Browser Sandbox & Pixel Auditor Audit

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R33 — Playwright

   R25 — Docker security

   R41 — Agentic security

   R21 — MCP

   R22 — OAuth

   R27 — OpenTelemetry

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Audit P3 browser sandbox: disposable Playwright profile, confined download dir, egress allowlist, command denial, D9 screenshot/OCR/DOM coordinate verification, parameter-bound approval, and C6 human takeover/emergency stop. Run malicious webpage tests.

   Run the complete P3 RC suite: workflow invariants, D2 MCP auth, D3 message bus, D7 OAuth delegation, D9 browser isolation, C4 code-diagnosis sandbox, D11 trajectory ledger, D8 PyRIT CI gate (C12), and M10 misuse evaluation.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   No separate task text for this block on day 88 — the sourced work sits in the block above. Keep the time box.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Freeze P3 RC package: architecture diagram, threat model, test/evaluation report, and residual-risk statement.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R21Model Context Protocol (MCP)↗ modelcontextprotocol.io

  Official specification: client/server lifecycle, JSON-RPC messages, tool discovery, authorization, and trust boundaries.

• R22OAuth 2.0 Security BCP (RFC 9700)↗ rfc-editor.org

  RFC 6749 core flows + RFC 9700 security best practices: narrow scopes, audience restriction, token leakage, and replay.

• R25Docker Security Docs↗ docs.docker.com

  Daemon surface, Linux namespaces/capabilities, rootless/non-root containers, read-only FS, and secrets.

• R27OpenTelemetry Documentation↗ opentelemetry.io

  Traces, spans, context propagation, semantic conventions, and redacting sensitive attributes.

• R33Playwright Documentation↗ playwright.dev

  Isolated BrowserContext, downloads, permissions, screenshots, bounding boxes, locators, and tracing.

• R41OWASP Agentic AI Resources↗ genai.owasp.org

  Agentic threat taxonomy: tool misuse, excessive agency, memory poisoning, inter-agent trust, and human oversight.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsPlaywright
  Isolation

  Shows that each BrowserContext is an incognito-like profile with its own cookies and storage, which is the disposable-profile primitive your D9 browser sandbox must create per task.

  R33checked 2026-11-11
• videoDatadog
  Container Security Fundamentals - Seccomp

  Demonstrates filtering container syscalls with a seccomp profile, the concrete mechanism for command denial when a computer-use agent tries to shell out of its sandbox.

  R25checked 2026-11-11
• videoNaveen AutomationLabs · 18:08
  #5 - BrowserContext in Playwright || Handle Two different user sessions with BrowserContext

  Builds two fully separate browser sessions side by side, which is the practical test for whether your agent's profile isolation actually prevents cross-session cookie leakage.

  R33checked 2026-11-11
• articleSafeguard.sh
  Container Isolation: Namespaces, Cgroups, Seccomp

  Frames containers as three kernel primitives and catalogs the escape-prone misconfigurations (privileged flags, host mounts), the checklist for auditing the agent's container boundary.

  R25checked 2026-11-11
• docsDocker Docs
  Rootless mode

  Explains running both daemon and container inside a user namespace with no root, the baseline control when the code-diagnosis and browser sandboxes share one host.

  R25checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.