Agent Runtime browser contract

The Agent Runtime loads a playable release as static browser assets inside an isolated iframe. The game owns rendering, input, rules, and game state. The runtime owns isolation, lifecycle events, asset delivery, and the VifuHub SDK bridge.

Area	Requirement
Entry	main.url points to an HTML file in build.output, usually index.html.
Build output	Static browser files only; no server process runs for the game.
Assets	Prefer relative paths. Use hub.resources for declared data and media.
JavaScript	Bundle executable code into the release; remote JavaScript is blocked.
Network	Use the VifuHub SDK instead of calling arbitrary external APIs.
Storage	Browser storage is suitable for temporary state; use hub.gameState for durable state.
Host bridge	Use @vifu/hub, not raw window.parent.postMessage(...).

Games must tolerate iframe constraints: avoid top-level navigation, required popups, and direct parent-window access; render responsively; and pause or resume cleanly when visibility changes.

Uploaded game code runs in a strict sandbox. Browser sandboxing and CSP limit execution, while the service that owns each protected operation still enforces authorization.

Read the Deploy policy for artifact rules.