Demo evidence

Status

assets/demo.gif (and the matching assets/demo.mp4) is presented as an 18-second continuous screen recording of an Agent Browser run, not as the older montage of stills. The capture record says ffmpeg -f x11grab recorded the same X display used by the session's browser and noVNC view. It attributes the typing and sign-in click to POST /browser/interact, the page changes to the session's own navigation, and the takeover keystrokes to that display while the session stayed open. The retained public evidence and its independently verifiable limits are stated below.

The recording illustrates the product's human-takeover flow end to end: an agent drives the session over the API, reaches a two-factor prompt it has no way to answer, stops; a human types into the displayed session; the agent then calls snapshot and continues against the unblocked page.

How the recording was made

Field	Recorded value
Capture method	ffmpeg -f x11grab -draw_mouse 1 -framerate 25 -video_size 1280x800 -i :99, single continuous take, 18 s
Agent actions	POST /browser/session/create, /browser/navigate, /browser/interact (type, click), /browser/snapshot against the API in src/agent_browser/
Human takeover	Pointer and keystrokes delivered to the same X display the session owns, while the session remained active
Target site	A local fixture served on http://127.0.0.1:8080 (sign-in → two-factor → dashboard), allowed through the project's own AGENT_BROWSER_TEST_MODE / AGENT_BROWSER_TEST_ORIGINS fixture path so the loopback destination policy stays otherwise intact
Browser binary	Chromium 141.0.7390.37, launched through Patchright by the unmodified session manager. The source-built Compose image installs Google Chrome Stable instead; the recording host already had a Chromium build at the Chrome path, so this run used it. The runtime, API, policy, and session code are unmodified.
Post-processing	Caption bar composited below the frame (drawtext); frames, timing, and content unaltered
Captions	Derived from the run's own action log, timestamped against the recording

Honest limits of this recording

• The fixture site is local and synthetic, so the run is reproducible and contains no third-party content. It exercises the same navigation, interaction, and snapshot paths as any other target.
• The browser binary is Chromium rather than Google Chrome Stable (see the table). The Compose quickstart installs Chrome.
• The caption bar is an editorial overlay added after capture. The browser frame above it is untouched.
• The repository does not retain the raw capture or timestamped action log, so a third party cannot independently re-verify the capture operator's single-take and no-replay assertions from the published files alone.
• The social preview (assets/social-preview.png) is a prepared brand asset and is not runtime proof.

Public provenance and integrity

The current media first entered public history in pull request #61, whose head was da3db74f1c9fa3d3867e660bc52936c0cf181db3 and whose merge commit is 0bb66239232d038a49323dc6310557b3c89939b7. That change touched the README, this evidence file, and demo media only; its executable runtime tree therefore matches its v0.1.0 parent. The public record does not bind the capture itself to an exact source commit or hosted capture job.

SHA-256 values for the currently committed media:

• assets/demo.gif: db9e3fb9a378b5c8c28556224577b78e72a834188259e0f93c06cb15d5c99e13
• assets/demo.mp4: f9c5445717e2768d4f116d295bd009d6b8406dfdb7875f9b338d9b9476ada7f8
• assets/demo-poster.png: 6a716cb68e9867bdbc0aeee3bb7fa74d9def8e6208f87c998fba2e9b137e2b46

Superseded: the v0.1.0 release-candidate media

The section below documents the earlier assets/demo.mp4 and assets/demo-poster.png — an eight-second montage of three still frames with no live motion. Those files have been replaced by the continuous recording described above. The acceptance evidence recorded here still stands on its own and is retained unchanged for the v0.1.0 release record.

Capture record (superseded media)

Field	Recorded value
Exact 40-character commit	e9a9000700e2dc4d1c11724be3ee8894a2709436
Immutable container image ID	sha256:25e81e9acb1a9a8ff3f36dc8f6775f5ad1736eabdf95ae53f4c6c3384ef777f1
Build command and run URL	Rootless podman build against a private per-job Podman API, release-evidence workflow, container job
Acceptance command and run URL	Isolated exact-image acceptance in a --network none pod, same run, acceptance job
Agent Browser version	0.1.0 (agreed across project, package, Compose, and image label at this commit)
Google Chrome Stable executable, package version, architecture, and source	/opt/google/chrome/chrome, Google Chrome 152.0.7977.75, package google-chrome-stable 152.0.7977.75-1, amd64, installed in-image via patchright install --with-deps chrome
Capture date in UTC	2026-09-03, 01:57:24Z to 01:57:41Z
Capture operator	Automated release-evidence workflow on a GitHub-hosted ubuntu-24.04 runner; no interactive operator step
assets/demo.mp4 SHA-256	0ded738bd0c7cf2646cefdb94e1194ee77f5b5430fc578503015ac6dc0987e81
assets/demo-poster.png SHA-256	f8197cafcf4d7ce0bc7e323256307a9d2ed687a0fb96d416dd4e4178feb8a9f3
assets/social-preview.png and Pages-copy SHA-256 and dimensions	e3473f97af387d28bed32e8959873b79175ccc305e17dfa7aa310ef1e9329556; 1280x640; docs/assets/social-preview.png is byte-identical

How the superseded media was produced

Two real frames were taken during the isolated acceptance run against the exact image:

• demo-frames/api-before.png (834c3641a04a1c20ba76cda64da82567272581f13c15bb5b93c210f1eaab9763) — the page as returned through the control API, before the interaction batch.
• demo-frames/display-after.png (f8197cafcf4d7ce0bc7e323256307a9d2ed687a0fb96d416dd4e4178feb8a9f3) — an X11 screenshot of the container display, after the interaction batch.

assets/demo-poster.png is a byte-identical copy of demo-frames/display-after.png.

assets/demo.mp4 is an eight-second silent H.264 montage (1280x720, 30 fps) concatenating three still images: two seconds of assets/social-preview.png, three seconds of api-before.png, and three seconds of display-after.png. It contains no audio track and no live motion. Checksums for both generated files were written by the workflow to generated-assets/SHA256SUMS and match the committed files byte for byte.

What the superseded frames show

Both frames render the same deterministic release fixture, served over container loopback at 127.0.0.1:18080, with the same generated nonce visual-proof-a3c237fb698c9854200f497ee196b811 and the same generated proof color #68c173. acceptance.json records that color and the nonce digest d89143ca65da86f83a2f69b2a72c0b2ba2691d686feaa0202baa6af54064af6f, which is how the same-display check is bound to this run rather than to a stock page.

In display-after.png the owned fixture page is the active, foregrounded tab; the button reads clicked and the text field contains acceptance text, so the API-driven interaction is visible on the container display. A bounded, denied popup tab remains present but inactive in the background, which is the expected outcome of the popup-bounded check: the popup is refused and bounded rather than silently allowed, and the owned page is restored to the foreground before the click returns.

What the superseded v0.1 acceptance proved

acceptance.json reports PASS over 33 checks bound to the same image ID, covering:

• image binding: exact-image-id-handoff, runtime-image-id-proof, remote-podman;
• isolation: isolated-pod-network-none, resource-bounded-pod, same-pod-namespace, loopback-fixture, in-namespace-http-driver, loopback-listener-proof;
• session authority: health, session-create, capacity-rejection, observer-refusal, controller-success;
• interaction: navigation, snapshot, click, type, press, scroll, second-snapshot;
• refusals: direct-ssrf-refusal, redirect-refusal, download-non-persistence, popup-bounded;
• human takeover surface: novnc-web, novnc-websocket, vnc-rfb-readiness;
• visual binding: same-display-color-proof;
• teardown: idempotent-end, process-cleanup, profile-cleanup, pod-cleanup.

Superseded v0.1 social-preview provenance

The committed logo is assets/agent-browser-logo.png, SHA-256 bb3a63b2a54e3a48dbdc77605f3511d5211ae5b695bac831ca689c7bc593b4e2. It is rebuilt from the owner-supplied artwork, which had previously been committed as a JPEG carrying a transparency checkerboard and a dashed border painted into its pixels rather than a real alpha channel. The committed PNG is 424x452, has a genuine alpha channel, drops the painted border, and uses a 64-colour palette so that JPEG ringing no longer blurs the pixel-art edges.

assets/social-preview.png is a generated 1280x640 brand card, not a screenshot and not runtime proof. It is composed programmatically from the committed logo plus flat vector shapes and text: the product name, the vendor line, the tagline, a decorative API panel, and the footer "Self-hosted Chrome · API control · Live human takeover". The API panel lists only routes that the v0.1 surface actually implements, and its "CONNECTED / 1280x800 / noVNC" strip is decorative styling rather than a captured session readout. docs/assets/ holds byte-identical publication copies of both images so a /docs Pages build cannot escape its source root. The card depicts the product contract but is not itself a record of a live run.

Superseded v0.1 observation record

• Automated acceptance proved: every check listed above, executed against the exact image inside a network-isolated pod.
• Human visual observation: the two committed frames and the generated poster were reviewed after the run and match the recorded nonce, proof color, and interaction state described above.
• Takeover exercised: the noVNC web endpoint, its WebSocket, and VNC/RFB readiness were verified as reachable on container loopback. An interactive human takeover session was not part of this automated run.
• Edits applied to the final media: scaling and letterbox padding to 1280x720, concatenation of the three stills, H.264 encoding at CRF 20, and removal of the encoder creation timestamp. No crop, speed change, redaction, or retouching was applied to the frame content.

Superseded v0.1 limitations

• The superseded v0.1 video was generated from stills, not a continuous recording, and proved nothing on its own.
• This evidence covers a single local, network-isolated container run. It does not demonstrate hosted or multi-tenant operation, remote network security, sustained load, or availability.
• Chrome inventory and notice evidence are for transparency and do not grant redistribution authorization. Distribution of this release is source-only.
• Rebuilding the same source later may resolve a newer Chrome Stable version than the one recorded here.

Superseded v0.1 integrity check

At the time of the v0.1 acceptance record, those assets were re-hashed after copying and matched generated-assets/SHA256SUMS from the run. The poster and video were visually reviewed, the social preview was exactly 1280x640, and the release verifier was re-run at the commit that contained them. Those historical hashes do not describe the current continuous media; its hashes are listed in Public provenance and integrity.