Computer operation

JARVIS operates real Windows applications, windows, files and a real browser. It prefers the most structured interface available, pins targets by identity rather than title, refuses stale targets, and reads the world back after every action, rolling back what does not match.

LIVE-PROVEN , rung 6 of 8 Desktop, browser, file and multi-monitor operation were driven live on the owner's machine on 16 September 2026, with bounded native-app evidence recorded again on 19 September. These are historical readings. Most registry desktop rows are TESTED, and full installed-app journeys are owed at release.

PARTIAL Parts of this system sit at different rungs. The breakdown below shows each one.

As of
Parts tracked
8
Catalogued capabilities
17
On the unmerged branch
3
Real capture, captured 22 September 2026. JARVIS launched Calculator and verified it (“Calculator is open on monitor two”). Asked to type a sum into it, the planner reached for a tool it had not been granted, and JARVIS refused: “not a tool I have been granted”. ShowsDesktop launch and close are verified, and ungranted tools are refused rather than attempted. Does not showIt did not do the arithmetic. Operating inside the app was not reachable from conversation that evening.
What happens, step by step
  1. 0:00 Asked: “Open Calculator.”
  2. 0:03 Launched and verified: “Calculator is open on monitor two.”
  3. 0:08 Asked to type into it → refused: “not a tool I have been granted”
  4. 0:13 Closed on request

Captured at revision 893913a9c

Status breakdown

Where each part stands

3 live-proven 2 integrated 2 tested 1 implemented

  1. Applications, windows and files Capability model DESKTOP, FILES and MULTI-MONITOR driven live 2026-09-16 (for example, 'open Notepad' verified in 2.3 s). Historical.
    LIVE-PROVEN , rung 6 of 8 OBSERVED Where: Production branch
  2. Browser operation with semantic targeting Capability model BROWSER driven live 2026-09-16. Historical.
    LIVE-PROVEN , rung 6 of 8 OBSERVED Where: Production branch
  3. Stale-target refusal (20 s identity lease) The expiry refusal was recorded live in the 2026-09-16 capability model.
    LIVE-PROVEN , rung 6 of 8 OBSERVED Where: Production branch
  4. DOM scene with frames and shadow roots, plus dom-target-check Not merged into production. Iframes and shadow DOM are absent from production.
    INTEGRATED , rung 4 of 8 TESTED Where: Advanced Systems branch (not merged)
  5. DPI-correct UI Automation geometry A disposable owned window moved across four displays with physical-pixel readback. Not merged into production.
    INTEGRATED , rung 4 of 8 FIXTURE Where: Advanced Systems branch (not merged)
  6. Registry desktop capabilities Opening, closing and moving are deliberately not live-probed by the registry, because the probe would change the owner's screen.
    TESTED , rung 3 of 8 TESTED Where: Production branch
  7. Screen grounding (screen, OCR, targeting) Maps screen regions to UI Automation or DOM elements. Registry rows were demoted for reachability in an August audit.
    TESTED , rung 3 of 8 TESTED Where: Production branch
  8. Browser typing and form filling on the DOM scene Pending validation. Not merged into production.
    IMPLEMENTED , rung 2 of 8 NONE Where: Advanced Systems branch (not merged)

Pipeline

How it flows

A desktop action

  1. Owner phrase
  2. App catalogue and live window census ambiguous target: ask
  3. Target lease 20 s identity lease (can stop the request)
  4. PolicyEngine.decide desktop mutation needs exact-identity approval (can stop the request)
  5. Choose a rung native, UIA, keyboard, mouse
  6. Journal the before-state
  7. Effect
  8. Independent re-read (can stop the request)
  9. VERIFIED or rolled back
  10. Receipt and undo journal
Ambiguity becomes a question; a mismatch becomes a rollback.

A browser action (Advanced branch)

  1. Page
  2. DOM scene frames and shadow roots
  3. dom-target-check/1 moved, replaced, covered or changed: refuse (can stop the request)
  4. Governed action (can stop the request)
  5. Read-back
Not merged into production.

Diagrams are simplified from the code paths named in the sources below. They are illustrative, not screenshots.

Operating someone’s real computer is where assistants usually fail quietly. They click the wrong window because it has the same title. They type into a field that has moved. They report success because the click went through, whether or not anything happened. JARVIS’s desktop layer is designed around those failures. Every action is previewed, gated by the governance chain, journaled, and verified by reading the world back.

The interaction ladder

To act on an application, JARVIS chooses the most structured interface available, in this order:

  1. Native API. Most precise, and states can be read back directly.
  2. UI Automation. The Windows accessibility tree, with named controls and states.
  3. Keyboard. Deterministic, but blind to layout.
  4. Synthetic mouse. The last resort.

Each rung down is more fragile, so JARVIS descends only when it has to. Coordinate-based clicking is withheld by default. When it is used, it is announced, because a silent coordinate click is the most likely way to act on the wrong thing. Directly changing a window through its raw native handle is refused in production, because Windows can recycle a handle for an unrelated window.

Window identity and the 20-second lease

Two windows can share a title and a position. So JARVIS identifies a window by its handle, process ID, window class and process-creation generation, and never by title or rectangle. Once a target is resolved, it gets a 20-second identity lease. If the lease expires before the action runs, the action is refused with “target identity is unknown or expired”. That refusal was recorded live in the capability model on 16 September 2026.

Why refuse rather than re-resolve silently? A re-resolution could pick a different window than the one the owner meant. Refusing is cheap. Acting on the wrong window may not be.

When a phrase such as “close the editor” matches more than one window, JARVIS asks which one instead of choosing.

Verification, rollback and undo

After every action, JARVIS re-reads the geometry and state it expected to change. The outcome is one of:

  • VERIFIED: what was read matches what was expected.
  • MISMATCH: the action is rolled back rather than reported as done.
  • FAILED: the effect did not happen.
  • ROLLED_BACK: the change was reversed.

Undo is exact. The window controller reverses “this exact journalled action, never whichever action happened last.” So if two things happened, undoing one cannot accidentally reverse the other.

JARVIS also yields to the owner. If the owner types or clicks during the final focus boundary before an effect, JARVIS stands down and never retries that effect. A person’s hands on the keyboard outrank a plan.

Browser

JARVIS drives the owner’s visible Chrome through Playwright. It finds elements semantically, by role and accessible name, rather than by pixel positions or fragile selectors. Downloads and raw click-and-type are refused in production. Nothing a web page says can reach policy, approvals or the E-stop. Page text is data, never an instruction.

The Advanced Systems branch, which is not merged into production, adds a DOM scene reader. It understands relationships across frames and shadow roots, which production cannot see into today. It also adds dom-target-check/1, which refuses a target that has moved, been replaced, been covered or changed since it was observed. Two rules keep browser observation from turning into authority: “CSS viewport rectangles are observation data, never native screen leases”, and “CURRENT/STALE is an observation comparison, never click authority.” Typing and form filling on this path are still pending validation.

Screen grounding

Screen capture, OCR and a targeting module map regions of the screen to UI Automation or DOM elements. Browser regions feed the same path without gaining any native authority. A generic “invoke” with no independent check that the application reached its goal stays UNVERIFIED. The system does not credit itself for a click whose result it cannot see. Text recognised on screen is quarantined as possible prompt injection. See perception.

Scaled displays

On the Advanced branch, UI Automation geometry was corrected for Windows display scaling. An owned, disposable window was moved across four displays, with each position read back in physical pixels. A later move was then refused by the E-stop. This ran on a disposable fixture window, not the owner’s applications.

What is live and what is tested

Area Rung Evidence
Opening apps, window control, files, multi-monitor LIVE-PROVEN Capability model, 16 September 2026 (historical)
Browser with semantic targeting LIVE-PROVEN Capability model, 16 September 2026 (historical)
Stale-target refusal LIVE-PROVEN Capability model, 16 September 2026 (historical)
Bounded native application operation LIVE-PROVEN Re-recorded 19 September 2026 (historical)
Registry desktop rows TESTED Deliberately not live-probed
Screen grounding TESTED Tests
Frames, shadow roots, target checks INTEGRATED Advanced branch only
DPI-correct geometry INTEGRATED Advanced branch, fixture window

What is not proven yet

  • Live readings are historical. They were recorded on 16 and 19 September 2026.
  • Full-universe installed-app journeys are still owed at release. Live evidence so far covers a bounded set of applications and actions.
  • The registry does not live-probe desktop mutations. It skips them on purpose to avoid disturbing the owner’s screen, so their registry rows stay TESTED.
  • Iframes and shadow DOM are absent from production. Browser typing and filling on the Advanced path are unvalidated.
  • Screen grounding was demoted for reachability in an August audit and has not been re-proven live.

Invariants

Rules the code enforces

  • Coordinate fallback never silent

    jarvis/desktop/interaction.py

  • target identity is unknown or expired

    jarvis/desktop/ (window identity lease refusal)

  • CSS viewport rectangles are observation data, never native screen leases.

    Advanced Systems browser docs (branch, not merged)

  • CURRENT/STALE is an observation comparison, never click authority.

    Advanced Systems browser docs (branch, not merged)

Capabilities

Related capabilities

All 17 catalogued capabilities in this area

Sources

Sources

Paths are relative to the private JARVIS repository. They are listed so the claims above can be audited by the owner and reviewers; the files themselves are not published.

  • doc docs/analysis/JARVIS_CAPABILITY_MODEL_2026-09-16.md
  • ledger docs/ledger/CAPABILITY_TRUTH.json
  • ledger docs/ledger/NATIVE_APP_DEVELOPMENT_PROOF_20260920.json
  • ledger docs/ledger/CURRENT_BODY_EVIDENCE_MATRIX.md