Ground reality
ChromiumFish is not a cosmetic fork and not merely Playwright around Chromium. Its source contains a native C++ perceive–think–act loop inside the browser process, built on Chromium’s experimental Actor framework and AIPageContent and exposed through Browser.agentRunTask.
That is a serious donor substrate. It is not yet the Minefield Engine.
What the donor already proves
- Actor-based click, type, scroll, select, navigate, wait, and read operations.
- AIPageContent serialization of actionable page elements.
- Cross-origin iframe input routing and semantic descriptor matching.
- A custom CDP task entry point plus record/replay and limited drift healing.
- An OpenAI-compatible model client running through Chromium’s network stack.
What remains missing
The current controller is task-local rather than a permanent profile subsystem. The convenient launcher creates and deletes a temporary profile. Provider credentials travel in process arguments. Replay is a workflow cache, not a crash-consistent transaction journal.
Minefield additionally requires durable operation identities, target generations, document epochs, stale-result rejection, unknown-outcome reconciliation, and continuation after browser restart.
The Minefield delta
- Profile integration: a complete
MinefieldAgentServiceFactory, with separate regular, guest, and off-the-record services. - Target ownership: owned
WebContentsunder unique ownership; adopted tabs observed through leases. - Transaction evidence: a SQLite WAL recording OBSERVED, INTENT_COMMITTED, DISPATCH_STARTED, DISPATCH_ACKNOWLEDGED, and OUTCOME_OBSERVED.
- Recovery: uncertain external effects become UNKNOWN_OUTCOME and are re-observed rather than blindly retried.
- Secure model transport: authenticated WinAgent named-pipe requests; WinAgent performs provider HTTPS calls and never returns the long-lived key.
- Scoped scheduling: a page lease prevents active targets from freezing without falsely foregrounding unrelated pages or processes.
- User-owned authority: Minefield-specific capability policy instead of globally disabling Chromium Actor checks.
Version drift found
The donor repository currently describes a Chromium 150 engine in its upstream pin and source patches, while its application script and default Python SDK release pin still describe Chromium 149. The first artifact is therefore a reproducibility manifest containing exact commits, patch hashes, GN arguments, toolchain versions, build output, and a native-agent smoke result.
What we will not do
- No ignored patch failures.
- No global Actor safety function changed to unconditional success.
- No visibility fiction through
SetHidden. - No API key in Chromium arguments.
- No dangling
WebContentspointer. - No DevTools target ID treated as durable identity.
- No blind retry after an irreversible or uncertain action.
Implementation order
- Pin and reproduce ChromiumFish.
- Add the profile-keyed service and target ownership.
- Add operation IDs, generations, and document epochs.
- Add the journal and deterministic kill points.
- Move model transport into the WinAgent broker.
- Add page-scoped scheduler leases.
- Install the user-owned capability policy.
- Add restart continuation and outcome reconciliation.
Acceptance boundary
The engine is accepted only when secrets stay outside Chromium, profile shutdown is memory-safe, incognito remains isolated, stale generations cannot execute, scheduler exemptions end with leases, every kill point recovers deterministically, and uncertain non-idempotent actions never duplicate external effects.
Current checkpoint
The first implementation packet is deliberately narrow: MinefieldAgentService, its complete factory, explicit profile selection, owned/adopted target leases, generation and document-epoch types, build integration, and lifecycle tests.
The hard problem is no longer proving that Chromium can act. ChromiumFish has proved that. The Minefield problem is making native action durable, attributable, profile-correct, restartable, and under explicit user authority.