commands and navigation, and keep raw browser/network evidence private while publishing sanitized summaries.
• Reject synthetic or incomplete proof and unsafe output paths, strengthen artifact provenance, require Node 24, and update the CLI, skills, documentation, and CI runtimes.

Test plan

Build / Unit / Integration / E2E

• npm ci
• npm run build — build and DTS output passed under Node 24
• node dist/bin/proofshot.js --help
• node dist/bin/proofshot.js --version
• npm pack --dry-run
• npm test — 548/548 tests across 34 files
• npm run test:ffmpeg — real FFmpeg integration passed

User testing

• Under Node 24.19.0, verified agent-browser 0.34.0 JSON success/error handling, idle restart, two isolated sessions, recording finalization, text-only HAR capture, and exact process/socket/listener cleanup.
• Verified the managed Doggo preflight reports ProofShot source c4dcf97, CLI SHA-256 804c33caca90cb000a78f9de6d8134554c48fa7a69ab5b76ba323513594e0be3, ffmpeg availability, a healthy doctor result, and an empty session inventory.
• The supervised ProofShot browser canary remains intentionally human-gated and was not run unattended.

Revert risk

High: this changes core session lifecycle, process ownership, browser containment, evidence redaction, artifact creation, and the minimum Node runtime.

Notes

npm ci reported eight dependency vulnerabilities (3 moderate, 4 high, 1 critical). Their triage remains a separate follow-up.