Research an isolated authenticated browser capability for Joanna

## Goal

Research a safe way for Joanna to use authenticated websites through a persistent browser without placing browser credentials on a privileged runtime or requiring a personal workstation to stay online.

This issue is for research and architecture only. It does not approve a deployment.

## Proposed boundary

- Run Chromium and Playwright on a dedicated, isolated browser VM or container host.
- Put a constrained Browser Broker between Joanna and Playwright. Joanna should receive browser capabilities, not unrestricted Playwright, JavaScript evaluation, or CDP access.
- Keep one persistent browser profile and active browser lease per authorized household user.
- Store no browser profiles, cookies, password-manager state, SSH keys, Docker sockets, or infrastructure mounts on the Joanna runtime.
- Block private-network, localhost, file, browser-internal, and unapproved Internet destinations at the broker and network layers.
- Treat browser profiles and session cookies as credentials.

## Remote takeover

Use Cloudflare Tunnel and Cloudflare Access for takeover when the user is away from home:

1. Joanna pauses when login, MFA, CAPTCHA, sensitive identity data, payment information, or final confirmation needs human input.
2. BearClaw creates a short-lived, single-purpose takeover grant bound to the authenticated user and browser lease.
3. Telegram sends an expiring takeover link.
4. Cloudflare Access authenticates the user before the browser-only takeover UI opens.
5. The user completes the sensitive step and explicitly returns control to Joanna.

The browser VM should require no inbound Internet firewall rule. Do not add Tailscale as a second remote-access dependency.

## Credential handling

Start without a password-vault API or CLI integration.

- Let the user unlock and use a password-manager extension only during takeover.
- Reuse the authenticated website session afterward.
- Never expose vault search, plaintext passwords, clipboard contents, master credentials, or MFA secrets to Joanna.
- If unattended reauthentication is considered later, design a separate fill-only credential broker scoped to an exact user, credential reference, and expected origin.

## Research questions

- Which browser/takeover stack best supports a persistent Chromium session: Kasm, Guacamole, noVNC, or a smaller custom browser-only UI?
- Can the chosen stack pause and resume the exact Playwright-controlled browser context reliably?
- Does the selected Chromium build support the required password-manager extension with persistent profiles?
- How should Cloudflare Access identity be matched to BearClaw's user and one-time takeover grant?
- What is the safest origin allowlist and redirect policy for real sites with multiple authentication and CDN domains?
- How should profile volumes, downloads, uploads, logs, encryption, retention, and backups be handled?
- How should one-browser-per-profile locking, timeouts, crashes, and abandoned takeover sessions be recovered?
- Which actions may run automatically, which may be prepared for review, and which always require explicit confirmation?
- Is the takeover experience usable from an iPhone over cellular?

## First proof of concept

Use one approved travel-provider account for a read-only test:

- Start the isolated browser from Telegram through Joanna.
- Authenticate manually through the Cloudflare-protected takeover UI.
- Navigate to the existing reservation and determine whether check-in is available.
- Stop before entering identity documents, changing the reservation, checking in, purchasing, attesting, or submitting anything.
- Restart the browser worker and confirm the authenticated session persists.
- Confirm that one household user cannot access another user's profile or takeover grant.
- Confirm that expired grants, copied links, unapproved origins, redirects, and private-network destinations fail closed.
- Verify that the flow works from a phone outside the home network.

## Research completion criteria

- Document the recommended VM/container, browser, broker, takeover UI, and Cloudflare configuration.
- Produce a small threat model covering malicious page content, credential/session theft, cross-user access, and broker compromise.
- Define the BearClaw capability and approval contract without exposing raw Playwright.
- Record resource requirements, update/backup ownership, recovery behavior, and operating cost.
- Demonstrate or reject the read-only proof of concept.
- Obtain explicit approval before any production implementation.

## References

- [Cloudflare Tunnel](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/)
- [Cloudflare Access policies](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/)
- [Cloudflare Access application paths](https://developers.cloudflare.com/cloudflare-one/access-controls/policies/app-paths/)
- [Playwright MCP](https://github.com/microsoft/playwright-mcp)

Start with the linked Cloudflare Tunnel, Access, and Playwright MCP references, then compare Kasm, Guacamole, noVNC, and a custom browser-only UI against the stated takeover and isolation requirements. A complete result recommends or rejects the read-only travel-provider proof of concept, documents the threat model and capability contract, and records configuration, recovery, resource, ownership, and cost decisions.

Written by the indexing model from the issue text.