✨🧑‍💻 - Browser extension H2 browser runtime lifecycle protected sessions and actual browser harnesses #703

Is there an existing issue or feature request for this?

• I have searched the existing issues and feature requests.

What area does this improvement affect?

New Feature

What actions does this improvement affect?

Issue, Pull Request, Commit

Description of the idea or improvement

H2 — Browser runtime, lifecycle, protected sessions and actual-browser harnesses. Part of the complete product from merged PR #699 and milestone GitHub browser extension — complete product. Implementation order does not reduce product scope or the 803-case acceptance floor.

Ownership: cross-cutting engineering/integration evidence; no additional or duplicate claim over the 150-feature inventory.

Implement idempotent mount/refresh/dispose with route/object/settings/credential epochs, scoped observer ownership, abort/late-result protection, native editor/focus preservation and independently paused features. Add versioned bounded nonsecret settings/migrations, protected session credentials, sender/frame/origin/typed message validation, GET-only reader ports, bounded activity-aware scheduler/cache and explicit Connect/revoke/account-change cleanup. Exercise required API floors and API absence without worker keepalive. Introduce original GitHub fixtures and isolated real extension-loaded Chrome, Firefox and Safari harnesses, including the actual Safari containing app; ordinary WebKit and mocked extension APIs do not count as Safari proof. No real tokens/private repositories in automated fixtures. Record exact OS/browser/build/source/fixture receipts and truthful prerequisite failures. Shared foundation is #702; later features reuse these services rather than duplicating storage/network authority.

Normative baseline: specs/github-browser-extension.md, specs/github-browser-extension-functional-catalog.md, specs/github-browser-extension-platforms-and-delivery.md, specs/github-browser-extension-action-integration.md, specs/github-browser-extension-control-center-and-setup.md, and the versioned structured schemas/catalog. Follow specs/README.md and _template.md; update owning SDDs, current catalog evidence, tests and user docs in the implementation PR. Before starting, refine exact current-code acceptance and prerequisite evidence through the Action's pre-branch SDD flow.

Tests and acceptance: Implement the owned lifecycle/security portions of the existing 96 core cases (full IDs from primary SDD §14), including suspension/resume, same-number issue/PR identity, navigation races, protected paths, revocation, permission denial, stale/private evidence and storage failure. Do not claim all 96 until producer/consumer/packaging dependencies land. Pure policies 100% branch; other new modules 95% statements/90% branches; existing root gates stay. Actual three-browser loading evidence and documented Safari setup are this milestone's explicit gate.

All new pure evidence/eligibility/intent/approval policies require 100% branches; other new modules require at least 95% statements/90% branches with changed executable lines covered. Modules at most 220 lines/Svelte components 90 unless reviewed decomposition exception. Add risk-derived cases beyond the baseline where needed; every required behavior maps to executable evidence and docs. Full product acceptance remains all 150 functions/all three desktop targets, not this issue alone.

Current limitations or challenges

PR #699 specifies the product; this milestone's behavior is not implemented merely because the specifications or earlier engineering increments exist. Dependencies: #702. Use the roadmap's linked issues to verify those dependencies before starting; do not advertise future features, runtime compatibility or store approval as already verified.

Expected impact

Browser runtime, lifecycle, protected sessions and actual-browser harnesses becomes a complete, tested and documented part of the original premium GitHub productivity application. Users receive observable outcomes, safe defaults and useful failure/recovery paths across Chrome, Firefox and Safari, with explicit source/freshness/permission boundaries where applicable.

Alternatives considered

Reject reduced catalog scope, copied implementation/assets, speculative compatibility claims, placeholder acceptance, duplicate Action authority and weaker existing test gates. Deliver in reviewable increments while retaining the complete accepted product contract.

Version of copilot

Published Action 3.10.5; develop baseline includes merged #699. Extension versions independently; future implementation selects and locks compatible dependencies using primary documentation.

Additional context or comments

Backlog milestone. Do not add in-progress or create a branch until its dependencies are ready and it is deliberately started. The Action owns admission/SDD/remote branch lifecycle. PRs link their issue and include actual test/browser/docs receipts; merge/deploy/store publication is not implied. First active increment: #702.