WebRider: Persona-Conditioned Intent Controllers for Live-Web Assistance

# WebRider: Persona-Conditioned Intent Controllers for Live-Web Assistance
Source: [https://arxiv.org/html/2608.06704](https://arxiv.org/html/2608.06704)
Zhi Li1,2111Work done while interning at Google\., Tao Zhou2\\corresponding, Yeqing Li2, Eugene Ie2, Demetri Terzopoulos1

###### Abstract

Delegating a web task involves more than asking a question; it requires transferring a policy: what to verify, how to handle uncertainty, which preferences matter, and when to stop\. Yet, current live\-web agents are evaluated solely on the final answer, ignoring the policy constraints that define the delegation\. A plausible final answer can conceal violations of that policy\. Our full live audit reveals this critical gap: a strong controller completes 99\.2% of tasks but honors all policy constraints in only 38\.8% of cases\. Finishing does not imply fidelity\. WebRider bridges this gap by formalizing the delegated policy as an*intent contract*—an operational record of goals, constraints, evidence obligations, answer form, and task\-local persona controls that must hold even as web pages change\. WebRider employs a hierarchical architecture: a top\-layer controller maintains the contract, a middle layer realizes intentions as guarded executable actions, and a tool layer executes these actions via browser, search, and maps tools\. Our benchmark, RiderBench, evaluates this design on 4,096 live\-web contracts across 42 public websites, auditing both the internal contract state and the visible user experience to determine if a rollout preserved its policy and if the steps were persona\-consistent\. The guarded middle interface also serves as a high\-quality training signal; an 8B action\-policy model trained through this interface outperforms executable\-only baselines under a fixed controller\. By making the browsing path a first\-class object, WebRider enables a system that is auditable, human\-judgeable, and learnable without conflating action realization with final\-answer decisions\.*Dataset URL:hf\.co/datasets/WebRider/WebRider*

## Introduction

A browser agent can appear successful for the wrong reason\. It may reach a product page and offer a fluent recommendation after disregarding the return policy the user cared about, or answer a local query after drifting to the wrong city\. In these cases, the user delegated not just an endpoint, but a specific way of doing the task\.

Consider:*“Find a good refurbished 4K mirrorless camera under $900\.”*The hard constraints are explicit\. The task\-local policy is not: a trust\-first user expects seller reputation, condition, warranty, and returns to be checked; a deal seeker may broaden the search to open\-box offers; an uncertainty\-averse user may insist on asking before proceeding if compatibility is unknown\. Crucially, these are not demographic identities or private memories\. They are*control policies*governing evidence gathering, uncertainty handling, ranking, interaction, and stopping\. Consequently, two controllers can obey the same request yet require entirely different valid routes\.

Preserving such a policy is difficult on the live web\. Evidence appears gradually, pages change, access can fail, and reasoning, grounding, clicking, clarification, and stopping are entangled in a single loop\. Worse, a final answer can remain plausible even if the controller has deviated from the delegated route\. The scientific question is:*How can a browser agent preserve a task\-local policy through every visible step while the page state changes?*

We call the stable audit record for that policy an*intent contract*\. It encapsulates the goal, constraints, preferences, evidence obligations, blockers, answer form, and persona/control policy\. WebRider enforces this record through the hierarchy illustrated in Figure[1](https://arxiv.org/html/2608.06704#Sx1.F1): a top layer tracks the contract and decides whether to browse, ask, stop, block, or answer; a middle layer realizes the current intention as a single, atomic guarded JSON Action AST; and a bottom layer executes browser, search, or maps actions\. Persona specifies the policy; the hierarchy preserves it during execution\. Significantly, the split is structural, not a claim of cognitive equivalence\. It decouples long\-horizon sufficiency decisions from page\-local action selection and creates a local target whose correctness can be verified after every step\.

![Refer to caption](https://arxiv.org/html/2608.06704v1/figures/figure1.png)Figure 1:The WebRider hierarchy preserves task\-local policy\. The top layer enforces the intent contract and tracks finalization state; the middle layer generates atomic, guarded executable actions; and the executor layer operates on the live web page, returning observations to the controller\.The paper follows one causal chain\. RiderBench expands 768 audited requests into 4,096 persona\-conditioned contracts across 42 sites, enabling same\-request counterfactuals under fixed hard constraints and evidence obligations\. Success is measured via contract gates and a paired human study to evaluate whether completed traces and visible steps preserve the delegated policy\. Finally, ablations isolate whether persistent intention drives control better than persona or intention text alone, and analysis of guarded middle traces tests whether the resulting action boundary can train a replaceable policy under a fixed controller\.

The headline result illustrates why the path matters: Our strong benchmark controller \(Full\-Pro\), terminates on 99\.2% of contracts, but only 38\.8% satisfy every contract gate\. The human study finds that final\-trace success and stepwise acceptability diverge significantly, while the mechanism study isolates the value of persistent intention\. WebRider thus makes missing delegation fidelity observable and provides a controlled way to test, audit, and learn the route that produced the answer\.

## Related Work

### Web and GUI agents\.

Foundational works such as World of Bits\(Shiet al\.[2017](https://arxiv.org/html/2608.06704#bib.bib15)\)and WebShop\(Yaoet al\.[2022](https://arxiv.org/html/2608.06704#bib.bib13)\)formulate web interaction as grounded decision making, while Mind2Web\(Denget al\.[2023](https://arxiv.org/html/2608.06704#bib.bib3)\)provides broad offline action supervision\. More recent efforts, including WebArena\(Zhouet al\.[2024](https://arxiv.org/html/2608.06704#bib.bib1)\)and VisualWebArena\(Kohet al\.[2024](https://arxiv.org/html/2608.06704#bib.bib2)\), offer controlled executable environments\. The field has since expanded to live sites and general computer use with benchmarks like WebVoyager\(Heet al\.[2024](https://arxiv.org/html/2608.06704#bib.bib4)\), BrowserGym\(Le Sellier de Chezelleset al\.[2025](https://arxiv.org/html/2608.06704#bib.bib7)\), WorkArena\(Drouinet al\.[2024](https://arxiv.org/html/2608.06704#bib.bib6)\), OSWorld\(Xieet al\.[2024](https://arxiv.org/html/2608.06704#bib.bib5)\), and BrowserArena\(Anupamet al\.[2025](https://arxiv.org/html/2608.06704#bib.bib20)\)\. Critically, these benchmarks primarily ask whether an agent completes a task or reaches a correct state\. By contrast, WebRider adds a task\-local delegation record, asking not just*if*the task is done, but whether the policy survives the entire trajectory\.

### Personalization and persona\.

Recent work on user\-conditioned agents \(e\.g\., PersonalWAB\(Caiet al\.[2025](https://arxiv.org/html/2608.06704#bib.bib11)\), RealWebAssist\(Yeet al\.[2026](https://arxiv.org/html/2608.06704#bib.bib10)\), Persona2Web\(Kimet al\.[2026](https://arxiv.org/html/2608.06704#bib.bib9)\), ShopperBench\(Linget al\.[2026](https://arxiv.org/html/2608.06704#bib.bib16)\), Orion\(Huet al\.[2026](https://arxiv.org/html/2608.06704#bib.bib21)\), TIPO\(Linet al\.[2026](https://arxiv.org/html/2608.06704#bib.bib22)\), PersonaFingerprint\(Songet al\.[2026](https://arxiv.org/html/2608.06704#bib.bib28)\), SimPersona\(Foumaniet al\.[2026](https://arxiv.org/html/2608.06704#bib.bib29)\)\) aims to move beyond a single average policy\. However, existing approaches often conflate persona with stylistic traits or static memory\. By contrast, WebRider redefines persona as a controlled counterfactual—an observable, task\-local rule governing search breadth, verification, clarification, ranking, and stopping\. By pairing these rules with identical requests, site families, hard constraints, and evidence obligations, WebRider isolates useful behavior change from constraint drift or unsupported recommendations\.

### Modular and trainable control\.

ReAct\(Yaoet al\.[2023](https://arxiv.org/html/2608.06704#bib.bib12)\)interleaves reasoning and action, while SeeAct\(Zhenget al\.[2024](https://arxiv.org/html/2608.06704#bib.bib19)\), WebGUM\(Furutaet al\.[2024](https://arxiv.org/html/2608.06704#bib.bib23)\), WebLINX\(Lùet al\.[2024](https://arxiv.org/html/2608.06704#bib.bib18)\), Avenir\-Web\(Liet al\.[2026](https://arxiv.org/html/2608.06704#bib.bib26)\), and WAC\(Shenet al\.[2026](https://arxiv.org/html/2608.06704#bib.bib27)\)improve grounding through visual context, dialogue, memory, experts, or correction\. Planning work has likewise separated high\-level planning from low\-level execution\(Erolet al\.[1994](https://arxiv.org/html/2608.06704#bib.bib30); Sodhiet al\.[2024](https://arxiv.org/html/2608.06704#bib.bib31); Aghzalet al\.[2026](https://arxiv.org/html/2608.06704#bib.bib32)\)\. By contrast, WebRider trains a narrower interface: given top intention, persona state, current observation, and recent history, its middle layer predicts a single, post\-guard executable Action AST\. It does not learn evidence sufficiency or final\-answer readiness; these remain top\-layer decisions\.

### Trajectory evaluation and human acceptability\.

Trustworthiness research shows that completion can hide unsupported or unsafe behavior\(Levyet al\.[2026](https://arxiv.org/html/2608.06704#bib.bib8)\)\. Recent benchmarks such as Mind2Web 2\(Gouet al\.[2025](https://arxiv.org/html/2608.06704#bib.bib25)\), AgentRewardBench\(Lùet al\.[2025](https://arxiv.org/html/2608.06704#bib.bib17)\), and Emergence WebVoyager\(Akkilet al\.[2026](https://arxiv.org/html/2608.06704#bib.bib24)\)investigate trajectory judging, ambiguity, and live\-web reporting\. WebRider goes further by decomposing completion into contract gates, reports access and runtime failures separately, and adds human labels for stepwise persona consistency and delegation comfort\. Crucially, model\-rater pilots are used only as diagnostics, never as human gold standards\.

## Hierarchical Controller

WebRider decouples the decision of*what*still matters from*how*to act on the current web page\. Rather than relying on a fixed sequence of LLM calls, the architecture enforces a strict boundary: the top layer manages evidence sufficiency and task finalization, while the middle layer generates a single executable action at a time\. This separation ensures that persona and evidence decisions remain inspectable while simultaneously making the action realization process trainable\.

### Top layer\.

The top layer’s state encapsulates the goal, constraints, preferences, blockers, evidence ledger, progress, and next intention\. The layer orchestrates the high\-level strategy, deciding whether to browse, ask, answer, stop, or flag an external blocker\. to continue browsing, the layer emits a compact command, such as “Verify this candidate’s return policy” or “Find a second source for compatibility\.”

### Middle layer and guards\.

Based on the current observation, top\-layer command, persona state, and recent history, the middle layer emits exactly one JSON Action AST:Click,Type,Scroll,Search,Maps,Back,Wait, or a safe fallback\. This layer grounds the current intention, but it is prohibited from deciding evidence sufficiency or final\-answer readiness\. A deterministic compiler and a suite of helper guards enforce the grammar, rejecting malformed targets and terminal labels, detecting repeated or blocked states, and attaching recovery actions\. For training, the target is the final post\-guard executable action, not raw model text\. The same guards remain active when a learned middle layer is deployed, so every browser step supplies a local and verifiable target\. Accordingly, the learned policy is strictly scoped to action realization: complexities such as CAPTCHA and access\-policy handling, evidence sufficiency, and final answering remain the responsibility of the guards or the top layer\.

### Executor and trace\.

The executor performs browser and grounding actions, returning screenshots, observations, element labels, and block or readiness signals\. It has no persona or evidence reasoning abilities\. Each step records the current intention, protected constraints, evidence state, guarded action, and resulting observation\. Figure[2](https://arxiv.org/html/2608.06704#Sx3.F2)illustrates how these fields make a live trajectory auditable, allowing middle\-policy training with the top state, guards, and executor held fixed\.

![Refer to caption](https://arxiv.org/html/2608.06704v1/x1.png)Figure 2:An audited rollout pairs each browser state with its stored contract state: current intention, post\-guard executable action, expected next observation, evidence coverage, remaining obligations, and final gate\. The controller withholds the answer until evidence for blackout performance, width, no\-drill installation, and public browsing is covered\.

## Persona\-Conditioned Intent Contracts

An*intent contract*is this paper’s operational object for a delegated browsing task\. Given requestxx, a website familyww, and a task\-local persona/control policypp, the stable record is

\(x,w,p\)↦\(g,H,S,Bmat,E,A,p\)=z,\(x,w,p\)\\mapsto\(g,H,S,B\_\{\\mathrm\{mat\}\},E,A,p\)=z,\(1\)whereggdenotes the goal,HHthe hard constraints,SSthe soft preferences,BmatB\_\{\\mathrm\{mat\}\}the blocking conditions that require asking or stopping,EEthe evidence obligations, andAAthe answer schema\. Recordzzchanges only upon explicit user clarification, ensuring its obligations are known before interaction and auditable afterward\.

The policy specifies how to perform the task, not who the user is\. A trust\-first verifier checks source credibility \(e\.g\., seller reputation, review count\) and returns before recommending; an uncertainty\-averse controller asks when an unresolved attribute can change the answer; a deal hunter may broaden the search to include sale, refurbished, or open\-box options\. BecauseHHandEEstay fixed, a policy may alter search breadth, verification depth, ranking, or stopping—but it cannot override a constraint violation or justify an unsupported claim\.

At steptt, the controller top layer maintains state

sttop=ftop​\(z,o≤t,a<t\),s^\{\\text\{top\}\}\_\{t\}=f^\{\\text\{top\}\}\(z,o\_\{\\leq t\},a\_\{<t\}\),\(2\)whereo≤to\_\{\\leq t\}anda<ta\_\{<t\}are the observation and action histories, respectively\. The middle layer maps this state and the current observationoto\_\{t\}to one guarded action

at=fmid​\(sttop,ot,ht\),a\_\{t\}=f^\{\\text\{mid\}\}\(s^\{\\text\{top\}\}\_\{t\},o\_\{t\},h\_\{t\}\),\(3\)wherehth\_\{t\}is the recent action/evidence history\. Hereata\_\{t\}is the guarded Action AST executed to produceot\+1o\_\{t\+1\}\. Ask, Answer, Blocked, and Stop decisions remain with the top layer; the middle grounds the current intention and may recover through a browser\-safe fallback\.

This boundary separates*why*the controller acts from*how*it executes its actions\. Allowing the middle layer to terminate would entangle click choice with the assessment of evidence sufficiency\. Conversely, specifying every click at the top would preclude a reusable action policy\. WebRider resolves this by keeping the layers distinct but aligned; the top state records the contractual obligations while the middle layer determines how to advance that intention on the current web page\. This separation ensures that the top layer maintains the contract, while the middle layer is the agent of execution\.

### Contract\-gated success\.

We define*Contract\-Gated Success*as the logical conjunction of five binary gates:

CGS=cT∧cH∧cE∧cA∧¬cB,\\mathrm\{CGS\}=c\_\{T\}\\land c\_\{H\}\\land c\_\{E\}\\land c\_\{A\}\\land\\neg c\_\{B\},\(4\)where the gates indicate terminal completioncTc\_\{T\}, hard\-constraint satisfactioncHc\_\{H\}, evidence sufficiencycEc\_\{E\}, usable answer qualitycAc\_\{A\}, and unresolved material blockerscBc\_\{B\}\.*Aggregate CGS*is the fraction of live rollouts satisfying CGS\. Importantly, external access blocks and runtime failures \(e\.g\., CAPTCHAs, browser crashes\) are reported separately to ensure they are not conflated with unjustified answering, missed evidence, or constraint drift\.

### Step\-level human acceptability\.

While CGS validates the completed trace, the human audit evaluates whether each visible step preserves the persona policy and whether a rater would trust an agent to execute such behavior\. We define these metrics as the*Persona\-Consistency Score*\(PCS\) and*Human\-Comfort Preference*\(HCP\)\. They complement rather than duplicate CGS; a trace may satisfy final gates while taking intermediate steps that a human delegate would reject\.

Base Tasks768Policies15Contracts4,096RolloutRecords

Figure 3:RiderBench\. Audited base tasks are paired with task\-local policies, then executed as live rollout records\.MeasureCountBase tasks768Contracts4,096Websites / domains42 / 12Persona policies15Train / dev / test2,560 / 512 / 1,024Base / pairing audit pass768/768 / 4,096/4,096Difficulty 1/2/3/41024 / 1024 / 1024 / 1024Ambiguity high/medium/low1366 / 1365 / 1365Task modes911 / 909 / 664 / 651 / 651 / 310Output schemas2471 / 1625Base\-task variants 5 / 6512 / 256

Table 1:RiderBench coverage\. Task modes are plan / compare / verify / lookup / select / troubleshoot; outputs are recommendation / evidence\-answer\.Broader searchand diversityStricter assuranceand deliberationcautious directask/verifyrigorous explorationcompare evidencefast/simplesufficient stopopportunity searchvalue/dealsUrgentConven\.AccessLocalBrandSafetyControlBudgetDealDiversitySustain\.QualitySpecTrustUncert\.

Figure 4:Persona\-policy projection\. Search breadth increases rightward and assurance upward; live rollouts use the full 10\-axis policy vector\.RunNNTermCGSHardEvidAnsBlockRTStepsFull\-Pro4,09699\.2%38\.8%70\.3%57\.4%42\.3%13\.5%0\.8%8\.37Full\-Flash4,09699\.7%34\.4%68\.2%58\.6%62\.5%15\.7%0\.3%11\.49Flash\-604,09699\.0%37\.9%73\.3%58\.8%64\.1%17\.0%1\.0%20\.04Exec\-Pro4,09699\.7%32\.9%42\.2%35\.7%33\.0%14\.7%0\.3%9\.09Exec\-Flash4,09699\.5%32\.8%41\.3%35\.6%33\.6%16\.9%0\.5%11\.58GPT\-5\.5\-Diag1,024–44\.9%67\.2%62\.5%46\.1%3\.1%0\.0%–

Table 2:Live contract\-gated audits\. Full\-Pro CGS is 38\.8% \(95% CI 37\.4–40\.3%\)\. GPT\-5\.5\-Diag is a blocked\-site\-excluded diagnostic; resource accounting appears only in the supplement\.![Refer to caption](https://arxiv.org/html/2608.06704v1/figures/human_audit_comparison.png)Figure 5:Paired human audit\. Raters see one contract and two blinded rollouts, then judge persona consistency and delegation comfort\. Here, one side drifts to Chicago for a New York request while the other remains on New York evidence\.A\. Paired human outcomeComparisonPairsRolloutsRatersPCS\-APCS\-BΔ\\DeltaPCSHCP netCJIntentCore vs teacher/full80160686%70%\+16 pp\+42\.5%≤\\leq8%

B\. Agreement and gate calibrationDiagnosticUnitNNRatersκH\\kappa\_\{H\}κP\\kappa\_\{P\}Exp\.\-am\.κ\\kappaExp\.\-am\. acc\.ρ\\rho/acc\.FP/lowAnchor PCS/HCP20 pairs60\.620\.660\.64≥\\geq85%––PCS–CGS overlap160 rollouts6––––ρ≈0\.55\\rho\\approx 0\.5511%Expert CGS gate300 rollouts2––––0\.88 acc\.6\.0% FP

Table 3:Human PCS/HCP outcomes and CGS calibration\. Panel A: CJ combines neither/cannot\-judge responses\. Panel B: FP/low reports gate false positives or low\-PCS CGS passes\.ConditionInterfaceNNCGSHard\-CEvidAnsEarly AnsPromptno persona/intent fields1,02436\.5%66\.0%52\.0%55\.0%31%Prompt\+PIpersona\+intent in prompt1,02441\.2%70\.5%60\.5%62\.0%24%Teacher/fulloriginal controller1,02440\.0%72\.6%56\.8%59\.3%–Flatone AST \+ guards1,02444\.6%82\.4%70\.9%71\.1%∼\\sim14%Persona\-onlyone AST \+ persona1,02442\.6%84\.1%70\.6%70\.6%–Intent\-onlyone AST \+ intention1,02445\.5%81\.0%69\.1%71\.8%–IntentCorepersona \+ intention \+ guards1,02446\.8%78\.6%72\.1%71\.6%∼\\sim12%IntentCore\-30same interface, 30\-step cap1,02442\.0%76\.5%65\.6%68\.4%–

Table 4:Mechanism ablations\. All rows use 20 steps except the horizon diagnostic IntentCore\-30\. Persistent intention adds \+5\.6 pp CGS over Prompt\+PI and raises evidence to 72\.1%\.

## RiderBench

RiderBench makes persona\-conditioned delegation auditable by structuring data into two components: a*task layer*storing persona\-free base tasks and persona\-conditioned contracts, and a*rollout layer*capturing live observations, guarded actions, side labels, and calibrated outcomes\. The benchmark contains 768 requests across 42 sites and 12 domains, expanded into 4,096 unique contracts under 15 policies, partitioned into 2,560 train, 512 dev, and 1,024 test splits\. Figure[3](https://arxiv.org/html/2608.06704#Sx4.F3)and Table[1](https://arxiv.org/html/2608.06704#Sx4.T1)summarize the construction process and coverage\.

Multiple policies are paired with each base task, while hard constraints and evidence obligations remain fixed\. This supports same\-request counterfactuals: a route may change because the delegated policy changes, but correctness is unachievable by relaxing the task constraints\. Figure[4](https://arxiv.org/html/2608.06704#Sx4.F4)projects the 15\-policy library onto two axes for visualization, while live rollouts use the full 10\-axis vector\.

The released step\-row schema documents the evidence chain by co\-locating the request and constraints, persona policy, top intention, screenshot \(or observation\), executable action, and verification labels\. Thus, trajectories are inspectable both as raw browser behavior and as a record of intent contract preservation\.

The audit precedes rollout scoring and excludes tasks with persona names in surface prompts, non\-browsing requests, non\-inspectable hard constraints, missing evidence obligations, and policies that cannot alter observable behaviors \(search, verification, clarification, ranking, or stopping\)\. To ensure rigor, difficulty is exactly balanced, ambiguity varies by at most one contract, and every base task includes 5 to 6 policy variants\. These controls enable block\-aware live evaluation, pre\-specified slice analysis, and counterfactual tests without post\-hoc filtering based on success\.

Construct validity rests on observable behavior: a policy is meaningful only if it alters the trajectory as intended while preserving hard constraints and evidence\. This separation makes persona failure falsifiable, distinguishing it from mere stylistic judgment\.

A\. Direct WebRider and human evidenceSignalMetricComparisonNNBaseTestΔ\\DeltaAuxiliaryIntentionCGSteacher→\\rightarrowIntentCore1,02440\.046\.8\+6\.7Evid/Ans 72\.1/71\.6HumanPCSteacher→\\rightarrowIntentCore80 pairs7086\+16HCP \+42\.5Personaroutesame\-base counterfactuals768 groups–96–98–spread 35–36MiddleCGSExec\-Pro→\\rightarrowMidSFT\-8B1,02431\.250\.8\+19\.5Evid 78\.1

B\. External proxy checksSignalMetricProxyNNBaseTestΔ\\DeltappIntentionstep succ\.Mind2Web semantic1,33930\.842\.7\+11\.9<10−12<10^\{\-12\}Intentionstep succ\.WebLINX dialogue50034\.839\.0\+4\.20\.0275Interfacestep succ\.Mind2Web screenshot\+state50036\.843\.6\+6\.87\.56×10−57\.56\{\\times\}10^\{\-5\}Personagate passPersonalWAB\-style1200\.015\.0\+15\.07\.63×10−67\.63\{\\times\}10^\{\-6\}

Table 5:Direct and external evidence\. Panel A reports live, human, counterfactual, and learned\-middle results; Panel B reports related proxy tasks\.![Refer to caption](https://arxiv.org/html/2608.06704v1/figures/figure6.png)Figure 6:One guarded trace supports both trajectory evaluation and middle\-layer training\. The contract remains the audit target as persona changes the route; the complete trace accumulates contract\-gate evidence, while each step yields a supervised example whose target is the post\-guard executable Action AST\. Callouts summarize route divergence, contract\-gate outcomes, and learned\-middle performance\.
## Experiments and Evaluation

We evaluated four key aspects: \(1\) whether completed live traces preserved their contracts, \(2\) whether humans accepted the visible steps, \(3\) whether structure added value beyond persona/intention text, and \(4\) whether the guarded middle action was learnable\. All live runs utilized the same 4,096\-contract dataset, a Chromium backend, and a calibrated audit protocol ensuring at most one active task per site\. External blocks and runtime failures were labeled separately to distinguish infrastructure issues from policy violations\. When page\-local evidence was unavailable, blocked, or geographic, Search and Maps tools were audited for grounding accuracy\.

Evidence and answer gates combined deterministic checks with judgments from GPT\-5\.5 \(high\-reasoning\) and Gemini 3\.1 Pro \(preview\), calibrated against a two\-expert audit of 300 rollouts\. Paired mechanism evaluations used the same contract slice and a 20\-step budget unless specified as a horizon diagnostic\.

We compared four model configurations: Full\-Pro/Full\-Flash \(complete controllers\), Exec\-Pro/Exec\-Flash \(restricted to executable actions in the middle layer\), IntentCore \(binding persona and top intention to a single guarded action\), and MidSFT\-8B \(replacing only the middle policy\)\. The supplement maps these names to archived run identifiers, launch settings, and training recipes\.

### Live contract\-gated evaluation\.

Table[2](https://arxiv.org/html/2608.06704#Sx4.T2)disentangles termination from contract quality, access blocks, and runtime failures\. While GPT\-5\.5\-Diag excludes heavily blocked sites and thus does not constitute a matched full\-run comparison, the main results reveal a critical gap: Full\-Pro terminated on 99\.2% of contracts but passed all gates on only 38\.8%\. This highlights that evidence and answer gates identified many trajectories that terminated without sufficient evidence\.

### Stepwise human acceptability\.

Raters compared two blinded rollouts for the same contract, marking each side’s persona consistency and choosing the behavior towards which they would rather delegate \(Figure[5](https://arxiv.org/html/2608.06704#Sx4.F5)\)\. Arm A was IntentCore and Arm B was the teacher/full controller\. Six raters labeled 80 pairs \(160 rollouts\): 20 shared anchors supported agreement estimates, and 60 coverage pairs were labeled by two amateur raters after expert calibration\. A separate two\-expert audit calibrated CGS on 300 rollouts\. The outcomes in Table[3](https://arxiv.org/html/2608.06704#Sx4.T3)show that IntentCore achieved 86% PCS versus 70% for teacher/full controller, yielding a \+42\.5% net HCP advantage\. Notably, PCS is correlated with but distinct from CGS \(ρ≈0\.55\\rho\\approx 0\.55\)\.

### Hierarchy adds more than information\.

Table[4](https://arxiv.org/html/2608.06704#Sx4.T4)compares prompt\-only and structured controllers on the paired 1,024\-contract slice\. Prompt\+PI supplied the same persona and intention information as text, whereas IntentCore bound this information to a persistent top state and a single guarded action\. The matched gain was \+5\.6 percentage points \(pp\) in CGS, while the improvement from the teacher/full controller to IntentCore was \+6\.7 pp \(95% paired CI: \+3\.9 pp to \+9\.5 pp; 143 vs\. 74 favorable transitions\)\.

### Convergent evidence\.

Table[5](https://arxiv.org/html/2608.06704#Sx5.T5)distinguishes direct WebRider evidence from external proxy checks\. The proxy baselines test related action\-grounding or profile\-conditioning signals and are not entries on the live WebRider leaderboard\.

### Learning the action\-realization layer\.

While the preceding ablations tested whether hierarchy improves control, this experiment asked whether its per\-step interface is reusable\. The top layer handled long\-horizon evidence and stopping decisions, and the executor was deterministic; thus, only the middle layer, mapping local states to post\-guard actions, required replacement\. Table[6](https://arxiv.org/html/2608.06704#Sx6.T6)reports results for both held\-out prediction and live insertion\. MidSFT\-8B achieved 91\.24% action match and 84\.81% target match, along with 50\.8% CGS and 78\.1% evidence on 1,024 live contracts\. This validates the shared evaluation and training boundary shown in Figure[6](https://arxiv.org/html/2608.06704#Sx5.F6), rather than requiring full\-controller replacement\.

Middle ResultNNActionTargetCGSEvidMidSFT\-8B offline2,14691\.24%84\.81%––Qwen8B\-Exec offline2,42288\.93%82\.33%––Qwen32B offline1,02490\.23%82\.81%––Gemma4\-31B offline1,02472\.27%79\.69%––Qwen30B\-A3B offline12882\.81%75\.78%––Exec\-Pro ref\. live1,024––31\.2%–Exec\-Flash ref\. live1,024––34\.8%–MidSFT\-8B live1,024––50\.8%78\.1%

Table 6:Trained middle layer results\. Offline rows predict post\-guard actions, while live rows hold the Gemini top layer and guards fixed\.
### Results and discussion\.

The first result is a gap between termination and fidelity\. Full\-Pro almost always stopped, yet less than 40% of traces satisfied all contract gates \(Table[2](https://arxiv.org/html/2608.06704#Sx4.T2)\)\. Hard constraints passed more often than evidence and answer quality, so the missing mass was not merely browser failure: many completed traces reached a plausible endpoint without assembling the support or preserving the conditions required by the contract\. Contract\-gated scoring exposed this failure while retaining block and runtime labels as separate causes\.

Human judgments revealed a complementary gap\. IntentCore’s 86% PCS and \+42\.5% net HCP advantage aligned with its automatic improvement, yet PCS and CGS correlated only moderately; 11% of CGS\-passing human\-audit rollouts were assigned low PCS scores\. The two measurements therefore answer different questions: CGS asks whether the completed trace satisfies auditable obligations, while PCS/HCP asks whether the visible behavior remains acceptable to a person delegating under that policy\.

The ablations pinpoint the mechanism more narrowly\. Persona and intention text improved a prompt\-only controller, but adding a persistent top state plus one guarded action yielded further improvement \(Table[4](https://arxiv.org/html/2608.06704#Sx4.T4)\)\. The gain was not reproduced by a longer horizon: IntentCore\-30 fell to 42\.0% CGS and incurred more runtime failures\. Same\-base counterfactuals supported the intended role of the persona: 96–98% of 768 groups changed action signature and roughly 35–36% showed within\-group success spread\. Persona is thus a behavior\-shaping control variable, not a guarantee of higher success or a change to the task’s hard requirements\.

The executable\-only runs clarified the learning result\. Removing finalization from the middle lowered Full\-Pro CGS from 38\.8% to 32\.9%, showing that a clean interface is not automatically a better live controller\. It did, however, define a local target that MidSFT\-8B learned well\. Under the fixed top layer, the student reached 50\.8% CGS and 78\.1% evidence, surpassing the same\-subset Exec\-Pro/Exec\-Flash references\. Because access pressure differed across runs, Table[7](https://arxiv.org/html/2608.06704#Sx6.T7)also reports no\-block and clean denominators; the clean CGS was 52\.0% versus 38\.9%/39\.9%\. This serves as evidence for the trainability of the action\-realization boundary, not a full\-agent model\-family ranking\.

RunAllBlockNo\-blockCleanExec\-Pro32\.914\.738\.838\.9Exec\-Flash32\.816\.939\.639\.9MidSFT\-8B50\.82\.052\.052\.0

Table 7:Block\-adjusted CGS \(%\)\. No\-block removes access blocks; Clean further excludes runtime failures\.SliceGroupsCGS SpanBlock SpanWebsite420\.0–90\.50\.0–100\.0Domain129\.4–68\.80\.0–34\.4Task type630\.4–46\.612\.7–14\.9Difficulty437\.3–40\.311\.9–14\.7

Table 8:Full\-Pro cross\-slice ranges over 4,096 contracts\. Variation across websites and domains exceeds the baseline difficulty spread\.The slice analysis identified where live\-web difficulty enters\. Full\-Pro spanned 0\.0–90\.5% CGS across sites but only 37\.3–40\.3% across the balanced author difficulty levels \(Table[8](https://arxiv.org/html/2608.06704#Sx6.T8)\)\. Task form mattered even at similar block rates: Compare tasks reached 46\.6% CGS, whereas Select tasks reached 30\.4%\. These results refined the aggregate claim in a useful way\. WebRider measures contract preservation under changing public\-web conditions, where site affordance, access policy, evidence availability, and stopping structure can dominate a nominal difficulty tag\.

External proxies serve only as scope checks: intention helped on Mind2Web and WebLINX, state aided visual grounding, and persona gating altered PersonalWAB\-style outcomes\.

## Conclusions and Future Work

Persona\-conditioned browsing is fundamentally a delegation problem: constraints, evidence thresholds, and rules for asking or stopping determine which route is acceptable\. WebRider makes that route explicit through intent contracts, audits it at both trace and step levels, and employs a hierarchy that keeps finalization decisions above executable action selection\. RiderBench reveals three critical insights: \(1\) high termination can coexist with low contract fidelity, \(2\) human judgments confirm that final gates do not fully capture stepwise acceptability, and \(3\) guarded middle traces provide a learnable action interface under a fixed top layer\. For this setting, the path is part of the task, and explicit intent makes it possible to verify whether that path was preserved\.

### Limitations and Future Work\.

WebRider studies given task\-local policies, not private long\-term memory or contract inference from dialogue; policy elicitation remains future work\. The hierarchy is structural, not a claim of cognitive equivalence\. Live sites change, and CAPTCHA or access\-policy blocks remain unresolved\. We report access and runtime failures separately, though later reruns may drift\. Baseline coverage is strongest for Gemini controllers, and GPT\-5\.5\-Diag was not a matched full run\.

Evidence and answer gates combine GPT\-5\.5 high\-reasoning and Gemini 3\.1 Pro preview judgments with deterministic checks, calibrated on a two\-expert, 300\-rollout audit\. These are less mechanical than termination or block detection\. The 80\-pair PCS/HCP study blinds raters to run names, but rollout style can reveal cues; not every mechanism contrast has human labels \(see supplement for HCP tie normalization\)\. MidSFT\-8B replaces only the action\-realization middle layer under a fixed top layer and active guards\. Full\-controller learning and a full 4,096\-contract student run remain future work\.

### Ethical Considerations\.

RiderBench uses non\-logged\-in public\-web tasks and excludes purchases, credentials, private accounts, irreversible actions, and sensitive flows\. Persona policies are abstract task\-local rules rather than demographic profiles\. The release distinguishes between authored contracts, model\-generated text, public\-web observations, and human labels\. Screenshot\-reduced artifacts serve as the fallback when website terms or third\-party content require it\. Operational traces do not expose hidden model reasoning\.

### Reproducibility\.

The release centers on the atomic unit of execution: one browser step under a single contract\. It includes audited contracts, code, manifests, a 100\-task bundle with 827 screenshots, and step splits for Full\-Pro, Full\-Flash, Flash\-60, Exec\-Pro, and Exec\-Flash\. Data rows store the request, constraints, persona, top intention, observation, guarded action, verification, and outcome; rollout identifiers and step indices reconstruct trajectories and metrics\. The supplement documents launch, training, human\-audit, table\-regeneration, and release procedures\. Credentials, private state, tokens, raw rater material, and restricted third\-party content are excluded\.

## References

- Why do LLM\-based web agents fail? a hierarchical planning perspective\.InProceedings of the 64th Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 32157–32180\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.acl-long.1483),[Link](https://aclanthology.org/2026.acl-long.1483/)Cited by:[Modular and trainable control\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px3.p1.1)\.
- D\. Akkil, M\. Allaham, A\. Raj, T\. Abuelsaad, and R\. Kokku \(2026\)Emergence WebVoyager: toward consistent and transparent evaluation of \(web\) agents in the wild\.External Links:2603\.29020,[Document](https://dx.doi.org/10.48550/arXiv.2603.29020),[Link](https://arxiv.org/abs/2603.29020)Cited by:[Trajectory evaluation and human acceptability\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px4.p1.1)\.
- S\. Anupam, D\. Brown, S\. Li, E\. Wong, H\. Hassani, and O\. Bastani \(2025\)BrowserArena: evaluating LLM agents on real\-world web navigation tasks\.External Links:2510\.02418,[Document](https://dx.doi.org/10.48550/arXiv.2510.02418),[Link](https://arxiv.org/abs/2510.02418)Cited by:[Web and GUI agents\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px1.p1.1)\.
- H\. Cai, Y\. Li, W\. Wang, F\. Zhu, X\. Shen, W\. Li, and T\. Chua \(2025\)Large language models empowered personalized web agents\.InProceedings of the ACM on Web Conference 2025,pp\. 198–215\.External Links:[Document](https://dx.doi.org/10.1145/3696410.3714842),[Link](https://doi.org/10.1145/3696410.3714842)Cited by:[Personalization and persona\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px2.p1.1)\.
- X\. Deng, Y\. Gu, B\. Zheng, S\. Chen, S\. Stevens, B\. Wang, H\. Sun, and Y\. Su \(2023\)Mind2Web: towards a generalist agent for the web\.InAdvances in Neural Information Processing Systems,Vol\.36,pp\. 28091–28114\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2023/file/5950bf290a1570ea401bf98882128160-Paper-Datasets_and_Benchmarks.pdf)Cited by:[Web and GUI agents\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px1.p1.1)\.
- A\. Drouin, M\. Gasse, M\. Caccia, I\. H\. Laradji, M\. Del Verme, T\. Marty, D\. Vazquez, N\. Chapados, and A\. Lacoste \(2024\)WorkArena: how capable are web agents at solving common knowledge work tasks?\.InProceedings of the 41st International Conference on Machine Learning,R\. Salakhutdinov, Z\. Kolter, K\. Heller, A\. Weller, N\. Oliver, J\. Scarlett, and F\. Berkenkamp \(Eds\.\),Proceedings of Machine Learning Research, Vol\.235,pp\. 11642–11662\.External Links:[Link](https://proceedings.mlr.press/v235/drouin24a.html)Cited by:[Web and GUI agents\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px1.p1.1)\.
- K\. Erol, J\. Hendler, and D\. S\. Nau \(1994\)HTN planning: complexity and expressivity\.InProceedings of the Twelfth National Conference on Artificial Intelligence,pp\. 1123–1128\.External Links:[Link](https://auld.aaai.org/Library/AAAI/1994/aaai94-173.php)Cited by:[Modular and trainable control\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px3.p1.1)\.
- Z\. Z\. Foumani, A\. Castelo, S\. Xie, T\. Chaiwachirasak, H\. Li, and L\. Wang \(2026\)SimPersona: learning discrete buyer personas from raw clickstreams for grounded e\-commerce agents\.External Links:2605\.14205,[Document](https://dx.doi.org/10.48550/arXiv.2605.14205),[Link](https://arxiv.org/abs/2605.14205)Cited by:[Personalization and persona\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px2.p1.1)\.
- H\. Furuta, K\. Lee, O\. Nachum, Y\. Matsuo, A\. Faust, S\. S\. Gu, and I\. Gur \(2024\)Multimodal web navigation with instruction\-finetuned foundation models\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=efFmBWioSc)Cited by:[Modular and trainable control\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px3.p1.1)\.
- B\. Gou, Z\. Huang, Y\. Ning, Y\. Gu, M\. Lin, W\. Qi, A\. Kopanev, B\. Yu, B\. Jimenez Gutierrez, Y\. Shu, C\. H\. Song, J\. Wu, S\. Chen, H\. N\. Moussa, T\. Zhang, J\. Xie, Y\. Li, T\. Xue, Z\. Liao, K\. Zhang, B\. Zheng, Z\. Cai, V\. Rozgic, M\. Ziyadi, H\. Sun, and Y\. Su \(2025\)Mind2Web 2: evaluating agentic search with agent\-as\-a\-judge\.InAdvances in Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=AUaW6DS9si)Cited by:[Trajectory evaluation and human acceptability\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px4.p1.1)\.
- H\. He, W\. Yao, K\. Ma, W\. Yu, Y\. Dai, H\. Zhang, Z\. Lan, and D\. Yu \(2024\)WebVoyager: building an end\-to\-end web agent with large multimodal models\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),L\. Ku, A\. Martins, and V\. Srikumar \(Eds\.\),Bangkok, Thailand,pp\. 6864–6890\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.371),[Link](https://aclanthology.org/2024.acl-long.371/)Cited by:[Web and GUI agents\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px1.p1.1)\.
- D\. Hu, J\. Ge, W\. Tang, H\. Kong, L\. Li, and B\. Wu \(2026\)Orion: steering personalized web agents via global\-micro profiling and adaptive intent tracking\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.40,pp\. 29468–29476\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v40i35.40188),[Link](https://ojs.aaai.org/index.php/AAAI/article/view/40188)Cited by:[Personalization and persona\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px2.p1.1)\.
- S\. Kim, S\. Lee, and D\. Lee \(2026\)Persona2Web: benchmarking personalized web agents for contextual reasoning with user history\.External Links:2602\.17003,[Document](https://dx.doi.org/10.48550/arXiv.2602.17003),[Link](https://arxiv.org/abs/2602.17003)Cited by:[Personalization and persona\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px2.p1.1)\.
- J\. Y\. Koh, R\. Lo, L\. Jang, V\. Duvvur, M\. Lim, P\. Huang, G\. Neubig, S\. Zhou, R\. Salakhutdinov, and D\. Fried \(2024\)VisualWebArena: evaluating multimodal agents on realistic visual web tasks\.InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),L\. Ku, A\. Martins, and V\. Srikumar \(Eds\.\),Bangkok, Thailand,pp\. 881–905\.External Links:[Document](https://dx.doi.org/10.18653/v1/2024.acl-long.50),[Link](https://aclanthology.org/2024.acl-long.50/)Cited by:[Web and GUI agents\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px1.p1.1)\.
- T\. Le Sellier de Chezelles, M\. Gasse, A\. Lacoste, M\. Caccia, A\. Drouin, L\. Boisvert, M\. Thakkar, T\. Marty, R\. Assouel, S\. O\. Shayegan, L\. K\. Jang, X\. H\. Lù, O\. Yoran, D\. Kong, F\. F\. Xu, S\. Reddy, G\. Neubig, Q\. Cappart, R\. Salakhutdinov, and N\. Chapados \(2025\)The BrowserGym ecosystem for web agent research\.Transactions on Machine Learning Research\.External Links:[Link](https://openreview.net/forum?id=5298fKGmv3)Cited by:[Web and GUI agents\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px1.p1.1)\.
- I\. Levy, B\. Wiesel, S\. Marreed, A\. Oved, A\. Yaeli, and S\. Shlomov \(2026\)ST\-WebAgentBench: a benchmark for evaluating safety and trustworthiness in web agents\.InThe Fourteenth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=MuCDzH0ctf)Cited by:[Trajectory evaluation and human acceptability\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px4.p1.1)\.
- A\. Y\. Li, X\. Hao, S\. Liu, and M\. Wang \(2026\)Avenir\-Web: human\-experience\-imitating multimodal web agents with mixture of grounding experts\.External Links:2602\.02468,[Document](https://dx.doi.org/10.48550/arXiv.2602.02468),[Link](https://arxiv.org/abs/2602.02468)Cited by:[Modular and trainable control\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px3.p1.1)\.
- Z\. Lin, J\. Li, D\. Xu, S\. Pan, Y\. Shi, Y\. Liu, Y\. Min, and Y\. Yao \(2026\)Mobile GUI agent privacy personalization with trajectory induced preference optimization\.External Links:2604\.11259,[Document](https://dx.doi.org/10.48550/arXiv.2604.11259),[Link](https://arxiv.org/abs/2604.11259)Cited by:[Personalization and persona\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px2.p1.1)\.
- Y\. Ling, C\. Yuan, S\. Dong, Y\. Yang, N\. Mocherla, and A\. Goyal \(2026\)ShopperBench: a benchmark for personalized shopping with persona\-guided simulation\.InProceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics \(Volume 5: Industry Track\),Y\. Matusevych, G\. Eryiğit, and N\. Aletras \(Eds\.\),Rabat, Morocco,pp\. 837–846\.External Links:[Document](https://dx.doi.org/10.18653/v1/2026.eacl-industry.62),[Link](https://aclanthology.org/2026.eacl-industry.62/)Cited by:[Personalization and persona\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px2.p1.1)\.
- X\. H\. Lù, Z\. Kasner, and S\. Reddy \(2024\)WebLINX: real\-world website navigation with multi\-turn dialogue\.InProceedings of the 41st International Conference on Machine Learning,R\. Salakhutdinov, Z\. Kolter, K\. Heller, A\. Weller, N\. Oliver, J\. Scarlett, and F\. Berkenkamp \(Eds\.\),Proceedings of Machine Learning Research, Vol\.235,pp\. 33007–33056\.External Links:[Link](https://proceedings.mlr.press/v235/lu24e.html)Cited by:[Modular and trainable control\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px3.p1.1)\.
- X\. H\. Lù, A\. Kazemnejad, N\. Meade, A\. Patel, D\. Shin, A\. Zambrano, K\. Stańczak, P\. Shaw, C\. J\. Pal, and S\. Reddy \(2025\)AgentRewardBench: evaluating automatic evaluations of web agent trajectories\.InProceedings of the Second Conference on Language Modeling,External Links:[Link](https://openreview.net/forum?id=fQcUZMPIvu)Cited by:[Trajectory evaluation and human acceptability\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px4.p1.1)\.
- Z\. Shen, X\. Hu, X\. Li, T\. Fang, J\. Li, and S\. Zhang \(2026\)World\-model\-augmented web agents with action correction\.External Links:2602\.15384,[Document](https://dx.doi.org/10.48550/arXiv.2602.15384),[Link](https://arxiv.org/abs/2602.15384)Cited by:[Modular and trainable control\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px3.p1.1)\.
- T\. Shi, A\. Karpathy, L\. Fan, J\. Hernandez, and P\. Liang \(2017\)World of bits: an open\-domain platform for web\-based agents\.InProceedings of the 34th International Conference on Machine Learning,D\. Precup and Y\. W\. Teh \(Eds\.\),Proceedings of Machine Learning Research, Vol\.70,pp\. 3135–3144\.External Links:[Link](https://proceedings.mlr.press/v70/shi17a.html)Cited by:[Web and GUI agents\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px1.p1.1)\.
- P\. Sodhi, S\. R\. K\. Branavan, and R\. McDonald \(2024\)HeaP: hierarchical policies for web actions using LLMs\.External Links:[Link](https://openreview.net/forum?id=tcFcKyJgRM)Cited by:[Modular and trainable control\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px3.p1.1)\.
- C\. Song, H\. Wang, and R\. Martin \(2026\)PersonaFingerprint: measuring persona inference on modern websites with LLM\-driven browsing\.External Links:2605\.15962,[Document](https://dx.doi.org/10.48550/arXiv.2605.15962),[Link](https://arxiv.org/abs/2605.15962)Cited by:[Personalization and persona\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px2.p1.1)\.
- T\. Xie, D\. Zhang, J\. Chen, X\. Li, S\. Zhao, R\. Cao, T\. J\. Hua, Z\. Cheng, D\. Shin, F\. Lei, Y\. Liu, Y\. Xu, S\. Zhou, S\. Savarese, C\. Xiong, V\. Zhong, and T\. Yu \(2024\)OSWorld: benchmarking multimodal agents for open\-ended tasks in real computer environments\.InAdvances in Neural Information Processing Systems,Vol\.37,pp\. 52040–52094\.External Links:[Document](https://dx.doi.org/10.52202/079017-1650),[Link](https://proceedings.neurips.cc/paper_files/paper/2024/file/5d413e48f84dc61244b6be550f1cd8f5-Paper-Datasets_and_Benchmarks_Track.pdf)Cited by:[Web and GUI agents\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px1.p1.1)\.
- S\. Yao, H\. Chen, J\. Yang, and K\. Narasimhan \(2022\)WebShop: towards scalable real\-world web interaction with grounded language agents\.InAdvances in Neural Information Processing Systems,Vol\.35,pp\. 20744–20757\.External Links:[Link](https://proceedings.neurips.cc/paper_files/paper/2022/file/82ad13ec01f9fe44c01cb91814fd7b8c-Paper-Conference.pdf)Cited by:[Web and GUI agents\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px1.p1.1)\.
- S\. Yao, J\. Zhao, D\. Yu, N\. Du, I\. Shafran, K\. Narasimhan, and Y\. Cao \(2023\)ReAct: synergizing reasoning and acting in language models\.InThe Eleventh International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=WE_vluYUL-X)Cited by:[Modular and trainable control\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px3.p1.1)\.
- S\. Ye, H\. Shi, D\. Shih, H\. Yun, T\. Roosta, and T\. Shu \(2026\)RealWebAssist: a benchmark for long\-horizon web assistance with real\-world users\.InProceedings of the AAAI Conference on Artificial Intelligence,Vol\.40,pp\. 34441–34449\.External Links:[Document](https://dx.doi.org/10.1609/aaai.v40i40.40742),[Link](https://ojs.aaai.org/index.php/AAAI/article/view/40742)Cited by:[Personalization and persona\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px2.p1.1)\.
- B\. Zheng, B\. Gou, J\. Kil, H\. Sun, and Y\. Su \(2024\)GPT\-4V\(ision\) is a generalist web agent, if grounded\.InProceedings of the 41st International Conference on Machine Learning,R\. Salakhutdinov, Z\. Kolter, K\. Heller, A\. Weller, N\. Oliver, J\. Scarlett, and F\. Berkenkamp \(Eds\.\),Proceedings of Machine Learning Research, Vol\.235,pp\. 61349–61385\.External Links:[Link](https://proceedings.mlr.press/v235/zheng24e.html)Cited by:[Modular and trainable control\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px3.p1.1)\.
- S\. Zhou, F\. F\. Xu, H\. Zhu, X\. Zhou, R\. Lo, A\. Sridhar, X\. Cheng, T\. Ou, Y\. Bisk, D\. Fried, U\. Alon, and G\. Neubig \(2024\)WebArena: a realistic web environment for building autonomous agents\.InThe Twelfth International Conference on Learning Representations,External Links:[Link](https://openreview.net/forum?id=oKn9c6ytLx)Cited by:[Web and GUI agents\.](https://arxiv.org/html/2608.06704#Sx2.SS0.SSS0.Px1.p1.1)\.

## Appendix A: Guide to the Evidence

The appendix follows the order in which a reader would reconstruct the study\. Appendix[Appendix B: Tasks and Intent Contracts](https://arxiv.org/html/2608.06704#Sx9)specifies the benchmark tasks and intent contracts; Appendix[Appendix C: Persona Policies and Counterfactual Pairing](https://arxiv.org/html/2608.06704#Sx10)defines the task\-local policies and counterfactual pairing; Appendix[Appendix D: Evaluation and Experimental Protocol](https://arxiv.org/html/2608.06704#Sx11)gives the evaluation and rollout protocol; Appendix[Appendix E: Training the Action\-Realization Layer](https://arxiv.org/html/2608.06704#Sx14)documents middle\-policy training; Appendix[Appendix F: Full Live and Mechanism Results](https://arxiv.org/html/2608.06704#Sx12)expands the quantitative results; Appendix[Appendix G: Human Stepwise Evaluation](https://arxiv.org/html/2608.06704#Sx13)reports the human study; Appendix[Appendix H: Prompt and Executable\-Action Interfaces](https://arxiv.org/html/2608.06704#Sx15)records the prompt and executable\-action interfaces; Appendix[Appendix I: Robustness, Access Effects, and Resources](https://arxiv.org/html/2608.06704#Sx16)collects uncertainty, access, stratified, and resource analyses; Appendix[Appendix J: Worked Contracts and Rollout Cases](https://arxiv.org/html/2608.06704#Sx18)provides worked cases; and Appendix[Appendix K: Release and Reproducibility Boundary](https://arxiv.org/html/2608.06704#Sx17)states the release boundary\.

### Reading order\.

Readers checking benchmark validity can begin with Appendix[Appendix B: Tasks and Intent Contracts](https://arxiv.org/html/2608.06704#Sx9)and Appendix[Appendix C: Persona Policies and Counterfactual Pairing](https://arxiv.org/html/2608.06704#Sx10)\. Reproduction of the main comparisons starts in Appendix[Appendix D: Evaluation and Experimental Protocol](https://arxiv.org/html/2608.06704#Sx11), with learned\-middle details in Appendix[Appendix E: Training the Action\-Realization Layer](https://arxiv.org/html/2608.06704#Sx14)\. The quantitative and audit evidence follows in Appendix[Appendix F: Full Live and Mechanism Results](https://arxiv.org/html/2608.06704#Sx12)–Appendix[Appendix I: Robustness, Access Effects, and Resources](https://arxiv.org/html/2608.06704#Sx16)\. Each section states the setup before its tables and closes with the conclusion supported by them\.

## Appendix B: Tasks and Intent Contracts

RiderBench separates the public task from the policy under which it is delegated\. A base task fixes the web objective, hard constraints, evidence obligations, material blockers, and requested answer form\. Pairing adds a task\-local persona/control policy without changing those auditable requirements\. Table[9](https://arxiv.org/html/2608.06704#Sx9.T9)shows the representation used throughout the paper\.

FieldCamera exampleRequestFind a refurbished 4K mirrorless camera under $900\.GoalRecommend a valid, purchasable candidate\.Hard constraintsRefurbished; 4K; price below $900\.PreferencesSeller reputation and return confidence\.BlockersCompatibility or coverage remains unknown\.EvidencePrice, condition, feature, seller, and return\-policy evidence\.Answer formSelection, support, caveat, and alternatives\.Persona policyTrust\-first verification before recommendation\.
Table 9:Intent\-contract schema\. Constraints, preferences, blockers, evidence obligations, and answer form remain independently inspectable\.
The task audit runs before any rollout is scored\. It rejects persona names in the surface request, non\-browsing tasks, non\-inspectable hard constraints, missing evidence requirements, and pairings in which the policy cannot change search, verification, ranking, asking, or stopping\. Table[10](https://arxiv.org/html/2608.06704#Sx9.T10)reports the deterministic checks\.

CheckObservedRequiredBase tasks768768Websites / domains42 / 1242 / 12Contracts4,0964,096Task\-audit pass768768Pairing\-audit pass4,0964,096Schema issues00Persona names in requests00
Table 10:Final deterministic task and pairing audit, completed before live outcomes were available\.
The pre\-specified task strata are summarized in Table[11](https://arxiv.org/html/2608.06704#Sx9.T11)\. Difficulty is exactly balanced, ambiguity differs by at most one contract, and every domain contributes 64 base tasks\. These controls support later slice analyses without post\-hoc filtering\.

DimensionCategoryContractsDifficultyLevel 11,024Level 21,024Level 31,024Level 41,024AmbiguityHigh1,366Medium1,365Low1,365Task modePlan911Compare909Verify664Lookup651Select651Troubleshoot310OutputRecommendation2,471Evidence answer1,625SplitTrain2,560Development512Test1,024
Table 11:Contract distribution across pre\-specified evaluation strata and the base\-task\-grouped learning split\.

## Appendix C: Persona Policies and Counterfactual Pairing

Here,*persona*denotes a task\-local decision policy over search breadth, assurance, cost, uncertainty, locality, and stopping while the base request and hard constraints remain fixed\. Table[12](https://arxiv.org/html/2608.06704#Sx10.T12)gives the construction axes\.

AxisHigh settingCostprioritize total price, fees, and discounts among valid optionsTrustprefer official, reputable, and auditable sourcesSpeedstop once safe evidence is sufficientEvidenceverify each material claim before answeringClarifyask when an unresolved fact can change the decisionExplorecompare candidates and sources before settlingPrivacyavoid unnecessary accounts, disclosure, or irreversible actionsAccessprefer readable, stable, low\-friction interaction pathsLocalityuse location, hours, dates, availability, and travel timeDiversitysurface meaningfully different valid options
Table 12:Persona\-policy axes\. Intermediate values encode balanced settings between the endpoints\.
Near\-neighbor policies share several tendencies but must differ on one auditable decision\. Table[13](https://arxiv.org/html/2608.06704#Sx10.T13)records the discriminants used to validate same\-task counterfactuals\.

ContrastRequired distinctionBudget / dealtotal\-value accounting vs\. sale, refurbished, or open\-box discoveryConvenience / accessresolving confusion vs\. preferring stable, readable interfacesTrust / specsource authority vs\. exact technical compatibilityTrust / uncertaintyaccept after strong evidence vs\. ask or abstain under material ambiguityQuality / sustainabilityquality fit vs\. durability, repairability, locality, or waste reductionPrivacy / uncertaintysensitive\-flow risk vs\. epistemic uncertainty
Table 13:Near\-neighbor counterfactuals\. A pair is valid only when the distinction can change the route without relaxing hard constraints\.
### Counterfactual trajectory statistics\.

For each base task, we group rollouts that differ only in persona policy\. An*action signature*is the ordered sequence of normalized action kinds \(e\.g\.,type–scroll–click–answer\); a group is action\-divergent when it contains more than one signature\. Its diversity index is1−maxs⁡ns/n1\-\\max\_\{s\}n\_\{s\}/n, wherensn\_\{s\}is the frequency of signaturess\. A group has a CGS spread when it contains both a passing and a non\-passing rollout\. Table[14](https://arxiv.org/html/2608.06704#Sx10.T14)reports these descriptive quantities; they establish behavioral sensitivity to policy while PCS/HCP evaluates whether the changed behavior is preferable\.

RunGroupsUnique sig\.DivergentDiversityCGS spreadFull\-Pro7684\.3096\.5%0\.63535\.4%Full\-Flash7684\.6597\.9%0\.69436\.3%
Table 14:Same\-base\-task counterfactuals over all 4,096 contracts per run \(5\.33 policies per group\)\. Among 8,960 within\-group policy pairs, 14\.6% \(Pro\) and 14\.9% \(Flash\) switch between CGS pass and non\-pass\.
Table[15](https://arxiv.org/html/2608.06704#Sx10.T15)lists all 15 policies\. Each row includes a behavioral criterion that can fail on an observed trajectory, making the policies observable controls over action choice\.

PolicyNNBehavioral criterionExplicit control768follow stated constraints; no latent preference may redirect the routeTrust\-first verifier446prefer authoritative evidence; extra browsing must strengthen supportSpec\-exact researcher375verify exact compatibility and technical attributesQuality\-first explorer298compare observable quality signals before rankingLocal\-context planner275use distance, hours, dates, and availabilityUrgent pragmatist274stop after sufficient safe evidence without skipping blockersUncertainty\-averse271ask or abstain when ambiguity can change the resultBrand loyalist248honor an explicit brand preference without inventing oneSafety/privacy guardian224avoid accounts, credentials, purchases, and private data without permissionDiversity explorer200return distinct valid alternatives without relaxing constraintsDeal hunter164search sale/refurbished/open\-box options and verify total costSustainability\-minded149seek durability, repairability, refurbished, or local evidenceAccessibility seeker138prefer robust, readable, low\-cognitive\-load paths without reducing correctnessConvenience novice137prefer clear, low\-friction interaction and clarify confusing stepsBudget optimizer129rank valid options by total value, including fees and add\-ons
Table 15:Complete task\-local persona\-policy library\. Counts are contract counts; every row states an observable criterion for the route\.

## Appendix D: Evaluation and Experimental Protocol

This section fixes the scoring rules, controller boundaries, launch settings, and comparison discipline used by every quantitative result\. Table[16](https://arxiv.org/html/2608.06704#Sx11.T16)separates contract failures from access and infrastructure failures\. Throughout the paper,*external\-access failure*and the compact*Block*/*No\-block*columns refer to the environmental variableXaccessX\_\{\\mathrm\{access\}\};*task blocker*refers only to the material feasibility conditionBmatB\_\{\\mathrm\{mat\}\}in the intent contract\. The two terms are never used interchangeably\.

MeasureDefinitionCGSterminal rollout satisfying hard constraints, evidence, answer quality, and material\-blocker checksHard\-Call mandatory constraints are satisfiedEvidencerequired page or source evidence is observed before finalizationAnswerfinal response is usable and follows the requested formAccessXaccessX\_\{\\mathrm\{access\}\}CAPTCHA, login wall, denial, or anti\-bot interruption; reported outside CGS componentsRuntimecrash, timeout, or infrastructure failure; reported separatelyPersona consistencyhuman judgment that visible steps preserve the task\-local policyHuman comfortpaired preference for the rollout that is safer or more comfortable to delegate
Table 16:Evaluation measures\. Automatic gates score the completed trace; human measures evaluate the visible route under the same contract\.
### Persona coverage\.

CGS has no separate positive\-persona conjunct\. Persona\-derived requirements that become task obligations enter Hard\-C or Evidence, while the automatic persona proxy detects explicit policy contradictions\. Positive route\-level fidelity— including search breadth, verification depth, clarification, and stopping—is measured by the stepwise PCS/HCP study in Appendix[Appendix G: Human Stepwise Evaluation](https://arxiv.org/html/2608.06704#Sx13)\.

The hierarchy also determines what a fair mechanism comparison holds fixed\. The top layer owns long\-horizon evidence and finalization; the executor is deterministic; the middle produces one local, post\-guard action target at each browser step\. Table[17](https://arxiv.org/html/2608.06704#Sx11.T17)summarizes the resulting boundaries\.

FamilyBoundary and held\-fixed componentsPrompt controlsprompt\-local reasoning/finalization; browser and evaluation stack fixedFullpersistent top state; API middle may propose browser or terminal actions; guards/executor fixedExectop owns terminal decisions; middle emits one executable Action ASTIntentCorepersistent persona\-conditioned intention feeds one guarded action; contract slice, model, and budget fixedMidSFTGemini top, guards, executor, and grammar fixed; only the action policy is learned
Table 17:Controller boundaries used by the main comparisons\.
The descriptive variant names encode the boundary under test\. Table[18](https://arxiv.org/html/2608.06704#Sx11.T18)gives the backbone, evaluated scope, and step cap\. Prompt, structural, and executable\-boundary comparisons use the same 20\-step cap; Flash\-60 and IntentCore\-30 are horizon diagnostics rather than architecture comparisons\.

VariantBackboneNNCapFull\-ProGemini 3\.1 Pro409620Full\-FlashGemini 3\.5 Flash409620Flash\-60Gemini 3\.5 Flash409660Exec\-ProGemini 3\.1 Pro409620Exec\-FlashGemini 3\.5 Flash409620Prompt / Prompt\+PIGemini 3\.1 Pro102420Structural armsGemini 3\.1 Pro102420IntentCore\-30Gemini 3\.1 Pro102430GPT\-5\.5\-DiagGPT\-5\.5102420MidSFT\-8B liveQwen3\-VL\-8B middle102420
Table 18:Experiment variants\. GPT\-5\.5\-Diag excludes five heavily access\-blocked sites; MidSFT\-8B keeps the Gemini top layer, guards, grammar, and executor fixed\.
Provider throughput differed with available serving capacity, while the scheduler allowed at most one active rollout per website\. Worker/RPM values describe collection throughput under that scheduler\. Table[19](https://arxiv.org/html/2608.06704#Sx11.T19)records the launch settings needed to reproduce each run family\.

RunWorkers/RPMTimeoutSeed/dateFull\-Pro8/25900s20260518Full\-Flash8/60900s20260518Flash\-6012/1201800s20260525Structural arms8/25900s20260521IntentCore\-308/251200s20260525Exec\-Pro6/25900s20260606Exec\-Flash16/500900s20260606GPT\-5\.5\-Diag4/–900s20260612MidSFT\-8B live–/–900s20260612
Table 19:Live collection settings\. Throughput parameters reflect provider capacity under one\-active\-rollout\-per\-site scheduling\.

### Controller development settings\.

We did not run a Cartesian hyperparameter sweep\. Architecture choices were tested as named ablations, while generation and runtime settings were changed one factor at a time in smoke runs\. Selection never used the final test CGS: quality\-facing settings were fixed before the reported run, and throughput settings were selected from provider limits and runtime stability\. The exact development values and decision rules are in Table[20](https://arxiv.org/html/2608.06704#Sx11.T20); training choices are reported separately in Table[38](https://arxiv.org/html/2608.06704#Sx14.T38)\. Protocol fields not listed as varied in the development table remained at the single values in Table[19](https://arxiv.org/html/2608.06704#Sx11.T19)and were not tuned\.

ParameterValues tried \(count\)Reported choice and selection criterionStep cap20, 30, 60 \(3\)20 for matched controller comparisons; 30 and 60 retained only as horizon diagnosticsTask timeout900, 1200, 1800 s \(3\)900 s at 20 steps, scaled to 1200/1800 s for the longer diagnostic horizonsGemini thinkingproviderhigh; explicit 2048\-token fallback \(2 forms\)highthroughout; 2048 makes the same setting explicit when an SDK accepts a budget instead of a levelJSON output ceilingcomponent defaults 500, 600, 1200, 1800, 2400; production 8192 \(6\)8192 for Exec runs after smoke tests exposed truncated Action AST replies; component defaults for earlier Full runsSampling temperaturetop/repair 0\.0; action 0\.1 \(2\)fixed by layer: deterministic state/repair and low\-variance action realizationRetries/site concurrency1/1 \(1 each\)fixed to isolate one retry and prevent simultaneous tasks on the same websiteWorkers2, 4, 6, 8, 12, 16 \(6\)6–16 by provider/run; throughput only, chosen below the global rate limitGlobal RPM25, 60, 120, 500 \(4\)provider\-specific quota; throughput only and shared across workersTable 20:Controller and runtime values used during development\. Worker and RPM settings affect collection throughput, not the per\-contract policy or scoring rule\.
### Run provenance\.

All live Gemini rows use the same frozen 4,096\-contract release ledger, whose SHA\-256 isac92cdc24c1a2ded383b0bdb8aa3c33711682003781a96bfb55d216e08b73368\. The anonymous artifact indexes each canonical task\-level ledger by the stable archive ID and evaluator version in Table[21](https://arxiv.org/html/2608.06704#Sx11.T21)\.

Paper familyArtifact manifest IDEval\.Full\-ProWR\-FULL\-PROCGS\-v1Full\-FlashWR\-FULL\-FLASHsameFlash\-60WR\-FLASH\-60sameTeacher/fullWR\-TEACHER\-1024sameStructural armsWR\-STRUCT\-1024sameIntentCore\-30WR\-INTENT\-30sameExec\-ProWR\-EXEC\-PROsameExec\-FlashWR\-EXEC\-FLASHsame
Table 21:Paper names mapped to stable task\-level artifact IDs and calibrated evaluator versions\. Training and external\-proxy artifacts are described in Appendix[Appendix E: Training the Action\-Realization Layer](https://arxiv.org/html/2608.06704#Sx14)and Appendix[Appendix F: Full Live and Mechanism Results](https://arxiv.org/html/2608.06704#Sx12)\.

### Repeated collection and matched comparisons\.

Live rollout, evaluation, and ablation jobs were repeated in three interleaved weekly waves\. Within a wave, corresponding runs used the same contract file and calibrated audit version; paired mechanism comparisons also used the same contracts and step budget\. The paper reports all\-contract ledgers, same\-contract paired slices, or explicitly labeled clean/nonblocked diagnostics rather than mixing scopes\.

### Randomness and replay\.

Table[22](https://arxiv.org/html/2608.06704#Sx11.T22)consolidates every seed that changes a reported sample, split, side assignment, or rollout schedule\. The stable runner stores the seed in its manifest and reuses it on resume; task shuffling, site round\-robin tie breaking, and launch jitter use a localRandominstance derived from that seed\. Hosted model APIs do not expose a portable generation seed, and public websites are time\-varying\. Consequently, the archived task IDs, outputs, screenshots, manifests, and hashes reproduce the evaluated sample exactly, while a new live request is not expected to be bitwise identical\. Distributed training likewise fixes model/data seeds but does not claim bitwise\-deterministic CUDA execution\.

ProcedureSeedControlled randomnessFull Pro/Flash20260518task order, site interleaving, and launch jitterStructural arms20260521common 1,024\-contract schedule across controller armsHorizon runs20260525Flash\-60 and 30\-step diagnostic schedulesExec Pro/Flash20260606common 4,096\-contract executable\-boundary scheduleGPT diagnostic20260612blocked\-site\-excluded task scheduleHuman packets20260520stratified packet draw and blinded left/right assignmentModel\-rater audit20260605stratified diagnostic subsample; temperature 0Contract training split20260606deterministic hash split bybase\_task\_idExpanded training split20260613deterministic hash split bybase\_task\_idOptimization42model initialization path, data order, and trainer samplerExternal proxies2026061020260612paired example order for Mind2Web/WebLINX adapters
Table 22:Seeds for reported stochastic procedures\. API responses and the live web remain externally nondeterministic; evaluated artifacts are immutable and checksum\-addressed\.

### Automatic audit\.

Evidence and answer gates combine GPT\-5\.5 high\-reasoning and Gemini 3\.1 Pro preview judgments with deterministic checks\. The audit is calibrated against two experts on 300 rollouts; Appendix[Appendix G: Human Stepwise Evaluation](https://arxiv.org/html/2608.06704#Sx13)reports gate\-level agreement and false positives\. External\-access and runtime failures receive separate detected labels\.

## Appendix F: Full Live and Mechanism Results

This section expands the compact main tables\. It first reports paired transitions and external proxy checks, then gives the complete live and structural result rows\. Percentages are shown without percent signs inside tables; operational cost remains in Appendix[Appendix I: Robustness, Access Effects, and Resources](https://arxiv.org/html/2608.06704#Sx16)\.

### Matched mechanism effects\.

The structural comparison is paired by contract\. Table[23](https://arxiv.org/html/2608.06704#Sx12.T23)reports exact transitions rather than inferring a paired effect from rounded endpoints\. The largest gain from the full hierarchy is evidence satisfaction\.

Pair / metricΔ\\DeltaBetterWorseTieTeacher→\\rightarrowIntentCore / CGS\+6\.7414374807Teacher→\\rightarrowIntentCore / Evid\+15\.2322569730Teacher→\\rightarrowIntentCore / Ans\+12\.37408190426Flat→\\rightarrowIntent\-only / CGS\+0\.88111102811Persona\-only→\\rightarrowIntentCore / CGS\+4\.2013592797
Table 23:Paired structural deltas \(percentage points\) on the same 1,024 contracts\.

### External mechanism checks\.

External datasets cannot reproduce live\-WebRider contracts, but they can test related intention, state, and profile interfaces\. Table[24](https://arxiv.org/html/2608.06704#Sx12.T24)keeps these proxy checks separate from the live leaderboard\.

ProxyNNBaseTestΔ\\DeltaMind2Web intent1,33930\.842\.7\+11\.9WebLINX intent50034\.839\.0\+4\.2Mind2Web state50036\.843\.6\+6\.8PersonalWAB\-style1200\.015\.0\+15\.0
Table 24:External proxy checks\. Correspondingppvalues are<10−12<10^\{\-12\}, 0\.0275,7\.56×10−57\.56\\times 10^\{\-5\}, and7\.63×10−67\.63\\times 10^\{\-6\}\.
Mind2Web step success requires the correct operation and target label, plus token F1≥0\.8\\geq 0\.8for typed values\. WebLINX step success is exact candidate selection\. The PersonalWAB\-style metric is exact recovery of the held\-out gold candidate from a fixed set\. All significance values in Table[24](https://arxiv.org/html/2608.06704#Sx12.T24)use exact paired McNemar tests\. Dataset splits, fixed checkpoints, condition changes, and decoding settings for these proxy tests are specified in Table[25](https://arxiv.org/html/2608.06704#Sx12.T25)\.

ProxyDataset splitFixed modelCondition changeMind2Web intentosunlp/Multimodal\-Mind2Webtest\_task; 31 negativesQwen3\-VL\-8B \+ MidSFT\-v3;T=0T=0semantic intention vs\. task\-onlyMind2Web statefirst 500 paired Mind2Web rowsQwen3\-VL\-8B \+ MidSFT\-v3; same prompt;T=0T=0screenshot vs\. screenshot removedWebLINX intentMcGill\-NLP/WebLINXreranking/validation; 31 negativesQwen3\-VL\-8B \+ MidSFT\-v3;T=0T=0full dialogue intention vs\. last user utterancePersonalWAB\-stylepublic test split; ambiguous task view; 7 negatives; 8 history itemsGemini 3\.5 Flash;T=0T=0profile\+history vs\. task\-onlyTable 25:External\-proxy setup\. Mind2Web and WebLINX use MidSFT\-v3 with seeds 20260610/20260612; the PersonalWAB\-style test uses Gemini 3\.5 Flash with temperature zero\.
### Live audits\.

Table[26](https://arxiv.org/html/2608.06704#Sx12.T26)separates the contract\-quality components from access and runtime conditions\. Full\-Pro exposes the gap between termination and contract satisfaction; Flash\-60 changes only the horizon; Exec\-Pro and Exec\-Flash move all finalization out of the middle\. GPT\-5\.5\-Diag is a 1,024\-contract diagnostic slice that excludes five heavily access\-blocked websites\.

RunNNTermCGSHardEvidAnsFull\-Pro409699\.238\.870\.357\.442\.3Full\-Flash409699\.734\.468\.258\.662\.5Flash\-60409699\.037\.973\.358\.864\.1Exec\-Pro409699\.732\.942\.235\.733\.0Exec\-Flash409699\.532\.841\.335\.633\.6GPT\-5\.5\-Diag1024–44\.967\.262\.546\.1
Table 26:Complete live\-result ledger: terminal completion and contract\-quality components \(%\)\.
Table[27](https://arxiv.org/html/2608.06704#Sx12.T27)separates access, runtime, and browser\-step conditions from contract\-quality outcomes\.

RunAccessRuntimeMean stepsFull\-Pro13\.50\.88\.37Full\-Flash15\.70\.311\.49Flash\-6017\.01\.020\.04Exec\-Pro14\.70\.39\.09Exec\-Flash16\.90\.511\.58GPT\-5\.5\-Diag3\.10\.0–
Table 27:Access and runtime conditions for the live rows \(%, except mean browser\-action steps\)\.

### Prompt and structural controls\.

All rows in Table[28](https://arxiv.org/html/2608.06704#Sx12.T28)use the same 1,024\-contract slice and 20\-step cap except IntentCore\-30, the labeled horizon diagnostic\. Prompt\+PI and IntentCore contain the same persona/intention information; the difference is whether that information is bound to persistent top state and one guarded action interface\.

ConditionCGSHardEvidAnsEarly ans\.Prompt36\.566\.052\.055\.031Prompt\+PI41\.270\.560\.562\.024Teacher/full40\.072\.656\.859\.3–Flat44\.682\.470\.971\.1∼\\sim14Persona\-only42\.684\.170\.670\.6–Intent\-only45\.581\.069\.171\.8–IntentCore46\.878\.672\.171\.6∼\\sim12IntentCore\-3042\.076\.565\.668\.4–
Table 28:Prompt and structural ablations \(%\)\. The 30\-step row is a horizon diagnostic, not an architecture comparison\.

### Horizon operation check\.

The matched operation statistics in Table[29](https://arxiv.org/html/2608.06704#Sx12.T29)show that the additional ten steps neither rescue IntentCore nor leave the runtime distribution unchanged: CGS falls 4\.8 points while timeout/runtime failures increase by 3\.81 points\.

ConditionCapNNCGSRuntime / mean stepsIntentCore20102446\.81\.17 / 9\.21IntentCore\-3030102442\.04\.98 / 11\.43
Table 29:Matched IntentCore horizon diagnostic \(%, except browser\-action steps\)\. Runtime includes timeouts and runtime exceptions in the calibrated task ledger\.

## Appendix G: Human Stepwise Evaluation

The human study asks whether a person would accept the visible route under the delegated policy\. Raters see the same contract and two randomized sides, but not run names or automatic CGS labels\. Figure[7](https://arxiv.org/html/2608.06704#Sx13.F7)shows the interface; Table[30](https://arxiv.org/html/2608.06704#Sx13.T30)maps the study design to the reported statistics\. Six adult university\-affiliated volunteers were recruited by convenience sampling: two laboratory colleagues served as expert calibrators and four other university members served as non\-expert raters\. Participation was voluntary and uncompensated; all raters consented before labeling\.

![Refer to caption](https://arxiv.org/html/2608.06704v1/figures/human_audit_interface.png)Figure 7:Human stepwise\-audit interface\. The contract remains visible while raters inspect two blinded rollouts, mark whether displayed steps preserve the persona policy, and choose the rollout they would rather delegate to\.StageUnit and outputContract reviewcommon request, policy, constraints, and evidence obligations for both sidesStep audityes/no/cannot\-judge per displayed step; aggregated to rollout\-level persona consistencyPair preferenceA/B/tie/neither/cannot\-judge; aggregated to net human comfortShared anchors20 pairs rated by all six raters; agreement and expert–amateur checksCoverage pairs60 pairs, two raters per pair; study coverageGate calibration300 rollouts, two experts; automatic\-gate agreement and false positives
Table 30:Human\-study workflow and statistic mapping\.
### Blinding and aggregation\.

The interface assigns conditions to left and right with a seeded random draw for each packet–rater assignment\. Run names, condition identities, and automatic CGS labels remain hidden until labels are locked\. Shared\-anchor pairs receive six independent ratings\. Coverage pairs receive two independent non\-expert ratings after rubric calibration\. For a step, a strict majority of judgeable ratings determines yes or no; a yes/no tie, or a step with no judgeable rating, becomes CJ\. Thus a two\-rater coverage disagreement is CJ at the step level\. For pair preference, a strict majority determines A, B, or neither; any remaining disagreement becomes tie\. Neither means both routes are unacceptable, whereas CJ is reserved for missing or illegible information\.

### PCS\.

For rolloutrr, every displayed stepssis first aggregated across its assigned raters toy~r​s∈\{1,0,CJ\}\\tilde\{y\}\_\{rs\}\\in\\\{1,0,\\mathrm\{CJ\}\\\}by the rule above\. LetCr=\{s:y~r​s=1\}C\_\{r\}=\\\{s:\\tilde\{y\}\_\{rs\}=1\\\}andJr=\{s:y~r​s∈\{0,1\}\}J\_\{r\}=\\\{s:\\tilde\{y\}\_\{rs\}\\in\\\{0,1\\\}\\\}:

PCSr=\|Cr\|\|Jr\|\.\\mathrm\{PCS\}\_\{r\}=\\frac\{\|C\_\{r\}\|\}\{\|J\_\{r\}\|\}\.CJ steps are excluded from the denominator and reported separately; a rollout with no judgeable step remains CJ\. Arm\-level PCS pools aggregated consistent and judgeable steps for description\. Wilson intervals accompany these pooled rates\. Confirmatory inference preserves the matched design: it applies a two\-sided Wilcoxon signed\-rank test to the 80 rollout\-level differencesPCSA,r−PCSB,r\\mathrm\{PCS\}\_\{A,r\}\-\\mathrm\{PCS\}\_\{B,r\}\. For example, aggregated labels \{yes, yes, CJ, no, yes\} givePCS=3/4=0\.75\\mathrm\{PCS\}=3/4=0\.75; against a matched rollout at 0\.50, the pair difference is\+0\.25\+0\.25\.

### HCP\.

LetnA,nB,nT,nNn\_\{A\},n\_\{B\},n\_\{T\},n\_\{N\}denote the packet\-level A, B, tie, and neither counts\. True cannot\-judge packets are reported separately and excluded, givingN=nA\+nB\+nT\+nNN=n\_\{A\}\+n\_\{B\}\+n\_\{T\}\+n\_\{N\}\. The primary all\-pair net preference is

ΔHCP=\(nA−nB\)/N\.\\Delta\_\{\\mathrm\{HCP\}\}=\(n\_\{A\}\-n\_\{B\}\)/N\.This denominator retains ties and neither outcomes\. We also report the decisive A\-win ratenA/\(nA\+nB\)n\_\{A\}/\(n\_\{A\}\+n\_\{B\}\)with a Wilson interval and test the null of equal A/B preference using a two\-sided exact binomial sign test over thenA\+nBn\_\{A\}\+n\_\{B\}decisive pairs\. The 80 packets yield\(nA,nT,nB,nN\)=\(47,16,13,4\)\(n\_\{A\},n\_\{T\},n\_\{B\},n\_\{N\}\)=\(47,16,13,4\)and no packet\-level CJ: all\-pair net HCP is42\.542\.5points; among 60 decisive pairs, A wins78\.3%78\.3\\%\(95% Wilson CI\[66\.4,86\.9\]\[66\.4,86\.9\]; exactp=1\.21×10−5p=1\.21\\times 10^\{\-5\}\)\.

Arm A is IntentCore and Arm B is the teacher/full controller\. Table[31](https://arxiv.org/html/2608.06704#Sx13.T31)reports the paired outcome\. Anchor agreement isκ=0\.66\\kappa=0\.66for PCS andκ=0\.62\\kappa=0\.62for HCP; expert–non\-expert agreement is 85% \(κ=0\.64\\kappa=0\.64\)\.

MeasureNNABΔ\\Delta/netPersona consistency80 pairs578/672469/671\+16\.1 ppHuman comfort80 pairs47 prefer13 prefer\+42\.5 pp
Table 31:Human\-study outcomes\. PCS entries are aggregated consistent/judgeable steps; HCP retains 16 ties and four neither outcomes in its all\-pair denominator\. A is IntentCore and B is the teacher/full controller\.
Pooled PCS is 86\.0% for A \(95% Wilson CI\[83\.2,88\.4\]\[83\.2,88\.4\]\) and 69\.9% for B \(\[66\.3,73\.2\]\[66\.3,73\.2\]\); the matched rollout\-level Wilcoxon test givesp<0\.001p<0\.001\. Across the 160 rollouts, persona consistency and CGS correlate atρ≈0\.55\\rho\\approx 0\.55; 11% of CGS\-passing rollouts still receive a low persona\-consistency score\. The two evaluations therefore overlap only partly\.

The automatic gates are strongest for terminal and external\-access detection and noisier for evidence and answer quality\. Table[32](https://arxiv.org/html/2608.06704#Sx13.T32)reports calibration against two experts on 300 rollouts\.

GateAccuracyκ\\kappaFalse positiveTerminal0\.990\.930\.6%Hard\-C0\.910\.815\.1%Evidence0\.860\.728\.4%Answer0\.870\.746\.8%External access0\.980\.950\.4%CGS0\.880\.746\.0%
Table 32:Automatic gates against two experts on 300 rollouts\. Evidence and answer judgments are the noisiest components\.
Model judges were also tested as rubric diagnostics\. Their abstention and alignment in Table[33](https://arxiv.org/html/2608.06704#Sx13.T33)explain why these pilots are not treated as human gold\.

DiagnosticNNPCS align\.HCP align\.CJ/adjud\.ChatGPT packet5044%42%8/50ChatGPT text200––86\.5%Gemini image\-only50––36/50Gemini records\+image50––44/50
Table 33:Model\-rater diagnostics\. These rows test rubric sufficiency and are excluded from the PCS/HCP human results\.

## Appendix E: Training the Action\-Realization Layer

Training the middle directly tests the hierarchy’s reusable action boundary\. The top layer retains the contract, evidence ledger, and ask/answer/stop decisions; deterministic guards retain the legal action grammar; and the executor remains fixed\. The learned component maps a top intention and browser observation to one post\-guard executable action\. This boundary yields a supervised target at every step while leaving long\-horizon finalization with the top layer\.

### Training records\.

Each record contains the screenshot, task contract, persona policy, top intention/command, protected constraints, recent history, and visible UI labels\. The target is the final executable Action AST after compiler repair and deterministic guards\. Terminal actions are removed because finalization belongs to the top layer\.

The v3 exporter began with 34,297 Full\-Pro step records and retained 27,246 high\-confidence executable targets\. The 7,051 exclusions comprise 3,633 low\-confidence rows, 250 rows without an action type, 2,234 terminal actions, and 934 rows whose top subgoal was terminal\. A deterministic hash ofbase\_task\_idassigns complete base\-task groups to the 25,100/2,146 train/evaluation split \(8%, seed 20260606\), preventing sibling persona contracts from crossing the split\. Sites remain represented on both sides; this is a base\-task\-grouped split, not a cross\-site generalization test\.

Table[34](https://arxiv.org/html/2608.06704#Sx14.T34)reports the live replacement under the fixed top/runtime boundary\. All three rows use the current 1024\-contract scope; clean CGS removes external\-access and runtime failures only\.

MiddleCGSHardEvidAccessCleanExec\-Pro ref\.31\.2––14\.738\.9Exec\-Flash ref\.34\.8––16\.939\.9MidSFT\-8B50\.861\.378\.12\.052\.0
Table 34:Live middle replacement \(%\) on 1,024 contracts, with the top layer and deterministic guards fixed\.
The offline comparison in Table[35](https://arxiv.org/html/2608.06704#Sx14.T35)evaluates the same post\-guard prediction problem\. Qwen3\-VL\-8B v3 gives the best held\-out action match among the evaluated students; increasing parameter count does not improve this boundary across the evaluated configurations\.

StudentEvalNNActionTargetMidSFT\-8B v32,14691\.2484\.81Qwen8B\-Exec2,42288\.9382\.33Qwen32B1,02490\.2382\.81Gemma4\-31B1,02472\.2779\.69Qwen30B\-A3B12882\.8175\.78
Table 35:Held\-out post\-guard action and target match \(%\)\. Evaluation sizes follow the completed run for each student\.
AST validity requires a parseable JSON object with a normalized action type and a fallback object\.*Action match*is exact equality of the normalized predicted and guarded\-target action types;*target match*is exact equality of their visible UI labels \(including the empty label for actions without a UI target\)\. These metrics isolate executable realization and do not score the top layer’s evidence\-sufficiency or final\-answer decision\.

Model identities and corpus sizes are explicit in Table[36](https://arxiv.org/html/2608.06704#Sx14.T36)\. The release manifest records the corpus hash, split seed, evaluated adapter checkpoint, stable artifact ID, and base\-task ID for every record\.

StudentBase checkpointCorpus; train/evalMidSFT\-8B v3Qwen/Qwen3\-VL\-8B\-InstructContract; 25,100/2,146Qwen8B\-ExecQwen/Qwen3\-VL\-8B\-InstructExec\-expanded; 29,170/2,422Qwen32BQwen/Qwen3\-VL\-32B\-InstructContract; 25,100/2,146Gemma4\-31Bgoogle/gemma\-4\-31B\-itContract; 25,100/2,146Qwen30B\-A3BQwen/Qwen3\-VL\-30B\-A3B\-InstructExec\-expanded; 29,170/2,422
Table 36:Base checkpoints and executable\-only corpora\. The Contract split uses seed 20260606; the expanded executable split uses seed 20260613\.
Table[37](https://arxiv.org/html/2608.06704#Sx14.T37)records the common optimization recipe; Table[39](https://arxiv.org/html/2608.06704#Sx14.T39)gives model\-specific hardware and distributed settings recovered from the final checkpoint metadata\. All runs use the same strict filtering rule and optimizer seed\.

AspectCore settingKey valuesFixed detailTargetpost\-guard Action ASTsupervised executable actionterminal decisions excludedAdapterbf16 PEFT LoRAr=16r=16;α=32\\alpha=32; dropout 0\.05no bias or saved dense modules; no quantizationTrainable modulesdense: languageq/k/v/oq/k/v/o\+ MLP gate/up/downMoE: languageq/k/v/oq/k/v/ovision tower and multimodal aligner frozenInput / precisionbf16; gradient checkpointinglength 6,144; RGB screenshotsprocessor defaults; no pixel or image\-token capOptimizerfused AdamWβ=\(0\.9,0\.95\)\\beta=\(0\.9,0\.95\);ϵ=10−8\\epsilon=10^\{\-8\}; decay 0\.1gradient norm 1\.0Schedulecosine; zero warmupone corpus pass; seeds 42fixed across reported runsData pipelineshuffled; lazy; right\-paddedno packing or drop\-lastdelete overlength; one preprocessing workerCheckpointingfinal\-step selectioneval/250; W&B log/5; retain 3load\-best\-at\-end disabledTable 37:Common middle\-policy optimization settings\.
### Development range and selection\.

Table[38](https://arxiv.org/html/2608.06704#Sx14.T38)enumerates the distinct values in the archived launch configurations and smoke logs\. These were sequential fit/stability checks rather than a full Cartesian search\. Final settings were chosen without live\-test CGS: first by successful full\-corpus execution within the four\-A6000 memory envelope, then by held\-out executable\-action metrics\. MidSFT\-8B is the principal student because it has the highest held\-out action match among the completed students under the corrected middle\-only target\. Every remaining optimization field in Table[37](https://arxiv.org/html/2608.06704#Sx14.T37)was held at its one reported value and was not tuned\.

ParameterValues tried \(count\)SelectedCriterionAdaptation4\-bit QLoRA; bf16 LoRA \(2\)bf16 LoRAfull\-corpus fit on 4×\\timesA6000; no quantizationLoRAr/αr/\\alpha8/16; 16/32 \(2\)16/32rank 16 fit the full runsLearning rate10−410^\{\-4\};8×10−58\{\\times\}10^\{\-5\};6×10−56\{\\times\}10^\{\-5\};3×10−53\{\\times\}10^\{\-5\};2×10−52\{\\times\}10^\{\-5\};1\.5×10−51\.5\{\\times\}10^\{\-5\};10−510^\{\-5\}\(7\)8×10−58\{\\times\}10^\{\-5\}\(8B\)3×10−53\{\\times\}10^\{\-5\}\(32B\)2×10−52\{\\times\}10^\{\-5\}\(MoE\)10−510^\{\-5\}\(Gemma recovery\)stable completion; held\-out action matchMaximum length3072; 4096; 6144; 8192 \(4\)6144longest validated setting across dense runsMicrobatch1; 2; 3 \(3\)1 \(dense\); 2 \(MoE\)largest value with memory headroomGradient accumulation1; 2; 4; 8; 11; 16 \(6\)per model in Table[39](https://arxiv.org/html/2608.06704#Sx14.T39)effective global batch 32 \(33 for Gemma recovery\)Epochs1 \(1; fixed\)1one complete corpus passLoRA dropout0\.05 \(1; fixed\)0\.05fixed across full runsOptimizer / scheduleAdamW; cosine \(1 each\)AdamW; cosinefixedβ\\beta,ϵ\\epsilon, decay, and zero warmupTable 38:Middle\-policy development values and final\-selection criteria\. Smoke\-only values are counted because they informed feasibility; final per\-model settings appear in Table[39](https://arxiv.org/html/2608.06704#Sx14.T39)\.RunGPUsMicroAccum\.GlobalLearning rateZeROFinal stepMidSFT\-8B418328×10−58\\times 10^\{\-5\}Z2785Qwen8B\-Exec418328×10−58\\times 10^\{\-5\}Z2912Qwen32B418323×10−53\\times 10^\{\-5\}Z3785Gemma4\-31B4→34\\to 318→118\\to 1132→3332\\to 333×10−5→10−53\\times 10^\{\-5\}\\to 10^\{\-5\}Z3785∗Qwen30B\-A3B424322×10−52\\times 10^\{\-5\}Z3912Table 39:Model\-specific settings\. GPUs are 48\-GiB RTX A6000s; Global is GPUs×\\timesmicrobatch×\\timesaccumulation\.All runs used step\-based evaluation and checkpointing\. The 8B and MoE runs saved every 250 steps; Qwen32B and Gemma saved every 100\. For Gemma, a change from four to three workers made the four\-rank optimizer state incompatible; the step\-600 adapter weights were restored model\-only, and AdamW and its schedule were reinitialized for steps 601–785 \(the asterisk in the table\)\.

### Software environment\.

Training used the recorded environment in Table[40](https://arxiv.org/html/2608.06704#Sx14.T40)\. Live collection was CPU\-only and requested 32 vCPUs and 128 GiB RAM per managed worker job\. The scheduler exposed this logical allocation but not the physical host CPU SKU; hosted Gemini/OpenAI serving hardware was likewise provider\-managed\. Table[41](https://arxiv.org/html/2608.06704#Sx14.T41)therefore reports the complete reproducible client environment and explicitly marks the two provider\-controlled quantities\.

ComponentRecorded environmentHostUbuntu 24\.04 LTS; Linux 6\.8\.0\-124\-generic \(x86\-64, glibc 2\.39\); AMD Ryzen Threadripper 3990X; 251 GiB RAMAccelerators4×\\timesNVIDIA RTX A6000, 48 GiB each; driver 570\.207Core stackPython 3\.12\.13; PyTorch 2\.11\.0\+cu128; CUDA 12\.8Training stackTransformers 5\.8\.1; Accelerate 1\.13\.0; DeepSpeed 0\.19\.1; ms\-swift 4\.2\.3Table 40:Recorded software and hardware environment for middle\-policy training\.ComponentRecorded live\-runtime environmentAllocationmanaged Linux CPU job; 32 vCPUs, 128 GiB RAM; physical CPU SKU and host kernel not exposed by schedulerBase systemx86\-64 Debian GNU/Linux 13\.4 \(trixie\) container userland; Python 3\.12\.13BrowserChromium 148\.0\.7778\.167 and matching ChromeDriver 148\.0\.7778\.167Full imagegoogle\-genai 2\.4\.0, Selenium 4\.44\.0, CloakBrowser 0\.3\.28, NumPy 2\.4\.5, Pillow 12\.2\.0Exec imagegoogle\-genai 2\.8\.0, Selenium 4\.44\.0, CloakBrowser 0\.3\.31, NumPy 2\.4\.6, Pillow 12\.2\.0Common utilitypython\-dotenv 1\.2\.2; headless Chromium; 1024×\\times768 viewportHosted modelsexact model IDs are in Table[18](https://arxiv.org/html/2608.06704#Sx11.T18); server CPU/GPU and model\-build hashes are not exposed by the API providersTable 41:Hardware allocation, operating system, browser, and client\-library versions for live experiments\.

## Appendix H: Prompt and Executable\-Action Interfaces

The reproducible object is the interface between layers, not a collection of undocumented prompts\. Figure[8](https://arxiv.org/html/2608.06704#Sx15.F8)gives condensed prompt cards, while Table[42](https://arxiv.org/html/2608.06704#Sx15.T42)states the corresponding input/output contracts\. The release contains the full prompt files\.

Top state

INPUT

contract,persona

observation,ledger

lastaction

OUTPUTJSON

intention

activeconstraints

missingevidence

blockers

decision:browse\|ask\|

answer\|stop

RULE

neverchooseaUIlabel

Executable middle

INPUT

screenshot,topcommand

protectedconstraints

recenthistory,UIlabels

OUTPUTJSON

thought:shortgroundednote

action:exactlyoneof

click\|type\|scroll\|

search\|maps\|back\|wait

fallback:executableaction

RULE

noanswer/ask/stoplabels

neverinventtargetlabels

Middle SFT record

USERRECORD

screenshot

taskcontract

personapolicy

topintention/command

observationandhistory

ASSISTANTTARGET

finalpost\-guard

executableActionAST

FILTER

removeterminalactions

keepdeterministicfallback

Figure 8:Condensed prompt interfaces\. The training target is the action after deterministic compilation and guards, not raw model text\.ComponentInput→\\rightarrowrequired outputTop statecontract, policy, observation, ledger, last action→\\rightarrowintention, active constraints, missing evidence, blockers, and browse/ask/answer/stop decisionMiddlescreenshot, top command, protected constraints, recent actions, visible labels→\\rightarrowone executable Action AST and safe fallbackGuard stackraw AST, repeated state, terminal and external\-access signals→\\rightarrowparsed action, deterministic repair/rejection, recovery, or external\-access labelExecutorparsed browser/Search/Maps action→\\rightarrowscreenshot, URL/title, visible labels, observation, and status
Table 42:Runtime layer contracts\. Finalization remains in the top layer; the middle is supervised only on executable action realization\.
The structural ablation changes which state fields reach the middle while holding the system prompt, contract slice, model, and step budget fixed\. Table[43](https://arxiv.org/html/2608.06704#Sx15.T43)lists the exact state masks, and Table[44](https://arxiv.org/html/2608.06704#Sx15.T44)records the held\-fixed guard and terminal authority\. All arms receive the current observation and a task\-local top command\. The bounded recent state contains at most five URLs/actions, three failures, loop counts, and the evidence ledger; no arm receives the full raw transcript\.

MaskPersonaIntentLedgerRecentRaw hist\.Teacher/fullyesyesyesyesnoFlatnononononoPersona\-onlyyesnonononoIntent\-onlynoyesnononoIntentCoreyesyesnononoExec/MidSFTyesyesyesyesno
Table 43:Actual state fields delivered to the middle\. Intent is the structured current intent state; Recent is bounded action/failure history rather than the full trajectory\.
FamilyGuards/compilerTerminal authorityFull/structuralalways activemiddle proposal accepted or rejected by the terminal gateExec/MidSFTalways activetop/runtime only; middle grammar is executable\-only
Table 44:Guard and finalization authority held fixed within each comparison family\.
The executable grammar remains active for both API and learned middles\. Table[45](https://arxiv.org/html/2608.06704#Sx15.T45)defines the legal actions; Table[46](https://arxiv.org/html/2608.06704#Sx15.T46)records the bounded recovery policy\.

ActionRequired fields and guarded behaviorclickvisible integer target label; reject missing or prose\-only labelstypevisible label and nonempty constraint\-preserving textscrollwindow or visible target plus direction; reject repeated low\-information loopssearchnonempty query preserving hard constraints; return if the search is unhelpfulmapsplace query and task location when supplied; legal only for geographic/place tasksRecoverywaitorbackwith a bounded reason grounded in loading, stale state, access interruption, or browser historyTerminal labelsillegal in the executable middle; the top/runtime gate decides answer, incomplete, blocked, or stop
Table 45:Action\-AST compiler contract\. The grammar prevents the middle from taking over evidence sufficiency or finalization\.
ConditionAllowed responseTarget absentscroll, search, maps, back, or wait according to top intentAmbiguous targetact only when the top command disambiguates; otherwise observe or searchEvidence missingcontinue browsing; the middle cannot answerRepeated failurebacktrack, wait, or simplify the query under a guard labelExternal accessstop automation and emit an access\-failure signal; do not bypass access policy
Table 46:Fallback semantics for executable middle actions\.
### Search and Maps grounding\.

Google Search and Google Maps use the same guarded Action AST as browser\-local actions\. They are available when page\-local evidence is missing, stale, access\-blocked, or inherently geographic; retrieved results must still become visible evidence before the top layer may answer\. Table[47](https://arxiv.org/html/2608.06704#Sx15.T47)reports canonical action\-ledger use, and Figure[9](https://arxiv.org/html/2608.06704#Sx15.F9)gives the executable templates\.

RunRowsSearchMapsShareFull\-Pro34,2972,53597\.42%Full\-Flash47,0715,88622512\.98%Flash\-6082,08712,31128915\.35%Exec\-Pro37,2522,165615\.98%Exec\-Flash47,4183,8954189\.10%
Table 47:Grounding\-skill use in canonical rollout attempts\. Share is Search plus Maps actions divided by action rows\.
SEARCH

\{"action":\{"type":"google\_search",

"query":"site:<domain\><constraints\>"\},

"fallback":\{"type":"go\_back"\}\}

MAPS

\{"action":\{"type":"google\_maps",

"query":"<place/service\>",

"location":"<taskcity/region\>"\},

"fallback":\{"type":"google\_search",

"query":"<sameconstraints\>"\}\}

Figure 9:Search and Maps Action\-AST templates\. Queries preserve hard constraints and persona\-relevant preferences; fallbacks return to public evidence without bypassing access controls\.

### Bounded helper decisions\.

The hybrid teacher also exposes the explicit gate outputs in Table[48](https://arxiv.org/html/2608.06704#Sx15.T48); these helpers never execute browser actions or finalize an answer\.

HelperRequired outputClarifierASKonly when a missing user fact changes correct behavior; otherwiseCONTINUEVerifierALLOW,CONTINUE,ASK, orBLOCK, plus missing evidence and violated constraintsRecoveryOK,LOOP,DEAD\_END, orSTALE, plus a boundedBACK,NEW\_SEARCH, orSCROLLbias
Table 48:Teacher\-side helper prompt outputs\. Deterministic implementations use the same decision vocabulary\.

## Appendix I: Robustness, Access Effects, and Resources

This section collects diagnostics needed to interpret the live results without mixing them into the controller comparison\. It reports uncertainty for the central estimates, separates external access failures from contract failures, and then gives the pre\-specified task, domain, website, and resource views\. All percentages use the denominator stated in the caption\.

### Statistical decision protocol\.

The unit of inference is the contract \(or the blinded contract pair for the human study\), and all tests are two\-sided atα=0\.05\\alpha=0\.05\. Binary outcomes on the same contracts use exact McNemar tests, equivalently exact binomial tests on discordant pairs\. Single proportions use Wilson intervals; paired CGS effects use the mean of per\-contract differences with a 95% paired interval\. Human PCS uses a paired Wilcoxon signed\-rank test over rollout\-level PCS differences, and HCP uses an exact sign test over decisive A/B preferences\. Holm correction is applied within the four archived structural contrasts and within the four external\-proxy contrasts\. The resulting tests and intervals are consolidated in Table[49](https://arxiv.org/html/2608.06704#Sx16.T49)\. Horizon, access\-adjusted, stratified, and unequal\-evaluation\-size model rows are explicitly descriptive; they are not interpreted through unreported significance tests\.

ComparisonTest / intervalResultHuman PCS, A vs\. Bpaired Wilcoxonp<0\.001p<0\.001Human HCP, A vs\. Bexact sign test47/60 decisive A wins;p=1\.21×10−5p=1\.21\{\\times\}10^\{\-5\}Prompt\+PI→\\rightarrowIntentCorepaired 95% interval\+5\.6\+5\.6pp,\[\+1\.3,\+9\.9\]\[\+1\.3,\+9\.9\]; excludes zeroTeacher→\\rightarrowIntentCoreexact McNemar \+ Holm143/74 discordant;p=3\.26×10−6p=3\.26\{\\times\}10^\{\-6\},q=1\.31×10−5q=1\.31\{\\times\}10^\{\-5\}Persona\-only→\\rightarrowIntentCoreexact McNemar \+ Holm135/92;p=0\.00520p=0\.00520,q=0\.0156q=0\.0156Flat→\\rightarrowIntentCoreexact McNemar \+ Holm126/104;p=0\.166p=0\.166,q=0\.332q=0\.332Flat→\\rightarrowIntent\-onlyexact McNemar \+ Holm111/102;p=0\.584p=0\.584,q=0\.584q=0\.584Exec\-Pro vs\. Exec\-Flashexact McNemar299/303;p=0\.903p=0\.903Full\-Pro→\\rightarrowExec\-Proexact McNemar274/516;p=5\.51×10−18p=5\.51\{\\times\}10^\{\-18\}Full\-Flash→\\rightarrowFlash\-60exact McNemar430/290;p=2\.04×10−7p=2\.04\{\\times\}10^\{\-7\}External proxies \(4\)exact McNemar \+ Holmcorrectedq<4×10−12,0\.0275q<4\{\\times\}10^\{\-12\},0\.0275;1\.51×10−4,2\.29×10−51\.51\{\\times\}10^\{\-4\},2\.29\{\\times\}10^\{\-5\}Table 49:Inferential procedures and reported decisions\. Discordant counts are favorable/unfavorable in the arrow direction\. Descriptive diagnostics are identified in their table captions\.
### Uncertainty and matched comparisons\.

Table[50](https://arxiv.org/html/2608.06704#Sx16.T50)reports confidence intervals only where a calibrated estimate or archived matched comparison is available\. Architecture comparisons use the same contract slice and step budget; Flash\-60 is listed separately as a horizon diagnostic\.

Estimate / comparisonEffect95% CIDesign /ppFull\-Pro CGS38\.837\.4–40\.3all contractsTeacher→\\rightarrowIntentCore\+6\.7\+3\.9–\+9\.5matched slicePrompt\+PI→\\rightarrowIntentCore\+5\.6\+1\.3–\+9\.9matched sliceFlat→\\rightarrowIntentCore\+2\.1−0\.8\-0\.8–\+5\.0matched sliceExec\-Pro vs\. Exec\-Flash−0\.10\-0\.10−1\.27\-1\.27–\+1\.08p=0\.903p=0\.903Full\-Pro→\\rightarrowExec\-Pro−5\.91\-5\.91−7\.24\-7\.24–−4\.58\-4\.58p=5\.5×10−18p=5\.5\{\\times\}10^\{\-18\}Full\-Flash→\\rightarrowFlash\-60\+3\.4–horizon diagnostic
Table 50:Uncertainty for the headline and matched CGS comparisons\. Effects are percentage points except the Full\-Pro estimate\.

### External access and the denominator\.

External\-access failures are detected by the runtime and reported outside the contract gates\. Table[51](https://arxiv.org/html/2608.06704#Sx16.T51)retains the all\-contract result and adds two diagnostics: Unblocked removes contracts with external\-access failures; Clean also removes runtime failures\. Together, the three denominators expose the access imbalance in the learned\-middle comparison\.

RunAllAccessUnblockedCleanExec\-Pro32\.914\.738\.838\.9Exec\-Flash32\.816\.939\.639\.9MidSFT\-8B50\.82\.052\.052\.0
Table 51:Access\-adjusted CGS \(%\)\. All uses every contract; Unblocked removes external\-access failures; Clean also removes runtime failures\.

### Difficulty and ambiguity\.

The author difficulty tags are balanced by construction, while ambiguity is balanced to within one contract\. Table[52](https://arxiv.org/html/2608.06704#Sx16.T52)shows much less variation across these strata than across websites or domains, indicating that access and page affordance drive a large part of live\-web difficulty\.

SliceMetric1/high2/med\.3/low4DifficultyCGS39\.440\.338\.437\.3DifficultyEvid58\.656\.959\.854\.3DifficultyAccess13\.611\.913\.614\.7AmbiguityCGS36\.740\.139\.7–AmbiguityEvid56\.957\.258\.1–AmbiguityAccess13\.413\.813\.1–
Table 52:Full\-Pro stratification by difficulty levels 1–4 and ambiguity high/medium/low \(%\)\.

### Domain and task form\.

Table[53](https://arxiv.org/html/2608.06704#Sx16.T53)retains all 12 domains but only the metrics needed to explain the spread\. Table[54](https://arxiv.org/html/2608.06704#Sx16.T54)shows that task modes have similar access\-failure rates but different CGS and evidence satisfaction, so comparison, selection, and stopping structure matter even when access is comparable\.

DomainCGSEvidAccessML models/benchmarks68\.871\.50\.3Local food/services68\.581\.88\.2Open\-source tools58\.571\.55\.6Electronics/PC retail47\.665\.60\.3Everyday shopping42\.769\.930\.6Beauty/personal care32\.652\.90\.0Scholarly evidence32\.655\.31\.8Travel/recreation30\.647\.622\.6Home/rental living29\.447\.926\.2Recipe/meal planning23\.848\.20\.0Public archives21\.258\.230\.6Developer docs9\.417\.634\.4
Table 53:Full\-Pro results by domain \(%\)\. Each domain contains 340 contracts except everyday shopping \(356\)\.
Task formNNCGSEvidAccessCompare90946\.662\.214\.9Plan91142\.058\.912\.7Verify66437\.360\.113\.0Lookup65134\.153\.113\.2Select65130\.452\.713\.1Troubleshoot31037\.451\.913\.9Evidence answer162536\.155\.813\.2Recommendation247140\.758\.513\.6
Table 54:Full\-Pro results by task mode and output family \(%\)\. Similar access\-failure rates isolate differences in evidence collection and stopping\.
Table[55](https://arxiv.org/html/2608.06704#Sx16.T55)crosses task mode with the balanced difficulty tags\. The interaction explains why the marginal difficulty rows are flat: evidence availability and answer form can dominate the author\-assigned level\.

A\. Counts

Task formD1D2D3D4Compare243212228226Plan212238226235Verify166172163163Lookup155166172158Select163160161167Troubleshoot85767475B\. CGS \(%\)

Task formD1D2D3D4Compare50\.247\.639\.948\.7Plan47\.642\.045\.633\.6Verify36\.137\.838\.037\.4Lookup23\.932\.540\.738\.6Select32\.538\.824\.226\.3Troubleshoot35\.340\.837\.836\.0C\. Evidence \(%\)

Task formD1D2D3D4Compare63\.062\.361\.461\.9Plan65\.657\.661\.951\.5Verify62\.057\.662\.658\.3Lookup51\.645\.858\.157\.0Select51\.560\.658\.440\.7Troubleshoot48\.255\.348\.656\.0D\. External access \(%\)

Task formD1D2D3D4Compare14\.416\.512\.715\.9Plan13\.79\.711\.915\.7Verify12\.712\.814\.711\.7Lookup15\.58\.414\.514\.6Select11\.710\.614\.915\.0Troubleshoot12\.914\.513\.514\.7
Table 55:Full\-Pro task\-form by difficulty matrix \(%, exceptNN\)\. Easy lookup tasks can be harder than difficult compare tasks because task form changes evidence availability and stopping\.

### Website access\.

Table[56](https://arxiv.org/html/2608.06704#Sx16.T56)and Table[57](https://arxiv.org/html/2608.06704#Sx16.T57)report all 42 websites, sorted by external\-access failure rate\. The spread shows that live\-site access and page affordance explain substantially more variance than the balanced task\-difficulty tags\.

WebsiteNNAccessCGSCostco84100\.00\.0Stack Overflow105100\.00\.0Library of Congress10593\.36\.7Wayfair9691\.70\.0Expedia8489\.34\.8Walmart8027\.537\.5Uber Eats10524\.850\.5npm8021\.271\.2MDN Web Docs1309\.214\.6Smithsonian1053\.829\.5Amazon963\.171\.9Semantic Scholar1052\.926\.7GitHub962\.136\.5arXiv1301\.546\.9Wikipedia1301\.526\.2Yelp1301\.584\.6TripAdvisor801\.238\.8Home Depot841\.235\.7Apple961\.061\.5Booking\.com961\.053\.1Papers with Code1050\.981\.0PubMed1050\.920\.9
Table 56:Full\-Pro website results with nonzero external\-access failure rates \(%\)\.
WebsiteNNAccessCGSGeeksforGeeks1050\.012\.4Google Maps1050\.066\.7Hugging Face1300\.062\.3IKEA800\.022\.5Kaggle1050\.064\.8Micro Center800\.026\.2National Park Service800\.022\.5Newegg800\.078\.8Allrecipes960\.011\.5Nordstrom1050\.018\.1Best Buy840\.022\.6PyPI840\.090\.5Docker Hub800\.038\.8Sephora1300\.036\.9Epicurious800\.017\.5Serious Eats800\.028\.7Etsy800\.065\.0Target960\.055\.2Food Network840\.039\.3Ulta1050\.041\.9
Table 57:Full\-Pro results for the 20 websites with zero detected external\-access failures \(%\)\. Together with Table[56](https://arxiv.org/html/2608.06704#Sx16.T56), this completes the 42\-site ledger\.

### Resource accounting\.

Resource figures are separated from the scientific result tables and are not used to rank controller quality\. Table[58](https://arxiv.org/html/2608.06704#Sx16.T58)reports the archived token and API\-cost ledger in a compact form\. Additional resources used during experiment stages, hyperparameter tuning, ablations, etc\., are not included\.

RunNNTokensTotal/ rolloutFull\-Pro4096268\.0M$758\.75$0\.185Struct teacher102481\.98M$229\.64$0\.224Struct flat102459\.49M$183\.41$0\.179Struct intent102458\.79M$178\.14$0\.174IntentCore102461\.65M$185\.23$0\.181Full\-Flash4096419\.9M$196\.55$0\.048Flash\-604096–$348–355$0\.085–0\.087GPT\-5\.5\-Diag1024∼\\sim88\.12M∼\\sim$559\.56$0\.547
Table 58:Proprietary Model API Resource accounting\.

## Appendix K: Release and Reproducibility Boundary

The release mirrors the paper’s unit of analysis: a task contract, a controller intention, a screenshot or observation, one executable action, and verification labels\. Table[59](https://arxiv.org/html/2608.06704#Sx17.T59)lists the public artifact classes; Table[60](https://arxiv.org/html/2608.06704#Sx17.T60)records the step\-row groups needed to reconstruct trajectories and paper metrics\.

ArtifactPublic contents and reconstruction roleDocumentationoverview, loading instructions, and checksums; identifies release entry pointsTask contracts4,096 contracts from 768 audited tasks; reconstructs task, policy, constraints, evidence, and split statisticsStep rolloutsscreenshot\-bearing records for reported full and executable\-boundary runs; reconstructs trajectories and metricsExample bundle100 task folders with summaries, step records, and screenshots; supports qualitative inspectionEvaluation outputscalibrated contract gates, paired deltas, and stratified summariesMiddle trainingdata/model manifests, offline evaluation, and live replacement summariesRuntime/codeAction AST, guards/compiler, browser runtime, evaluator, and table scripts
Table 59:Release asset map\. Public artifacts cover the paper’s evidence while excluding credentials, private browser state, and restricted third\-party material\.
Row groupRepresentative fields and reconstruction roleTask contractrequest, hard requirements, persona policy, evidence obligations; identifies the delegated policyTop stateintention, active constraints, missing evidence, blockers, expected observation; explains the requested actionObservationscreenshot, URL, title, visible labels, execution status; records what the controller could observeExecutable actionaction kind, target, text/query, post\-guard action; links intention to browser transitionVerificationallow\-answer, evidence\-sufficient, drift, missing obligations; selects continue/recover/answer/failOutcomeCGS, hard/evidence/answer scores, external\-access/runtime fields; reconstructs result tables
Table 60:Public step\-row schema\. Grouping by rollout identifier and sorting by step index reconstructs the trajectory and its contract\-gated outcome\.
Credentials, account state, tokens, browser profiles, and secret\-bearing environment files are excluded\. The artifact includes consent\-cleared human\-study aggregates; raw rationales and screenshot material restricted by third\-party terms remain outside the public boundary\.

### Paper\-to\-code traceability\.

The source release contains a machine\-readable implementation map and the same map as a rendered README\. Every module implementing a novel paper component starts with a module comment naming the corresponding paper section and its role: contract/schema construction; persistent top state; middle Action AST; guards and fallback repair; deterministic execution; stable scheduling; contract\-gated evaluation; human packet construction/aggregation; and middle\-policy export, training, and evaluation\. Generic API, serialization, and command\-line plumbing are identified as infrastructure rather than method steps\. This convention lets a reader move from each method block in the paper to its entry point without relying on machine\-specific paths\.

## Appendix J: Worked Contracts and Rollout Cases

This appendix connects the formal objects to inspectable examples\. Table[61](https://arxiv.org/html/2608.06704#Sx18.T61)exposes the exact trace behind the main rollout figure\. Figure[10](https://arxiv.org/html/2608.06704#Sx18.F10)shows how a persona\-free task becomes counterfactual contracts\. Figure[11](https://arxiv.org/html/2608.06704#Sx18.F11)and Figure[12](https://arxiv.org/html/2608.06704#Sx18.F12)show policy\-conditioned route and stopping differences; Figure[13](https://arxiv.org/html/2608.06704#Sx18.F13)and Figure[14](https://arxiv.org/html/2608.06704#Sx18.F14)show process risks that terminal completion alone would obscure\.

### Exact trace behind Figure[2](https://arxiv.org/html/2608.06704#Sx3.F2)\.

The archived Exec\-Pro record is taskrbc4\-00001, a ten\-step Amazon comparison of renter\-friendly blackout curtains\. The main figure displays steps 2, 3, 5, 6, 9, and 10; the full action/evidence sequence is below\.

StepModeGuarded action / decisionEvidence state1Queryclick continuepublic browsing preserved; product evidence missing2Acttype constrained queryseek no\-drill, wide\-window, and odor evidence3Queryscroll resultscurtain evidence seen; fit and installation remain4Inspectclick candidate 1no\-drill candidate found; width remains5Verifyscroll detailsinspect size, description, and reviews6Verifyscroll detailsrequired product constraints covered7Verifygo backcomparison still needs a second candidate8Backtrackclick candidate 2second no\-drill source opened9Inspectscroll detailssecond product attributes become visible10Verifytop\-layer decision: answerevidence gate opens for comparison and caveatTable 61:Complete action/evidence trace underlying Figure[2](https://arxiv.org/html/2608.06704#Sx3.F2)\. The top layer delays finalization until two candidates have been inspected; each intermediate record stores the top intention, one guarded action, and the remaining obligations\.![[Uncaptioned image]](https://arxiv.org/html/2608.06704v1/x2.png)

Figure 10:A base request becomes two task\-local intent contracts\. Hard constraints and evidence obligations remain fixed; search breadth, verification, asking, ranking, and stopping may change\.
![Refer to caption](https://arxiv.org/html/2608.06704v1/figures/case_google_maps_persona.png)Figure 11:Same request, different acceptable routes\. The urgent\-pragmatist rollout moves from the result list to viable late\-hour options; the quality\-first rollout opens candidate\-specific evidence before recommending\. Both pass CGS, but their search depth and evidence choices follow different task\-local policies\.![Refer to caption](https://arxiv.org/html/2608.06704v1/figures/case_newegg_persona.png)Figure 12:Same request, different stopping behavior\. The explicit\-control rollout remains partial while compatibility evidence is unresolved; the urgent\-pragmatist rollout reaches a passing plan after generation, length, and compatibility evidence become visible\. The comparison isolates a persona\-conditioned evidence threshold under fixed hard constraints\.
### A CGS false\-pass risk\.

Packetpcs\_hcp\_0137contains two persona\-conditioned contracts for the same air\-purifier base request\. Both receive automatic CGS passes\. Side A \(taskrbc4\-00024\) opens a product page and grounds its recommendation in visible evidence\. Side B \(taskrbc4\-00022\) answers while its final browser state remains the Amazon home page and introduces Coway and Levoit even though its brand\-loyalist policy forbids assuming an unspecified brand\. Its automatic persona proxy is 0\.50, the pass threshold\. The case is therefore an inspectable audit diagnostic, not a human\-study observation\.

![Refer to caption](https://arxiv.org/html/2608.06704v1/figures/case_cgs_pass_pcs_preferred.png)

A: recommendation grounded on a visible product page

![Refer to caption](https://arxiv.org/html/2608.06704v1/figures/case_cgs_pass_pcs_lower.png)

B: answer issued from a non\-evidentiary browser state

Side ASide BPolicysafety/privacy guardianbrand loyalistVisible routeclick–type–click–scroll–answertype–search–answerHard / evidence / answer1\.00 / 1\.00 / 0\.901\.00 / 1\.00 / 0\.90Persona proxy1\.000\.50Terminal browser stateinspected product pageAmazon home page

Figure 13:Two persona\-conditioned contracts for the same base request pass the automatic terminal contract gate but differ in visible process support\. Side B exposes the permissive boundary of the automatic persona proxy: a CGS pass can still warrant stepwise human review\.![Refer to caption](https://arxiv.org/html/2608.06704v1/figures/case_walmart_failure.png)Figure 14:Walmart failure case\. Relevant browsing is followed by a modal loop and a terminal answer copied from the interface\. The example separates locally plausible actions from a usable, evidence\-backed completion\.