# Zyquo Atlas — AI Browser Research (Phase 0.A)

Compiled 2026-07-30 from several intensive web-research sessions across the current AI-browser landscape, page-extraction techniques, AI-UX patterns, streaming engineering, and browser-AI security. This document is the design contract for every AI feature in Phases 3 and 6 — each feature below traces to a pattern documented here. Sources are cited inline; where a claim rested only on low-quality SEO content it is marked [unverified].

# 0. Category state (July 2026) and what it means for Atlas

Three facts shape the design:

1. The AI-sidebar-only browser is not a business. Arc went to maintenance mode (May 2025; The Browser Company acquired by Atlassian, Oct 2025). OpenAI is shutting down ChatGPT Atlas on 2026-08-09, concluding "the browser is a feature, not the destination." SigmaOS — a native SwiftUI+WebKit browser, exactly Atlas's stack — is effectively abandoned. → The browser must be excellent as a browser first (Atlas's Phase 2 gate is correct); AI is a multiplier, not the product. (Engadget, TechCrunch 2026-07-09, r/macapps.)
2. Indirect prompt injection is the unsolved, category-defining security problem. Brave demonstrated exploits in Comet (twice), Opera Neon, and Fellou; a plain "summarize this page" click exfiltrated a user's email + OTP in Comet. On-device models do not fix it. → Atlas is read-oriented, not agentic — a defensible, safer position — but even read-only AI is exploitable (§7). (brave.com/blog: comet-prompt-injection, unseeable-prompt-injections, prompt-injection-flaw-opera-neon, indirect-prompt-injection.)
3. Agentic is where vendors went; grounded reading is where users get value. Every agent-mode review reports impressive demos, unreliable multi-step execution, and heavy fallback to the reliable features (summarize, chat-with-page, compare tabs). → Atlas invests in reliable reading tools + massive customization + BYO-key model choice, the three gaps left by the failed/paywalled incumbents.

Naming note: OpenAI's retiring product was also "Atlas." Zyquo Atlas docs disambiguate as Zyquo Atlas throughout (never "Atlas" alone in user-facing text).

# 1. Landscape — functional patterns per product

# Arc / Arc Max (The Browser Company) — "AI as small, keystroke-invoked utilities"

The most important reference: AI as invisible utilities, each one interaction with a shortcut, output where you already are.

• Ask on Page: hold ⌘F — the find bar becomes an ask box; answer inline. Overloads an existing muscle-memory shortcut ("find" and "ask about this page" are the same intent at different fidelities). Adopt.
• 5-Second Previews: hover a link (Shift+hover off search pages) → floating popover summarizing the destination page.
• Tidy Tab Titles / Tidy Downloads / Tidy Tabs: zero-UI AI applied to chores; users don't perceive it as "AI." Tidy Tabs only touches ephemeral tabs, never pinned.
• Failure evidence to engineer against: "Ask on Page told me it encountered an error 3 of 4 times"; "5-second previews don't give much beyond the page title." → Extraction fragility is the #1 cause of perceived AI failure. (Arc Max help; HN 37753840.)

# Dia (Browser Company/Atlassian) — "the URL bar is the chat box"

• Intent-detecting address bar: classifies input as navigate / search / ask, "mostly based on length and syntax." Documented failure: "sometimes I'm trying to google something and get thrown into an AI chat against my intention." Keyboard overrides: Ctrl+⌘+Return forces chat, Shift+⌘+Return forces search.
• Skills: saved prompts invoked by /shortcut in chat, created via a Natural-Language Skill Builder, shared in a public gallery. One power user built 50+ (/summary, /research, /newsletter…). Strongest signal in the landscape that user-authored slash-prompts are the killer feature — and it's cheap.
• Chat-with-all-tabs via @tabname / @history mentions (mentioned tabs render as a stacked pile); Quick Insert pushes AI output into the current field.
• Regressions users resent: no fuzzy ⌘T command bar (replaced by chat), no Spaces, no Boosts. "Power users miss the keyboard launcher more than the sidebar." → Ship the palette AND the ask, not one replacing the other. (miskakyto.fi; SupaSidebar; TechCrunch.)

# Perplexity Comet — the agentic sidebar, most-tested, most-exploited

• Assistant sidebar (⌘A); one-click page summary (icon next to Assistant); @tab cross-tab context; agentic tasks with blue frames on pages it touches and a visible step list.
• Failure evidence: @tab targeting "inconsistent or a bit buggy" (→ use a picker with chips, not fuzzy text); the agent "only analyzed the snippet, not the full page, so it missed the deeper answer" and a reviewer asked for "a visible list of the pages it reviewed" (→ Atlas's citation requirement); long agent chains "often fail halfway."
• Security: the canonical exploit — "summarize this page" fed page content to the LLM without distinguishing user instructions from untrusted content; hidden Reddit-comment instructions exfiltrated email + OTP with no further input. (cybernews; brave.com/blog.)

# Brave Leo — the privacy-first, BYO-model reference (closest sibling to Atlas)

Study hardest; its stance maps onto Atlas's constraints almost exactly.

• Sidebar + full-page + address-bar; no account, no login; reads pages, PDFs, Google Docs/Sheets, YouTube transcripts, images.
• Skills (best-documented /-command design): type / → New → fields for model + shortcut + prompt (per-skill model binding); or "Save as skill" from a good answer's … menu (creation-from-success). Built-ins /summarize /explain /improve. Adopt this creation flow verbatim.
• Model catalog + BYOM: free & premium model tiers, "Automatic" routing default, default at brave://settings/leo-ai, and connect local models via Ollama or your own API endpoint — "rare among browser-native AI tools."
• Privacy gold standard: no chats/context/logs in the cloud, no training, account-free; reverse proxy strips IP.
• Agentic (opt-in, off by default): isolated profile; a second alignment-checker model firewalled from page content; all agent work in a visible tab; memory writes shown and undoable; explicitly rejects per-site permission prompts ("low-signal repeated prompts train users to ignore warnings"). → Don't build a nag-wall. (Brave help; brave.com/blog/ai-browsing, leo-skills.)

# Microsoft Edge Copilot Mode — "whole-browser AI toggle" + granular consent

• One toggle switches the whole browser into/out of Copilot Mode (visible chrome change).
• Unified new-tab box (chat+search+navigate); multi-tab context with permission; Actions (agentic, opt-in, US-only); Journeys (past browsing auto-grouped into topical "storylines" as new-tab cards — reviewers' most-liked feature).
• Best-documented consent model: Edge classifies each query as needing page context or not; non-contextual queries send only query + URL + title + history; contextual queries prompt for active-tab access. → Adopt the query-classifier privacy architecture. (Edge blog 2025-07-28, 2025-10-23; Microsoft Q&A.)

# Opera (Aria → Opera AI) & Neon

• Aria command line ⌘/ (ask without leaving the page); explicit Page-Context mode; NL tab commands.
• The Aria→Opera AI rebuild is instructive: moved access from left sidebar to a top-right button, from overlay-on-content to a side panel; made it context-aware by default with a per-chat revoke toggle; retired the Command Line and Compose mode because "a context-aware chat subsumes them." → Don't build Compose as a separate surface. Also ships answer→image snapshot to clipboard and AI wallpaper generation (relevant to Atlas theming). Neon ($20/mo) is agentic (Neon Do, composable Cards) — and was prompt-injection-exploited via an opacity:0 element. (blogs.opera.com migration post; brave.com/blog/prompt-injection-flaw-opera-neon.)

# SigmaOS — same stack (SwiftUI+WebKit), a cautionary tale

• Native SwiftUI on WebKit; Airis gave structured summaries + key points + follow-up Q&A and early model choice (GPT-4o/Perplexity/Claude).
• Why it died for users: removed traditional bookmarks and broke redirect-based SSO for every institutional workflow ("bookmarks are deferred execution triggers for auth flows"); limited extensions; no security updates. → Atlas must-dos: keep plain bookmarks that store+navigate a URL verbatim; Phase-7-test redirect SSO/OAuth on WKWebView (Okta/SAML/Google/Entra/library proxies); natively cover top extension jobs (ad/tracker block, autofill, reader, per-site CSS); rely on WKWebView inheriting Safari's security cadence. (sigmaos.com; Product Hunt reviews; r/macapps.)

# Chrome — Gemini in Chrome + built-in on-device APIs

• Best multi-tab UX: current tab shared by default (toggleable); add up to 10 more via a picker or @-mention with fuzzy search; checkmarks in the picker; a tab whose content is in use shows a "glowing underline" on the tab itself — the best "content leaving device" indicator in the industry. Adopt the on-the-tab indicator.
• Ask-AI-about-history ("the site with the walnut desk"); Skills (save+reuse multi-tab prompt workflows); select-from-screen prompting (compare two selected products); menu-bar/global invoke with a configurable shortcut; auto-browse with a well-specified confirm/take-over safety taxonomy.
• Built-in on-device APIs (Gemini Nano): Translator/Language-Detector/Summarizer stable; Writer/Rewriter/Proofreader/Prompt in trial. → The task taxonomy Google settled on — summarize, translate, detect-language, write, rewrite, proofread — is the right set of primitive AIActions for a browser. A local tier (Apple Foundation Models / MLX / Ollama) is a legitimate future option for hover-summaries. (Google blog; developer.chrome.com/docs/ai; Chrome at I/O 2026.)

# ChatGPT Atlas (retiring 2026-08-09) — most feature-complete; best primary docs

• Two writing surfaces, sharply distinguished (adopt the framing verbatim): "The sidebar is for bigger questions and page-level context. Inline editing is for precise small improvements to the text you're actively typing." Inline: highlight in a field → click the logo → ask → replace in place (Insert fallback).
• Selection implicitly joins chat context ("highlight a paragraph and Atlas includes it automatically"); Saved Prompts recalled via @ / bookmarks bar; semantic ⌘F ("no exact match → find similar"); per-site visibility toggle in the address bar ("when off, ChatGPT can't view page content"); Agent Mode capability sandbox (no code execution, no filesystem, no passwords/autofill, pages not added to history, logged-out mode, isolated clipboard).
• Criticisms to design against: the "anti-web browser" critique (AI content substituted for real links — "zero links to Taylor Swift's actual website") → AI answers must be additive to prominent, plural, clickable real sources; "tainted memories" CSRF made memory a persistent injection sink → memory writes visible + undoable; keyboard/ customization poverty → precisely the gap Atlas fills. (OpenAI release notes; Wikipedia.)

# Others

Claude in Chrome/Cowork (extension; two permission modes + site-level grants); Fellou (plan-preview-before-execute — best agentic-transparency idea); Zen/Orion/Vivaldi/Brave as Arc-refugee destinations chosen for customization, not AI (validates Atlas pillar #1). Market share: no provider is a safe sole bet (ChatGPT ~53%, Gemini ~27%, Claude ~8% of gen-AI traffic, Jun 2026) — the strongest argument for multi-provider/BYO-key.

# 2. Page content extraction for LLMs (the technical heart of Content/)

Extraction failure is AI failure in the user's mind (Arc evidence, §1). Budget disproportionately here.

# Readability & the extractor landscape

• Mozilla Readability.js (Apache-2.0, the Firefox Reader engine): _grabArticle() scores nodes (1 base + 1/comma + ≤3 for length + ±25 class/id weight), propagates to ancestors, scales by (1 − linkDensity), takes top nbTopCandidates=5, appends qualifying siblings, and retries with relaxed flags until ≥ charThreshold=500 chars. Returns {title, content(HTML), textContent, excerpt, byline, siteName, lang, publishedTime}. parse() mutates the DOM — always document.cloneNode(true) first in a live WKWebView. isProbablyReaderable(document) is the cheap article-vs-app gate. Does NOT sanitize output — treat page-derived strings as untrusted (injection surface).
• Defuddle (MIT, kepano): browser-first, more forgiving than Readability, standardizes code/math/footnotes, and emits Markdown directly (markdown: true) — skipping a separate Turndown step. Other refs: trafilatura (Python, server-only), Postlight (unmaintained), dom-distiller (uses render signals).
• 2026 benchmark reality: extractors converge on articles (F1 ≈ 0.93) but diverge on structured/app pages (F1 0.41–0.84). The article path is solved; invest in the fallback.
• Decision: primary extractor = Defuddle (MIT, browser-first, native Markdown); keep Readability as A/B fallback and isProbablyReaderable as the gate. Both run on a clone so the live page is untouched. (github.com/mozilla/readability, kepano/defuddle; arxiv 2605.21097.)

# Fallback ladder when extraction fails (Gmail, dashboards, SPAs)

1. isProbablyReaderable gate; post-hoc check (extracted < charThreshold or < ~20% of body.innerText) → treat as failed.
2. document.body.innerText — layout-aware "what the user can see" (excludes display:none, inserts render-accurate breaks). Annotate extractionQuality: .rawText.
3. Structured visible-text TreeWalker → pseudo-Markdown (h1–h6→#, li→-, table→pipes, a→links), skipping display:none/zero-rect nodes.
4. Accessibility-tree-style walk for app pages (role + accessible name + state). Raw HTML dumps are an anti-pattern.
5. Last resort: title + URL + meta description, with the UI saying "couldn't read this page."

# Why Markdown, and structure preservation

Markdown cuts tokens ~60–80% vs HTML; headings survive as ## lines (chunk boundaries + citation anchors), lists/tables keep semantics, links keep [text](url) for "answer with sources." PageContext.markdown is canonical; keep plainText for token estimates and a heading index [(headingPath, charRange)] for chunking + citations. (Turndown with headingStyle:'atx', codeBlockStyle:'fenced' if converting Readability HTML.)

# WKWebView mechanics

• Isolate everything in a named WKContentWorld (ZyquoAtlasContent): the extractor reads the DOM/selection/computed-styles (shared across worlds) but never collides with or is observed by page JS. Message handlers registered in that world can't be spoofed by the page. Exception: the history.pushState hook (SPA detection) must run in .page because it wraps the page's own binding.
• Pull: callAsyncJavaScript (named args auto-serialize; body may await; resolves Promises) — but evaluateJavaScript crashes on an undefined result, so every injected entry point ends with a value and is wrapped try/catch → {ok, ...}. Cap extraction in JS (~300–600 KB), send one JSON object; never stream the DOM across the bridge.
• Push: world-scoped WKScriptMessageHandler for selection-changed, SPA-navigation, and a MutationObserver contentVersion counter.
• Selection: window.getSelection(); getRangeAt(0).getBoundingClientRect() positions the floating toolbar (account for webView.pageZoom); send ±N chars of surrounding text + nearest heading for grounding; debounce selectionchange ~200 ms; post {text, rect, isEditable} (isEditable drives Rewrite-vs-Explain). Cross-origin iframes need per-frame observers (forMainFrameOnly:false) aggregated natively.
• SPA navigation fires no WKNavigationDelegate callbacks — detect via KVO on webView.url + a pushState/replaceState/popstate hook + MutationObserver, all three; each invalidates the PageContext cache and cancels in-flight AI for the old context.
• App-page data paths: special-case YouTube (transcript), PDF (PDFKit text), Google Docs (full-document script/selection) rather than DOM scraping (Chrome reads the Workspace API for shared Docs — same lesson).

# 3. Chunking, context & long pages

• 2026 long-context calculus: frontier windows are 200K–2.5M tokens, but effective context is ~50–65% of advertised (context rot), and filling big windows is slow + costly. A web page is almost never "long" in 2026 terms (a long article ≈ 5–15K tokens; brutal pages rarely pass 100K after boilerplate stripping).
• Default = STUFF the whole page for any Cloud model with ≥128K context. Summarizer budget rule: if estTokens(page) < 0.6 × model.contextWindow − reservedOutput → stuff; else → map-reduce. Map-reduce survives only for (i) small/cheap models chosen for hover-summaries, (ii) pathological pages, (iii) multi-tab compare (N pages × 15K). Map runs chunks concurrently; stream only the reduce phase to the UI (map partials shown as progress "Reading section 3/9…"). Refine is never used (sequential → bad streaming UX; page content isn't narrative enough to need it).
• Chunker over PageContext.markdown: split on heading boundaries (carry headingPath); large sections → ~600-token Q&A chunks with ~50-token overlap; tiny sections merge; token estimate chars/4. Each Chunk {id, headingPath, text, charRange, firstWords} — charRange/firstWords power citation + highlight. Summarize chunks are coarser (2–4K, no overlap).
• Chat-with-page retrieval: stuff by default; when over budget or multi-tab, a tiny Swift BM25 (k1=1.2, b=0.75, ~80 LOC) scores chunks against the question + recent turns, taking top-k within budget + always the lead section. No local embeddings in v1 (the benchmark deltas don't justify the complexity for single-page scope) — leave a RelevanceSelector protocol hook. This matches what Brave Leo ships (stuff/truncate, no per-page vector DB). (firecrawl chunking benchmarks; Brave Leo deepwiki.)

# 4. AI surfaces & UX patterns (Phase 3/6 feature contract)

Every Phase 3/6 AI surface, with the pattern it traces to:

1. Smart omnibox (OmniIntent) — graduated ladder, not a mode switch: URL → navigate (always, immediately); fuzzy palette (tabs/history/bookmarks/actions); web search; ask (streamed answer + prominent plural sources, in an anchored overlay, never navigating away). Show the resolved mode inline before commit; bias to navigate/search; force-ask via modifier (Dia keys); user-settable default. Ship the palette AND the ask (Dia's lesson).
2. ⌘F as the AI front door — exact → fuzzy → semantic → ask-about-page (Arc Ask-on-Page + OpenAI semantic find, combined; no one has shipped the full ladder).
3. Chat-with-page sidebar (right, ~360pt, collapsible; ⌘⇧A) — per-tab PageContext context and per-tab history; model chip (all Cloud models) + Automatic/sticky/default; quick-action row (Summarize, Key points, Translate, Ask selection); numbered [§n] citations that scroll-to-highlight the source section on click.
4. Selection floating toolbar — on text selection: Explain / Summarize / Translate / Rewrite / Ask; short results in an anchored popover, long results hand off to the sidebar with the selection as context (Edge "transition to panel"); selection also implicitly joins chat context (OpenAI). Support multiple/element selections later (Chrome I/O 2026).
5. Inline writing assist in web text fields — distinct from the sidebar (OpenAI framing): highlight in a <textarea>/contenteditable → quiet logo affordance → improve / rewrite / expand / shorten / fix-grammar / translate → replace in place via execCommand('insertText') (preserves undo + triggers the site's React/framework input pipeline) with a native-setter+input-event fallback; overlay UI in a body-appended container positioned via Range.getClientRects() (Grammarly technique — never inject markup into the editable content). Make the affordance quiet and dismissible (Edge auto-popup backlash).
6. Summarize / TL;DR — one keystroke; key-points-first with progressive disclosure (Airis structured summaries); long-page map-reduce with streaming progress.
7. Translate page / selection to a chosen language.
8. Multi-tab reasoning — gather several tabs' PageContext; explicit picker with visible chips (not Comet's flaky @tab1); compare/summarize across them.
9. Skills (/shortcut) — ship in Phase 3, not later (industry consensus: Dia/Leo/Chrome/ Neon/Comet all shipped it). Per-skill model + shortcut + prompt binding (Leo); create-from-a-good-answer and a natural-language builder; built-ins (/summarize /explain /keypoints /translate /improve /tldr /compare-tabs); JSON import/export (doubles as the gallery story with no server).
10. Opt-in auto-actions — auto-summary on opening long articles; link hover-summaries (Arc 5-Second Previews); always user-toggleable, per-action model (fast/cheap).
11. Zero-UI AI on chores — tidy tab titles on pin, tidy download filenames, suggest a bookmark folder, auto-name tab groups (Arc/Opera); preview-then-apply for any AI tab mutation.
12. Ask-AI-about-my-history — retrieval over the local full-text history index; send only candidate titles/snippets, never ship history to a model (Chrome pattern, done privately).
13. Global Quick Ask — ⌥Space + menu-bar extra, user-configurable shortcut (Chrome menu-bar Gemini).

Keyboard census adopted: ⌘⇧A AI sidebar (Atlas/Comet), ⌥Space Quick Ask, ⌘F ask-ladder (Arc), Dia-style omnibox force-modifiers.

# 5. Streaming & responsiveness (60fps while a page loads AND AI streams)

• Coalesce SSE deltas into a buffer, flush to @Observable/@Published state on a timer ~33–100 ms (30Hz buttery ↔ 100ms flicker-free) — never re-render per token.
• Incremental Markdown safely: the parse tree is unstable mid-stream (two backticks look like inline code until the third arrives). Parse the buffer into blocks, render completed blocks as immutable views with stable hierarchical IDs, render only the trailing partial block as plain text; only the last block ever mutates, so SwiftUI re-lays-out just the tail. Parse off the main actor, publish on @MainActor. Reference: microsoft/SwiftStreamingMarkdown (feed full-source-so-far, not deltas; built-in inline citations) — port/imitate.
• Per-tab cancellation: each tab's AI context owns at most one in-flight Task<Void, Error>. Cancel on (a) didStartProvisionalNavigation, (b) SPA locationchange, (c) tab close, (d) Stop, (e) a superseding request. Cancelling the Task cancels the underlying URLSession.bytes stream automatically (Swift cooperative cancellation) — this is exactly Zyquo Cloud's AsyncThrowingStream + continuation.onTermination { task.cancel() } pattern (see PROVIDER-REUSE.md §5), so Atlas's cancel-on-navigation hooks straight in.
• Keep all AI networking/parsing/chunking off the main thread; WKWebView renders in its own processes, so the only jank risk is our main actor.

# 6. Multi-tab / multi-page reasoning

• Global panel that tracks the active tab, with per-tab conversation state underneath (dominant shipped pattern: Comet/Leo/Gemini). Add other tabs via an explicit picker with chips + @-mention fuzzy search (Chrome), never freetext matching (Comet's failure).
• "Summarize/compare these N tabs" gathers each tab's PageContext; N×~15K tokens usually exceeds a small model → map-reduce across tabs (§3): map = per-tab summary (concurrent), reduce = the cross-tab comparison (streamed). Cite per claim which tab/section it came from.

# 7. Safety, privacy & correctness (a design constraint from the first AI line)

Consent & indicators

• First-run opt-in (Brave Leo) — AI off until confirmed.
• On-the-tab "content in use" indicator (Chrome's glowing underline) as Atlas's canonical "content leaving device" signal, plus a chrome-level in-flight indicator, plus a per-site "invisible to AI" toggle in the omnibox (OpenAI), plus a one-screen "what left this device today" log.
• Query classifier (Edge): most AI interactions ship only query + URL + title + local history; page content leaves only when the action needs it, always to the user's chosen provider via their own key — never to Zyquo (this is the project privacy rule).
• No nag-wall (Brave): one clear global consent + a per-site denylist, prompts reserved for genuinely consequential moments; consent scoped to the surface, never inherited from an unrelated setting (OpenAI's mistake).
• Never default to collecting content data (Dia's mistake — 30-day undeleteable retention). With BYO keys, Zyquo sees nothing.

Prompt injection (architectural invariants, even though Atlas is read-only) Both the Comet and Neon exploits were triggered by nothing more than clicking "summarize this page." Therefore:

• Page content is always untrusted data, never instructions. Wrap extracted content in explicit delimiters + datamarking (Microsoft Spotlighting), label it untrusted in the system prompt, and treat model output derived from it as potentially unsafe (Brave mitigation #1).
• Extract visible rendered text only — strip display:none, opacity:0, visibility:hidden, zero-size/off-screen, aria-hidden, HTML comments, <template>, low-contrast/white-on-white text (Neon's exploit rode raw-HTML hidden text).
• The AI layer has zero tool access: no navigation, no fetch, no filesystem, no shell, no key-vault reads, no cookies/passwords/autofill, no zyquo:// internal or non-HTTPS pages, no cross-tab reach that isn't explicitly user-selected — so even a fully successful injection can only produce a bad summary, never an action (a documented capability sandbox, per OpenAI's Agent-Mode boundary list).
• On-device models don't fix injection (Brave, Jun 2026) — a local tier is a cost/latency optimization, not a security control.

Grounding & citation hygiene A citation makes a bad answer look trustworthy — the worst failure (CJR ~60% attribution error; EBU ~half of news answers flawed). Countermeasures with UX teeth:

• [§n] chunk-ID citations in the prompt (constrain IDs to supplied chunks, so a hallucinated [§7] is detectable and droppable); optionally upgrade to Anthropic's native Citations blocks when the provider is Anthropic.
• Quote-and-locate: require a short verbatim quote per citation; verify by substring against the chunk (whitespace-fuzzy); drop unverifiable citations.
• Click → scroll-and-highlight in the live page via an injected locateQuote() using window.find/Range + the CSS Custom Highlight API (styled with the theme accent), with a #:~:text= Text-Fragment fallback for citations pointing at other tabs (WebKit supports text fragments since Safari 16.1). headingPath chips are the zero-trust baseline even when quote verification fails.
• Persistent lightweight "AI can be wrong — verify important info" line (industry standard); AI answers additive to prominent, plural, clickable real sources (avoid OpenAI's "anti-web browser" trap).

# 8. Phase 7 additions derived from this research (beyond the CLAUDE.md spec)

1. Redirect-based SSO/OAuth on WKWebView — Okta, SAML, Google, Microsoft Entra, library proxies (the bug that killed SigmaOS for institutional users).
2. Prompt-injection resistance suite — pages with white-on-white text, opacity:0 divs, HTML comments, aria-hidden blocks, low-contrast text in images, and a spoiler-tagged Reddit-style comment; assert Atlas summarizes them and reports the embedded instructions rather than following or silently ingesting them.
3. Extraction-quality suite — news article, docs page, blog, JS-heavy app, very long article, page with a user selection, PDF, YouTube; assert clean main-content + correct selection + honest failure messaging + chunk-count transparency.

# 9. Traceability — planned feature → pattern source