Run with Browser AI · Chapter 18
Run Chapter 18: WebMCP search_book Laboratory
Register, replace, remove and invoke a bounded search_book capability through live WebMCP when available, with an explicitly separate simulator for every other browser.
← Read Expose the First WebMCP Tool
Execution
Not inspected
Observed state machine
What “built-in” means in this browser
No capability call has been made in this page yet.
- 01Not inspected
- 02Unsupported
- 03Unavailable
- 04Downloadable
- 05Downloading
- 06Available
- 07Session ready
- 08Running
- 09Completed
- 10Failed
Derived from events
Observatory measurements
Missing evidence stays missing. The dashboard never estimates an absent measurement.
Application instrumentation
Cross the boundary without erasing it
The page can validate what it sends. Extension receipt is confirmed only in the attached DevTools panel.
- 01Application SDKBuild a sanitized envelope
- 02Same-origin bridgeValidate schema and size
- 03Extension transportRoute by inspected tab
- 04DevTools panelConfirm receipt and correlate
To test end to end, load the Observatory extension, attach DevTools to this tab and enable instrumentation for this origin.
Shared lifecycle · distinct contracts
Browser AI capability switchboard
No interface has been inspected. Each check will use that interface's declared creation options.
| Interface | Global | Exposed | Availability | Options |
|---|
Canonical fixture · live task API
Summarization contract
Exposed Not inspected
Availability —
Session None
Load the canonical fixture, then inspect the current browser.
Generated artifact
No summary yet.
Contract evaluation
- No evaluation yet.
Ranked evidence · explicit routing policy
Language routing laboratory
Choose a fixture, then inspect Language Detector.
Ranked detector evidence
| Rank | Language | Confidence | Use |
|---|---|---|---|
| No ranked candidates yet. | |||
Translated artifact
No translation yet.
Translation evaluation
- No translation evaluation yet.
Resource state · measured lineage
Session lineage laboratory
Prompt API Not inspected
Availability —
Inspect the current browser before creating a session.
Original session
Not created- ID
- —
- Parent
- None
- Usage
- —
- Quota
- —
- Remaining
- —
- Clone / destroy
- —
No output yet.
Cloned session
Not created- ID
- —
- Parent
- —
- Usage
- —
- Quota
- —
- Remaining
- —
- Clone / destroy
- —
No output yet.
Shared-history acknowledgement
No shared-history run yet.
Lifecycle invariants
- No invariants evaluated yet.
Finite budget · explicit discontinuity
Context budget laboratory
Prompt API Not inspected
Availability —
Session None
Inspect the current browser before creating a measured session.
Latest runtime result
No turn has run.
Observed deltas
| Turn | Before | After | Δ usage | Outcome |
|---|---|---|---|---|
| No measured turns yet. | ||||
Application-created state transfer
Compaction checkpoint
No checkpoint built.
Checkpoint and lifecycle invariants
- No invariants evaluated yet.
Separate clocks · matched fixture
Latency decomposition laboratory
Prompt API Not inspected
Availability —
Session None
Progress callbacks are reported as monitor observations. They are not relabelled as downloaded bytes.
Inspect the browser, then create a session under an explicit operational label.
Raw observations
| Path | Session | Create | First chunk | Generation | Total | Chars | Chars/s | Outcome |
|---|---|---|---|---|---|---|---|---|
| No latency observations yet. | ||||||||
Latest partial or completed output
No prompt has run.
Protocol checks
- No checks evaluated yet.
Versioned profiles · truthful identity
Model contract compatibility laboratory
Evidence source —
Browser attested —
Profile version —
Label this browser configuration, inspect the profiles, then run the matched compatibility suite.
| Versioned profile | Option SHA-256 | Availability | Creation | Asset callbacks | Prompt | Destroyed | Exact error |
|---|---|---|---|---|---|---|---|
| No compatibility observations yet. | |||||||
Latest local fixture output
No compatible profile has run.
Evidence invariants
- No invariants evaluated yet.
Two timelines · one authority gate
Validation pipeline laboratory
Prompt API Not inspected
Availability —
Session None
Decision Not evaluated
Operational timeline
- 01InspectNot run
- 02CreateNot run
- 03PromptNot run
- 04DestroyNot run
Evaluation and effect timeline
- 01ParseNot run
- 02InvariantsNot run
- 03Human reviewAwaiting candidate
- 04DecisionNot evaluated
- 05CommitNot authorized
Protected source policy
Inspect the browser for a live run, or load a labelled specimen to exercise the evaluator immediately.
Immutable candidate · No candidate
No candidate has been produced or loaded.
Automatic evaluation
- No checks evaluated yet.
Human rubric · —
No candidate is ready for review.
No human judgment recorded.
Authority boundary
Nothing committedAcceptance only enables a separate in-memory commit. This laboratory performs no external action.
| Stage | Outcome | What this establishes | Duration |
|---|---|---|---|
| No candidate evaluated yet. | |||
Seven fixtures · paired evidence
Feature evaluation and release gate
Suite —
Capture —
Gate Not evaluated
Classify the seven interfaces, run the non-AI baselines, then collect the current browser observations.
Paired feature matrix
| Feature / evidence path | API state | Slices | Baseline | Live automatic | Human rubric | Current | Transition |
|---|---|---|---|---|---|---|---|
| No fixture matrix loaded. | |||||||
Latest raw candidate · metrics-only trace
No live candidate yet.
Risk-based release gate
- No gate evaluated yet.
Raw repetitions
| Case | Rep | Session | Operational | Automatic | Total |
|---|---|---|---|---|---|
| No live observations yet. | |||||
Slice outcomes
| Slice | Accepted | Evaluated | Rate |
|---|---|---|---|
| No slice evidence yet. | |||
Explicit route · declarative jobs
Fallback router and local worker coordinator
Policy —
Prompt API Not inspected
Availability —
Selected route Not decided
Inspect the current browser or select a failure state, then apply the explicit degradation policy.
Decision explanation
No route decision yet.
Rejected alternatives
- No alternatives evaluated.
In-page contract simulator
Local worker coordinator
The production owner is a loopback service. This page does not watch a directory or contact an AI service.
Registered worker specimens
| Worker | Tags | Status | Model evidence | Source |
|---|---|---|---|---|
| No workers registered. | ||||
Validation result
- No job validated yet.
Lease controls
No job accepted.
Queue and attempts
| Job | State | Worker | Attempt | Lease |
|---|---|---|---|---|
| Queue is empty. | ||||
Append-only audit
- No coordinator events.
Chapter 16 laboratory
Structured output firewall
Compare constrained and unconstrained model output, then make every trust transition inspectable. The final action is a page-memory dry run with no external effect.
Inspect the generation constraint and candidate schema
Loading schema…
Loading the structured-output experiment…
| Stage | Outcome | Evidence | What it establishes |
|---|---|---|---|
| No candidate validated yet. | |||
Dry-run job preview
No dry run executed.
Chapter 17 laboratory
Capability contract workbench
Inspect the difference between a typed software capability and a guessed interface action. The only executable path is a bounded, read-only search over a fixed in-page corpus.
Select and inspect a route.
| Observed surface | Visible label | Available semantics | Laboratory action |
|---|---|---|---|
| Inspect a route to see its evidence. | |||
Inspect the application-provided capability definition
Loading definition…
Lifecycle controls
Loading the capability workbench…
No capability result yet.
Invocation ledger
| Call | Route | Permission | Result | Matches | External effect |
|---|---|---|---|---|---|
| No invocations recorded. | |||||
Chapter 18 laboratory
WebMCP search_book
Inspect the experimental browser surface, register one bounded read-only capability, test its deterministic contract, and observe replacement and removal. No model-selection claim is inferred from a manual test.
Inspect the browser before choosing a registration surface.
Inspect the registration definition and effect contract
Loading definition…
Bounded result
No capability result yet.
Registration history
| At | Action | Surface | Version | Registration | Outcome |
|---|---|---|---|---|---|
| No registration events. | |||||
Tool-call ledger
| Call | Source | Surface | Arguments | Permission | Result | External effect |
|---|---|---|---|---|---|---|
| No tool calls. | ||||||
Chapter 19 laboratory
Tool-choice behavioral evaluator
Change what the model can discover, alter the metadata it sees, introduce catalog pressure, and diagnose the exact stage where a candidate stops matching the task.
Registered tool visibility
Task
Loading fixture…
Run controls
Loading the tool-choice evaluator…
Live selection and result-use output
No live model output.
Deterministic tool result
No deterministic tool result.
Evaluation ledger
| Run | Source | Fixture | Metadata | Visible | Passed | Failed | Diagnosis |
|---|---|---|---|---|---|---|---|
| No evaluations. | |||||||
Chapter 20 laboratory
Prompt-injection containment laboratory
Mix trusted policy with hostile page text, tool metadata and tool results. Observe whether the model follows the attack, then independently verify whether deterministic policy prevents an external effect.
Capability scopeLoading…
Explicit trust domains
Visible tool catalog and application policy
| Tool | Untrusted description | Normalized effect | Authority | Provenance |
|---|---|---|---|---|
| Loading catalog… | ||||
Run controls
Loading the containment laboratory…
Raw live model output
No live model output.
Bounded execution result
No deterministic result.
Security evaluation ledger
| Source | Scenario | Attack source | Model | Policy | Execution | System |
|---|---|---|---|---|---|---|
| No security evaluations. | ||||||
Chapter 22 laboratory
Personal browser policy engine
Extract bounded content units, collect typed evidence, compile an inspectable policy, and mediate the fixture feed locally. A model may supply evidence; deterministic rules select the presentation action.
Pipeline controls
Loading the personal policy engine…
This contained page demonstrates presentation control without deleting source content. Re-run the same policy to observe origin/provider/version-scoped cache hits.
Contained sample feed
Editorial · reading
A calm explanation of browser capability boundaries
The browser can expose a capability without deciding how an application should use it. Policy remains visible, versioned and under the reader's control.
Sponsored · declared by fixture adapter
Act now—this offer disappears in minutes
Unlock the exclusive upgrade immediately. Do not miss the countdown.
Analysis · long reading unit
Why evidence and policy must remain separate
A provider reports observations under a declared contract. Those observations can be direct declarations, deterministic measurements, model assessments or unavailable signals. The policy compiler then applies ordered predicates outside the provider. This separation matters because replacing a runtime should not quietly replace the user's rule. It also preserves unknown evidence rather than treating missing output as proof that a unit is harmless. A presentation decision therefore names the extractor, provider, policy version, matching rule and reversible action. The resulting trace is useful both for debugging one surprising decision and for comparing policy behaviour across many units.
Media · autoplay declared
Breaking video begins automatically
The fixture marks this unit as autoplaying so deterministic evidence can act before model inference.
Private message composer
Synthetic private region
This text exists only to prove that the extractor excludes the region before reading it.
Payment form
Synthetic payment region
The policy engine must never ingest this fixture content.
Below simulated viewport
Deferred content unit
This unit demonstrates viewport budgeting: the extractor identifies its boundary, but evidence collection is deferred.
Unit decisions
| Unit | Status | Evidence | Provider | Policy | Action | Rule | Cache |
|---|---|---|---|---|---|---|---|
| No policy decisions. | |||||||
Decision audit
| Time | Unit | Provider | Policy | Action | Reason | Cache | Data boundary |
|---|---|---|---|---|---|---|---|
| No policy events. | |||||||
Chapter experiment
Expose the First WebMCP Tool
Loading the chapter experiment…
No model output yet.
Inspect the context supplied by this chapter
What this experience knows
This experience is grounded in Chapter 18 and exposes one deliberately narrow read-only capability.
API boundary
The live path requires document.modelContext.registerTool, available behind the WebMCP origin trial from Chrome 149. Removal is driven by an AbortController signal passed to registerTool; controller.abort() withdraws the registration and, as of Chrome 153, does not interrupt an in-flight execution. Exact failures are retained rather than rewritten as generic unavailability.
Simulation boundary
The simulator and live WebMCP paths are separate actions. Simulator events carry surface: in-page-simulator; they are never counted as browser registrations.
Contract boundary
search_book accepts a 2–300 character query and an optional integer limit from 1–10. Additional properties are forbidden. The implementation validates these rules again.
Corpus boundary
Search is limited to a fixed eighteen-chapter summary index embedded in this experiment. It cannot read arbitrary DOM text, files, browser history or another origin.
Disclosure boundary
At most ten known references are returned. Excerpts are capped at 180 characters. Query text and excerpts remain in page memory under metrics-only capture.
Identity boundary
The Observatory records origin, tool name, contract version, registration ID, schema hash, definition hash and registration surface. Application-provided metadata remains browserAttested: false.
Lifecycle boundary
Inspection, registration, proposal, argument validation, policy admission, execution, result validation, replacement and removal are separate events. A resolved callback is not automatically a valid result.
Effect boundary
The tool declares a current-book read with no state mutation, no network and no external effect. Its safety annotations should mark it read-only, not consequential, and not a source of untrusted external content. The implementation performs no fetch, navigation, DOM actuation or persistence.
Behavioral boundary
Manual fixtures test the deterministic tool before a model chooses it. This chapter does not claim an agent discovered or selected the registration; that behavioral evaluation begins in Chapter 19.
This laboratory exposes the Chapter 17 search_book contract through the browser’s imperative WebMCP surface when the current context supports it. Registration, replacement, removal and callback invocation receive distinct trace events and correlation IDs.
The deterministic simulator is a separate button and a separate evidence source. It can test the contract on any browser, but it never claims that Chrome registered or exposed the tool.