LakshmanTurlapati · Oct 15, 2026 · Oct 15, 2026 · Oct 15, 2026 · Oct 15, 2026 · Oct 15, 2026
diff --git a/.gitattributes b/.gitattributes
@@ -3,3 +3,7 @@ graphify-out/**/manifest.json filter=lfs diff=lfs merge=lfs -text
 graphify-out/**/*.graphml filter=lfs diff=lfs merge=lfs -text
 graphify-out/**/*.svg filter=lfs diff=lfs merge=lfs -text
 graphify-out/**/graph.html filter=lfs diff=lfs merge=lfs -text
+
+# Phase 66 benchmark fixtures are hashed byte for byte by scripts/bench/tasks/core.lock.json;
+# never convert their line endings on checkout.
+scripts/bench/fixtures/** -text
diff --git a/.gitignore b/.gitignore
@@ -47,7 +47,7 @@ lattice/
 Logs/
 Extenive logs, multiple scenariaos.txt
 showcase/server/fsb-data.db*
-Research/
+/Research/
 
 # Quick task 260630-hct -- self-hosted DB-IP IP-to-City Lite region dataset.
 # The real ~100MB production artifact is generated by
@@ -78,3 +78,6 @@ graphify-out/.graphify_uncached.txt
 
 # local secrets directory
 .secrets/
+
+# Phase 66 -- raw benchmark captures (may contain page content; D-21)
+scripts/bench/.local/
diff --git a/.planning/MILESTONES.md b/.planning/MILESTONES.md
@@ -1,5 +1,28 @@
 # Project Milestones: FSB (Full Self-Browsing)
 
+## v0.9.91 MCP Clients as Providers (Shipped: 2026-09-28)
+
+**Phases completed:** 9 phases (57-65), 61 plans, 157 tasks
+
+**Delivered:** Installed agent CLIs (Claude Code, OpenCode, Codex) became key-less side-panel providers that drive the live browser back through FSB's own MCP tools.
+
+**Key accomplishments:**
+
+- Agent identity capture: MCP `initialize` clientInfo plus a 21-client installed sweep became durable clicked/connected/installed evidence behind one guarded `getMcpClients` view (Phase 57)
+- Providers panel: "API Configuration" became "Providers" with explicit `api` vs `agent` kinds, one evidence-based recommendation, and BYOK settings preserved (Phase 58)
+- Reverse-request channel: authenticated loopback pairing with a rotating session secret, exact Host/Origin checks, secret redaction, and a permanent CI gate against forbidden agent flags (Phase 59)
+- Supervised adapters: one five-method adapter contract and spawn supervisor running Claude Code 2.1.177, OpenCode 1.14.25 and Codex with pinned profiles, recorded fixtures and CI drift checks (Phases 60, 62, 64, 65)
+- Delegation UX: consent, live streaming feed, background-tab ownership, Take Control, Stop/reclaim, a 20-second heartbeat and service-worker-eviction recovery (Phase 61)
+- Native wake host: an optional native-messaging host that only starts or attaches to `serve` and never spawns agent CLIs (Phase 63)
+
+**Human UAT:** All 48 pending live scenarios in the Phase 58-65 human-UAT ledgers, and the matching human verification items, were closed at the user's direction on 2026-09-28 as waived, not executed. The archived ledgers keep their original pending entries as the record.
+
+**Known deferred items at close:** 117 acknowledged (116 quick-task audit entries and 1 diagnosis-only debug session; see STATE.md Deferred Items)
+
+**Archive:** `.planning/milestones/v0.9.91-ROADMAP.md`, `.planning/milestones/v0.9.91-REQUIREMENTS.md`, `.planning/milestones/v0.9.91-phases/`
+
+---
+
 ## v1.1.0 T1 App Execution Expansion (Shipped: 2026-06-30)
 
 **Phases completed:** 8 phases (44-51), 29 plans, 17/17 requirements satisfied.
@@ -25,11 +48,13 @@
 
 ---
 
-## v1.0.0 Full App Catalog (OpenTabs Parity) (Shipped: 2026-06-29)
+## v0.13.0 Full App Catalog (OpenTabs Parity) (Shipped: 2026-06-29)
+
+*Relabeled from v1.0.0 on 2026-09-28 so that v1.0.0 names the Jev Fast Mode milestone that ships extension 1.0.0. Archive files and references were renamed to match.*
 
 **Phases completed:** 10 phases (35-43, including inserted 39.5), 46 plans, 17/17 requirements satisfied.
 
-**Archive:** `.planning/milestones/v1.0.0-ROADMAP.md`, `.planning/milestones/v1.0.0-REQUIREMENTS.md`, `.planning/milestones/v1.0.0-MILESTONE-AUDIT.md`, and `.planning/milestones/v1.0.0-phases/`.
+**Archive:** `.planning/milestones/v0.13.0-ROADMAP.md`, `.planning/milestones/v0.13.0-REQUIREMENTS.md`, `.planning/milestones/v0.13.0-MILESTONE-AUDIT.md`, and `.planning/milestones/v0.13.0-phases/`.
 
 **Audit status:** `passed` -- automated milestone gate met. Non-blocking debt carried forward: live guarded-write UAT, live discovery first-visit UAT, Pattern-D cross-origin execution, and T1 expansion for the DOM/discovery tail.
 

diff --git a/.planning/PROJECT.md b/.planning/PROJECT.md
diff --git a/.planning/REQUIREMENTS.md b/.planning/REQUIREMENTS.md
diff --git a/.planning/RETROSPECTIVE.md b/.planning/RETROSPECTIVE.md
@@ -214,6 +214,42 @@
 
 ---
 
+## Milestone: v0.9.91 -- MCP Clients as Providers
+
+**Shipped:** 2026-09-28
+**Phases:** 9 | **Plans:** 61
+
+### What Was Built
+- Durable MCP client identity (handshake clientInfo, a 21-client installed sweep, copy intent) behind one guarded `getMcpClients` view
+- A Providers panel with explicit `api` vs `agent` kinds and one evidence-based recommendation, with BYOK settings preserved
+- An authenticated reverse-request channel with a rotating session secret, exact Host/Origin checks, secret redaction and a permanent forbidden-flag CI gate
+- One five-method adapter contract and spawn supervisor running Claude Code, OpenCode and Codex, with pinned profiles, recorded fixtures and drift CI
+- Delegation UX (consent, live feed, Take Control/Stop, heartbeat, service-worker-eviction recovery) and an optional native wake host that only starts `serve`
+
+### What Worked
+- Security-first ordering: the channel's trust boundary (Phase 59) landed and was tested before any spawn code existed (Phase 60).
+- The adapter contract stayed unchanged while OpenCode and Codex were added, which proved the abstraction.
+- Source-pin contract tests caught drift early, and every phase kept the full suite green.
+
+### What Was Inefficient
+- Every live check was deferred to one milestone-end sweep that never ran; 48 scenarios accumulated and were waived at close, so the milestone has no live evidence.
+- The milestone sat at `human_needed` for two months after implementation finished (2026-07-22 to 2026-09-28).
+- Tests read live planning files (phase folders, ROADMAP.md, REQUIREMENTS.md), so archiving the milestone required repointing test paths.
+
+### Patterns Established
+- Closing with waived UAT: record the waiver in STATE.md and MILESTONES.md and leave the UAT ledgers untouched, so no pass is fabricated.
+- Tests that inspect planning artifacts read the archived milestone copies once a milestone closes.
+
+### Key Lessons
+1. Deferring all live checks to a single end-of-milestone sweep turns UAT into debt; schedule them per phase, or agree up front that closure is automated-only.
+2. Point planning-artifact tests at archive paths (or keep fixtures out of `.planning/`) so milestone archival cannot break the suite.
+
+### Cost Observations
+- Model mix: inherit profile.
+- Notable: 157 tasks across 61 plans; implementation ran 2026-07-10 to 2026-07-22.
+
+---
+
 ## Cross-Milestone Trends
 
 ### Process Evolution
@@ -234,6 +270,7 @@
 | v0.9.35 | 5 | 15 | MCP reliability before new feature expansion |
 | v0.9.36 | 3 | 6 | Explicit MCP visual lifecycle and trusted client identity |
 | v0.9.60 | 11 | 30 | Multi-agent tab concurrency, MCP 0.8.0, run_task lifecycle return, change_report, restricted-tab recovery |
+| v0.9.91 | 9 | 61 | Agent CLIs as side-panel providers; security-first reverse channel; all live UAT waived at close |
 
 ### Top Lessons (Verified Across Milestones)