Add browser workflow reliability primitives and guardrails

config/default.yaml

@@ -238,7 +238,8 @@ models:
 #   default_namespace: default
 #   allowed_namespaces: []  # Empty = allow any namespace; set to restrict access.
 
-# Optional: Browser automation tools (browser.navigate/screenshot/click/type/content/eval/evaluate)
+# Optional: Browser automation tools
+# (browser.navigate/screenshot/click/type/content/wait_for/assert/extract/checkpoint.save/checkpoint.resume/eval/evaluate)
 # Requires a local Chrome/Chromium install or a remote CDP endpoint.
 # browser:
 #   enabled: true
@@ -247,6 +248,14 @@ models:
 #   headless: true
 #   max_pages: 5
 #   default_timeout: 30000
+#   # Guardrails:
+#   # allowed_domains: ["*.example.com"]
+#   # high_risk_domains: ["bank.example.com"]
+#   # require_confirmation_for_high_risk: true
+#   # max_workflow_steps: 120
+#   # default_retry_attempts: 1
+#   # max_retry_attempts: 5
+#   # retry_delay_ms: 250
 #
 # Tool policy reminder:
 # - `tools.profile: coding` or `tools.profile: full` must allow browser.* tools.