diff --git a/apps/api/src/app.module.ts b/apps/api/src/app.module.ts
index cfbfbff011..d0147d7411 100644
--- a/apps/api/src/app.module.ts
+++ b/apps/api/src/app.module.ts
@@ -25,6 +25,7 @@ import { ContextModule } from './context/context.module';
 import { TrustPortalModule } from './trust-portal/trust-portal.module';
 import { ControlTemplateModule } from './framework-editor/control-template/control-template.module';
 import { IsmsDocumentTemplateModule } from './framework-editor/isms-document-template/isms-document-template.module';
+import { FrameworkFamilyModule } from './framework-editor/framework-family/framework-family.module';
 import { FrameworkEditorFrameworkModule } from './framework-editor/framework/framework.module';
 import { PolicyTemplateModule } from './framework-editor/policy-template/policy-template.module';
 import { RequirementModule } from './framework-editor/requirement/requirement.module';
@@ -101,6 +102,7 @@ import { OffboardingChecklistModule } from './offboarding-checklist/offboarding-
     FrameworkEditorFrameworkModule,
     PolicyTemplateModule,
     RequirementModule,
+    FrameworkFamilyModule,
     TaskTemplateModule,
     FindingTemplateModule,
     FindingsModule,
diff --git a/apps/api/src/browserbase/browser-auth-profile-context.service.ts b/apps/api/src/browserbase/browser-auth-profile-context.service.ts
new file mode 100644
index 0000000000..01ecb124cd
--- /dev/null
+++ b/apps/api/src/browserbase/browser-auth-profile-context.service.ts
@@ -0,0 +1,94 @@
+import { Injectable, Logger, NotFoundException } from '@nestjs/common';
+import { db, type BrowserAuthProfile } from '@db';
+import { BrowserbaseSessionService } from './browserbase-session.service';
+import { BrowserbaseOrgContextService } from './browserbase-org-context.service';
+import { PENDING_CONTEXT_ID } from './browserbase-org-context.service';
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+@Injectable()
+export class BrowserAuthProfileContextService {
+  private readonly logger = new Logger(BrowserAuthProfileContextService.name);
+
+  constructor(
+    private readonly sessions: BrowserbaseSessionService = new BrowserbaseSessionService(),
+    private readonly orgContexts: BrowserbaseOrgContextService = new BrowserbaseOrgContextService(
+      sessions,
+    ),
+  ) {}
+
+  async initialize(input: {
+    profileId: string;
+    organizationId: string;
+  }): Promise<BrowserAuthProfile> {
+    try {
+      const contextId = await this.resolveInitialContextId(
+        input.organizationId,
+      );
+      return await db.browserAuthProfile.update({
+        where: { id: input.profileId },
+        data: { contextId },
+      });
+    } catch (error) {
+      await this.deletePendingProfile(input.profileId);
+      throw error;
+    }
+  }
+
+  async ready(profile: BrowserAuthProfile): Promise<BrowserAuthProfile> {
+    if (profile.contextId !== PENDING_CONTEXT_ID) return profile;
+    return this.waitForProfileContext(profile.id);
+  }
+
+  private async resolveInitialContextId(
+    organizationId: string,
+  ): Promise<string> {
+    const legacy = await this.orgContexts.getOrgContext(organizationId);
+    if (legacy) return legacy.contextId;
+    return this.sessions.createBrowserbaseContext();
+  }
+
+  private async waitForProfileContext(
+    profileId: string,
+  ): Promise<BrowserAuthProfile> {
+    const maxWaitMs = 10_000;
+    const pollMs = 200;
+    const startedAt = Date.now();
+
+    while (Date.now() - startedAt < maxWaitMs) {
+      const current = await db.browserAuthProfile.findUnique({
+        where: { id: profileId },
+      });
+
+      if (current && current.contextId !== PENDING_CONTEXT_ID) {
+        return current;
+      }
+
+      if (!current) {
+        throw new NotFoundException('Browser auth profile not found');
+      }
+
+      await delay(pollMs);
+    }
+
+    this.logger.warn(
+      `Timed out waiting for Browser auth profile context ${profileId}`,
+    );
+    throw new Error(
+      'Browser profile initialization is taking too long. Please retry.',
+    );
+  }
+
+  private async deletePendingProfile(profileId: string): Promise<void> {
+    try {
+      await db.browserAuthProfile.deleteMany({
+        where: { id: profileId, contextId: PENDING_CONTEXT_ID },
+      });
+    } catch (error) {
+      this.logger.warn('Failed to clear pending browser auth profile', {
+        profileId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+}
diff --git a/apps/api/src/browserbase/browser-auth-profile.service.spec.ts b/apps/api/src/browserbase/browser-auth-profile.service.spec.ts
new file mode 100644
index 0000000000..64470d6be0
--- /dev/null
+++ b/apps/api/src/browserbase/browser-auth-profile.service.spec.ts
@@ -0,0 +1,191 @@
+import { BrowserbaseSessionService } from './browserbase-session.service';
+import { BrowserAuthProfileService } from './browser-auth-profile.service';
+
+jest.mock('@db', () => ({
+  db: {
+    browserAuthProfile: {
+      findMany: jest.fn(),
+      findUnique: jest.fn(),
+      findUniqueOrThrow: jest.fn(),
+      findFirst: jest.fn(),
+      create: jest.fn(),
+      update: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+    browserbaseContext: {
+      findUnique: jest.fn(),
+      create: jest.fn(),
+      update: jest.fn(),
+      updateMany: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+  },
+}));
+
+import { db } from '@db';
+
+describe('BrowserAuthProfileService', () => {
+  let sessions: BrowserbaseSessionService;
+  let service: BrowserAuthProfileService;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    sessions = new BrowserbaseSessionService();
+    jest
+      .spyOn(sessions, 'createBrowserbaseContext')
+      .mockResolvedValue('ctx_new');
+    service = new BrowserAuthProfileService(sessions);
+  });
+
+  it('normalizes hostname and login identity when creating a profile', async () => {
+    (db.browserAuthProfile.findUnique as jest.Mock).mockResolvedValue(null);
+    (db.browserbaseContext.findUnique as jest.Mock).mockResolvedValue(null);
+    (db.browserAuthProfile.create as jest.Mock).mockResolvedValue({
+      id: 'bap_1',
+      organizationId: 'org_1',
+      hostname: 'github.com',
+      loginIdentity: 'svc@example.com',
+      contextId: '__PENDING__',
+    });
+    (db.browserAuthProfile.update as jest.Mock).mockResolvedValue({
+      id: 'bap_1',
+      organizationId: 'org_1',
+      hostname: 'github.com',
+      loginIdentity: 'svc@example.com',
+      contextId: 'ctx_new',
+    });
+
+    await service.getOrCreateProfileFromUrl({
+      organizationId: 'org_1',
+      url: 'https://GitHub.com/acme/repo',
+      loginIdentity: ' SVC@EXAMPLE.COM ',
+    });
+
+    expect(db.browserAuthProfile.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        organizationId: 'org_1',
+        hostname: 'github.com',
+        loginIdentity: 'svc@example.com',
+        contextId: '__PENDING__',
+      }),
+    });
+    expect(db.browserAuthProfile.update).toHaveBeenCalledWith({
+      where: { id: 'bap_1' },
+      data: { contextId: 'ctx_new' },
+    });
+  });
+
+  it('does not create an orphan context when another request creates the profile', async () => {
+    (db.browserAuthProfile.findUnique as jest.Mock).mockResolvedValue(null);
+    (db.browserAuthProfile.create as jest.Mock).mockRejectedValue({
+      code: 'P2002',
+    });
+    (db.browserAuthProfile.findUniqueOrThrow as jest.Mock).mockResolvedValue({
+      id: 'bap_existing',
+      organizationId: 'org_1',
+      hostname: 'github.com',
+      loginIdentity: '',
+      contextId: 'ctx_existing',
+    });
+
+    const result = await service.getOrCreateProfileFromUrl({
+      organizationId: 'org_1',
+      url: 'https://github.com/acme/repo',
+    });
+
+    expect(result.profile.id).toBe('bap_existing');
+    expect(sessions.createBrowserbaseContext).not.toHaveBeenCalled();
+  });
+
+  it('prioritizes a verified profile for the target hostname', async () => {
+    (db.browserAuthProfile.findMany as jest.Mock).mockResolvedValue([
+      { id: 'bap_old', status: 'needs_reauth', hostname: 'github.com' },
+      { id: 'bap_verified', status: 'verified', hostname: 'github.com' },
+    ]);
+
+    const profile = await service.resolveProfileForTarget({
+      organizationId: 'org_1',
+      targetUrl: 'https://github.com/acme/repo',
+    });
+
+    expect(profile.id).toBe('bap_verified');
+    expect(db.browserAuthProfile.findMany).toHaveBeenCalledWith({
+      where: { organizationId: 'org_1', hostname: 'github.com' },
+      orderBy: { updatedAt: 'desc' },
+    });
+  });
+
+  it('rejects profile verification for a different hostname', async () => {
+    jest
+      .spyOn(sessions, 'checkLoginStatus')
+      .mockResolvedValue({ isLoggedIn: true });
+    (db.browserAuthProfile.findFirst as jest.Mock).mockResolvedValue({
+      id: 'bap_1',
+      organizationId: 'org_1',
+      hostname: 'github.com',
+      lastVerifiedAt: null,
+    });
+
+    await expect(
+      service.verifyProfileSession({
+        organizationId: 'org_1',
+        profileId: 'bap_1',
+        sessionId: 'sess_1',
+        url: 'https://gitlab.com/acme/repo',
+      }),
+    ).rejects.toThrow('Verification URL must match');
+    expect(sessions.checkLoginStatus).not.toHaveBeenCalled();
+  });
+
+  it('rejects profile verification when the session uses another context', async () => {
+    jest.spyOn(sessions, 'getSessionContextId').mockResolvedValue('ctx_other');
+    jest
+      .spyOn(sessions, 'checkLoginStatus')
+      .mockResolvedValue({ isLoggedIn: true });
+    (db.browserAuthProfile.findFirst as jest.Mock).mockResolvedValue({
+      id: 'bap_1',
+      organizationId: 'org_1',
+      hostname: 'github.com',
+      contextId: 'ctx_profile',
+      lastVerifiedAt: null,
+    });
+
+    await expect(
+      service.verifyProfileSession({
+        organizationId: 'org_1',
+        profileId: 'bap_1',
+        sessionId: 'sess_wrong',
+        url: 'https://github.com/acme/repo',
+      }),
+    ).rejects.toThrow('does not belong to this auth profile');
+    expect(sessions.checkLoginStatus).not.toHaveBeenCalled();
+    expect(db.browserAuthProfile.update).not.toHaveBeenCalled();
+  });
+
+  it('treats a pending legacy org context as unavailable', async () => {
+    (db.browserbaseContext.findUnique as jest.Mock).mockResolvedValue({
+      organizationId: 'org_1',
+      contextId: '__PENDING__',
+    });
+
+    await expect(service.getOrgContext('org_1')).resolves.toBeNull();
+  });
+
+  it('clears pending org context when Browserbase context creation fails', async () => {
+    (db.browserbaseContext.findUnique as jest.Mock).mockResolvedValue(null);
+    (db.browserbaseContext.create as jest.Mock).mockResolvedValue({
+      organizationId: 'org_1',
+      contextId: '__PENDING__',
+    });
+    jest
+      .spyOn(sessions, 'createBrowserbaseContext')
+      .mockRejectedValue(new Error('Browserbase unavailable'));
+
+    await expect(service.getOrCreateOrgContext('org_1')).rejects.toThrow(
+      'Browserbase unavailable',
+    );
+    expect(db.browserbaseContext.deleteMany).toHaveBeenCalledWith({
+      where: { organizationId: 'org_1', contextId: '__PENDING__' },
+    });
+  });
+});
diff --git a/apps/api/src/browserbase/browser-auth-profile.service.ts b/apps/api/src/browserbase/browser-auth-profile.service.ts
new file mode 100644
index 0000000000..0d18c60932
--- /dev/null
+++ b/apps/api/src/browserbase/browser-auth-profile.service.ts
@@ -0,0 +1,290 @@
+import {
+  BadRequestException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { db } from '@db';
+import {
+  defaultProfileDisplayName,
+  normalizeHostnameFromUrl,
+  normalizeLoginIdentity,
+} from './browserbase-url';
+import { BrowserbaseSessionService } from './browserbase-session.service';
+import { BrowserAuthProfileContextService } from './browser-auth-profile-context.service';
+import {
+  BrowserbaseOrgContextService,
+  PENDING_CONTEXT_ID,
+  isPrismaUniqueConstraintError,
+} from './browserbase-org-context.service';
+
+export interface AuthProfileInput {
+  organizationId: string;
+  url: string;
+  displayName?: string;
+  loginIdentity?: string;
+  vaultProvider?: string;
+  vaultExternalItemRef?: string;
+  vaultConnectionId?: string;
+}
+
+@Injectable()
+export class BrowserAuthProfileService {
+  constructor(
+    private readonly sessions: BrowserbaseSessionService = new BrowserbaseSessionService(),
+    private readonly orgContexts: BrowserbaseOrgContextService = new BrowserbaseOrgContextService(
+      sessions,
+    ),
+    private readonly profileContexts: BrowserAuthProfileContextService = new BrowserAuthProfileContextService(
+      sessions,
+      orgContexts,
+    ),
+  ) {}
+
+  async listProfiles(organizationId: string) {
+    return db.browserAuthProfile.findMany({
+      where: { organizationId },
+      orderBy: [{ hostname: 'asc' }, { updatedAt: 'desc' }],
+    });
+  }
+
+  async getProfile({
+    profileId,
+    organizationId,
+  }: {
+    profileId: string;
+    organizationId: string;
+  }) {
+    return db.browserAuthProfile.findFirst({
+      where: { id: profileId, organizationId },
+    });
+  }
+
+  async getOrCreateProfileFromUrl(input: AuthProfileInput) {
+    const hostname = normalizeHostnameFromUrl(input.url);
+    const loginIdentity = normalizeLoginIdentity(input.loginIdentity);
+
+    const existing = await db.browserAuthProfile.findUnique({
+      where: {
+        organizationId_hostname_loginIdentity: {
+          organizationId: input.organizationId,
+          hostname,
+          loginIdentity,
+        },
+      },
+    });
+
+    if (existing) {
+      return {
+        profile: await this.profileContexts.ready(existing),
+        isNew: false,
+      };
+    }
+
+    try {
+      const pendingProfile = await db.browserAuthProfile.create({
+        data: {
+          organizationId: input.organizationId,
+          hostname,
+          loginIdentity,
+          displayName:
+            input.displayName?.trim() || defaultProfileDisplayName(hostname),
+          contextId: PENDING_CONTEXT_ID,
+          lastAuthCheckUrl: input.url,
+          vaultProvider: input.vaultProvider,
+          vaultExternalItemRef: input.vaultExternalItemRef,
+          vaultConnectionId: input.vaultConnectionId,
+        },
+      });
+      const profile = await this.profileContexts.initialize({
+        profileId: pendingProfile.id,
+        organizationId: input.organizationId,
+      });
+      return { profile, isNew: true };
+    } catch (error) {
+      if (!isPrismaUniqueConstraintError(error)) {
+        throw error;
+      }
+
+      const profile = await db.browserAuthProfile.findUniqueOrThrow({
+        where: {
+          organizationId_hostname_loginIdentity: {
+            organizationId: input.organizationId,
+            hostname,
+            loginIdentity,
+          },
+        },
+      });
+      return {
+        profile: await this.profileContexts.ready(profile),
+        isNew: false,
+      };
+    }
+  }
+
+  async resolveProfileForTarget(input: {
+    organizationId: string;
+    targetUrl: string;
+    profileId?: string;
+  }) {
+    if (input.profileId) {
+      const profile = await this.getProfile({
+        profileId: input.profileId,
+        organizationId: input.organizationId,
+      });
+      if (!profile) {
+        throw new NotFoundException('Browser auth profile not found');
+      }
+      return this.profileContexts.ready(profile);
+    }
+
+    const hostname = normalizeHostnameFromUrl(input.targetUrl);
+    const profiles = await db.browserAuthProfile.findMany({
+      where: { organizationId: input.organizationId, hostname },
+      orderBy: { updatedAt: 'desc' },
+    });
+
+    const verified = profiles.find((profile) => profile.status === 'verified');
+    if (verified) return this.profileContexts.ready(verified);
+    if (profiles[0]) return this.profileContexts.ready(profiles[0]);
+
+    const created = await this.getOrCreateProfileFromUrl({
+      organizationId: input.organizationId,
+      url: input.targetUrl,
+    });
+    return created.profile;
+  }
+
+  async startProfileSession(input: {
+    organizationId: string;
+    profileId: string;
+  }): Promise<{ sessionId: string; liveViewUrl: string }> {
+    const profile = await this.getProfile(input);
+    if (!profile) {
+      throw new NotFoundException('Browser auth profile not found');
+    }
+    const readyProfile = await this.profileContexts.ready(profile);
+    return this.sessions.createSessionWithContext(readyProfile.contextId);
+  }
+
+  async verifyProfileSession(input: {
+    organizationId: string;
+    profileId: string;
+    sessionId: string;
+    url: string;
+  }) {
+    const profile = await this.getProfile({
+      organizationId: input.organizationId,
+      profileId: input.profileId,
+    });
+    if (!profile) {
+      throw new NotFoundException('Browser auth profile not found');
+    }
+    this.assertUrlMatchesProfileHostname({
+      url: input.url,
+      profileHostname: profile.hostname,
+    });
+    await this.assertSessionMatchesProfile({
+      sessionId: input.sessionId,
+      profileContextId: profile.contextId,
+    });
+
+    const auth = await this.sessions.checkLoginStatus(
+      input.sessionId,
+      input.url,
+    );
+    const status = auth.isLoggedIn ? 'verified' : 'needs_reauth';
+    const updated = await db.browserAuthProfile.update({
+      where: { id: profile.id },
+      data: {
+        status,
+        lastVerifiedAt: auth.isLoggedIn ? new Date() : profile.lastVerifiedAt,
+        lastAuthCheckUrl: input.url,
+        blockedReason: auth.isLoggedIn ? null : 'Login verification failed.',
+      },
+    });
+
+    return { profile: updated, auth };
+  }
+
+  async markNeedsReauth(input: {
+    organizationId: string;
+    profileId: string;
+    reason?: string;
+  }) {
+    const profile = await this.getProfile(input);
+    if (!profile) {
+      throw new NotFoundException('Browser auth profile not found');
+    }
+
+    return db.browserAuthProfile.update({
+      where: { id: profile.id },
+      data: {
+        status: 'needs_reauth',
+        blockedReason: input.reason ?? 'Authentication needs to be refreshed.',
+      },
+    });
+  }
+
+  async markBlocked(input: {
+    organizationId: string;
+    profileId: string;
+    reason: string;
+  }) {
+    const profile = await this.getProfile(input);
+    if (!profile) {
+      throw new NotFoundException('Browser auth profile not found');
+    }
+
+    return db.browserAuthProfile.update({
+      where: { id: profile.id },
+      data: {
+        status: 'blocked',
+        blockedReason: input.reason,
+      },
+    });
+  }
+
+  async getOrCreateOrgContext(
+    organizationId: string,
+  ): Promise<{ contextId: string; isNew: boolean }> {
+    return this.orgContexts.getOrCreateOrgContext(organizationId);
+  }
+
+  async getOrgContext(
+    organizationId: string,
+  ): Promise<{ contextId: string } | null> {
+    return this.orgContexts.getOrgContext(organizationId);
+  }
+
+  private assertUrlMatchesProfileHostname(input: {
+    url: string;
+    profileHostname: string;
+  }): void {
+    let hostname: string;
+    try {
+      hostname = normalizeHostnameFromUrl(input.url);
+    } catch {
+      throw new BadRequestException('Invalid verification URL');
+    }
+
+    if (hostname !== input.profileHostname) {
+      throw new BadRequestException(
+        'Verification URL must match the browser auth profile hostname.',
+      );
+    }
+  }
+
+  private async assertSessionMatchesProfile(input: {
+    sessionId: string;
+    profileContextId: string;
+  }): Promise<void> {
+    const sessionContextId = await this.sessions.getSessionContextId(
+      input.sessionId,
+    );
+    if (sessionContextId === input.profileContextId) return;
+
+    throw new BadRequestException(
+      'Browser session does not belong to this auth profile.',
+    );
+  }
+}
diff --git a/apps/api/src/browserbase/browser-auth-profiles.controller.ts b/apps/api/src/browserbase/browser-auth-profiles.controller.ts
new file mode 100644
index 0000000000..10d2c2b347
--- /dev/null
+++ b/apps/api/src/browserbase/browser-auth-profiles.controller.ts
@@ -0,0 +1,136 @@
+import { Body, Controller, Get, Param, Post, UseGuards } from '@nestjs/common';
+import {
+  ApiBody,
+  ApiOperation,
+  ApiParam,
+  ApiResponse,
+  ApiSecurity,
+  ApiTags,
+} from '@nestjs/swagger';
+import { OrganizationId } from '../auth/auth-context.decorator';
+import { HybridAuthGuard } from '../auth/hybrid-auth.guard';
+import { PermissionGuard } from '../auth/permission.guard';
+import { RequirePermission } from '../auth/require-permission.decorator';
+import { BrowserbaseService } from './browserbase.service';
+import {
+  BrowserAuthProfileResponseDto,
+  MarkAuthProfileNeedsReauthDto,
+  ResolveAuthProfileDto,
+  ResolveAuthProfileResponseDto,
+  SessionResponseDto,
+  VerifyAuthProfileResponseDto,
+  VerifyAuthProfileSessionDto,
+} from './dto/browserbase.dto';
+
+@ApiTags('Browserbase')
+@Controller({ path: 'browserbase', version: '1' })
+@UseGuards(HybridAuthGuard, PermissionGuard)
+@ApiSecurity('apikey')
+export class BrowserAuthProfilesController {
+  constructor(private readonly browserbaseService: BrowserbaseService) {}
+
+  @Get('profiles')
+  @RequirePermission('integration', 'read')
+  @ApiOperation({
+    summary: 'List browser auth profiles',
+    description:
+      'List per-site browser auth profiles for the organization, including hostname, verification status, and vault metadata references.',
+  })
+  @ApiResponse({
+    status: 200,
+    type: [BrowserAuthProfileResponseDto],
+  })
+  async listProfiles(
+    @OrganizationId() organizationId: string,
+  ): Promise<BrowserAuthProfileResponseDto[]> {
+    return (await this.browserbaseService.listAuthProfiles(
+      organizationId,
+    )) as BrowserAuthProfileResponseDto[];
+  }
+
+  @Post('profiles/resolve')
+  @RequirePermission('integration', 'create')
+  @ApiOperation({
+    summary: 'Create or get browser auth profile',
+    description:
+      'Normalize a website URL to a hostname and create or reuse the matching browser auth profile for that org and login identity.',
+  })
+  @ApiBody({ type: ResolveAuthProfileDto })
+  @ApiResponse({
+    status: 201,
+    type: ResolveAuthProfileResponseDto,
+  })
+  async resolveProfile(
+    @OrganizationId() organizationId: string,
+    @Body() dto: ResolveAuthProfileDto,
+  ): Promise<ResolveAuthProfileResponseDto> {
+    return (await this.browserbaseService.getOrCreateAuthProfile({
+      organizationId,
+      ...dto,
+    })) as ResolveAuthProfileResponseDto;
+  }
+
+  @Post('profiles/:profileId/session')
+  @RequirePermission('integration', 'read')
+  @ApiOperation({
+    summary: 'Start browser auth profile session',
+    description:
+      'Create a Browserbase Live View session using a specific auth profile context so a user can log in or complete 2FA manually.',
+  })
+  @ApiParam({ name: 'profileId', description: 'Browser auth profile ID' })
+  @ApiResponse({ status: 201, type: SessionResponseDto })
+  async startProfileSession(
+    @OrganizationId() organizationId: string,
+    @Param('profileId') profileId: string,
+  ): Promise<SessionResponseDto> {
+    return await this.browserbaseService.startAuthProfileSession({
+      organizationId,
+      profileId,
+    });
+  }
+
+  @Post('profiles/:profileId/verify')
+  @RequirePermission('integration', 'update')
+  @ApiOperation({
+    summary: 'Verify browser auth profile session',
+    description:
+      'Check whether the Live View session is authenticated for the profile URL and update the profile status to verified or needs reauth.',
+  })
+  @ApiParam({ name: 'profileId', description: 'Browser auth profile ID' })
+  @ApiBody({ type: VerifyAuthProfileSessionDto })
+  @ApiResponse({ status: 200, type: VerifyAuthProfileResponseDto })
+  async verifyProfileSession(
+    @OrganizationId() organizationId: string,
+    @Param('profileId') profileId: string,
+    @Body() dto: VerifyAuthProfileSessionDto,
+  ): Promise<VerifyAuthProfileResponseDto> {
+    return (await this.browserbaseService.verifyAuthProfileSession({
+      organizationId,
+      profileId,
+      sessionId: dto.sessionId,
+      url: dto.url,
+    })) as VerifyAuthProfileResponseDto;
+  }
+
+  @Post('profiles/:profileId/needs-reauth')
+  @RequirePermission('integration', 'update')
+  @ApiOperation({
+    summary: 'Mark browser auth profile needs reauth',
+    description:
+      'Mark a browser auth profile as needing user reauthentication without storing any raw credentials or TOTP secrets.',
+  })
+  @ApiParam({ name: 'profileId', description: 'Browser auth profile ID' })
+  @ApiBody({ type: MarkAuthProfileNeedsReauthDto })
+  @ApiResponse({ status: 200, type: BrowserAuthProfileResponseDto })
+  async markNeedsReauth(
+    @OrganizationId() organizationId: string,
+    @Param('profileId') profileId: string,
+    @Body() dto: MarkAuthProfileNeedsReauthDto,
+  ): Promise<BrowserAuthProfileResponseDto> {
+    return (await this.browserbaseService.markAuthProfileNeedsReauth({
+      organizationId,
+      profileId,
+      reason: dto.reason,
+    })) as BrowserAuthProfileResponseDto;
+  }
+}
diff --git a/apps/api/src/browserbase/browser-automation-crud.service.ts b/apps/api/src/browserbase/browser-automation-crud.service.ts
new file mode 100644
index 0000000000..d13d67afc0
--- /dev/null
+++ b/apps/api/src/browserbase/browser-automation-crud.service.ts
@@ -0,0 +1,203 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { db, TaskFrequency } from '@db';
+import { BrowserbaseScreenshotService } from './browserbase-screenshot.service';
+
+const normalizeCriteria = (value: string | null | undefined): string | null => {
+  if (value == null) return null;
+  const trimmed = value.trim();
+  return trimmed.length === 0 ? null : trimmed;
+};
+
+@Injectable()
+export class BrowserAutomationCrudService {
+  constructor(
+    private readonly screenshots: BrowserbaseScreenshotService = new BrowserbaseScreenshotService(),
+  ) {}
+
+  async createBrowserAutomation(
+    data: {
+      taskId: string;
+      name: string;
+      description?: string;
+      targetUrl: string;
+      instruction: string;
+      evaluationCriteria?: string;
+      scheduleFrequency?: TaskFrequency;
+    },
+    organizationId?: string,
+  ) {
+    if (organizationId) {
+      await this.requireTaskInOrg({ taskId: data.taskId, organizationId });
+    }
+
+    return db.browserAutomation.create({
+      data: {
+        taskId: data.taskId,
+        name: data.name,
+        description: data.description,
+        targetUrl: data.targetUrl,
+        instruction: data.instruction,
+        evaluationCriteria: normalizeCriteria(data.evaluationCriteria),
+        isEnabled: true,
+        ...(data.scheduleFrequency !== undefined
+          ? { scheduleFrequency: data.scheduleFrequency }
+          : {}),
+      },
+    });
+  }
+
+  async getBrowserAutomation(automationId: string, organizationId?: string) {
+    const automation = await db.browserAutomation.findUnique({
+      where: { id: automationId },
+      include: {
+        task: { select: { organizationId: true } },
+        runs: { orderBy: { createdAt: 'desc' }, take: 10 },
+      },
+    });
+    return this.hideCrossOrgAutomation({ automation, organizationId });
+  }
+
+  async getBrowserAutomationsForTask(taskId: string, organizationId?: string) {
+    if (organizationId) {
+      await this.requireTaskInOrg({ taskId, organizationId });
+    }
+
+    return db.browserAutomation.findMany({
+      where: { taskId },
+      include: {
+        runs: { orderBy: { createdAt: 'desc' }, take: 1 },
+      },
+      orderBy: { createdAt: 'desc' },
+    });
+  }
+
+  async updateBrowserAutomation(
+    automationId: string,
+    data: {
+      name?: string;
+      description?: string;
+      targetUrl?: string;
+      instruction?: string;
+      evaluationCriteria?: string;
+      isEnabled?: boolean;
+      scheduleFrequency?: TaskFrequency;
+    },
+    organizationId?: string,
+  ) {
+    if (organizationId) {
+      await this.requireAutomationInOrg({ automationId, organizationId });
+    }
+
+    const { evaluationCriteria, scheduleFrequency, ...rest } = data;
+    return db.browserAutomation.update({
+      where: { id: automationId },
+      data: {
+        ...rest,
+        ...(evaluationCriteria !== undefined
+          ? { evaluationCriteria: normalizeCriteria(evaluationCriteria) }
+          : {}),
+        ...(scheduleFrequency !== undefined ? { scheduleFrequency } : {}),
+      },
+    });
+  }
+
+  async deleteBrowserAutomation(automationId: string, organizationId?: string) {
+    if (organizationId) {
+      await this.requireAutomationInOrg({ automationId, organizationId });
+    }
+    return db.browserAutomation.delete({ where: { id: automationId } });
+  }
+
+  async getRunWithPresignedUrl(runId: string, organizationId?: string) {
+    const run = await db.browserAutomationRun.findUnique({
+      where: { id: runId },
+      include: { automation: { include: { task: true } } },
+    });
+    if (!run) return null;
+    if (organizationId && run.automation.task.organizationId !== organizationId) {
+      return null;
+    }
+    if (!run.screenshotUrl) return run;
+    const screenshotUrl = await this.screenshots.getPresignedUrl({
+      key: run.screenshotUrl,
+    });
+    return { ...run, screenshotUrl };
+  }
+
+  async getAutomationsWithPresignedUrls(taskId: string, organizationId?: string) {
+    const automations = await this.getBrowserAutomationsForTask(taskId, organizationId);
+    return Promise.all(
+      automations.map(async (automation) => {
+        const runsWithUrls = await Promise.all(
+          automation.runs.map(async (run) => {
+            if (!run.screenshotUrl) return run;
+            const screenshotUrl = await this.screenshots.getPresignedUrl({
+              key: run.screenshotUrl,
+            });
+            return { ...run, screenshotUrl };
+          }),
+        );
+        return { ...automation, runs: runsWithUrls };
+      }),
+    );
+  }
+
+  async getAutomationRuns(
+    automationId: string,
+    limit = 20,
+    organizationId?: string,
+  ) {
+    if (organizationId) {
+      await this.requireAutomationInOrg({ automationId, organizationId });
+    }
+    return db.browserAutomationRun.findMany({
+      where: { automationId },
+      orderBy: { createdAt: 'desc' },
+      take: limit,
+    });
+  }
+
+  async getAutomationRun(runId: string, organizationId?: string) {
+    return this.getRunWithPresignedUrl(runId, organizationId);
+  }
+
+  private hideCrossOrgAutomation<T extends { task: { organizationId: string } }>({
+    automation,
+    organizationId,
+  }: {
+    automation: T | null;
+    organizationId?: string;
+  }): T | null {
+    if (!automation) return null;
+    if (organizationId && automation.task.organizationId !== organizationId) {
+      return null;
+    }
+    return automation;
+  }
+
+  private async requireAutomationInOrg(input: {
+    automationId: string;
+    organizationId: string;
+  }) {
+    const automation = await db.browserAutomation.findUnique({
+      where: { id: input.automationId },
+      include: { task: { select: { organizationId: true } } },
+    });
+    const scoped = this.hideCrossOrgAutomation({
+      automation,
+      organizationId: input.organizationId,
+    });
+    if (!scoped) throw new NotFoundException('Automation not found');
+  }
+
+  private async requireTaskInOrg(input: {
+    taskId: string;
+    organizationId: string;
+  }) {
+    const task = await db.task.findFirst({
+      where: { id: input.taskId, organizationId: input.organizationId },
+      select: { id: true },
+    });
+    if (!task) throw new NotFoundException('Task not found');
+  }
+}
diff --git a/apps/api/src/browserbase/browser-automation-errors.spec.ts b/apps/api/src/browserbase/browser-automation-errors.spec.ts
new file mode 100644
index 0000000000..8fd898a0a4
--- /dev/null
+++ b/apps/api/src/browserbase/browser-automation-errors.spec.ts
@@ -0,0 +1,64 @@
+import { classifyBrowserAutomationError } from './browser-automation-errors';
+
+describe('classifyBrowserAutomationError', () => {
+  it('classifies auth expiry as needs_reauth', () => {
+    const result = classifyBrowserAutomationError(
+      new Error('Session expired. User is not logged in.'),
+      'auth',
+    );
+
+    expect(result.code).toBe('needs_reauth');
+    expect(result.stage).toBe('auth');
+    expect(result.needsReauth).toBe(true);
+  });
+
+  it('classifies 2FA and device approval as needs_user_action', () => {
+    const result = classifyBrowserAutomationError(
+      new Error(
+        'Login paused because device approval required before continuing',
+      ),
+      'auth',
+    );
+
+    expect(result.code).toBe('needs_user_action');
+    expect(result.blockedReason).toContain('Manual 2FA');
+  });
+
+  it('classifies captcha and rate limit failures with stable codes', () => {
+    expect(
+      classifyBrowserAutomationError(new Error('reCAPTCHA required')).code,
+    ).toBe('captcha_blocked');
+    expect(
+      classifyBrowserAutomationError(new Error('429 Too Many Requests')).code,
+    ).toBe('rate_limited');
+  });
+
+  it('does not expose raw unknown error text to users', () => {
+    const result = classifyBrowserAutomationError(
+      new Error('internal token abc123'),
+    );
+
+    expect(result.code).toBe('unknown');
+    expect(result.userFacing).toBe(
+      'Browser automation failed for an unknown reason.',
+    );
+  });
+
+  it('does not classify generic forbidden errors as reauth', () => {
+    const result = classifyBrowserAutomationError(
+      new Error('403 forbidden while loading report'),
+      'navigation',
+    );
+
+    expect(result.code).toBe('unknown');
+    expect(result.needsReauth).toBe(false);
+  });
+
+  it('reads message fields from non-Error thrown objects', () => {
+    const result = classifyBrowserAutomationError({
+      message: 'Target closed while taking screenshot',
+    });
+
+    expect(result.code).toBe('browser_session_lost');
+  });
+});
diff --git a/apps/api/src/browserbase/browser-automation-errors.ts b/apps/api/src/browserbase/browser-automation-errors.ts
new file mode 100644
index 0000000000..b1dc6db3a1
--- /dev/null
+++ b/apps/api/src/browserbase/browser-automation-errors.ts
@@ -0,0 +1,162 @@
+export type BrowserAutomationFailureCode =
+  | 'needs_reauth'
+  | 'needs_user_action'
+  | 'rate_limited'
+  | 'captcha_blocked'
+  | 'timeout'
+  | 'browser_session_lost'
+  | 'evaluation_failed'
+  | 'unknown';
+
+export type BrowserAutomationFailureStage =
+  | 'auth'
+  | 'navigation'
+  | 'action'
+  | 'screenshot'
+  | 'evaluation'
+  | 'upload'
+  | 'session'
+  | 'unknown';
+
+export interface ClassifiedBrowserAutomationError {
+  code: BrowserAutomationFailureCode;
+  stage: BrowserAutomationFailureStage;
+  userFacing: string;
+  needsReauth: boolean;
+  blockedReason?: string;
+}
+
+const getErrorText = (error: unknown): string => {
+  if (error instanceof Error) return error.message;
+  if (typeof error === 'string') return error;
+  if (typeof error === 'object' && error !== null && 'message' in error) {
+    const message = error.message;
+    if (typeof message === 'string') return message;
+  }
+  if (typeof error === 'object' && error !== null && 'error' in error) {
+    const nestedError = error.error;
+    if (typeof nestedError === 'string') return nestedError;
+  }
+  return String(error);
+};
+
+export function classifyBrowserAutomationError(
+  error: unknown,
+  stage: BrowserAutomationFailureStage = 'unknown',
+): ClassifiedBrowserAutomationError {
+  const message = getErrorText(error);
+  const lower = message.toLowerCase();
+
+  if (
+    lower.includes('two-factor') ||
+    lower.includes('2fa') ||
+    lower.includes('totp') ||
+    lower.includes('device approval') ||
+    lower.includes('approval required') ||
+    lower.includes('verify your identity')
+  ) {
+    return {
+      code: 'needs_user_action',
+      stage: 'auth',
+      userFacing:
+        'The site requires a user action such as 2FA or device approval.',
+      needsReauth: true,
+      blockedReason: 'Manual 2FA or device approval is required.',
+    };
+  }
+
+  if (
+    lower.includes('session expired') ||
+    lower.includes('not logged in') ||
+    lower.includes('not signed in') ||
+    lower.includes('signed out') ||
+    lower.includes('login required') ||
+    lower.includes('log in required') ||
+    lower.includes('sign in required') ||
+    lower.includes('please log in') ||
+    lower.includes('please login') ||
+    lower.includes('401 unauthorized') ||
+    lower.includes('http 401') ||
+    lower.includes('unauthorized. please log in') ||
+    lower.includes('unauthorized. please login')
+  ) {
+    return {
+      code: 'needs_reauth',
+      stage: 'auth',
+      userFacing:
+        'Authentication is no longer valid. Reconnect this browser profile.',
+      needsReauth: true,
+      blockedReason: 'Authentication expired or could not be verified.',
+    };
+  }
+
+  if (lower.includes('captcha') || lower.includes('recaptcha')) {
+    return {
+      code: 'captcha_blocked',
+      stage: 'auth',
+      userFacing:
+        'The site presented a captcha that automation cannot complete.',
+      needsReauth: false,
+      blockedReason: 'Captcha challenge blocked automation.',
+    };
+  }
+
+  if (
+    lower.includes('rate limit') ||
+    lower.includes('too many requests') ||
+    lower.includes('429')
+  ) {
+    return {
+      code: 'rate_limited',
+      stage,
+      userFacing: 'The site or Browserbase rate limited this automation.',
+      needsReauth: false,
+    };
+  }
+
+  if (
+    lower.includes('timeout') ||
+    lower.includes('timed out') ||
+    lower.includes('deadline')
+  ) {
+    return {
+      code: 'timeout',
+      stage,
+      userFacing: 'The browser automation timed out before it could finish.',
+      needsReauth: false,
+    };
+  }
+
+  if (
+    lower.includes('no page') ||
+    lower.includes('page closed') ||
+    lower.includes('target closed') ||
+    lower.includes('browser has been closed') ||
+    lower.includes('session ended')
+  ) {
+    return {
+      code: 'browser_session_lost',
+      stage: 'session',
+      userFacing: 'The browser session ended before the automation finished.',
+      needsReauth: false,
+    };
+  }
+
+  return {
+    code: 'unknown',
+    stage,
+    userFacing: 'Browser automation failed for an unknown reason.',
+    needsReauth: false,
+  };
+}
+
+export function evaluationFailedError(
+  message: string,
+): ClassifiedBrowserAutomationError {
+  return {
+    code: 'evaluation_failed',
+    stage: 'evaluation',
+    userFacing: message,
+    needsReauth: false,
+  };
+}
diff --git a/apps/api/src/browserbase/browser-automation-execution.service.spec.ts b/apps/api/src/browserbase/browser-automation-execution.service.spec.ts
new file mode 100644
index 0000000000..67e0acfa31
--- /dev/null
+++ b/apps/api/src/browserbase/browser-automation-execution.service.spec.ts
@@ -0,0 +1,117 @@
+import { db } from '@db';
+import { BrowserAuthProfileService } from './browser-auth-profile.service';
+import { BrowserAutomationExecutionService } from './browser-automation-execution.service';
+import { BrowserEvidenceRunnerService } from './browser-evidence-runner.service';
+import { BrowserbaseSessionService } from './browserbase-session.service';
+
+jest.mock('@db', () => ({
+  db: {
+    $transaction: jest.fn(),
+    browserAutomation: { findUnique: jest.fn() },
+    browserAutomationRun: { updateMany: jest.fn(), findUnique: jest.fn() },
+  },
+  Prisma: {
+    TransactionIsolationLevel: { Serializable: 'Serializable' },
+  },
+}));
+
+describe('BrowserAutomationExecutionService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+
+    (db.$transaction as jest.Mock).mockImplementation(async (callback) =>
+      callback({
+        browserAutomationRun: {
+          count: jest.fn().mockResolvedValue(0),
+          create: jest.fn().mockResolvedValue({
+            id: 'bar_1',
+            automationId: 'bau_1',
+            profileId: 'bap_1',
+            startedAt: new Date('2026-06-19T12:00:00.000Z'),
+          }),
+        },
+      }),
+    );
+    (db.browserAutomation.findUnique as jest.Mock).mockResolvedValue({
+      id: 'bau_1',
+      taskId: 'tsk_1',
+      targetUrl: 'https://example.com',
+      instruction: 'collect evidence',
+      evaluationCriteria: null,
+      task: { organizationId: 'org_1' },
+    });
+    (db.browserAutomationRun.updateMany as jest.Mock).mockResolvedValue({
+      count: 1,
+    });
+  });
+
+  it('persists a failed terminal state when the runner throws', async () => {
+    const sessions = new BrowserbaseSessionService();
+    const profiles = new BrowserAuthProfileService(sessions);
+    const runner = new BrowserEvidenceRunnerService(sessions);
+
+    jest.spyOn(profiles, 'resolveProfileForTarget').mockResolvedValue({
+      id: 'bap_1',
+      organizationId: 'org_1',
+      hostname: 'example.com',
+      loginIdentity: '',
+      displayName: 'example.com browser profile',
+      contextId: 'ctx_1',
+      status: 'verified',
+      lastVerifiedAt: null,
+      lastAuthCheckUrl: null,
+      blockedReason: null,
+      vaultProvider: null,
+      vaultExternalItemRef: null,
+      vaultConnectionId: null,
+      createdAt: new Date('2026-06-19T12:00:00.000Z'),
+      updatedAt: new Date('2026-06-19T12:00:00.000Z'),
+    });
+    jest
+      .spyOn(runner, 'runEvidence')
+      .mockRejectedValue(new Error('Target closed'));
+
+    const service = new BrowserAutomationExecutionService(
+      sessions,
+      profiles,
+      runner,
+    );
+
+    const response = await service.runBrowserAutomation('bau_1', 'org_1');
+
+    expect(response.success).toBe(false);
+    expect(response.failureCode).toBe('browser_session_lost');
+    expect(db.browserAutomationRun.updateMany).toHaveBeenCalledWith({
+      where: { id: 'bar_1', status: 'running' },
+      data: expect.objectContaining({
+        status: 'failed',
+        failureCode: 'browser_session_lost',
+        failureStage: 'session',
+      }),
+    });
+  });
+
+  it('rejects live-session replay when the run is already terminal', async () => {
+    const sessions = new BrowserbaseSessionService();
+    const profiles = new BrowserAuthProfileService(sessions);
+    const runner = new BrowserEvidenceRunnerService(sessions);
+
+    (db.browserAutomationRun.findUnique as jest.Mock).mockResolvedValue({
+      id: 'bar_1',
+      automationId: 'bau_1',
+      status: 'completed',
+    });
+    const runSpy = jest.spyOn(runner, 'executeEvidenceOnSession');
+
+    const service = new BrowserAutomationExecutionService(
+      sessions,
+      profiles,
+      runner,
+    );
+
+    await expect(
+      service.executeAutomationOnSession('bau_1', 'bar_1', 'sess_1', 'org_1'),
+    ).rejects.toThrow('Run is no longer active');
+    expect(runSpy).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/api/src/browserbase/browser-automation-execution.service.ts b/apps/api/src/browserbase/browser-automation-execution.service.ts
new file mode 100644
index 0000000000..098082fd50
--- /dev/null
+++ b/apps/api/src/browserbase/browser-automation-execution.service.ts
@@ -0,0 +1,276 @@
+import {
+  ConflictException,
+  Injectable,
+  Logger,
+  NotFoundException,
+} from '@nestjs/common';
+import { db } from '@db';
+import { BrowserAuthProfileService } from './browser-auth-profile.service';
+import { BrowserAutomationRunStoreService } from './browser-automation-run-store.service';
+import { failedBrowserEvidenceRunResult } from './browser-automation-run-result';
+import {
+  BrowserEvidenceRunnerService,
+  type BrowserEvidenceRunResult,
+} from './browser-evidence-runner.service';
+import { BrowserbaseSessionService } from './browserbase-session.service';
+
+@Injectable()
+export class BrowserAutomationExecutionService {
+  private readonly logger = new Logger(BrowserAutomationExecutionService.name);
+
+  constructor(
+    private readonly sessions: BrowserbaseSessionService = new BrowserbaseSessionService(),
+    private readonly profiles: BrowserAuthProfileService = new BrowserAuthProfileService(
+      sessions,
+    ),
+    private readonly runner: BrowserEvidenceRunnerService = new BrowserEvidenceRunnerService(
+      sessions,
+    ),
+    private readonly runs: BrowserAutomationRunStoreService = new BrowserAutomationRunStoreService(),
+  ) {}
+
+  async startAutomationWithLiveView(
+    automationId: string,
+    organizationId: string,
+  ) {
+    const automation = await this.getRunnableAutomation({
+      automationId,
+      organizationId,
+    });
+    const profile = await this.profiles.resolveProfileForTarget({
+      organizationId,
+      targetUrl: automation.targetUrl,
+    });
+    const run = await this.runs.createRun({
+      automationId,
+      profileId: profile.id,
+    });
+
+    try {
+      const { sessionId, liveViewUrl } =
+        await this.sessions.createSessionWithContext(profile.contextId);
+      return { runId: run.id, sessionId, liveViewUrl, profileId: profile.id };
+    } catch (error) {
+      const result = failedBrowserEvidenceRunResult(error);
+      await this.runs.finishRun({
+        runId: run.id,
+        startedAt: run.startedAt,
+        result,
+      });
+      await this.applyProfileResult({
+        organizationId,
+        profileId: profile.id,
+        result,
+      });
+      throw error;
+    }
+  }
+
+  async executeAutomationOnSession(
+    automationId: string,
+    runId: string,
+    sessionId: string,
+    organizationId: string,
+  ) {
+    const automation = await this.getRunnableAutomation({
+      automationId,
+      organizationId,
+    });
+    const run = await this.runs.getActiveRun({
+      runId,
+      automationId,
+    });
+
+    const profile = await this.profiles.resolveProfileForTarget({
+      organizationId,
+      targetUrl: automation.targetUrl,
+      profileId: run.profileId ?? undefined,
+    });
+    let result: BrowserEvidenceRunResult;
+    try {
+      result = await this.runner.executeEvidenceOnSession({
+        organizationId,
+        taskId: automation.taskId,
+        automationId,
+        runId,
+        sessionId,
+        targetUrl: automation.targetUrl,
+        instruction: automation.instruction,
+        evaluationCriteria: automation.evaluationCriteria,
+        profile: {
+          id: profile.id,
+          hostname: profile.hostname,
+          contextId: profile.contextId,
+          vaultProvider: profile.vaultProvider,
+          vaultExternalItemRef: profile.vaultExternalItemRef,
+          vaultConnectionId: profile.vaultConnectionId,
+        },
+        beforeExecution: () =>
+          this.runs.assertRunIsStillActive({ runId, automationId }),
+      });
+    } catch (error) {
+      if (this.isTerminalReplayError(error)) throw error;
+      this.logger.error('Browser evidence runner failed', error);
+      result = failedBrowserEvidenceRunResult(error);
+    }
+
+    await this.runs.finishRun({ runId, startedAt: run.startedAt, result });
+    await this.applyProfileResult({
+      organizationId,
+      profileId: profile.id,
+      result,
+    });
+    return this.toRunResponse({ runId, result });
+  }
+
+  async runBrowserAutomation(automationId: string, organizationId: string) {
+    const automation = await this.getRunnableAutomation({
+      automationId,
+      organizationId,
+    });
+    const profile = await this.profiles.resolveProfileForTarget({
+      organizationId,
+      targetUrl: automation.targetUrl,
+    });
+    const run = await this.runs.createRun({
+      automationId,
+      profileId: profile.id,
+    });
+
+    if (profile.status !== 'verified') {
+      const result = this.profileBlockedResult(profile.status);
+      await this.runs.finishRun({
+        runId: run.id,
+        startedAt: run.startedAt,
+        result,
+      });
+      return this.toRunResponse({ runId: run.id, result });
+    }
+
+    let result: BrowserEvidenceRunResult;
+    try {
+      result = await this.runner.runEvidence({
+        organizationId,
+        taskId: automation.taskId,
+        automationId,
+        runId: run.id,
+        targetUrl: automation.targetUrl,
+        instruction: automation.instruction,
+        evaluationCriteria: automation.evaluationCriteria,
+        profile: {
+          id: profile.id,
+          hostname: profile.hostname,
+          contextId: profile.contextId,
+          vaultProvider: profile.vaultProvider,
+          vaultExternalItemRef: profile.vaultExternalItemRef,
+          vaultConnectionId: profile.vaultConnectionId,
+        },
+      });
+    } catch (error) {
+      this.logger.error('Browser evidence runner failed', error);
+      result = failedBrowserEvidenceRunResult(error);
+    }
+    await this.runs.finishRun({
+      runId: run.id,
+      startedAt: run.startedAt,
+      result,
+    });
+    await this.applyProfileResult({
+      organizationId,
+      profileId: profile.id,
+      result,
+    });
+    return this.toRunResponse({ runId: run.id, result });
+  }
+
+  private async applyProfileResult(input: {
+    organizationId: string;
+    profileId: string;
+    result: BrowserEvidenceRunResult;
+  }) {
+    if (input.result.failureCode === 'needs_reauth') {
+      await this.profiles.markNeedsReauth({
+        organizationId: input.organizationId,
+        profileId: input.profileId,
+        reason: input.result.blockedReason,
+      });
+    }
+
+    if (
+      input.result.failureCode === 'captcha_blocked' ||
+      input.result.failureCode === 'needs_user_action'
+    ) {
+      await this.profiles.markBlocked({
+        organizationId: input.organizationId,
+        profileId: input.profileId,
+        reason:
+          input.result.blockedReason ??
+          input.result.error ??
+          'User action is required before this automation can run.',
+      });
+    }
+  }
+
+  private profileBlockedResult(status: string): BrowserEvidenceRunResult {
+    const needsUserAction = status === 'blocked';
+    return {
+      success: false,
+      status: 'blocked',
+      error: needsUserAction
+        ? 'This browser profile is blocked. Resolve the blocked state before running automations.'
+        : 'This browser profile is not verified. Reconnect it before running automations.',
+      needsReauth: !needsUserAction,
+      failureCode: needsUserAction ? 'needs_user_action' : 'needs_reauth',
+      failureStage: 'auth',
+      blockedReason: needsUserAction
+        ? 'Browser profile is blocked.'
+        : 'Browser profile is not verified.',
+      logs: [],
+    };
+  }
+
+  private toRunResponse(input: {
+    runId: string;
+    result: BrowserEvidenceRunResult;
+  }) {
+    return {
+      runId: input.runId,
+      success: input.result.success,
+      screenshotUrl: input.result.screenshotUrl,
+      evaluationStatus: input.result.evaluationStatus,
+      evaluationReason: input.result.evaluationReason,
+      error: input.result.error,
+      needsReauth: input.result.needsReauth,
+      failureCode: input.result.failureCode,
+      failureStage: input.result.failureStage,
+      blockedReason: input.result.blockedReason,
+    };
+  }
+
+  private async getRunnableAutomation(input: {
+    automationId: string;
+    organizationId: string;
+  }) {
+    const automation = await db.browserAutomation.findUnique({
+      where: { id: input.automationId },
+      include: {
+        task: {
+          select: { title: true, description: true, organizationId: true },
+        },
+      },
+    });
+    if (
+      !automation ||
+      automation.task.organizationId !== input.organizationId
+    ) {
+      throw new NotFoundException('Automation not found');
+    }
+    return automation;
+  }
+
+  private isTerminalReplayError(error: unknown): boolean {
+    return (
+      error instanceof ConflictException || error instanceof NotFoundException
+    );
+  }
+}
diff --git a/apps/api/src/browserbase/browser-automation-run-result.ts b/apps/api/src/browserbase/browser-automation-run-result.ts
new file mode 100644
index 0000000000..8740e92f03
--- /dev/null
+++ b/apps/api/src/browserbase/browser-automation-run-result.ts
@@ -0,0 +1,39 @@
+import { type Prisma } from '@db';
+import {
+  type BrowserAutomationFailureCode,
+  classifyBrowserAutomationError,
+} from './browser-automation-errors';
+import type { BrowserEvidenceRunResult } from './browser-evidence-runner.service';
+
+export function statusForBrowserFailureCode(
+  code: BrowserAutomationFailureCode | undefined,
+): 'failed' | 'blocked' {
+  if (code === 'captcha_blocked' || code === 'needs_user_action') {
+    return 'blocked';
+  }
+  return 'failed';
+}
+
+export function failedBrowserEvidenceRunResult(
+  error: unknown,
+): BrowserEvidenceRunResult {
+  const classified = classifyBrowserAutomationError(error);
+  const logs: Prisma.InputJsonArray = [
+    {
+      timestamp: new Date().toISOString(),
+      stage: classified.stage,
+      message: classified.userFacing,
+    },
+  ];
+
+  return {
+    success: false,
+    status: statusForBrowserFailureCode(classified.code),
+    error: classified.userFacing,
+    needsReauth: classified.needsReauth,
+    failureCode: classified.code,
+    failureStage: classified.stage,
+    blockedReason: classified.blockedReason,
+    logs,
+  };
+}
diff --git a/apps/api/src/browserbase/browser-automation-run-store.service.ts b/apps/api/src/browserbase/browser-automation-run-store.service.ts
new file mode 100644
index 0000000000..ac02332299
--- /dev/null
+++ b/apps/api/src/browserbase/browser-automation-run-store.service.ts
@@ -0,0 +1,103 @@
+import {
+  ConflictException,
+  Injectable,
+  NotFoundException,
+} from '@nestjs/common';
+import { db, Prisma } from '@db';
+import type { BrowserEvidenceRunResult } from './browser-evidence-runner.service';
+
+@Injectable()
+export class BrowserAutomationRunStoreService {
+  private readonly maxCreateRunAttempts = 3;
+
+  async createRun(input: { automationId: string; profileId?: string }) {
+    for (let attempt = 0; attempt < this.maxCreateRunAttempts; attempt += 1) {
+      try {
+        return await db.$transaction(
+          async (tx) => {
+            const attemptCount =
+              (await tx.browserAutomationRun.count({
+                where: { automationId: input.automationId },
+              })) + 1;
+            return tx.browserAutomationRun.create({
+              data: {
+                automationId: input.automationId,
+                profileId: input.profileId,
+                status: 'running',
+                startedAt: new Date(),
+                attemptCount,
+              },
+            });
+          },
+          { isolationLevel: Prisma.TransactionIsolationLevel.Serializable },
+        );
+      } catch (error) {
+        if (
+          !this.isSerializationConflict(error) ||
+          attempt === this.maxCreateRunAttempts - 1
+        ) {
+          throw error;
+        }
+      }
+    }
+
+    throw new Error('Failed to create browser automation run.');
+  }
+
+  async finishRun(input: {
+    runId: string;
+    startedAt: Date | null;
+    result: BrowserEvidenceRunResult;
+  }): Promise<void> {
+    const updated = await db.browserAutomationRun.updateMany({
+      where: { id: input.runId, status: 'running' },
+      data: {
+        status: input.result.status,
+        completedAt: new Date(),
+        durationMs: input.startedAt
+          ? Date.now() - input.startedAt.getTime()
+          : 0,
+        screenshotUrl: input.result.screenshotKey,
+        evaluationStatus: input.result.evaluationStatus ?? null,
+        evaluationReason: input.result.evaluationReason ?? null,
+        error: input.result.error,
+        failureCode: input.result.failureCode,
+        failureStage: input.result.failureStage,
+        blockedReason: input.result.blockedReason,
+        finalUrl: input.result.finalUrl,
+        logs: input.result.logs,
+      },
+    });
+
+    if (updated.count === 0) {
+      throw new ConflictException('Run is no longer active.');
+    }
+  }
+
+  async getActiveRun(input: { runId: string; automationId: string }) {
+    const run = await db.browserAutomationRun.findUnique({
+      where: { id: input.runId },
+    });
+    if (!run || run.automationId !== input.automationId) {
+      throw new NotFoundException('Run not found');
+    }
+    if (run.status !== 'running') {
+      throw new ConflictException('Run is no longer active.');
+    }
+    return run;
+  }
+
+  async assertRunIsStillActive(input: {
+    runId: string;
+    automationId: string;
+  }): Promise<void> {
+    await this.getActiveRun(input);
+  }
+
+  private isSerializationConflict(error: unknown): boolean {
+    return (
+      error instanceof Prisma.PrismaClientKnownRequestError &&
+      error.code === 'P2034'
+    );
+  }
+}
diff --git a/apps/api/src/browserbase/browser-evidence-evaluation.spec.ts b/apps/api/src/browserbase/browser-evidence-evaluation.spec.ts
new file mode 100644
index 0000000000..df90d48ce4
--- /dev/null
+++ b/apps/api/src/browserbase/browser-evidence-evaluation.spec.ts
@@ -0,0 +1,41 @@
+import type { BrowserEvidenceLog } from './browser-evidence-execution';
+import {
+  type BrowserEvidenceEvaluator,
+  evaluateIfNeeded,
+} from './browser-evidence-evaluation';
+
+describe('evaluateIfNeeded', () => {
+  it('marks evaluation extraction failures as failed evaluations', async () => {
+    const logs: BrowserEvidenceLog[] = [];
+    const stagehand: BrowserEvidenceEvaluator = {
+      async extract() {
+        throw new Error('extract failed');
+      },
+    };
+
+    const result = await evaluateIfNeeded({
+      stagehand,
+      criteria: 'Dashboard is visible',
+      logs,
+    });
+
+    expect(result).toEqual({
+      success: false,
+      evaluationStatus: 'fail',
+      evaluationReason:
+        'The automation captured evidence, but evaluation failed. Review the screenshot manually.',
+      error:
+        'The automation captured evidence, but evaluation failed. Review the screenshot manually.',
+      failureCode: 'evaluation_failed',
+      failureStage: 'evaluation',
+    });
+    expect(logs).toEqual(
+      expect.arrayContaining([
+        expect.objectContaining({
+          stage: 'evaluation',
+          message: 'extract failed',
+        }),
+      ]),
+    );
+  });
+});
diff --git a/apps/api/src/browserbase/browser-evidence-evaluation.ts b/apps/api/src/browserbase/browser-evidence-evaluation.ts
new file mode 100644
index 0000000000..bd378205ba
--- /dev/null
+++ b/apps/api/src/browserbase/browser-evidence-evaluation.ts
@@ -0,0 +1,82 @@
+import { z } from 'zod';
+import {
+  type BrowserAutomationFailureCode,
+  type BrowserAutomationFailureStage,
+  evaluationFailedError,
+} from './browser-automation-errors';
+import type { BrowserEvidenceLog } from './browser-evidence-execution';
+
+export interface BrowserEvidenceEvaluator {
+  extract<T extends z.ZodType>(
+    instruction: string,
+    schema: T,
+  ): Promise<z.infer<T>>;
+}
+
+export async function evaluateIfNeeded({
+  stagehand,
+  criteria,
+  logs,
+}: {
+  stagehand: BrowserEvidenceEvaluator;
+  criteria?: string | null;
+  logs: BrowserEvidenceLog[];
+}): Promise<{
+  success: boolean;
+  evaluationStatus?: 'pass' | 'fail';
+  evaluationReason?: string;
+  error?: string;
+  failureCode?: BrowserAutomationFailureCode;
+  failureStage?: BrowserAutomationFailureStage;
+}> {
+  const normalizedCriteria = criteria?.trim();
+  if (!normalizedCriteria) return { success: true };
+
+  logs.push({
+    timestamp: new Date().toISOString(),
+    stage: 'evaluation',
+    message: 'Evaluating final page against criteria.',
+  });
+
+  try {
+    const evalSchema = z.object({
+      pass: z.boolean(),
+      reason: z.string(),
+    });
+    const evaluation = await stagehand.extract(
+      [
+        'You are an auditor reviewing the current page after an automation has finished navigating.',
+        'Decide whether the page clearly satisfies this criteria.',
+        'Only return pass=true if the evidence is unambiguously present and visible.',
+        'If it is ambiguous, missing, or contradicted, return pass=false.',
+        'Always provide a short reason (max 220 characters).',
+        '',
+        `Criteria: ${normalizedCriteria}`,
+      ].join('\n'),
+      evalSchema,
+    );
+
+    return {
+      success: true,
+      evaluationStatus: evaluation.pass ? 'pass' : 'fail',
+      evaluationReason: evaluation.reason,
+    };
+  } catch (err) {
+    const classified = evaluationFailedError(
+      'The automation captured evidence, but evaluation failed. Review the screenshot manually.',
+    );
+    logs.push({
+      timestamp: new Date().toISOString(),
+      stage: classified.stage,
+      message: err instanceof Error ? err.message : String(err),
+    });
+    return {
+      success: false,
+      evaluationStatus: 'fail',
+      evaluationReason: classified.userFacing,
+      error: classified.userFacing,
+      failureCode: classified.code,
+      failureStage: classified.stage,
+    };
+  }
+}
diff --git a/apps/api/src/browserbase/browser-evidence-execution.ts b/apps/api/src/browserbase/browser-evidence-execution.ts
new file mode 100644
index 0000000000..85cc9c6560
--- /dev/null
+++ b/apps/api/src/browserbase/browser-evidence-execution.ts
@@ -0,0 +1,224 @@
+import { Logger } from '@nestjs/common';
+import { z } from 'zod';
+import { renderOverlay } from './screenshot-overlay';
+import type { BrowserbaseSessionService } from './browserbase-session.service';
+import {
+  bringEvidencePageToFront,
+  resolveEvidencePage,
+} from './browser-evidence-page';
+import { evaluateIfNeeded } from './browser-evidence-evaluation';
+import {
+  type BrowserAutomationFailureCode,
+  type BrowserAutomationFailureStage,
+  type ClassifiedBrowserAutomationError,
+  classifyBrowserAutomationError,
+} from './browser-automation-errors';
+import type { BrowserEvidenceSessionInput } from './browser-evidence-runner.service';
+
+type Stagehand = import('@browserbasehq/stagehand').Stagehand;
+
+const STAGEHAND_CUA_MODEL = 'anthropic/claude-sonnet-4-6';
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export interface BrowserEvidenceLog {
+  timestamp: string;
+  stage: string;
+  message: string;
+}
+
+export interface BrowserEvidenceExecutionResult {
+  success: boolean;
+  screenshot?: string;
+  finalUrl?: string;
+  evaluationStatus?: 'pass' | 'fail';
+  evaluationReason?: string;
+  error?: string;
+  needsReauth?: boolean;
+  failureCode?: BrowserAutomationFailureCode;
+  failureStage?: BrowserAutomationFailureStage;
+  blockedReason?: string;
+  logs: BrowserEvidenceLog[];
+}
+
+export async function executeBrowserEvidence({
+  input,
+  sessions,
+  logger,
+}: {
+  input: BrowserEvidenceSessionInput;
+  sessions: BrowserbaseSessionService;
+  logger: Logger;
+}): Promise<BrowserEvidenceExecutionResult> {
+  const logs: BrowserEvidenceLog[] = [];
+  const log = (stage: string, message: string) => {
+    logs.push({ timestamp: new Date().toISOString(), stage, message });
+  };
+  let stagehand: Stagehand | null = null;
+  let currentStage: BrowserAutomationFailureStage = 'session';
+
+  try {
+    log('session', 'Initializing Stagehand session.');
+    stagehand = await sessions.createStagehand(input.sessionId);
+    const initialPage = await sessions.ensureActivePage(stagehand);
+    let page = initialPage;
+
+    currentStage = 'navigation';
+    log('navigation', `Opening ${input.targetUrl}.`);
+    await page.goto(input.targetUrl, {
+      waitUntil: 'domcontentloaded',
+      timeoutMs: 30000,
+    });
+    await delay(1000);
+
+    currentStage = 'auth';
+    const authCheck = await checkAuth(stagehand);
+
+    if (!authCheck.isLoggedIn) {
+      const classified = classifyBrowserAutomationError(
+        new Error('Session expired. User is not logged in.'),
+        'auth',
+      );
+      log('auth', classified.userFacing);
+      return toExecutionFailure({ classified, logs });
+    }
+
+    currentStage = 'action';
+    log('action', 'Running navigation instruction.');
+    const instruction = `${input.instruction}. After completing all navigation steps, stop and wait.`;
+    await stagehand
+      .agent({
+        cua: true,
+        model: {
+          modelName: STAGEHAND_CUA_MODEL,
+          apiKey: process.env.ANTHROPIC_API_KEY,
+        },
+      })
+      .execute({ instruction, maxSteps: 20 });
+
+    await delay(2000);
+    page = await resolveEvidencePage({
+      stagehand,
+      initialPage,
+      targetUrl: input.targetUrl,
+    });
+    const finalUrl = page.url();
+
+    currentStage = 'screenshot';
+    log('screenshot', 'Capturing screenshot.');
+    const rawScreenshot = await page.screenshot({
+      type: 'jpeg',
+      quality: 80,
+      fullPage: false,
+    });
+
+    const screenshot = await renderScreenshot({
+      logger,
+      logs,
+      rawScreenshot,
+      instruction: input.instruction,
+      finalUrl,
+    });
+    currentStage = 'evaluation';
+    await bringEvidencePageToFront(page);
+    const evaluation = await evaluateIfNeeded({
+      stagehand,
+      criteria: input.evaluationCriteria,
+      logs,
+    });
+
+    if (!evaluation.success) {
+      return {
+        success: false,
+        screenshot,
+        finalUrl,
+        evaluationStatus: evaluation.evaluationStatus,
+        evaluationReason: evaluation.evaluationReason,
+        error: evaluation.error,
+        failureCode: evaluation.failureCode,
+        failureStage: evaluation.failureStage,
+        logs,
+      };
+    }
+
+    return {
+      success: true,
+      screenshot,
+      finalUrl,
+      evaluationStatus: evaluation.evaluationStatus,
+      evaluationReason: evaluation.evaluationReason,
+      logs,
+    };
+  } catch (err) {
+    const classified = classifyBrowserAutomationError(err, currentStage);
+    log(classified.stage, classified.userFacing);
+    logger.error('Failed to execute browser evidence run', err);
+    return toExecutionFailure({ classified, logs });
+  } finally {
+    if (stagehand) {
+      await sessions.safeCloseStagehand(stagehand);
+    }
+  }
+}
+
+async function renderScreenshot({
+  logger,
+  logs,
+  rawScreenshot,
+  instruction,
+  finalUrl,
+}: {
+  logger: Logger;
+  logs: BrowserEvidenceLog[];
+  rawScreenshot: Buffer;
+  instruction: string;
+  finalUrl: string;
+}): Promise<string> {
+  let finalBuffer: Buffer = rawScreenshot;
+  try {
+    finalBuffer = await renderOverlay({
+      buffer: rawScreenshot,
+      instruction,
+      sourceUrl: finalUrl,
+      capturedAt: new Date(),
+    });
+  } catch (overlayErr) {
+    logger.warn('Screenshot overlay render failed; uploading raw image', {
+      error:
+        overlayErr instanceof Error ? overlayErr.message : String(overlayErr),
+    });
+    logs.push({
+      timestamp: new Date().toISOString(),
+      stage: 'screenshot',
+      message: 'Overlay failed; captured raw screenshot.',
+    });
+  }
+  return finalBuffer.toString('base64');
+}
+
+async function checkAuth(
+  stagehand: Stagehand,
+): Promise<{ isLoggedIn: boolean }> {
+  const loginSchema = z.object({ isLoggedIn: z.boolean() });
+  return stagehand.extract(
+    'Check if the user is logged in to this website. Look for a user avatar, profile menu, account dropdown, or login/sign-in buttons. Return true if logged in, false if you see login buttons or a login form.',
+    loginSchema,
+  );
+}
+
+function toExecutionFailure({
+  classified,
+  logs,
+}: {
+  classified: ClassifiedBrowserAutomationError;
+  logs: BrowserEvidenceLog[];
+}): BrowserEvidenceExecutionResult {
+  return {
+    success: false,
+    error: classified.userFacing,
+    needsReauth: classified.needsReauth,
+    failureCode: classified.code,
+    failureStage: classified.stage,
+    blockedReason: classified.blockedReason,
+    logs,
+  };
+}
diff --git a/apps/api/src/browserbase/browser-evidence-page.spec.ts b/apps/api/src/browserbase/browser-evidence-page.spec.ts
new file mode 100644
index 0000000000..df155bfeaa
--- /dev/null
+++ b/apps/api/src/browserbase/browser-evidence-page.spec.ts
@@ -0,0 +1,62 @@
+import { selectEvidencePage } from './browser-evidence-page';
+
+interface TestPage {
+  closed: boolean;
+  id: string;
+  url(): string;
+}
+
+const page = ({
+  closed = false,
+  id,
+  url,
+}: {
+  closed?: boolean;
+  id: string;
+  url: string;
+}): TestPage => ({
+  closed,
+  id,
+  url: () => url,
+});
+
+const isClosed = (testPage: TestPage) => testPage.closed;
+
+describe('selectEvidencePage', () => {
+  it('prefers the newest open same-host page over the original page', () => {
+    const initialPage = page({
+      id: 'initial',
+      url: 'https://github.com/acme/start',
+    });
+    const newTab = page({
+      id: 'new-tab',
+      url: 'https://github.com/acme/evidence',
+    });
+
+    const selected = selectEvidencePage({
+      pages: [initialPage, newTab],
+      initialPage,
+      targetUrl: 'https://github.com/acme/start',
+      isClosed,
+    });
+
+    expect(selected).toBe(newTab);
+  });
+
+  it('returns null when every page is closed', () => {
+    const initialPage = page({
+      closed: true,
+      id: 'initial',
+      url: 'https://github.com/acme/start',
+    });
+
+    const selected = selectEvidencePage({
+      pages: [initialPage],
+      initialPage,
+      targetUrl: 'https://github.com/acme/start',
+      isClosed,
+    });
+
+    expect(selected).toBeNull();
+  });
+});
diff --git a/apps/api/src/browserbase/browser-evidence-page.ts b/apps/api/src/browserbase/browser-evidence-page.ts
new file mode 100644
index 0000000000..ee12e64d9f
--- /dev/null
+++ b/apps/api/src/browserbase/browser-evidence-page.ts
@@ -0,0 +1,113 @@
+import type { BrowserbaseSessionService } from './browserbase-session.service';
+import { normalizeHostnameFromUrl } from './browserbase-url';
+
+type Stagehand = import('@browserbasehq/stagehand').Stagehand;
+type EvidencePage = Awaited<
+  ReturnType<BrowserbaseSessionService['ensureActivePage']>
+>;
+
+interface EvidencePageCandidate {
+  url(): string;
+}
+
+export async function resolveEvidencePage({
+  stagehand,
+  initialPage,
+  targetUrl,
+}: {
+  stagehand: Stagehand;
+  initialPage: EvidencePage;
+  targetUrl: string;
+}): Promise<EvidencePage> {
+  const selectedPage = selectEvidencePage({
+    pages: stagehand.context.pages(),
+    initialPage,
+    targetUrl,
+    isClosed: isEvidencePageClosed,
+  });
+
+  if (!selectedPage) {
+    throw new Error('Browser session ended before evidence capture.');
+  }
+
+  await bringEvidencePageToFront(selectedPage);
+  return selectedPage;
+}
+
+export function selectEvidencePage<Page extends EvidencePageCandidate>({
+  pages,
+  initialPage,
+  targetUrl,
+  isClosed,
+}: {
+  pages: Page[];
+  initialPage: Page;
+  targetUrl: string;
+  isClosed: (page: Page) => boolean;
+}): Page | null {
+  const openPages = pages.filter((page) => !isClosed(page));
+  const targetHostname = safeHostname(targetUrl);
+  const openMatchesTarget = (page: Page) =>
+    targetHostname !== null && safeHostname(page.url()) === targetHostname;
+
+  const newestMatchingNewPage = [...openPages]
+    .reverse()
+    .find((page) => page !== initialPage && openMatchesTarget(page));
+  if (newestMatchingNewPage) return newestMatchingNewPage;
+
+  if (!isClosed(initialPage)) return initialPage;
+
+  const newestMatchingPage = [...openPages].reverse().find(openMatchesTarget);
+  if (newestMatchingPage) return newestMatchingPage;
+
+  return openPages.at(-1) ?? null;
+}
+
+export async function bringEvidencePageToFront(
+  page: EvidencePage,
+): Promise<void> {
+  const focusable = getFocusablePage(page);
+  if (focusable) await focusable.bringToFront();
+}
+
+function isEvidencePageClosed(page: EvidencePage): boolean {
+  const closable = getClosablePage(page);
+  return closable ? closable.isClosed() : false;
+}
+
+function getClosablePage(
+  page: EvidencePage,
+): { isClosed: () => boolean } | null {
+  if (!hasMethod(page, 'isClosed')) return null;
+  return { isClosed: () => Boolean(page.isClosed()) };
+}
+
+function getFocusablePage(
+  page: EvidencePage,
+): { bringToFront: () => Promise<void> } | null {
+  if (!hasMethod(page, 'bringToFront')) return null;
+  return {
+    bringToFront: async () => {
+      await page.bringToFront();
+    },
+  };
+}
+
+function hasMethod<K extends string>(
+  value: unknown,
+  key: K,
+): value is Record<K, () => unknown> {
+  if (typeof value !== 'object' || value === null || !(key in value)) {
+    return false;
+  }
+  const record = value as Record<K, unknown>;
+  return typeof record[key] === 'function';
+}
+
+function safeHostname(url: string): string | null {
+  try {
+    return normalizeHostnameFromUrl(url);
+  } catch {
+    return null;
+  }
+}
diff --git a/apps/api/src/browserbase/browser-evidence-runner.service.spec.ts b/apps/api/src/browserbase/browser-evidence-runner.service.spec.ts
new file mode 100644
index 0000000000..1f615889d4
--- /dev/null
+++ b/apps/api/src/browserbase/browser-evidence-runner.service.spec.ts
@@ -0,0 +1,101 @@
+import { BrowserEvidenceRunnerService } from './browser-evidence-runner.service';
+import { executeBrowserEvidence } from './browser-evidence-execution';
+import { BrowserbaseScreenshotService } from './browserbase-screenshot.service';
+import { BrowserbaseSessionService } from './browserbase-session.service';
+
+jest.mock('@db', () => ({
+  db: {},
+  Prisma: {},
+}));
+
+jest.mock('./browser-evidence-execution', () => ({
+  executeBrowserEvidence: jest.fn(),
+}));
+
+jest.mock('@/app/s3', () => ({
+  BUCKET_NAME: 'test-bucket',
+  getSignedUrl: jest.fn(),
+  s3Client: { send: jest.fn() },
+}));
+
+describe('BrowserEvidenceRunnerService', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  it('treats screenshot upload failures as non-fatal', async () => {
+    const screenshots = new BrowserbaseScreenshotService();
+    jest
+      .spyOn(screenshots, 'uploadScreenshot')
+      .mockRejectedValue(new Error('S3 unavailable'));
+
+    jest.mocked(executeBrowserEvidence).mockResolvedValue({
+      success: true,
+      screenshot: 'base64-image',
+      finalUrl: 'https://example.com/final',
+      logs: [],
+    });
+
+    const service = new BrowserEvidenceRunnerService(
+      new BrowserbaseSessionService(),
+      screenshots,
+    );
+
+    const result = await service.executeEvidenceOnSession({
+      organizationId: 'org_1',
+      taskId: 'tsk_1',
+      automationId: 'bau_1',
+      runId: 'bar_1',
+      targetUrl: 'https://example.com',
+      instruction: 'collect evidence',
+      profile: {
+        id: 'bap_1',
+        hostname: 'example.com',
+        contextId: 'ctx_1',
+      },
+      sessionId: 'sess_1',
+    });
+
+    expect(result.status).toBe('completed');
+    expect(result.screenshotKey).toBeUndefined();
+    expect(result.logs).toEqual([
+      expect.objectContaining({
+        stage: 'upload',
+        message: 'Screenshot upload failed; run completed without screenshot.',
+      }),
+    ]);
+  });
+
+  it('does not pass vault credential material into evidence execution', async () => {
+    jest.mocked(executeBrowserEvidence).mockResolvedValue({
+      success: true,
+      finalUrl: 'https://example.com/final',
+      logs: [],
+    });
+
+    const service = new BrowserEvidenceRunnerService(
+      new BrowserbaseSessionService(),
+      new BrowserbaseScreenshotService(),
+    );
+
+    await service.executeEvidenceOnSession({
+      organizationId: 'org_1',
+      automationId: 'bau_1',
+      runId: 'bar_1',
+      targetUrl: 'https://example.com',
+      instruction: 'collect evidence',
+      profile: {
+        id: 'bap_1',
+        hostname: 'example.com',
+        contextId: 'ctx_1',
+        vaultProvider: '1password',
+        vaultExternalItemRef: 'op://vault/item',
+        vaultConnectionId: 'conn_1',
+      },
+      sessionId: 'sess_1',
+    });
+
+    const call = jest.mocked(executeBrowserEvidence).mock.calls[0];
+    expect(call?.[0].input).not.toHaveProperty('credentialMaterial');
+  });
+});
diff --git a/apps/api/src/browserbase/browser-evidence-runner.service.ts b/apps/api/src/browserbase/browser-evidence-runner.service.ts
new file mode 100644
index 0000000000..0e07b19582
--- /dev/null
+++ b/apps/api/src/browserbase/browser-evidence-runner.service.ts
@@ -0,0 +1,206 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { Prisma } from '@db';
+import { BrowserbaseSessionService } from './browserbase-session.service';
+import { BrowserbaseScreenshotService } from './browserbase-screenshot.service';
+import {
+  type BrowserAutomationFailureCode,
+  type BrowserAutomationFailureStage,
+} from './browser-automation-errors';
+import {
+  executeBrowserEvidence,
+  type BrowserEvidenceLog,
+  type BrowserEvidenceExecutionResult,
+} from './browser-evidence-execution';
+import { browserRunCoordinator } from './browser-run-coordinator';
+
+export interface BrowserEvidenceRunnerInput {
+  organizationId: string;
+  taskId?: string;
+  automationId: string;
+  runId: string;
+  targetUrl: string;
+  instruction: string;
+  evaluationCriteria?: string | null;
+  profile: {
+    id: string;
+    hostname: string;
+    contextId: string;
+    vaultProvider?: string | null;
+    vaultExternalItemRef?: string | null;
+    vaultConnectionId?: string | null;
+  };
+  beforeExecution?: () => Promise<void>;
+}
+
+export interface BrowserEvidenceSessionInput extends BrowserEvidenceRunnerInput {
+  sessionId: string;
+}
+
+export interface BrowserEvidenceRunResult {
+  success: boolean;
+  status: 'completed' | 'failed' | 'blocked';
+  screenshotKey?: string;
+  screenshotUrl?: string;
+  finalUrl?: string;
+  evaluationStatus?: 'pass' | 'fail';
+  evaluationReason?: string;
+  error?: string;
+  needsReauth?: boolean;
+  failureCode?: BrowserAutomationFailureCode;
+  failureStage?: BrowserAutomationFailureStage;
+  blockedReason?: string;
+  logs: Prisma.InputJsonValue;
+}
+
+const toJsonLogs = (logs: BrowserEvidenceLog[]): Prisma.InputJsonArray =>
+  logs.map(
+    (log): Prisma.InputJsonObject => ({
+      timestamp: log.timestamp,
+      stage: log.stage,
+      message: log.message,
+    }),
+  );
+
+@Injectable()
+export class BrowserEvidenceRunnerService {
+  private readonly logger = new Logger(BrowserEvidenceRunnerService.name);
+
+  constructor(
+    private readonly sessions: BrowserbaseSessionService = new BrowserbaseSessionService(),
+    private readonly screenshots: BrowserbaseScreenshotService = new BrowserbaseScreenshotService(),
+  ) {}
+
+  async runEvidence(
+    input: BrowserEvidenceRunnerInput,
+  ): Promise<BrowserEvidenceRunResult> {
+    return browserRunCoordinator.withProfileLock({
+      profileId: input.profile.id,
+      hostname: input.profile.hostname,
+      run: async () => {
+        const { sessionId } = await this.sessions.createSessionWithContext(
+          input.profile.contextId,
+        );
+
+        try {
+          return await this.executeEvidenceOnSessionUnlocked({
+            ...input,
+            sessionId,
+          });
+        } finally {
+          await this.closeSession(sessionId);
+        }
+      },
+    });
+  }
+
+  async executeEvidenceOnSession(
+    input: BrowserEvidenceSessionInput,
+  ): Promise<BrowserEvidenceRunResult> {
+    return browserRunCoordinator.withProfileLock({
+      profileId: input.profile.id,
+      hostname: input.profile.hostname,
+      run: () => this.executeEvidenceOnSessionUnlocked(input),
+    });
+  }
+
+  private async executeEvidenceOnSessionUnlocked(
+    input: BrowserEvidenceSessionInput,
+  ): Promise<BrowserEvidenceRunResult> {
+    await input.beforeExecution?.();
+
+    const execution = await executeBrowserEvidence({
+      input,
+      sessions: this.sessions,
+      logger: this.logger,
+    });
+    let uploaded: { screenshotKey: string; screenshotUrl: string } | null =
+      null;
+    try {
+      uploaded = await this.uploadCapturedScreenshot({ input, execution });
+    } catch (err) {
+      this.logger.warn(
+        'Screenshot upload failed; continuing without screenshot',
+        {
+          runId: input.runId,
+          error: err instanceof Error ? err.message : String(err),
+        },
+      );
+      execution.logs.push({
+        timestamp: new Date().toISOString(),
+        stage: 'upload',
+        message: 'Screenshot upload failed; run completed without screenshot.',
+      });
+    }
+
+    if (!execution.success) {
+      return {
+        success: false,
+        status: this.blockedStatusForCode(execution.failureCode),
+        screenshotKey: uploaded?.screenshotKey,
+        screenshotUrl: uploaded?.screenshotUrl,
+        finalUrl: execution.finalUrl,
+        evaluationStatus: execution.evaluationStatus,
+        evaluationReason: execution.evaluationReason,
+        error: execution.error,
+        needsReauth: execution.needsReauth,
+        failureCode: execution.failureCode,
+        failureStage: execution.failureStage,
+        blockedReason: execution.blockedReason,
+        logs: toJsonLogs(execution.logs),
+      };
+    }
+
+    return {
+      success: true,
+      status: 'completed',
+      screenshotKey: uploaded?.screenshotKey,
+      screenshotUrl: uploaded?.screenshotUrl,
+      finalUrl: execution.finalUrl,
+      evaluationStatus: execution.evaluationStatus,
+      evaluationReason: execution.evaluationReason,
+      logs: toJsonLogs(execution.logs),
+    };
+  }
+
+  private async uploadCapturedScreenshot({
+    input,
+    execution,
+  }: {
+    input: BrowserEvidenceRunnerInput;
+    execution: BrowserEvidenceExecutionResult;
+  }): Promise<{ screenshotKey: string; screenshotUrl: string } | null> {
+    if (!execution.screenshot) return null;
+
+    const screenshotKey = await this.screenshots.uploadScreenshot({
+      organizationId: input.organizationId,
+      automationId: input.automationId,
+      runId: input.runId,
+      base64Screenshot: execution.screenshot,
+    });
+    const screenshotUrl = await this.screenshots.getPresignedUrl({
+      key: screenshotKey,
+    });
+
+    return { screenshotKey, screenshotUrl };
+  }
+
+  private async closeSession(sessionId: string): Promise<void> {
+    try {
+      await this.sessions.closeSession(sessionId);
+    } catch (err) {
+      this.logger.warn('Failed to close Browserbase session (ignored)', {
+        sessionId,
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+
+  private blockedStatusForCode(
+    code: BrowserAutomationFailureCode | undefined,
+  ): 'failed' | 'blocked' {
+    if (code === 'captcha_blocked' || code === 'needs_user_action') {
+      return 'blocked';
+    }
+    return 'failed';
+  }
+}
diff --git a/apps/api/src/browserbase/browser-run-coordinator.spec.ts b/apps/api/src/browserbase/browser-run-coordinator.spec.ts
new file mode 100644
index 0000000000..4350a0716d
--- /dev/null
+++ b/apps/api/src/browserbase/browser-run-coordinator.spec.ts
@@ -0,0 +1,71 @@
+import { BrowserRunCoordinator } from './browser-run-coordinator';
+
+describe('BrowserRunCoordinator', () => {
+  it('serializes runs for the same profile', async () => {
+    process.env.BROWSER_AUTOMATION_DOMAIN_THROTTLE_MS = '1';
+    const coordinator = new BrowserRunCoordinator();
+    const events: string[] = [];
+    let releaseFirst: () => void = () => {};
+
+    const first = coordinator.withProfileLock({
+      profileId: 'bap_1',
+      hostname: 'example.com',
+      run: async () => {
+        events.push('first:start');
+        await new Promise<void>((resolve) => {
+          releaseFirst = resolve;
+        });
+        events.push('first:end');
+      },
+    });
+
+    const second = coordinator.withProfileLock({
+      profileId: 'bap_1',
+      hostname: 'example.com',
+      run: async () => {
+        events.push('second:start');
+      },
+    });
+
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(events).toEqual(['first:start']);
+
+    releaseFirst();
+    await Promise.all([first, second]);
+    expect(events).toEqual(['first:start', 'first:end', 'second:start']);
+  });
+
+  it('serializes runs for the same hostname across profiles', async () => {
+    process.env.BROWSER_AUTOMATION_DOMAIN_THROTTLE_MS = '1';
+    const coordinator = new BrowserRunCoordinator();
+    const events: string[] = [];
+    let releaseFirst: () => void = () => {};
+
+    const first = coordinator.withProfileLock({
+      profileId: 'bap_1',
+      hostname: 'example.com',
+      run: async () => {
+        events.push('first:start');
+        await new Promise<void>((resolve) => {
+          releaseFirst = resolve;
+        });
+        events.push('first:end');
+      },
+    });
+
+    const second = coordinator.withProfileLock({
+      profileId: 'bap_2',
+      hostname: 'example.com',
+      run: async () => {
+        events.push('second:start');
+      },
+    });
+
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(events).toEqual(['first:start']);
+
+    releaseFirst();
+    await Promise.all([first, second]);
+    expect(events).toEqual(['first:start', 'first:end', 'second:start']);
+  });
+});
diff --git a/apps/api/src/browserbase/browser-run-coordinator.ts b/apps/api/src/browserbase/browser-run-coordinator.ts
new file mode 100644
index 0000000000..a141386db8
--- /dev/null
+++ b/apps/api/src/browserbase/browser-run-coordinator.ts
@@ -0,0 +1,93 @@
+const DEFAULT_DOMAIN_THROTTLE_MS = 5_000;
+
+const parsePositiveInt = (
+  value: string | undefined,
+  fallback: number,
+): number => {
+  if (!value) return fallback;
+  const parsed = Number.parseInt(value, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+};
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export class BrowserRunCoordinator {
+  private readonly profileLocks = new Map<string, Promise<void>>();
+  private readonly domainLocks = new Map<string, Promise<void>>();
+  private readonly lastDomainRunAt = new Map<string, number>();
+
+  async withProfileLock<T>({
+    profileId,
+    hostname,
+    run,
+  }: {
+    profileId: string;
+    hostname: string;
+    run: () => Promise<T>;
+  }): Promise<T> {
+    const previous = this.profileLocks.get(profileId) ?? Promise.resolve();
+    let release: () => void = () => {};
+    const current = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const chained = previous.then(() => current);
+    this.profileLocks.set(profileId, chained);
+
+    await previous;
+
+    try {
+      return await this.withDomainTurn({ hostname, run });
+    } finally {
+      release();
+      if (this.profileLocks.get(profileId) === chained) {
+        this.profileLocks.delete(profileId);
+      }
+    }
+  }
+
+  private async withDomainTurn<T>({
+    hostname,
+    run,
+  }: {
+    hostname: string;
+    run: () => Promise<T>;
+  }): Promise<T> {
+    const previous = this.domainLocks.get(hostname) ?? Promise.resolve();
+    let release: () => void = () => {};
+    const current = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    const chained = previous.then(() => current);
+    this.domainLocks.set(hostname, chained);
+
+    await previous;
+
+    try {
+      await this.waitForDomainTurn(hostname);
+      return await run();
+    } finally {
+      release();
+      if (this.domainLocks.get(hostname) === chained) {
+        this.domainLocks.delete(hostname);
+      }
+    }
+  }
+
+  private async waitForDomainTurn(hostname: string): Promise<void> {
+    const throttleMs = parsePositiveInt(
+      process.env.BROWSER_AUTOMATION_DOMAIN_THROTTLE_MS,
+      DEFAULT_DOMAIN_THROTTLE_MS,
+    );
+    const now = Date.now();
+    const lastRunAt = this.lastDomainRunAt.get(hostname) ?? 0;
+    const waitMs = Math.max(0, lastRunAt + throttleMs - now);
+
+    if (waitMs > 0) {
+      await delay(waitMs);
+    }
+
+    this.lastDomainRunAt.set(hostname, Date.now());
+  }
+}
+
+export const browserRunCoordinator = new BrowserRunCoordinator();
diff --git a/apps/api/src/browserbase/browserbase-org-context.service.spec.ts b/apps/api/src/browserbase/browserbase-org-context.service.spec.ts
new file mode 100644
index 0000000000..f63756e3e7
--- /dev/null
+++ b/apps/api/src/browserbase/browserbase-org-context.service.spec.ts
@@ -0,0 +1,126 @@
+import { RequestTimeoutException } from '@nestjs/common';
+import { db } from '@db';
+import { BrowserbaseSessionService } from './browserbase-session.service';
+import {
+  BrowserbaseOrgContextService,
+  PENDING_CONTEXT_ID,
+} from './browserbase-org-context.service';
+
+jest.mock('@db', () => ({
+  db: {
+    browserbaseContext: {
+      findUnique: jest.fn(),
+      create: jest.fn(),
+      update: jest.fn(),
+      updateMany: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+  },
+}));
+
+describe('BrowserbaseOrgContextService', () => {
+  let sessions: BrowserbaseSessionService;
+  let service: BrowserbaseOrgContextService;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    sessions = new BrowserbaseSessionService();
+    jest
+      .spyOn(sessions, 'createBrowserbaseContext')
+      .mockResolvedValue('ctx_new');
+    service = new BrowserbaseOrgContextService(sessions);
+  });
+
+  afterEach(() => {
+    jest.useRealTimers();
+  });
+
+  it('throws a request timeout when pending context creation never resolves', async () => {
+    jest.useFakeTimers();
+    const now = new Date('2026-01-01T00:00:00.000Z');
+    jest.setSystemTime(now);
+    (db.browserbaseContext.findUnique as jest.Mock).mockResolvedValue({
+      organizationId: 'org_1',
+      contextId: PENDING_CONTEXT_ID,
+      updatedAt: now,
+    });
+
+    const promise = service.getOrCreateOrgContext('org_1');
+    const expectation = expect(promise).rejects.toBeInstanceOf(
+      RequestTimeoutException,
+    );
+    await jest.advanceTimersByTimeAsync(10_500);
+
+    await expectation;
+    expect(db.browserbaseContext.updateMany).not.toHaveBeenCalled();
+  });
+
+  it('keeps one timeout budget when a missing context row restarts the wait path', async () => {
+    jest.useFakeTimers();
+    const now = new Date('2026-01-01T00:00:00.000Z');
+    jest.setSystemTime(now);
+    (db.browserbaseContext.findUnique as jest.Mock)
+      .mockResolvedValueOnce({
+        organizationId: 'org_1',
+        contextId: PENDING_CONTEXT_ID,
+        updatedAt: now,
+      })
+      .mockResolvedValueOnce(null)
+      .mockResolvedValueOnce(null)
+      .mockResolvedValue({
+        organizationId: 'org_1',
+        contextId: PENDING_CONTEXT_ID,
+        updatedAt: now,
+      });
+    (db.browserbaseContext.create as jest.Mock).mockRejectedValue({
+      code: 'P2002',
+    });
+
+    const promise = service.getOrCreateOrgContext('org_1');
+    const expectation = expect(promise).rejects.toBeInstanceOf(
+      RequestTimeoutException,
+    );
+    await jest.advanceTimersByTimeAsync(10_500);
+
+    await expectation;
+    expect(db.browserbaseContext.create).toHaveBeenCalledTimes(1);
+  });
+
+  it('claims and recovers stale pending context rows', async () => {
+    jest.useFakeTimers();
+    jest.setSystemTime(new Date('2026-01-01T00:02:00.000Z'));
+    (db.browserbaseContext.findUnique as jest.Mock).mockResolvedValue({
+      organizationId: 'org_1',
+      contextId: PENDING_CONTEXT_ID,
+      updatedAt: new Date('2026-01-01T00:00:00.000Z'),
+    });
+    (db.browserbaseContext.updateMany as jest.Mock)
+      .mockResolvedValueOnce({ count: 1 })
+      .mockResolvedValueOnce({ count: 1 });
+
+    const result = await service.getOrCreateOrgContext('org_1');
+
+    expect(result).toEqual({ contextId: 'ctx_new', isNew: true });
+    expect(db.browserbaseContext.create).not.toHaveBeenCalled();
+    expect(db.browserbaseContext.updateMany).toHaveBeenCalledTimes(2);
+    expect(db.browserbaseContext.updateMany).toHaveBeenNthCalledWith(
+      1,
+      expect.objectContaining({
+        where: expect.objectContaining({
+          organizationId: 'org_1',
+          contextId: PENDING_CONTEXT_ID,
+          updatedAt: { lte: new Date('2026-01-01T00:01:00.000Z') },
+        }),
+        data: expect.objectContaining({
+          contextId: expect.stringMatching(/^__PENDING__:/),
+        }),
+      }),
+    );
+    const claimId = (db.browserbaseContext.updateMany as jest.Mock).mock
+      .calls[0][0].data.contextId;
+    expect(db.browserbaseContext.updateMany).toHaveBeenNthCalledWith(2, {
+      where: { organizationId: 'org_1', contextId: claimId },
+      data: { contextId: 'ctx_new' },
+    });
+  });
+});
diff --git a/apps/api/src/browserbase/browserbase-org-context.service.ts b/apps/api/src/browserbase/browserbase-org-context.service.ts
new file mode 100644
index 0000000000..053ca313bd
--- /dev/null
+++ b/apps/api/src/browserbase/browserbase-org-context.service.ts
@@ -0,0 +1,225 @@
+import {
+  ConflictException,
+  Injectable,
+  Logger,
+  RequestTimeoutException,
+} from '@nestjs/common';
+import { randomUUID } from 'node:crypto';
+import { db } from '@db';
+import { BrowserbaseSessionService } from './browserbase-session.service';
+
+export const PENDING_CONTEXT_ID = '__PENDING__';
+const PENDING_CONTEXT_PREFIX = `${PENDING_CONTEXT_ID}:`;
+const ORG_CONTEXT_MAX_WAIT_MS = 10_000;
+const ORG_CONTEXT_POLL_MS = 200;
+const ORG_CONTEXT_STALE_MS = 60_000;
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+export const isPrismaUniqueConstraintError = (error: unknown): boolean => {
+  if (typeof error !== 'object' || error === null) return false;
+  if (!('code' in error)) return false;
+  const code = (error as { code?: unknown }).code;
+  return code === 'P2002';
+};
+
+const isPendingContextId = (contextId: string): boolean =>
+  contextId === PENDING_CONTEXT_ID ||
+  contextId.startsWith(PENDING_CONTEXT_PREFIX);
+
+@Injectable()
+export class BrowserbaseOrgContextService {
+  private readonly logger = new Logger(BrowserbaseOrgContextService.name);
+
+  constructor(
+    private readonly sessions: BrowserbaseSessionService = new BrowserbaseSessionService(),
+  ) {}
+
+  async getOrCreateOrgContext(
+    organizationId: string,
+  ): Promise<{ contextId: string; isNew: boolean }> {
+    return this.getOrCreateOrgContextWithinDeadline({
+      organizationId,
+      deadlineMs: Date.now() + ORG_CONTEXT_MAX_WAIT_MS,
+    });
+  }
+
+  private async getOrCreateOrgContextWithinDeadline(input: {
+    organizationId: string;
+    deadlineMs: number;
+  }): Promise<{ contextId: string; isNew: boolean }> {
+    if (Date.now() >= input.deadlineMs) {
+      this.throwContextTimeout(input.organizationId);
+    }
+
+    const existing = await db.browserbaseContext.findUnique({
+      where: { organizationId: input.organizationId },
+    });
+
+    if (existing && !isPendingContextId(existing.contextId)) {
+      return { contextId: existing.contextId, isNew: false };
+    }
+
+    if (existing) {
+      const claimId = await this.claimStalePendingOrgContext({
+        organizationId: input.organizationId,
+        contextId: existing.contextId,
+        updatedAt: existing.updatedAt,
+      });
+      if (claimId) {
+        return this.createAndStoreOrgContext({
+          organizationId: input.organizationId,
+          pendingContextId: claimId,
+        });
+      }
+      return this.waitForOrgContext(input);
+    }
+
+    try {
+      await db.browserbaseContext.create({
+        data: {
+          organizationId: input.organizationId,
+          contextId: PENDING_CONTEXT_ID,
+        },
+      });
+    } catch (error) {
+      if (!isPrismaUniqueConstraintError(error)) throw error;
+      return this.waitForOrgContext(input);
+    }
+
+    return this.createAndStoreOrgContext({
+      organizationId: input.organizationId,
+      pendingContextId: PENDING_CONTEXT_ID,
+    });
+  }
+
+  async getOrgContext(
+    organizationId: string,
+  ): Promise<{ contextId: string } | null> {
+    const context = await db.browserbaseContext.findUnique({
+      where: { organizationId },
+    });
+    if (!context || isPendingContextId(context.contextId)) return null;
+    return { contextId: context.contextId };
+  }
+
+  private async createAndStoreOrgContext(input: {
+    organizationId: string;
+    pendingContextId: string;
+  }): Promise<{ contextId: string; isNew: boolean }> {
+    try {
+      const contextId = await this.sessions.createBrowserbaseContext();
+      const updated = await db.browserbaseContext.updateMany({
+        where: {
+          organizationId: input.organizationId,
+          contextId: input.pendingContextId,
+        },
+        data: { contextId },
+      });
+      if (updated.count !== 1) {
+        throw new ConflictException(
+          'Browser context initialization was superseded. Please retry.',
+        );
+      }
+      return { contextId, isNew: true };
+    } catch (error) {
+      await this.clearPendingOrgContext({
+        organizationId: input.organizationId,
+        pendingContextId: input.pendingContextId,
+      });
+      throw error;
+    }
+  }
+
+  private async waitForOrgContext(input: {
+    organizationId: string;
+    deadlineMs: number;
+  }): Promise<{ contextId: string; isNew: boolean }> {
+    while (Date.now() < input.deadlineMs) {
+      const current = await db.browserbaseContext.findUnique({
+        where: { organizationId: input.organizationId },
+      });
+
+      if (current && !isPendingContextId(current.contextId)) {
+        return { contextId: current.contextId, isNew: false };
+      }
+
+      if (!current) {
+        return await this.getOrCreateOrgContextWithinDeadline(input);
+      }
+
+      const claimId = await this.claimStalePendingOrgContext({
+        organizationId: input.organizationId,
+        contextId: current.contextId,
+        updatedAt: current.updatedAt,
+      });
+      if (claimId) {
+        return this.createAndStoreOrgContext({
+          organizationId: input.organizationId,
+          pendingContextId: claimId,
+        });
+      }
+      await delay(
+        Math.min(
+          ORG_CONTEXT_POLL_MS,
+          Math.max(0, input.deadlineMs - Date.now()),
+        ),
+      );
+    }
+
+    this.throwContextTimeout(input.organizationId);
+  }
+
+  private throwContextTimeout(organizationId: string): never {
+    this.logger.warn(
+      `Timed out waiting for Browserbase context creation for org ${organizationId}`,
+    );
+    throw new RequestTimeoutException(
+      'Browser context initialization is taking too long. Please retry.',
+    );
+  }
+
+  private async claimStalePendingOrgContext(input: {
+    organizationId: string;
+    contextId: string;
+    updatedAt: Date;
+  }): Promise<string | null> {
+    const staleBefore = new Date(Date.now() - ORG_CONTEXT_STALE_MS);
+    if (input.updatedAt > staleBefore) return null;
+
+    const claimId = `${PENDING_CONTEXT_PREFIX}${randomUUID()}`;
+    const updated = await db.browserbaseContext.updateMany({
+      where: {
+        organizationId: input.organizationId,
+        contextId: input.contextId,
+        updatedAt: { lte: staleBefore },
+      },
+      data: { contextId: claimId },
+    });
+
+    if (updated.count !== 1) return null;
+    this.logger.warn(
+      `Recovering stale Browserbase context initialization for org ${input.organizationId}`,
+    );
+    return claimId;
+  }
+
+  private async clearPendingOrgContext(input: {
+    organizationId: string;
+    pendingContextId: string;
+  }): Promise<void> {
+    try {
+      await db.browserbaseContext.deleteMany({
+        where: {
+          organizationId: input.organizationId,
+          contextId: input.pendingContextId,
+        },
+      });
+    } catch (error) {
+      this.logger.warn('Failed to clear pending Browserbase context', {
+        organizationId: input.organizationId,
+        error: error instanceof Error ? error.message : String(error),
+      });
+    }
+  }
+}
diff --git a/apps/api/src/browserbase/browserbase-screenshot.service.ts b/apps/api/src/browserbase/browserbase-screenshot.service.ts
new file mode 100644
index 0000000000..9f430ad4c7
--- /dev/null
+++ b/apps/api/src/browserbase/browserbase-screenshot.service.ts
@@ -0,0 +1,100 @@
+import { Injectable, NotFoundException } from '@nestjs/common';
+import { GetObjectCommand, PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { BUCKET_NAME, getSignedUrl, s3Client } from '@/app/s3';
+import { db } from '@db';
+
+@Injectable()
+export class BrowserbaseScreenshotService {
+  private get s3Client(): S3Client {
+    if (!s3Client) {
+      throw new Error(
+        'S3 client not configured — set APP_AWS_ACCESS_KEY_ID, APP_AWS_SECRET_ACCESS_KEY, APP_AWS_REGION, APP_AWS_BUCKET_NAME in apps/api/.env',
+      );
+    }
+    return s3Client;
+  }
+
+  private get bucketName(): string {
+    if (!BUCKET_NAME) {
+      throw new Error(
+        'APP_AWS_BUCKET_NAME is not set — configure S3 credentials in apps/api/.env',
+      );
+    }
+    return BUCKET_NAME;
+  }
+
+  async uploadScreenshot({
+    organizationId,
+    automationId,
+    runId,
+    base64Screenshot,
+  }: {
+    organizationId: string;
+    automationId: string;
+    runId: string;
+    base64Screenshot: string;
+  }): Promise<string> {
+    const buffer = Buffer.from(base64Screenshot, 'base64');
+    const key = `browser-automations/${organizationId}/${automationId}/${runId}.jpg`;
+
+    await this.s3Client.send(
+      new PutObjectCommand({
+        Bucket: this.bucketName,
+        Key: key,
+        Body: buffer,
+        ContentType: 'image/jpeg',
+      }),
+    );
+
+    return key;
+  }
+
+  async getPresignedUrl({
+    key,
+    expiresIn,
+    responseContentDisposition,
+  }: {
+    key: string;
+    expiresIn?: number;
+    responseContentDisposition?: string;
+  }): Promise<string> {
+    const command = new GetObjectCommand({
+      Bucket: this.bucketName,
+      Key: key,
+      ResponseContentDisposition: responseContentDisposition,
+    });
+    return getSignedUrl(this.s3Client, command, {
+      expiresIn: expiresIn ?? 3600,
+    });
+  }
+
+  async getScreenshotRedirectUrl(input: {
+    runId: string;
+    organizationId: string;
+    download?: boolean;
+  }): Promise<string> {
+    const { runId, organizationId, download } = input;
+
+    const run = await db.browserAutomationRun.findUnique({
+      where: { id: runId },
+      include: { automation: { include: { task: true } } },
+    });
+
+    if (!run || !run.screenshotUrl) {
+      throw new NotFoundException('Screenshot not found');
+    }
+
+    if (run.automation.task.organizationId !== organizationId) {
+      throw new NotFoundException('Screenshot not found');
+    }
+
+    const responseContentDisposition = download
+      ? `attachment; filename="screenshot-${runId}.jpg"`
+      : undefined;
+
+    return this.getPresignedUrl({
+      key: run.screenshotUrl,
+      responseContentDisposition,
+    });
+  }
+}
diff --git a/apps/api/src/browserbase/browserbase-session.service.spec.ts b/apps/api/src/browserbase/browserbase-session.service.spec.ts
new file mode 100644
index 0000000000..5a1c986dbe
--- /dev/null
+++ b/apps/api/src/browserbase/browserbase-session.service.spec.ts
@@ -0,0 +1,254 @@
+import { ServiceUnavailableException } from '@nestjs/common';
+import Browserbase from '@browserbasehq/sdk';
+import { BrowserbaseSessionService } from './browserbase-session.service';
+import { browserbaseUnavailableException } from './browserbase-upstream-error';
+
+jest.mock('@browserbasehq/sdk', () => ({
+  __esModule: true,
+  default: jest.fn().mockImplementation(() => ({})),
+}));
+
+// Stagehand is loaded via a dynamic ESM import that jest cannot intercept, so
+// tests spy on the loadStagehand() seam and supply a fake constructor instead.
+type StagehandClass = Awaited<
+  ReturnType<BrowserbaseSessionService['loadStagehand']>
+>;
+
+const mockStagehandClass = ({
+  init,
+  close,
+}: {
+  init: jest.Mock;
+  close: jest.Mock;
+}): StagehandClass =>
+  jest.fn().mockImplementation(() => ({ init, close })) as unknown as StagehandClass;
+
+type BrowserbaseClient = ReturnType<
+  BrowserbaseSessionService['getBrowserbase']
+>;
+
+const prematureCloseError = () =>
+  Object.assign(new Error('Invalid response body: Premature close'), {
+    code: 'ERR_STREAM_PREMATURE_CLOSE',
+  });
+
+type MockBrowserbaseClientInput = {
+  createContext?: jest.Mock;
+  createSession?: jest.Mock;
+  debugSession?: jest.Mock;
+  retrieveSession?: jest.Mock;
+  updateSession?: jest.Mock;
+};
+
+const mockBrowserbaseClient = ({
+  createContext = jest.fn(),
+  createSession = jest.fn(),
+  debugSession = jest.fn(),
+  retrieveSession = jest.fn(),
+  updateSession = jest.fn(),
+}: MockBrowserbaseClientInput): BrowserbaseClient =>
+  ({
+    contexts: {
+      create: createContext,
+    },
+    sessions: {
+      create: createSession,
+      debug: debugSession,
+      retrieve: retrieveSession,
+      update: updateSession,
+    },
+  }) as unknown as BrowserbaseClient;
+
+describe('BrowserbaseSessionService', () => {
+  afterEach(() => {
+    jest.useRealTimers();
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
+  });
+
+  it('requests identity encoded Browserbase API responses', () => {
+    const service = new BrowserbaseSessionService();
+
+    service.getBrowserbase();
+
+    expect(jest.mocked(Browserbase)).toHaveBeenCalledWith(
+      expect.objectContaining({
+        defaultHeaders: { 'accept-encoding': 'identity' },
+      }),
+    );
+  });
+
+  it('retries transient Browserbase context creation failures', async () => {
+    jest.useFakeTimers();
+    const service = new BrowserbaseSessionService();
+    const createContext = jest
+      .fn()
+      .mockRejectedValueOnce(prematureCloseError())
+      .mockResolvedValueOnce({ id: 'ctx_1' });
+    jest
+      .spyOn(service, 'getBrowserbase')
+      .mockReturnValue(mockBrowserbaseClient({ createContext }));
+
+    const promise = service.createBrowserbaseContext();
+    await jest.advanceTimersByTimeAsync(250);
+
+    await expect(promise).resolves.toBe('ctx_1');
+    expect(createContext).toHaveBeenCalledTimes(2);
+  });
+
+  it('returns a service unavailable exception after retry exhaustion', async () => {
+    jest.useFakeTimers();
+    const service = new BrowserbaseSessionService();
+    const createContext = jest.fn().mockRejectedValue(prematureCloseError());
+    jest
+      .spyOn(service, 'getBrowserbase')
+      .mockReturnValue(mockBrowserbaseClient({ createContext }));
+
+    const promise = service.createBrowserbaseContext();
+    const expectation = expect(promise).rejects.toBeInstanceOf(
+      ServiceUnavailableException,
+    );
+    await jest.advanceTimersByTimeAsync(1_000);
+
+    await expectation;
+    expect(createContext).toHaveBeenCalledTimes(3);
+  });
+
+  it('preserves non-retryable Browserbase failures', async () => {
+    const service = new BrowserbaseSessionService();
+    const browserbaseError = Object.assign(
+      new Error('Browserbase rejected request'),
+      { status: 400 },
+    );
+    const createContext = jest.fn().mockRejectedValue(browserbaseError);
+    jest
+      .spyOn(service, 'getBrowserbase')
+      .mockReturnValue(mockBrowserbaseClient({ createContext }));
+
+    await expect(service.createBrowserbaseContext()).rejects.toBe(
+      browserbaseError,
+    );
+    expect(createContext).toHaveBeenCalledTimes(1);
+  });
+
+  it('retries transient Browserbase session retrieval failures', async () => {
+    jest.useFakeTimers();
+    const service = new BrowserbaseSessionService();
+    const retrieveSession = jest
+      .fn()
+      .mockRejectedValueOnce(prematureCloseError())
+      .mockResolvedValueOnce({ contextId: 'ctx_1' });
+    jest
+      .spyOn(service, 'getBrowserbase')
+      .mockReturnValue(mockBrowserbaseClient({ retrieveSession }));
+
+    const promise = service.getSessionContextId('session_1');
+    await jest.advanceTimersByTimeAsync(250);
+
+    await expect(promise).resolves.toBe('ctx_1');
+    expect(retrieveSession).toHaveBeenCalledTimes(2);
+    expect(retrieveSession).toHaveBeenCalledWith('session_1');
+  });
+
+  it('retries transient Browserbase live view lookup failures', async () => {
+    jest.useFakeTimers();
+    const service = new BrowserbaseSessionService();
+    const createSession = jest.fn().mockResolvedValue({ id: 'session_1' });
+    const debugSession = jest
+      .fn()
+      .mockRejectedValueOnce(prematureCloseError())
+      .mockResolvedValueOnce({
+        debuggerFullscreenUrl: 'https://live.browserbase.test/session_1',
+      });
+    jest.spyOn(service, 'getBrowserbase').mockReturnValue(
+      mockBrowserbaseClient({
+        createSession,
+        debugSession,
+      }),
+    );
+
+    const promise = service.createSessionWithContext('ctx_1');
+    await jest.advanceTimersByTimeAsync(250);
+
+    await expect(promise).resolves.toEqual({
+      sessionId: 'session_1',
+      liveViewUrl: 'https://live.browserbase.test/session_1',
+    });
+    expect(createSession).toHaveBeenCalledTimes(1);
+    expect(debugSession).toHaveBeenCalledTimes(2);
+  });
+
+  it('retries transient Stagehand init failures', async () => {
+    jest.useFakeTimers();
+    const service = new BrowserbaseSessionService();
+    const init = jest
+      .fn()
+      .mockRejectedValueOnce(prematureCloseError())
+      .mockResolvedValueOnce(undefined);
+    const close = jest.fn().mockResolvedValue(undefined);
+    const StagehandCtor = mockStagehandClass({ init, close });
+    jest.spyOn(service, 'loadStagehand').mockResolvedValue(StagehandCtor);
+
+    const promise = service.createStagehand('session_1');
+    await jest.advanceTimersByTimeAsync(250);
+
+    await expect(promise).resolves.toEqual({ init, close });
+    expect(StagehandCtor).toHaveBeenCalledTimes(2);
+    expect(init).toHaveBeenCalledTimes(2);
+    // The partially-initialized instance is closed before retrying.
+    expect(close).toHaveBeenCalledTimes(1);
+  });
+
+  it('throws a service unavailable exception after Stagehand init retry exhaustion', async () => {
+    jest.useFakeTimers();
+    const service = new BrowserbaseSessionService();
+    const init = jest.fn().mockRejectedValue(prematureCloseError());
+    const close = jest.fn().mockResolvedValue(undefined);
+    jest
+      .spyOn(service, 'loadStagehand')
+      .mockResolvedValue(mockStagehandClass({ init, close }));
+
+    const promise = service.createStagehand('session_1');
+    const expectation = expect(promise).rejects.toBeInstanceOf(
+      ServiceUnavailableException,
+    );
+    await jest.advanceTimersByTimeAsync(1_000);
+
+    await expectation;
+    expect(init).toHaveBeenCalledTimes(3);
+    expect(close).toHaveBeenCalledTimes(3);
+  });
+
+  it('preserves non-retryable Stagehand init failures', async () => {
+    const service = new BrowserbaseSessionService();
+    const sessionNotFound = Object.assign(new Error('Session not found'), {
+      status: 404,
+    });
+    const init = jest.fn().mockRejectedValue(sessionNotFound);
+    const close = jest.fn().mockResolvedValue(undefined);
+    jest
+      .spyOn(service, 'loadStagehand')
+      .mockResolvedValue(mockStagehandClass({ init, close }));
+
+    await expect(service.createStagehand('session_1')).rejects.toBe(
+      sessionNotFound,
+    );
+    expect(init).toHaveBeenCalledTimes(1);
+    // Even a non-retryable failure closes the partial instance.
+    expect(close).toHaveBeenCalledTimes(1);
+  });
+
+  it('navigateToUrl returns the friendly unavailable message when init keeps failing', async () => {
+    const service = new BrowserbaseSessionService();
+    jest
+      .spyOn(service, 'createStagehand')
+      .mockRejectedValue(browserbaseUnavailableException());
+
+    await expect(
+      service.navigateToUrl('session_1', 'https://github.com'),
+    ).resolves.toEqual({
+      success: false,
+      error: 'Browserbase is temporarily unavailable. Please retry in a moment.',
+    });
+  });
+});
diff --git a/apps/api/src/browserbase/browserbase-session.service.ts b/apps/api/src/browserbase/browserbase-session.service.ts
new file mode 100644
index 0000000000..df858f8efd
--- /dev/null
+++ b/apps/api/src/browserbase/browserbase-session.service.ts
@@ -0,0 +1,313 @@
+import { Injectable, Logger } from '@nestjs/common';
+import Browserbase from '@browserbasehq/sdk';
+import { z } from 'zod';
+import {
+  browserbaseUnavailableException,
+  getBrowserbaseErrorText,
+  isRetryableBrowserbaseUpstreamError,
+} from './browserbase-upstream-error';
+import { isNoPageError } from './run-error-formatter';
+
+type Stagehand = import('@browserbasehq/stagehand').Stagehand;
+
+const BROWSER_WIDTH = 1440;
+const BROWSER_HEIGHT = 900;
+const STAGEHAND_MODEL = 'anthropic/claude-sonnet-4-6';
+const BROWSERBASE_API_MAX_ATTEMPTS = 3;
+const BROWSERBASE_RETRY_DELAYS_MS = [250, 750];
+const BROWSERBASE_DEFAULT_HEADERS = { 'accept-encoding': 'identity' };
+
+const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
+
+@Injectable()
+export class BrowserbaseSessionService {
+  private readonly logger = new Logger(BrowserbaseSessionService.name);
+
+  getBrowserbase() {
+    return new Browserbase({
+      apiKey: process.env.BROWSERBASE_API_KEY,
+      defaultHeaders: BROWSERBASE_DEFAULT_HEADERS,
+    });
+  }
+
+  getProjectId() {
+    return process.env.BROWSERBASE_PROJECT_ID || '';
+  }
+
+  async createBrowserbaseContext(): Promise<string> {
+    return this.withBrowserbaseRetry({
+      operationName: 'context creation',
+      operation: async () => {
+        const context = await this.getBrowserbase().contexts.create({
+          projectId: this.getProjectId(),
+        });
+        return context.id;
+      },
+    });
+  }
+
+  async createSessionWithContext(
+    contextId: string,
+  ): Promise<{ sessionId: string; liveViewUrl: string }> {
+    const bb = this.getBrowserbase();
+
+    const session = await this.withBrowserbaseRetry({
+      operationName: 'session creation',
+      operation: () =>
+        bb.sessions.create({
+          projectId: this.getProjectId(),
+          browserSettings: {
+            context: {
+              id: contextId,
+              persist: true,
+            },
+            fingerprint: {
+              screen: {
+                maxHeight: BROWSER_HEIGHT,
+                maxWidth: BROWSER_WIDTH,
+                minHeight: BROWSER_HEIGHT,
+                minWidth: BROWSER_WIDTH,
+              },
+            },
+            viewport: { width: BROWSER_WIDTH, height: BROWSER_HEIGHT },
+          },
+          keepAlive: true,
+        }),
+    });
+
+    try {
+      const debug = await this.withBrowserbaseRetry({
+        operationName: 'session debug URL lookup',
+        operation: () => bb.sessions.debug(session.id),
+      });
+
+      return {
+        sessionId: session.id,
+        liveViewUrl: debug.debuggerFullscreenUrl,
+      };
+    } catch (error) {
+      try {
+        await this.closeSession(session.id);
+      } catch {
+        // Ignore best-effort cleanup errors after a failed live-view lookup.
+      }
+      throw error;
+    }
+  }
+
+  async closeSession(sessionId: string): Promise<void> {
+    await this.withBrowserbaseRetry({
+      operationName: 'session close',
+      operation: () =>
+        this.getBrowserbase().sessions.update(sessionId, {
+          projectId: this.getProjectId(),
+          status: 'REQUEST_RELEASE',
+        }),
+    });
+  }
+
+  async getSessionContextId(sessionId: string): Promise<string | undefined> {
+    const session = await this.withBrowserbaseRetry({
+      operationName: 'session retrieval',
+      operation: () => this.getBrowserbase().sessions.retrieve(sessionId),
+    });
+    return session.contextId;
+  }
+
+  private async withBrowserbaseRetry<T>({
+    operation,
+    operationName,
+  }: {
+    operation: () => Promise<T>;
+    operationName: string;
+  }): Promise<T> {
+    for (
+      let attempt = 1;
+      attempt <= BROWSERBASE_API_MAX_ATTEMPTS;
+      attempt += 1
+    ) {
+      try {
+        return await operation();
+      } catch (error) {
+        const retryable = isRetryableBrowserbaseUpstreamError(error);
+        if (!retryable) {
+          this.logger.error(`Browserbase ${operationName} failed`, {
+            attempt,
+            error: getBrowserbaseErrorText(error),
+          });
+          throw error;
+        }
+
+        if (attempt === BROWSERBASE_API_MAX_ATTEMPTS) {
+          this.logger.error(`Browserbase ${operationName} failed`, {
+            attempt,
+            error: getBrowserbaseErrorText(error),
+          });
+          throw browserbaseUnavailableException();
+        }
+
+        this.logger.warn(`Browserbase ${operationName} failed; retrying`, {
+          attempt,
+          error: getBrowserbaseErrorText(error),
+        });
+        await delay(BROWSERBASE_RETRY_DELAYS_MS[attempt - 1] ?? 1000);
+      }
+    }
+
+    throw browserbaseUnavailableException();
+  }
+
+  async loadStagehand(): Promise<
+    typeof import('@browserbasehq/stagehand').Stagehand
+  > {
+    const { Stagehand } = await import('@browserbasehq/stagehand');
+    return Stagehand;
+  }
+
+  async createStagehand(sessionId: string): Promise<Stagehand> {
+    const Stagehand = await this.loadStagehand();
+
+    // Stagehand.init() resumes the session by calling the Browserbase API on
+    // its own internal SDK client (outside getBrowserbase()), so transient
+    // upstream failures there — e.g. "Premature close" — bypass the per-call
+    // retry that wraps our direct SDK calls. Retry init the same way, closing
+    // any half-initialized instance between attempts so we don't leak it.
+    return this.withBrowserbaseRetry({
+      operationName: 'stagehand initialization',
+      operation: async () => {
+        const stagehand = new Stagehand({
+          env: 'BROWSERBASE',
+          apiKey: process.env.BROWSERBASE_API_KEY,
+          projectId: this.getProjectId(),
+          browserbaseSessionID: sessionId,
+          model: {
+            modelName: STAGEHAND_MODEL,
+            apiKey: process.env.ANTHROPIC_API_KEY,
+          },
+          verbose: 1,
+        });
+
+        try {
+          await stagehand.init();
+          return stagehand;
+        } catch (error) {
+          // keepAlive:true means close() will not end the Browserbase session,
+          // so the next attempt can resume the same sessionId.
+          await this.safeCloseStagehand(stagehand);
+          throw error;
+        }
+      },
+    });
+  }
+
+  async safeCloseStagehand(stagehand: Stagehand): Promise<void> {
+    try {
+      await stagehand.close();
+    } catch (err) {
+      this.logger.warn('Failed to close stagehand (ignored)', {
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+  }
+
+  async ensureActivePage(stagehand: Stagehand) {
+    const maxWaitMs = 5_000;
+    const pollMs = 250;
+    const startedAt = Date.now();
+
+    while (Date.now() - startedAt < maxWaitMs) {
+      const page = stagehand.context.pages().find((candidate) => {
+        const maybePage = candidate as { isClosed?: () => boolean };
+        return maybePage.isClosed ? !maybePage.isClosed() : true;
+      });
+      if (page) return page;
+      await delay(pollMs);
+    }
+
+    return await stagehand.context.newPage();
+  }
+
+  async navigateToUrl(
+    sessionId: string,
+    url: string,
+  ): Promise<{ success: boolean; error?: string }> {
+    let stagehand: Stagehand | null = null;
+
+    try {
+      stagehand = await this.createStagehand(sessionId);
+      const page = await this.ensureActivePage(stagehand);
+
+      await page.sendCDP('WebAuthn.enable');
+      await page.sendCDP('WebAuthn.addVirtualAuthenticator', {
+        options: {
+          protocol: 'ctap2',
+          transport: 'internal',
+          hasResidentKey: true,
+          hasUserVerification: true,
+          isUserVerified: true,
+          automaticPresenceSimulation: true,
+        },
+      });
+
+      await page.goto(url, {
+        waitUntil: 'domcontentloaded',
+        timeoutMs: 30000,
+      });
+
+      return { success: true };
+    } catch (err) {
+      this.logger.error('Failed to navigate to URL', err);
+      return {
+        success: false,
+        error: err instanceof Error ? err.message : 'Unknown error',
+      };
+    } finally {
+      if (stagehand) {
+        await this.safeCloseStagehand(stagehand);
+      }
+    }
+  }
+
+  async checkLoginStatus(
+    sessionId: string,
+    url: string,
+  ): Promise<{ isLoggedIn: boolean; username?: string }> {
+    const stagehand = await this.createStagehand(sessionId);
+
+    try {
+      const page = await this.ensureActivePage(stagehand);
+
+      await page.goto(url, {
+        waitUntil: 'domcontentloaded',
+        timeoutMs: 30000,
+      });
+      await delay(1500);
+
+      const loginSchema = z.object({
+        isLoggedIn: z
+          .boolean()
+          .describe('Whether the user is currently logged in to this site'),
+        username: z.string().optional().describe('The username if logged in'),
+      });
+
+      const result = await stagehand.extract(
+        'Check if the user is logged in to this website. Look for a user avatar, profile menu, or account dropdown in the header/navigation. If logged in, extract the username if visible.',
+        loginSchema,
+      );
+
+      return {
+        isLoggedIn: result.isLoggedIn,
+        username: result.username,
+      };
+    } catch (err) {
+      if (isNoPageError(err)) {
+        throw new Error(
+          'Browser session ended before we could verify login status. Please retry.',
+        );
+      }
+      throw err;
+    } finally {
+      await this.safeCloseStagehand(stagehand);
+    }
+  }
+}
diff --git a/apps/api/src/browserbase/browserbase-upstream-error.spec.ts b/apps/api/src/browserbase/browserbase-upstream-error.spec.ts
new file mode 100644
index 0000000000..0cb3eaa288
--- /dev/null
+++ b/apps/api/src/browserbase/browserbase-upstream-error.spec.ts
@@ -0,0 +1,29 @@
+import { ServiceUnavailableException } from '@nestjs/common';
+import {
+  browserbaseUnavailableException,
+  isRetryableBrowserbaseUpstreamError,
+} from './browserbase-upstream-error';
+
+describe('browserbase upstream errors', () => {
+  it('treats premature close as retryable', () => {
+    const error = Object.assign(new Error('Premature close'), {
+      code: 'ERR_STREAM_PREMATURE_CLOSE',
+      errno: 'ERR_STREAM_PREMATURE_CLOSE',
+    });
+
+    expect(isRetryableBrowserbaseUpstreamError(error)).toBe(true);
+  });
+
+  it('treats upstream 5xx responses as retryable', () => {
+    expect(isRetryableBrowserbaseUpstreamError({ status: 502 })).toBe(true);
+  });
+
+  it('uses a stable request-facing unavailable exception', () => {
+    const error = browserbaseUnavailableException();
+
+    expect(error).toBeInstanceOf(ServiceUnavailableException);
+    expect(error.message).toBe(
+      'Browserbase is temporarily unavailable. Please retry in a moment.',
+    );
+  });
+});
diff --git a/apps/api/src/browserbase/browserbase-upstream-error.ts b/apps/api/src/browserbase/browserbase-upstream-error.ts
new file mode 100644
index 0000000000..ed054baa8c
--- /dev/null
+++ b/apps/api/src/browserbase/browserbase-upstream-error.ts
@@ -0,0 +1,71 @@
+import { ServiceUnavailableException } from '@nestjs/common';
+
+const RETRYABLE_ERROR_CODES = new Set([
+  'ECONNRESET',
+  'ETIMEDOUT',
+  'EAI_AGAIN',
+  'ERR_STREAM_PREMATURE_CLOSE',
+]);
+
+const RETRYABLE_MESSAGE_PARTS = [
+  'premature close',
+  'socket hang up',
+  'fetch failed',
+  'network timeout',
+  'timeout',
+  'temporarily unavailable',
+];
+
+const readStringProperty = ({
+  value,
+  property,
+}: {
+  value: unknown;
+  property: string;
+}): string | undefined => {
+  if (typeof value !== 'object' || value === null) return undefined;
+  if (!(property in value)) return undefined;
+  const propertyValue = (value as Record<string, unknown>)[property];
+  return typeof propertyValue === 'string' ? propertyValue : undefined;
+};
+
+const readNumberProperty = ({
+  value,
+  property,
+}: {
+  value: unknown;
+  property: string;
+}): number | undefined => {
+  if (typeof value !== 'object' || value === null) return undefined;
+  if (!(property in value)) return undefined;
+  const propertyValue = (value as Record<string, unknown>)[property];
+  return typeof propertyValue === 'number' ? propertyValue : undefined;
+};
+
+export const getBrowserbaseErrorText = (error: unknown): string => {
+  if (error instanceof Error) return error.message;
+  if (typeof error === 'string') return error;
+  return String(error);
+};
+
+export const isRetryableBrowserbaseUpstreamError = (
+  error: unknown,
+): boolean => {
+  const code =
+    readStringProperty({ value: error, property: 'code' }) ??
+    readStringProperty({ value: error, property: 'errno' });
+  if (code && RETRYABLE_ERROR_CODES.has(code)) return true;
+
+  const status =
+    readNumberProperty({ value: error, property: 'status' }) ??
+    readNumberProperty({ value: error, property: 'statusCode' });
+  if (status && (status === 429 || status >= 500)) return true;
+
+  const message = getBrowserbaseErrorText(error).toLowerCase();
+  return RETRYABLE_MESSAGE_PARTS.some((part) => message.includes(part));
+};
+
+export const browserbaseUnavailableException = () =>
+  new ServiceUnavailableException(
+    'Browserbase is temporarily unavailable. Please retry in a moment.',
+  );
diff --git a/apps/api/src/browserbase/browserbase-url.ts b/apps/api/src/browserbase/browserbase-url.ts
new file mode 100644
index 0000000000..9bf2def94f
--- /dev/null
+++ b/apps/api/src/browserbase/browserbase-url.ts
@@ -0,0 +1,12 @@
+export function normalizeHostnameFromUrl(url: string): string {
+  const parsed = new URL(url);
+  return parsed.hostname.toLowerCase().replace(/\.$/, '');
+}
+
+export function defaultProfileDisplayName(hostname: string): string {
+  return `${hostname} browser profile`;
+}
+
+export function normalizeLoginIdentity(loginIdentity?: string | null): string {
+  return loginIdentity?.trim().toLowerCase() ?? '';
+}
diff --git a/apps/api/src/browserbase/browserbase.controller.ts b/apps/api/src/browserbase/browserbase.controller.ts
index a0c7047fee..a02d1fb69c 100644
--- a/apps/api/src/browserbase/browserbase.controller.ts
+++ b/apps/api/src/browserbase/browserbase.controller.ts
@@ -13,6 +13,7 @@ import {
 import type { Response } from 'express';
 import {
   ApiOperation,
+  ApiBody,
   ApiParam,
   ApiResponse,
   ApiSecurity,
@@ -32,6 +33,7 @@ import {
   ContextResponseDto,
   CreateBrowserAutomationDto,
   CreateSessionDto,
+  ExecuteAutomationSessionDto,
   NavigateToUrlDto,
   RunAutomationResponseDto,
   SessionResponseDto,
@@ -171,10 +173,12 @@ export class BrowserbaseController {
     type: BrowserAutomationResponseDto,
   })
   async createAutomation(
+    @OrganizationId() organizationId: string,
     @Body() dto: CreateBrowserAutomationDto,
   ): Promise<BrowserAutomationResponseDto> {
     return (await this.browserbaseService.createBrowserAutomation(
       dto,
+      organizationId,
     )) as BrowserAutomationResponseDto;
   }
 
@@ -191,9 +195,11 @@ export class BrowserbaseController {
   })
   async getAutomationsForTask(
     @Param('taskId') taskId: string,
+    @OrganizationId() organizationId: string,
   ): Promise<BrowserAutomationResponseDto[]> {
     return (await this.browserbaseService.getAutomationsWithPresignedUrls(
       taskId,
+      organizationId,
     )) as BrowserAutomationResponseDto[];
   }
 
@@ -210,9 +216,11 @@ export class BrowserbaseController {
   })
   async getAutomation(
     @Param('automationId') automationId: string,
+    @OrganizationId() organizationId: string,
   ): Promise<BrowserAutomationResponseDto | null> {
     return (await this.browserbaseService.getBrowserAutomation(
       automationId,
+      organizationId,
     )) as BrowserAutomationResponseDto | null;
   }
 
@@ -229,11 +237,13 @@ export class BrowserbaseController {
   })
   async updateAutomation(
     @Param('automationId') automationId: string,
+    @OrganizationId() organizationId: string,
     @Body() dto: UpdateBrowserAutomationDto,
   ): Promise<BrowserAutomationResponseDto> {
     return (await this.browserbaseService.updateBrowserAutomation(
       automationId,
       dto,
+      organizationId,
     )) as BrowserAutomationResponseDto;
   }
 
@@ -249,8 +259,12 @@ export class BrowserbaseController {
   })
   async deleteAutomation(
     @Param('automationId') automationId: string,
+    @OrganizationId() organizationId: string,
   ): Promise<{ success: boolean }> {
-    await this.browserbaseService.deleteBrowserAutomation(automationId);
+    await this.browserbaseService.deleteBrowserAutomation(
+      automationId,
+      organizationId,
+    );
     return { success: true };
   }
 
@@ -291,13 +305,14 @@ export class BrowserbaseController {
     description: 'Runs the automation on a pre-created session',
   })
   @ApiParam({ name: 'automationId', description: 'Automation ID' })
+  @ApiBody({ type: ExecuteAutomationSessionDto })
   @ApiResponse({
     status: 200,
     description: 'Execution result',
   })
   async executeAutomationOnSession(
     @Param('automationId') automationId: string,
-    @Body() body: { runId: string; sessionId: string },
+    @Body() body: ExecuteAutomationSessionDto,
     @OrganizationId() organizationId: string,
   ): Promise<{
     success: boolean;
@@ -350,9 +365,12 @@ export class BrowserbaseController {
   })
   async getAutomationRuns(
     @Param('automationId') automationId: string,
+    @OrganizationId() organizationId: string,
   ): Promise<BrowserAutomationRunResponseDto[]> {
     return (await this.browserbaseService.getAutomationRuns(
       automationId,
+      20,
+      organizationId,
     )) as BrowserAutomationRunResponseDto[];
   }
 
@@ -369,9 +387,11 @@ export class BrowserbaseController {
   })
   async getRunById(
     @Param('runId') runId: string,
+    @OrganizationId() organizationId: string,
   ): Promise<BrowserAutomationRunResponseDto | null> {
     return (await this.browserbaseService.getRunWithPresignedUrl(
       runId,
+      organizationId,
     )) as BrowserAutomationRunResponseDto | null;
   }
 
diff --git a/apps/api/src/browserbase/browserbase.module.ts b/apps/api/src/browserbase/browserbase.module.ts
index 9dfec69375..f0497ab123 100644
--- a/apps/api/src/browserbase/browserbase.module.ts
+++ b/apps/api/src/browserbase/browserbase.module.ts
@@ -1,12 +1,33 @@
 import { Module } from '@nestjs/common';
+import { BrowserAutomationCrudService } from './browser-automation-crud.service';
+import { BrowserAutomationExecutionService } from './browser-automation-execution.service';
+import { BrowserAutomationRunStoreService } from './browser-automation-run-store.service';
+import { BrowserAuthProfilesController } from './browser-auth-profiles.controller';
+import { BrowserAuthProfileContextService } from './browser-auth-profile-context.service';
+import { BrowserAuthProfileService } from './browser-auth-profile.service';
+import { BrowserEvidenceRunnerService } from './browser-evidence-runner.service';
 import { BrowserbaseController } from './browserbase.controller';
+import { BrowserbaseOrgContextService } from './browserbase-org-context.service';
+import { BrowserbaseScreenshotService } from './browserbase-screenshot.service';
+import { BrowserbaseSessionService } from './browserbase-session.service';
 import { BrowserbaseService } from './browserbase.service';
 import { AuthModule } from '../auth/auth.module';
 
 @Module({
   imports: [AuthModule],
-  controllers: [BrowserbaseController],
-  providers: [BrowserbaseService],
+  controllers: [BrowserbaseController, BrowserAuthProfilesController],
+  providers: [
+    BrowserbaseService,
+    BrowserbaseSessionService,
+    BrowserAutomationCrudService,
+    BrowserAutomationExecutionService,
+    BrowserAutomationRunStoreService,
+    BrowserAuthProfileContextService,
+    BrowserAuthProfileService,
+    BrowserbaseOrgContextService,
+    BrowserbaseScreenshotService,
+    BrowserEvidenceRunnerService,
+  ],
   exports: [BrowserbaseService],
 })
 export class BrowserbaseModule {}
diff --git a/apps/api/src/browserbase/browserbase.service.spec.ts b/apps/api/src/browserbase/browserbase.service.spec.ts
index 7f8cdba32f..29d21ee2f0 100644
--- a/apps/api/src/browserbase/browserbase.service.spec.ts
+++ b/apps/api/src/browserbase/browserbase.service.spec.ts
@@ -1,6 +1,15 @@
 // apps/api/src/browserbase/browserbase.service.spec.ts
 import { Test } from '@nestjs/testing';
 import { NotFoundException } from '@nestjs/common';
+import { BrowserAutomationCrudService } from './browser-automation-crud.service';
+import { BrowserAutomationExecutionService } from './browser-automation-execution.service';
+import { BrowserAutomationRunStoreService } from './browser-automation-run-store.service';
+import { BrowserAuthProfileContextService } from './browser-auth-profile-context.service';
+import { BrowserAuthProfileService } from './browser-auth-profile.service';
+import { BrowserEvidenceRunnerService } from './browser-evidence-runner.service';
+import { BrowserbaseOrgContextService } from './browserbase-org-context.service';
+import { BrowserbaseScreenshotService } from './browserbase-screenshot.service';
+import { BrowserbaseSessionService } from './browserbase-session.service';
 import { BrowserbaseService } from './browserbase.service';
 
 jest.mock('@db', () => ({
@@ -37,7 +46,18 @@ describe('BrowserbaseService.getScreenshotRedirectUrl', () => {
   beforeEach(async () => {
     jest.clearAllMocks();
     const moduleRef = await Test.createTestingModule({
-      providers: [BrowserbaseService],
+      providers: [
+        BrowserbaseService,
+        BrowserbaseSessionService,
+        BrowserAutomationCrudService,
+        BrowserAutomationExecutionService,
+        BrowserAutomationRunStoreService,
+        BrowserAuthProfileContextService,
+        BrowserAuthProfileService,
+        BrowserbaseOrgContextService,
+        BrowserbaseScreenshotService,
+        BrowserEvidenceRunnerService,
+      ],
     }).compile();
     service = moduleRef.get(BrowserbaseService);
   });
@@ -144,7 +164,18 @@ describe('BrowserbaseService schedule frequency passthrough', () => {
   beforeEach(async () => {
     jest.clearAllMocks();
     const moduleRef = await Test.createTestingModule({
-      providers: [BrowserbaseService],
+      providers: [
+        BrowserbaseService,
+        BrowserbaseSessionService,
+        BrowserAutomationCrudService,
+        BrowserAutomationExecutionService,
+        BrowserAutomationRunStoreService,
+        BrowserAuthProfileContextService,
+        BrowserAuthProfileService,
+        BrowserbaseOrgContextService,
+        BrowserbaseScreenshotService,
+        BrowserEvidenceRunnerService,
+      ],
     }).compile();
     service = moduleRef.get(BrowserbaseService);
   });
diff --git a/apps/api/src/browserbase/browserbase.service.ts b/apps/api/src/browserbase/browserbase.service.ts
index da81adadea..696133553f 100644
--- a/apps/api/src/browserbase/browserbase.service.ts
+++ b/apps/api/src/browserbase/browserbase.service.ts
@@ -1,403 +1,117 @@
-import { Injectable, Logger, NotFoundException } from '@nestjs/common';
-import Browserbase from '@browserbasehq/sdk';
-// Lazy-imported in createStagehand() to avoid Node v25 crash
-// (SlowBuffer.prototype was removed — @browserbasehq/stagehand bundles buffer-equal-constant-time which uses it)
-type Stagehand = import('@browserbasehq/stagehand').Stagehand;
-import { db, TaskFrequency } from '@db';
-import { z } from 'zod';
-import {
-  GetObjectCommand,
-  PutObjectCommand,
-  S3Client,
-} from '@aws-sdk/client-s3';
-import { BUCKET_NAME, getSignedUrl, s3Client } from '@/app/s3';
-import { renderOverlay } from './screenshot-overlay';
-import { isNoPageError, toRunErrorMessage } from './run-error-formatter';
-
-const BROWSER_WIDTH = 1440;
-const BROWSER_HEIGHT = 900;
-
-/** Stagehand v3 requires 'provider/model' format. */
-const STAGEHAND_MODEL = 'anthropic/claude-sonnet-4-6';
-const STAGEHAND_CUA_MODEL = 'anthropic/claude-sonnet-4-6';
-
-const delay = (ms: number) => new Promise((resolve) => setTimeout(resolve, ms));
-
-const PENDING_CONTEXT_ID = '__PENDING__';
-
-/** Empty strings become null; any actual text is trimmed and kept. */
-const normalizeCriteria = (value: string | null | undefined): string | null => {
-  if (value == null) return null;
-  const trimmed = value.trim();
-  return trimmed.length === 0 ? null : trimmed;
-};
-
-const isPrismaUniqueConstraintError = (error: unknown): boolean => {
-  if (typeof error !== 'object' || error === null) return false;
-  if (!('code' in error)) return false;
-  const code = (error as { code?: unknown }).code;
-  return code === 'P2002';
-};
+import { Injectable } from '@nestjs/common';
+import { TaskFrequency } from '@db';
+import { BrowserAutomationCrudService } from './browser-automation-crud.service';
+import { BrowserAutomationExecutionService } from './browser-automation-execution.service';
+import { BrowserAuthProfileService } from './browser-auth-profile.service';
+import { BrowserEvidenceRunnerService } from './browser-evidence-runner.service';
+import { BrowserbaseScreenshotService } from './browserbase-screenshot.service';
+import { BrowserbaseSessionService } from './browserbase-session.service';
+import { normalizeHostnameFromUrl } from './browserbase-url';
 
 @Injectable()
 export class BrowserbaseService {
-  private readonly logger = new Logger(BrowserbaseService.name);
-
-  private get s3Client(): S3Client {
-    if (!s3Client) {
-      throw new Error(
-        'S3 client not configured — set APP_AWS_ACCESS_KEY_ID, APP_AWS_SECRET_ACCESS_KEY, APP_AWS_REGION, APP_AWS_BUCKET_NAME in apps/api/.env',
-      );
-    }
-    return s3Client;
+  constructor(
+    private readonly sessions: BrowserbaseSessionService = new BrowserbaseSessionService(),
+    private readonly profiles: BrowserAuthProfileService = new BrowserAuthProfileService(
+      sessions,
+    ),
+    private readonly screenshots: BrowserbaseScreenshotService = new BrowserbaseScreenshotService(),
+    private readonly runner: BrowserEvidenceRunnerService = new BrowserEvidenceRunnerService(
+      sessions,
+      screenshots,
+    ),
+    private readonly automationCrud: BrowserAutomationCrudService = new BrowserAutomationCrudService(
+      screenshots,
+    ),
+    private readonly automationExecution: BrowserAutomationExecutionService =
+      new BrowserAutomationExecutionService(sessions, profiles, runner),
+  ) {}
+
+  async listAuthProfiles(organizationId: string) {
+    return this.profiles.listProfiles(organizationId);
+  }
+
+  async getOrCreateAuthProfile(input: {
+    organizationId: string;
+    url: string;
+    displayName?: string;
+    loginIdentity?: string;
+    vaultProvider?: string;
+    vaultExternalItemRef?: string;
+    vaultConnectionId?: string;
+  }) {
+    return this.profiles.getOrCreateProfileFromUrl(input);
   }
 
-  private get bucketName(): string {
-    if (!BUCKET_NAME) {
-      throw new Error(
-        'APP_AWS_BUCKET_NAME is not set — configure S3 credentials in apps/api/.env',
-      );
-    }
-    return BUCKET_NAME;
+  async startAuthProfileSession(input: {
+    organizationId: string;
+    profileId: string;
+  }) {
+    return this.profiles.startProfileSession(input);
   }
 
-  private getBrowserbase() {
-    return new Browserbase({
-      apiKey: process.env.BROWSERBASE_API_KEY,
-    });
+  async verifyAuthProfileSession(input: {
+    organizationId: string;
+    profileId: string;
+    sessionId: string;
+    url: string;
+  }) {
+    return this.profiles.verifyProfileSession(input);
   }
 
-  private getProjectId() {
-    return process.env.BROWSERBASE_PROJECT_ID || '';
+  async markAuthProfileNeedsReauth(input: {
+    organizationId: string;
+    profileId: string;
+    reason?: string;
+  }) {
+    return this.profiles.markNeedsReauth(input);
   }
 
-  /**
-   * Stagehand sometimes has no active page (or the page gets closed mid-run),
-   * which causes errors like: "No Page found for awaitActivePage: no page available".
-   * Ensure there's at least one non-closed page available, and create one if needed.
-   */
-  private async ensureActivePage(stagehand: Stagehand) {
-    const MAX_WAIT_MS = 5000;
-    const POLL_MS = 250;
-    const startedAt = Date.now();
-
-    while (Date.now() - startedAt < MAX_WAIT_MS) {
-      // Stagehand's Page type doesn't always expose Playwright's `isClosed()` in typings.
-      // We still want to filter out closed pages at runtime when possible.
-      const pages = stagehand.context.pages().filter((p) => {
-        const maybeIsClosed = (p as { isClosed?: () => boolean }).isClosed;
-        return typeof maybeIsClosed === 'function' ? !maybeIsClosed() : true;
-      });
-      if (pages[0]) return pages[0];
-      await delay(POLL_MS);
-    }
-
-    // Last resort: create a page (may still fail if the CDP session already died)
-    return await stagehand.context.newPage();
+  async getOrCreateOrgContext(organizationId: string) {
+    return this.profiles.getOrCreateOrgContext(organizationId);
   }
 
-  // ===== Organization Context Management =====
-
-  async getOrCreateOrgContext(
-    organizationId: string,
-  ): Promise<{ contextId: string; isNew: boolean }> {
-    // Fast path: already created
-    const existing = await db.browserbaseContext.findUnique({
-      where: { organizationId },
-    });
-
-    if (existing && existing.contextId !== PENDING_CONTEXT_ID) {
-      return { contextId: existing.contextId, isNew: false };
-    }
-
-    try {
-      await db.browserbaseContext.create({
-        data: {
-          organizationId,
-          contextId: PENDING_CONTEXT_ID,
-        },
-      });
-
-      const bb = this.getBrowserbase();
-      const context = await bb.contexts.create({
-        projectId: this.getProjectId(),
-      });
-
-      await db.browserbaseContext.update({
-        where: { organizationId },
-        data: { contextId: context.id },
-      });
-
-      return { contextId: context.id, isNew: true };
-    } catch (error) {
-      if (!isPrismaUniqueConstraintError(error)) {
-        throw error;
-      }
-    }
-
-    const MAX_WAIT_MS = 10_000;
-    const POLL_MS = 200;
-    const startedAt = Date.now();
-
-    while (Date.now() - startedAt < MAX_WAIT_MS) {
-      const current = await db.browserbaseContext.findUnique({
-        where: { organizationId },
-      });
-
-      if (current && current.contextId !== PENDING_CONTEXT_ID) {
-        return { contextId: current.contextId, isNew: false };
-      }
-
-      if (!current) {
-        return await this.getOrCreateOrgContext(organizationId);
-      }
-
-      await delay(POLL_MS);
-    }
-
-    this.logger.warn(
-      `Timed out waiting for Browserbase context creation for org ${organizationId}`,
-    );
-    throw new Error(
-      'Browser context initialization is taking too long. Please retry.',
-    );
+  async getOrgContext(organizationId: string) {
+    return this.profiles.getOrgContext(organizationId);
   }
 
-  async getOrgContext(
-    organizationId: string,
-  ): Promise<{ contextId: string } | null> {
-    const context = await db.browserbaseContext.findUnique({
-      where: { organizationId },
-    });
-
-    if (!context) return null;
-    return { contextId: context.contextId };
-  }
-
-  // ===== Session Management =====
-
-  async createSessionWithContext(
-    contextId: string,
-  ): Promise<{ sessionId: string; liveViewUrl: string }> {
-    const bb = this.getBrowserbase();
-
-    const session = await bb.sessions.create({
-      projectId: this.getProjectId(),
-      browserSettings: {
-        context: {
-          id: contextId,
-          persist: true,
-        },
-        fingerprint: {
-          screen: {
-            maxHeight: BROWSER_HEIGHT,
-            maxWidth: BROWSER_WIDTH,
-            minHeight: BROWSER_HEIGHT,
-            minWidth: BROWSER_WIDTH,
-          },
-        },
-        viewport: { width: BROWSER_WIDTH, height: BROWSER_HEIGHT },
-      },
-      keepAlive: true,
-    });
-
-    const debug = await bb.sessions.debug(session.id);
-
-    return {
-      sessionId: session.id,
-      liveViewUrl: debug.debuggerFullscreenUrl,
-    };
+  async createSessionWithContext(contextId: string) {
+    return this.sessions.createSessionWithContext(contextId);
   }
 
   async closeSession(sessionId: string): Promise<void> {
-    const bb = this.getBrowserbase();
-    await bb.sessions.update(sessionId, {
-      projectId: this.getProjectId(),
-      status: 'REQUEST_RELEASE',
-    });
-  }
-
-  // ===== Stagehand helpers =====
-
-  private async createStagehand(sessionId: string): Promise<Stagehand> {
-    const { Stagehand } = await import('@browserbasehq/stagehand');
-    const stagehand = new Stagehand({
-      env: 'BROWSERBASE',
-      apiKey: process.env.BROWSERBASE_API_KEY,
-      projectId: this.getProjectId(),
-      browserbaseSessionID: sessionId,
-      model: {
-        modelName: STAGEHAND_MODEL,
-        apiKey: process.env.ANTHROPIC_API_KEY,
-      },
-      verbose: 1,
-    });
-
-    await stagehand.init();
-    return stagehand;
-  }
-
-  private async safeCloseStagehand(stagehand: Stagehand) {
-    try {
-      await stagehand.close();
-    } catch (err) {
-      // IMPORTANT: never let cleanup errors override a successful run
-      this.logger.warn('Failed to close stagehand (ignored)', {
-        error: err instanceof Error ? err.message : String(err),
-      });
-    }
+    return this.sessions.closeSession(sessionId);
   }
 
-  // ===== Browser Actions =====
-
-  async navigateToUrl(
-    sessionId: string,
-    url: string,
-  ): Promise<{ success: boolean; error?: string }> {
-    let stagehand: Stagehand | null = null;
-
-    try {
-      stagehand = await this.createStagehand(sessionId);
-      const page = stagehand.context.pages()[0];
-      if (!page) {
-        throw new Error('No page found in browser session');
-      }
-
-      // Set up virtual authenticator to bypass passkeys via CDP
-      await page.sendCDP('WebAuthn.enable');
-      await page.sendCDP('WebAuthn.addVirtualAuthenticator', {
-        options: {
-          protocol: 'ctap2',
-          transport: 'internal',
-          hasResidentKey: true,
-          hasUserVerification: true,
-          isUserVerified: true,
-          automaticPresenceSimulation: true,
-        },
-      });
-
-      await page.goto(url, {
-        waitUntil: 'domcontentloaded',
-        timeoutMs: 30000,
-      });
-
-      return { success: true };
-    } catch (err) {
-      this.logger.error('Failed to navigate to URL', err);
-      if (stagehand) {
-        try {
-          await stagehand.close();
-        } catch (closeErr) {
-          this.logger.warn('Failed to close stagehand after navigation error', {
-            closeErr:
-              closeErr instanceof Error
-                ? closeErr.message
-                : 'Unknown close error',
-          });
-        }
-      }
-      return {
-        success: false,
-        error: err instanceof Error ? err.message : 'Unknown error',
-      };
-    }
-    // Don't close - user needs to interact via Live View
+  async navigateToUrl(sessionId: string, url: string) {
+    return this.sessions.navigateToUrl(sessionId, url);
   }
 
-  async checkLoginStatus(
-    sessionId: string,
-    url: string,
-  ): Promise<{ isLoggedIn: boolean; username?: string }> {
-    const stagehand = await this.createStagehand(sessionId);
-
-    try {
-      const page = await this.ensureActivePage(stagehand);
-
-      await page.goto(url, {
-        waitUntil: 'domcontentloaded',
-        timeoutMs: 30000,
-      });
-      await delay(1500);
-
-      // Use extract to check login status
-      const loginSchema = z.object({
-        isLoggedIn: z
-          .boolean()
-          .describe('Whether the user is currently logged in to this site'),
-        username: z.string().optional().describe('The username if logged in'),
-      });
-
-      const result = (await stagehand.extract(
-        'Check if the user is logged in to this website. Look for a user avatar, profile menu, or account dropdown in the header/navigation. If logged in, extract the username if visible.',
-        loginSchema as any,
-      )) as { isLoggedIn: boolean; username?: string };
-
-      return {
-        isLoggedIn: result.isLoggedIn,
-        username: result.username,
-      };
-    } catch (err) {
-      if (isNoPageError(err)) {
-        throw new Error(
-          'Browser session ended before we could verify login status. Please retry.',
-        );
-      }
-      throw err;
-    } finally {
-      await this.safeCloseStagehand(stagehand);
-    }
+  async checkLoginStatus(sessionId: string, url: string) {
+    return this.sessions.checkLoginStatus(sessionId, url);
   }
 
-  // ===== Browser Automation CRUD =====
-
-  async createBrowserAutomation(data: {
-    taskId: string;
-    name: string;
-    description?: string;
-    targetUrl: string;
-    instruction: string;
-    evaluationCriteria?: string;
-    scheduleFrequency?: TaskFrequency;
-  }) {
-    return db.browserAutomation.create({
-      data: {
-        taskId: data.taskId,
-        name: data.name,
-        description: data.description,
-        targetUrl: data.targetUrl,
-        instruction: data.instruction,
-        evaluationCriteria: normalizeCriteria(data.evaluationCriteria),
-        isEnabled: true, // Enable by default so scheduled runs work
-        ...(data.scheduleFrequency !== undefined
-          ? { scheduleFrequency: data.scheduleFrequency }
-          : {}),
-      },
-    });
+  async createBrowserAutomation(
+    data: {
+      taskId: string;
+      name: string;
+      description?: string;
+      targetUrl: string;
+      instruction: string;
+      evaluationCriteria?: string;
+      scheduleFrequency?: TaskFrequency;
+    },
+    organizationId?: string,
+  ) {
+    return this.automationCrud.createBrowserAutomation(data, organizationId);
   }
 
-  async getBrowserAutomation(automationId: string) {
-    return db.browserAutomation.findUnique({
-      where: { id: automationId },
-      include: {
-        runs: {
-          orderBy: { createdAt: 'desc' },
-          take: 10,
-        },
-      },
-    });
+  async getBrowserAutomation(automationId: string, organizationId?: string) {
+    return this.automationCrud.getBrowserAutomation(automationId, organizationId);
   }
 
-  async getBrowserAutomationsForTask(taskId: string) {
-    return db.browserAutomation.findMany({
-      where: { taskId },
-      include: {
-        runs: {
-          orderBy: { createdAt: 'desc' },
-          take: 1,
-        },
-      },
-      orderBy: { createdAt: 'desc' },
-    });
+  async getBrowserAutomationsForTask(taskId: string, organizationId?: string) {
+    return this.automationCrud.getBrowserAutomationsForTask(taskId, organizationId);
   }
 
   async updateBrowserAutomation(
@@ -411,634 +125,83 @@ export class BrowserbaseService {
       isEnabled?: boolean;
       scheduleFrequency?: TaskFrequency;
     },
+    organizationId?: string,
   ) {
-    const { evaluationCriteria, scheduleFrequency, ...rest } = data;
-    return db.browserAutomation.update({
-      where: { id: automationId },
-      data: {
-        ...rest,
-        ...(evaluationCriteria !== undefined
-          ? { evaluationCriteria: normalizeCriteria(evaluationCriteria) }
-          : {}),
-        ...(scheduleFrequency !== undefined ? { scheduleFrequency } : {}),
-      },
-    });
+    return this.automationCrud.updateBrowserAutomation(
+      automationId,
+      data,
+      organizationId,
+    );
   }
 
-  async deleteBrowserAutomation(automationId: string) {
-    return db.browserAutomation.delete({
-      where: { id: automationId },
-    });
+  async deleteBrowserAutomation(automationId: string, organizationId?: string) {
+    return this.automationCrud.deleteBrowserAutomation(automationId, organizationId);
   }
 
-  // ===== Browser Automation Execution =====
-
-  /**
-   * Start an automation run with a live session that the user can watch
-   */
-  async startAutomationWithLiveView(
-    automationId: string,
-    organizationId: string,
-  ): Promise<{
-    runId: string;
-    sessionId: string;
-    liveViewUrl: string;
-    error?: string;
-    needsReauth?: boolean;
-  }> {
-    const automation = await db.browserAutomation.findUnique({
-      where: { id: automationId },
-    });
-
-    if (!automation) {
-      throw new Error('Automation not found');
-    }
-
-    const context = await this.getOrgContext(organizationId);
-    if (!context) {
-      return {
-        runId: '',
-        sessionId: '',
-        liveViewUrl: '',
-        needsReauth: true,
-        error: 'No browser context found. Please connect your browser first.',
-      };
-    }
-
-    // Create a run record
-    const run = await db.browserAutomationRun.create({
-      data: {
-        automationId,
-        status: 'running',
-        startedAt: new Date(),
-      },
-    });
-
-    // Create session with live view
-    const { sessionId, liveViewUrl } = await this.createSessionWithContext(
-      context.contextId,
+  async startAutomationWithLiveView(automationId: string, organizationId: string) {
+    return this.automationExecution.startAutomationWithLiveView(
+      automationId,
+      organizationId,
     );
-
-    return {
-      runId: run.id,
-      sessionId,
-      liveViewUrl,
-    };
   }
 
-  /**
-   * Execute an automation on an existing session (for live view runs)
-   */
   async executeAutomationOnSession(
     automationId: string,
     runId: string,
     sessionId: string,
     organizationId: string,
-  ): Promise<{
-    success: boolean;
-    screenshotUrl?: string;
-    evaluationStatus?: 'pass' | 'fail';
-    evaluationReason?: string;
-    error?: string;
-    needsReauth?: boolean;
-  }> {
-    const automation = await db.browserAutomation.findUnique({
-      where: { id: automationId },
-      include: {
-        task: {
-          select: { title: true, description: true },
-        },
-      },
-    });
-
-    if (!automation) {
-      throw new Error('Automation not found');
-    }
-
-    const run = await db.browserAutomationRun.findUnique({
-      where: { id: runId },
-    });
-
-    if (!run) {
-      throw new Error('Run not found');
-    }
-
-    try {
-      const result = await this.executeAutomation(
-        sessionId,
-        automation.targetUrl,
-        automation.instruction,
-        {
-          title: automation.task.title,
-          description: automation.task.description,
-          evaluationCriteria: automation.evaluationCriteria,
-        },
-      );
-
-      if (!result.success) {
-        // Store evaluation data even on failure (requirement not met)
-        await db.browserAutomationRun.update({
-          where: { id: runId },
-          data: {
-            status: 'failed',
-            completedAt: new Date(),
-            durationMs: run.startedAt
-              ? Date.now() - run.startedAt.getTime()
-              : 0,
-            error: result.error,
-            evaluationStatus: result.evaluationStatus,
-            evaluationReason: result.evaluationReason,
-          },
-        });
-
-        return {
-          success: false,
-          error: result.error,
-          evaluationStatus: result.evaluationStatus,
-          evaluationReason: result.evaluationReason,
-          needsReauth: result.needsReauth,
-        };
-      }
-
-      // Upload screenshot to S3
-      let screenshotKey: string | undefined;
-      let presignedUrl: string | undefined;
-      if (result.screenshot) {
-        screenshotKey = await this.uploadScreenshot(
-          organizationId,
-          automationId,
-          runId,
-          result.screenshot,
-        );
-        presignedUrl = await this.getPresignedUrl(screenshotKey);
-      }
-
-      // Update run as completed. Only persist an evaluation verdict when
-      // the caller's automation had criteria configured.
-      await db.browserAutomationRun.update({
-        where: { id: runId },
-        data: {
-          status: 'completed',
-          completedAt: new Date(),
-          durationMs: run.startedAt ? Date.now() - run.startedAt.getTime() : 0,
-          screenshotUrl: screenshotKey,
-          evaluationStatus: result.evaluationStatus ?? null,
-          evaluationReason: result.evaluationReason ?? null,
-        },
-      });
-
-      return {
-        success: true,
-        screenshotUrl: presignedUrl,
-        evaluationStatus: result.evaluationStatus,
-        evaluationReason: result.evaluationReason,
-      };
-    } catch (err) {
-      this.logger.error('Failed to execute automation on session', err);
-      const { userFacing, needsReauth } = toRunErrorMessage(err);
-
-      await db.browserAutomationRun.update({
-        where: { id: runId },
-        data: {
-          status: 'failed',
-          completedAt: new Date(),
-          durationMs: run.startedAt ? Date.now() - run.startedAt.getTime() : 0,
-          error: userFacing,
-        },
-      });
-
-      return {
-        success: false,
-        error: userFacing,
-        needsReauth: needsReauth ? true : undefined,
-      };
-    }
-  }
-
-  async runBrowserAutomation(
-    automationId: string,
-    organizationId: string,
-  ): Promise<{
-    runId: string;
-    success: boolean;
-    screenshotUrl?: string;
-    evaluationStatus?: 'pass' | 'fail';
-    evaluationReason?: string;
-    error?: string;
-    needsReauth?: boolean;
-  }> {
-    // Get the automation with task context
-    const automation = await db.browserAutomation.findUnique({
-      where: { id: automationId },
-      include: {
-        task: {
-          select: { title: true, description: true },
-        },
-      },
-    });
-
-    if (!automation) {
-      throw new Error('Automation not found');
-    }
-
-    // Get org context
-    const context = await this.getOrgContext(organizationId);
-    if (!context) {
-      return {
-        runId: '',
-        success: false,
-        needsReauth: true,
-        error: 'No browser context found. Please connect your browser first.',
-      };
-    }
-
-    // Create a run record
-    const run = await db.browserAutomationRun.create({
-      data: {
-        automationId,
-        status: 'running',
-        startedAt: new Date(),
-      },
-    });
-
-    try {
-      // Create a session
-      const { sessionId } = await this.createSessionWithContext(
-        context.contextId,
-      );
-
-      try {
-        const result = await this.executeAutomation(
-          sessionId,
-          automation.targetUrl,
-          automation.instruction,
-          {
-            title: automation.task.title,
-            description: automation.task.description,
-            evaluationCriteria: automation.evaluationCriteria,
-          },
-        );
-
-        if (!result.success) {
-          // Update run as failed - include evaluation data if requirement not met
-          await db.browserAutomationRun.update({
-            where: { id: run.id },
-            data: {
-              status: 'failed',
-              completedAt: new Date(),
-              durationMs: Date.now() - run.startedAt!.getTime(),
-              error: result.error,
-              evaluationStatus: result.evaluationStatus,
-              evaluationReason: result.evaluationReason,
-            },
-          });
-
-          return {
-            runId: run.id,
-            success: false,
-            error: result.error,
-            evaluationStatus: result.evaluationStatus,
-            evaluationReason: result.evaluationReason,
-            needsReauth: result.needsReauth,
-          };
-        }
-
-        // Upload screenshot to S3 (only taken if evaluation passed)
-        let screenshotKey: string | undefined;
-        let presignedUrl: string | undefined;
-        if (result.screenshot) {
-          screenshotKey = await this.uploadScreenshot(
-            organizationId,
-            automationId,
-            run.id,
-            result.screenshot,
-          );
-          presignedUrl = await this.getPresignedUrl(screenshotKey);
-        }
-
-        // Update run as completed. Only persist an evaluation verdict when
-        // the automation had criteria configured.
-        await db.browserAutomationRun.update({
-          where: { id: run.id },
-          data: {
-            status: 'completed',
-            completedAt: new Date(),
-            durationMs: Date.now() - run.startedAt!.getTime(),
-            screenshotUrl: screenshotKey,
-            evaluationStatus: result.evaluationStatus ?? null,
-            evaluationReason: result.evaluationReason ?? null,
-          },
-        });
-
-        return {
-          runId: run.id,
-          success: true,
-          screenshotUrl: presignedUrl,
-          evaluationStatus: result.evaluationStatus,
-          evaluationReason: result.evaluationReason,
-        };
-      } finally {
-        // Always attempt to close the session, but never let cleanup override success
-        try {
-          await this.closeSession(sessionId);
-        } catch (err) {
-          this.logger.warn('Failed to close Browserbase session (ignored)', {
-            sessionId,
-            error: err instanceof Error ? err.message : String(err),
-          });
-        }
-      }
-    } catch (err) {
-      this.logger.error('Failed to run browser automation', err);
-      const { userFacing, needsReauth } = toRunErrorMessage(err);
-
-      // Update run as failed
-      await db.browserAutomationRun.update({
-        where: { id: run.id },
-        data: {
-          status: 'failed',
-          completedAt: new Date(),
-          durationMs: run.startedAt ? Date.now() - run.startedAt.getTime() : 0,
-          error: userFacing,
-        },
-      });
-
-      return {
-        runId: run.id,
-        success: false,
-        error: userFacing,
-        needsReauth: needsReauth ? true : undefined,
-      };
-    }
-  }
-
-  private async executeAutomation(
-    sessionId: string,
-    targetUrl: string,
-    instruction: string,
-    taskContext?: {
-      title: string;
-      description?: string | null;
-      evaluationCriteria?: string | null;
-    },
-  ): Promise<{
-    success: boolean;
-    screenshot?: string;
-    evaluationStatus?: 'pass' | 'fail';
-    evaluationReason?: string;
-    error?: string;
-    needsReauth?: boolean;
-  }> {
-    const stagehand = await this.createStagehand(sessionId);
-
-    try {
-      let page = await this.ensureActivePage(stagehand);
-
-      // Navigate to target URL
-      await page.goto(targetUrl, {
-        waitUntil: 'domcontentloaded',
-        timeoutMs: 30000,
-      });
-      await delay(1000);
-
-      // Check if we need to authenticate (look for login page indicators)
-      const loginSchema = z.object({
-        isLoggedIn: z.boolean(),
-      });
-      const authCheck = (await stagehand.extract(
-        'Check if the user is logged in to this website. Look for a user avatar, profile menu, account dropdown, or login/sign-in buttons. Return true if logged in, false if you see login buttons or a login form.',
-        loginSchema as any,
-      )) as { isLoggedIn: boolean };
-
-      if (!authCheck.isLoggedIn) {
-        return {
-          success: false,
-          needsReauth: true,
-          error: 'Session expired. Please re-authenticate in browser settings.',
-        };
-      }
-
-      // Execute the navigation instruction using Stagehand agent
-      const fullInstruction = `${instruction}. After completing all navigation steps, stop and wait.`;
-
-      await stagehand
-        .agent({
-          cua: true,
-          model: {
-            modelName: STAGEHAND_CUA_MODEL,
-            apiKey: process.env.ANTHROPIC_API_KEY,
-          },
-        })
-        .execute({
-          instruction: fullInstruction,
-          maxSteps: 20,
-        });
-
-      // Wait for final page to settle
-      await delay(2000);
-
-      // Always take a screenshot at the end (no pass/fail criteria gate)
-      page = await this.ensureActivePage(stagehand);
-      const sourceUrl = page.url();
-      const rawScreenshot = await page.screenshot({
-        type: 'jpeg',
-        quality: 80,
-        fullPage: false,
-      });
-
-      let finalBuffer: Buffer = rawScreenshot;
-      try {
-        finalBuffer = await renderOverlay({
-          buffer: rawScreenshot,
-          instruction,
-          sourceUrl,
-          capturedAt: new Date(),
-        });
-      } catch (overlayErr) {
-        this.logger.warn(
-          'Screenshot overlay render failed; uploading raw image',
-          {
-            error:
-              overlayErr instanceof Error
-                ? overlayErr.message
-                : String(overlayErr),
-          },
-        );
-      }
-
-      // Optional evaluation: if the automation was configured with
-      // natural-language criteria, ask Stagehand to inspect the page and
-      // produce a pass/fail verdict with a short reason.
-      let evaluationStatus: 'pass' | 'fail' | undefined;
-      let evaluationReason: string | undefined;
-      const criteria = taskContext?.evaluationCriteria?.trim();
-      if (criteria) {
-        try {
-          const evalSchema = z.object({
-            pass: z.boolean(),
-            reason: z.string(),
-          });
-          const evaluation = (await stagehand.extract(
-            `You are an auditor reviewing the current page after an automation has finished navigating. Decide whether the page clearly satisfies this criteria. Only return pass=true if the evidence is unambiguously present and visible. If it is ambiguous, missing, or contradicted, return pass=false. Always provide a short reason (max 220 characters).\n\nCriteria: ${criteria}`,
-            evalSchema as any,
-          )) as { pass: boolean; reason: string };
-
-          evaluationStatus = evaluation.pass ? 'pass' : 'fail';
-          evaluationReason = evaluation.reason;
-        } catch (evalErr) {
-          this.logger.warn(
-            'Evaluation step failed; returning screenshot without verdict',
-            {
-              error:
-                evalErr instanceof Error ? evalErr.message : String(evalErr),
-            },
-          );
-        }
-      }
-
-      return {
-        success: true,
-        screenshot: finalBuffer.toString('base64'),
-        evaluationStatus,
-        evaluationReason,
-      };
-    } catch (err) {
-      this.logger.error('Failed to execute automation', err);
-      const { userFacing, needsReauth } = toRunErrorMessage(err);
-      return {
-        success: false,
-        needsReauth: needsReauth ? true : undefined,
-        error: userFacing,
-      };
-    } finally {
-      await this.safeCloseStagehand(stagehand);
-    }
-  }
-
-  private async uploadScreenshot(
-    organizationId: string,
-    automationId: string,
-    runId: string,
-    base64Screenshot: string,
-  ): Promise<string> {
-    const buffer = Buffer.from(base64Screenshot, 'base64');
-    const key = `browser-automations/${organizationId}/${automationId}/${runId}.jpg`;
-
-    await this.s3Client.send(
-      new PutObjectCommand({
-        Bucket: this.bucketName,
-        Key: key,
-        Body: buffer,
-        ContentType: 'image/jpeg',
-      }),
+  ) {
+    return this.automationExecution.executeAutomationOnSession(
+      automationId,
+      runId,
+      sessionId,
+      organizationId,
     );
-
-    // Return just the key - we'll generate presigned URLs when viewing
-    return key;
   }
 
-  async getPresignedUrl(
-    key: string,
-    options: { expiresIn?: number; responseContentDisposition?: string } = {},
-  ): Promise<string> {
-    const command = new GetObjectCommand({
-      Bucket: this.bucketName,
-      Key: key,
-      ResponseContentDisposition: options.responseContentDisposition,
-    });
-    return getSignedUrl(this.s3Client, command, {
-      expiresIn: options.expiresIn ?? 3600,
-    });
+  async runBrowserAutomation(automationId: string, organizationId: string) {
+    return this.automationExecution.runBrowserAutomation(
+      automationId,
+      organizationId,
+    );
   }
 
-  /**
-   * Resolve a run's S3 screenshot key to a freshly signed presigned URL,
-   * scoped to the caller's organization. Used by the controller's
-   * GET runs/:runId/screenshot redirect endpoint so that the "Open full size"
-   * UI link never serves an expired URL.
-   *
-   * When `download` is true, the presigned URL is signed with an
-   * attachment Content-Disposition so the browser downloads the image
-   * instead of rendering it inline.
-   */
   async getScreenshotRedirectUrl(input: {
     runId: string;
     organizationId: string;
     download?: boolean;
   }): Promise<string> {
-    const { runId, organizationId, download } = input;
-
-    const run = await db.browserAutomationRun.findUnique({
-      where: { id: runId },
-      include: { automation: { include: { task: true } } },
-    });
-
-    if (!run || !run.screenshotUrl) {
-      throw new NotFoundException('Screenshot not found');
-    }
-
-    if (run.automation.task.organizationId !== organizationId) {
-      throw new NotFoundException('Screenshot not found');
-    }
-
-    const responseContentDisposition = download
-      ? `attachment; filename="screenshot-${runId}.jpg"`
-      : undefined;
-
-    return this.getPresignedUrl(run.screenshotUrl, {
-      responseContentDisposition,
-    });
+    return this.screenshots.getScreenshotRedirectUrl(input);
   }
 
-  async getRunWithPresignedUrl(runId: string) {
-    const run = await db.browserAutomationRun.findUnique({
-      where: { id: runId },
-    });
-
-    if (!run) return null;
-
-    if (run.screenshotUrl) {
-      const presignedUrl = await this.getPresignedUrl(run.screenshotUrl);
-      return { ...run, screenshotUrl: presignedUrl };
-    }
-
-    return run;
+  async getRunWithPresignedUrl(runId: string, organizationId?: string) {
+    return this.automationCrud.getRunWithPresignedUrl(runId, organizationId);
   }
 
-  async getAutomationsWithPresignedUrls(taskId: string) {
-    const automations = await this.getBrowserAutomationsForTask(taskId);
-
-    return Promise.all(
-      automations.map(async (automation) => {
-        const runsWithUrls = await Promise.all(
-          automation.runs.map(async (run) => {
-            if (run.screenshotUrl) {
-              const presignedUrl = await this.getPresignedUrl(
-                run.screenshotUrl,
-              );
-              return { ...run, screenshotUrl: presignedUrl };
-            }
-            return run;
-          }),
-        );
-        return { ...automation, runs: runsWithUrls };
-      }),
+  async getAutomationsWithPresignedUrls(taskId: string, organizationId?: string) {
+    return this.automationCrud.getAutomationsWithPresignedUrls(
+      taskId,
+      organizationId,
     );
   }
 
-  // ===== Run History =====
+  async getAutomationRuns(
+    automationId: string,
+    limit = 20,
+    organizationId?: string,
+  ) {
+    return this.automationCrud.getAutomationRuns(
+      automationId,
+      limit,
+      organizationId,
+    );
+  }
 
-  async getAutomationRuns(automationId: string, limit = 20) {
-    return db.browserAutomationRun.findMany({
-      where: { automationId },
-      orderBy: { createdAt: 'desc' },
-      take: limit,
-    });
+  async getAutomationRun(runId: string, organizationId?: string) {
+    return this.automationCrud.getAutomationRun(runId, organizationId);
   }
 
-  async getAutomationRun(runId: string) {
-    return db.browserAutomationRun.findUnique({
-      where: { id: runId },
-    });
+  getHostnameFromUrl(url: string): string {
+    return normalizeHostnameFromUrl(url);
   }
 }
diff --git a/apps/api/src/browserbase/credential-vault.ts b/apps/api/src/browserbase/credential-vault.ts
new file mode 100644
index 0000000000..aa9f111411
--- /dev/null
+++ b/apps/api/src/browserbase/credential-vault.ts
@@ -0,0 +1,30 @@
+export interface RuntimeCredentialMaterial {
+  username?: string;
+  password?: string;
+  totpCode?: string;
+}
+
+export const BROWSER_CREDENTIAL_VAULT_ADAPTER =
+  'BROWSER_CREDENTIAL_VAULT_ADAPTER';
+
+export interface BrowserCredentialVaultAdapter {
+  resolveCredentialReference(params: {
+    profileId: string;
+    provider?: string | null;
+    externalItemRef?: string | null;
+    connectionId?: string | null;
+  }): Promise<RuntimeCredentialMaterial | null>;
+}
+
+export class NoopBrowserCredentialVaultAdapter
+  implements BrowserCredentialVaultAdapter
+{
+  async resolveCredentialReference(_params: {
+    profileId: string;
+    provider?: string | null;
+    externalItemRef?: string | null;
+    connectionId?: string | null;
+  }): Promise<RuntimeCredentialMaterial | null> {
+    return null;
+  }
+}
diff --git a/apps/api/src/browserbase/dto/browserbase.dto.ts b/apps/api/src/browserbase/dto/browserbase.dto.ts
index 2a7334a782..1fb7b29b18 100644
--- a/apps/api/src/browserbase/dto/browserbase.dto.ts
+++ b/apps/api/src/browserbase/dto/browserbase.dto.ts
@@ -54,6 +54,136 @@ export class CloseSessionDto {
   sessionId: string;
 }
 
+export class AuthStatusResponseDto {
+  @ApiProperty()
+  isLoggedIn: boolean;
+
+  @ApiPropertyOptional()
+  username?: string;
+}
+
+// ===== Auth Profile DTOs =====
+
+export class ResolveAuthProfileDto {
+  @ApiProperty({ description: 'Website URL to normalize into an auth profile hostname' })
+  @IsUrl({}, { message: 'url must be a valid URL' })
+  @IsSafeUrl({ message: 'The provided URL is not allowed.' })
+  @IsString()
+  @IsNotEmpty()
+  url: string;
+
+  @ApiPropertyOptional({ description: 'Human-readable profile name' })
+  @IsString()
+  @IsOptional()
+  displayName?: string;
+
+  @ApiPropertyOptional({
+    description: 'Login identity label, such as a service account email',
+  })
+  @IsString()
+  @IsOptional()
+  loginIdentity?: string;
+
+  @ApiPropertyOptional({ description: 'External vault provider name' })
+  @IsString()
+  @IsOptional()
+  vaultProvider?: string;
+
+  @ApiPropertyOptional({ description: 'External vault item reference' })
+  @IsString()
+  @IsOptional()
+  vaultExternalItemRef?: string;
+
+  @ApiPropertyOptional({ description: 'External vault connection ID' })
+  @IsString()
+  @IsOptional()
+  vaultConnectionId?: string;
+}
+
+export class VerifyAuthProfileSessionDto {
+  @ApiProperty({ description: 'Browserbase session ID' })
+  @IsString()
+  @IsNotEmpty()
+  sessionId: string;
+
+  @ApiProperty({ description: 'URL to verify authentication on' })
+  @IsUrl({}, { message: 'url must be a valid URL' })
+  @IsSafeUrl({ message: 'The provided URL is not allowed.' })
+  @IsString()
+  @IsNotEmpty()
+  url: string;
+}
+
+export class MarkAuthProfileNeedsReauthDto {
+  @ApiPropertyOptional({ description: 'Reason the profile needs re-authentication' })
+  @IsString()
+  @IsOptional()
+  reason?: string;
+}
+
+export class BrowserAuthProfileResponseDto {
+  @ApiProperty()
+  id: string;
+
+  @ApiProperty()
+  organizationId: string;
+
+  @ApiProperty()
+  hostname: string;
+
+  @ApiProperty()
+  loginIdentity: string;
+
+  @ApiProperty()
+  displayName: string;
+
+  @ApiProperty()
+  contextId: string;
+
+  @ApiProperty({ enum: ['unverified', 'verified', 'needs_reauth', 'blocked'] })
+  status: string;
+
+  @ApiPropertyOptional()
+  lastVerifiedAt?: Date;
+
+  @ApiPropertyOptional()
+  lastAuthCheckUrl?: string;
+
+  @ApiPropertyOptional()
+  blockedReason?: string;
+
+  @ApiPropertyOptional()
+  vaultProvider?: string;
+
+  @ApiPropertyOptional()
+  vaultExternalItemRef?: string;
+
+  @ApiPropertyOptional()
+  vaultConnectionId?: string;
+
+  @ApiProperty()
+  createdAt: Date;
+
+  @ApiProperty()
+  updatedAt: Date;
+}
+
+export class ResolveAuthProfileResponseDto {
+  @ApiProperty({ type: BrowserAuthProfileResponseDto })
+  profile: BrowserAuthProfileResponseDto;
+
+  @ApiProperty()
+  isNew: boolean;
+}
+
+export class VerifyAuthProfileResponseDto {
+  @ApiProperty({ type: BrowserAuthProfileResponseDto })
+  profile: BrowserAuthProfileResponseDto;
+
+  @ApiProperty({ type: () => AuthStatusResponseDto })
+  auth: AuthStatusResponseDto;
+}
+
 // ===== Browser Automation DTOs =====
 
 export class CreateBrowserAutomationDto {
@@ -146,6 +276,18 @@ export class UpdateBrowserAutomationDto {
   scheduleFrequency?: TaskFrequency;
 }
 
+export class ExecuteAutomationSessionDto {
+  @ApiProperty({ description: 'Browser automation run ID' })
+  @IsString()
+  @IsNotEmpty()
+  runId: string;
+
+  @ApiProperty({ description: 'Browserbase session ID' })
+  @IsString()
+  @IsNotEmpty()
+  sessionId: string;
+}
+
 // ===== Response DTOs =====
 
 export class ContextResponseDto {
@@ -164,14 +306,6 @@ export class SessionResponseDto {
   liveViewUrl: string;
 }
 
-export class AuthStatusResponseDto {
-  @ApiProperty()
-  isLoggedIn: boolean;
-
-  @ApiPropertyOptional()
-  username?: string;
-}
-
 export class BrowserAutomationResponseDto {
   @ApiProperty()
   id: string;
@@ -208,6 +342,9 @@ export class BrowserAutomationRunResponseDto {
   @ApiProperty()
   automationId: string;
 
+  @ApiPropertyOptional()
+  profileId?: string;
+
   @ApiProperty()
   status: string;
 
@@ -226,6 +363,21 @@ export class BrowserAutomationRunResponseDto {
   @ApiPropertyOptional()
   error?: string;
 
+  @ApiPropertyOptional()
+  failureCode?: string;
+
+  @ApiPropertyOptional()
+  failureStage?: string;
+
+  @ApiPropertyOptional()
+  blockedReason?: string;
+
+  @ApiPropertyOptional()
+  finalUrl?: string;
+
+  @ApiPropertyOptional()
+  attemptCount?: number;
+
   @ApiProperty()
   createdAt: Date;
 }
@@ -245,4 +397,19 @@ export class RunAutomationResponseDto {
 
   @ApiPropertyOptional()
   needsReauth?: boolean;
+
+  @ApiPropertyOptional()
+  evaluationStatus?: string;
+
+  @ApiPropertyOptional()
+  evaluationReason?: string;
+
+  @ApiPropertyOptional()
+  failureCode?: string;
+
+  @ApiPropertyOptional()
+  failureStage?: string;
+
+  @ApiPropertyOptional()
+  blockedReason?: string;
 }
diff --git a/apps/api/src/cloud-security/providers/gcp-security.service.spec.ts b/apps/api/src/cloud-security/providers/gcp-security.service.spec.ts
index d03c50c9a8..9312f90950 100644
--- a/apps/api/src/cloud-security/providers/gcp-security.service.spec.ts
+++ b/apps/api/src/cloud-security/providers/gcp-security.service.spec.ts
@@ -822,4 +822,81 @@ describe('GCPSecurityService.scanSecurityFindings — all-scopes-failed guard',
 
     expect(findings).toEqual([]);
   });
+
+  // Regression: SCC public-bucket findings (PUBLIC_BUCKET_ACL) sometimes come
+  // back with an empty `finding.resourceName` while the resource identity lives
+  // on `result.resource.name`. Storing resourceId: "" made "Mark as exception"
+  // throw 'This finding cannot be marked as an exception — it lacks a stable
+  // check/resource identity'. The mapping must fall back to result.resource.name
+  // so the finding keeps a stable, non-empty resourceId.
+  it('falls back to result.resource.name for resourceId when finding.resourceName is empty (public bucket)', async () => {
+    fetchMock.mockResolvedValue(
+      sccPage([
+        {
+          finding: {
+            name: 'organizations/1/sources/-/findings/pub-bucket-1',
+            category: 'PUBLIC_BUCKET_ACL',
+            description: 'Bucket is public',
+            severity: 'HIGH',
+            state: 'ACTIVE',
+            resourceName: '', // SCC omitted the per-finding resource name
+            eventTime: '2026-01-01T00:00:00Z',
+            createTime: '2026-01-01T00:00:00Z',
+          },
+          resource: {
+            name: '//storage.googleapis.com/projects/acme/buckets/public-bucket',
+            type: 'storage.googleapis.com/Bucket',
+            projectDisplayName: 'acme',
+          },
+        },
+      ]),
+    );
+
+    const findings = await service.scanSecurityFindings(
+      { access_token: 'tok' },
+      { project_ids: ['acme'] },
+    );
+
+    expect(findings).toHaveLength(1);
+    // Pre-fix this was '' → resolveFindingForException rejected the finding.
+    expect(findings[0].resourceId).toBe(
+      '//storage.googleapis.com/projects/acme/buckets/public-bucket',
+    );
+  });
+
+  // Regression: when SCC omits BOTH `finding.resourceName` AND
+  // `result.resource.name`, the old `|| ''` tail left resourceId empty — the
+  // exact state the exception resolver rejects. The chain must bottom out at
+  // `finding.name` (the finding's canonical id), which SCC always populates,
+  // so resourceId is guaranteed non-empty.
+  it('falls back to finding.name and never leaves resourceId empty when both resourceName and resource.name are absent', async () => {
+    fetchMock.mockResolvedValue(
+      sccPage([
+        {
+          finding: {
+            name: 'organizations/1/sources/-/findings/no-resource-1',
+            category: 'PUBLIC_BUCKET_ACL',
+            description: 'Bucket is public',
+            severity: 'HIGH',
+            state: 'ACTIVE',
+            resourceName: '', // SCC omitted the per-finding resource name
+            eventTime: '2026-01-01T00:00:00Z',
+            createTime: '2026-01-01T00:00:00Z',
+          },
+          // No `resource` block at all → result.resource?.name is undefined.
+        },
+      ]),
+    );
+
+    const findings = await service.scanSecurityFindings(
+      { access_token: 'tok' },
+      { project_ids: ['acme'] },
+    );
+
+    expect(findings).toHaveLength(1);
+    expect(findings[0].resourceId).not.toBe('');
+    expect(findings[0].resourceId).toBe(
+      'organizations/1/sources/-/findings/no-resource-1',
+    );
+  });
 });
diff --git a/apps/api/src/cloud-security/providers/gcp-security.service.ts b/apps/api/src/cloud-security/providers/gcp-security.service.ts
index a034bb6b4d..f560d5b138 100644
--- a/apps/api/src/cloud-security/providers/gcp-security.service.ts
+++ b/apps/api/src/cloud-security/providers/gcp-security.service.ts
@@ -1415,7 +1415,15 @@ export class GCPSecurityService {
                 f.description || `Security finding: ${f.category}`,
               severity: this.mapSeverity(f.severity),
               resourceType: result.resource?.type ?? 'gcp-resource',
-              resourceId: f.resourceName,
+              // SCC sometimes omits the per-finding `resourceName` (notably
+              // PUBLIC_BUCKET_ACL findings) while the stable identity still
+              // lives on `result.resource.name`. If both are absent, fall back
+              // to `f.name` — the finding's own canonical id (also used for
+              // dedup above and as `id`), which SCC always populates. Ending
+              // the chain there keeps resourceId guaranteed non-empty so the
+              // finding can be marked as an exception (an empty resourceId is
+              // rejected by the resolver).
+              resourceId: f.resourceName || result.resource?.name || f.name,
               remediation,
               evidence: {
                 findingKey,
diff --git a/apps/api/src/framework-editor-versions/framework-manifest-builder.spec.ts b/apps/api/src/framework-editor-versions/framework-manifest-builder.spec.ts
index bd4c5b2b6b..322b75664e 100644
--- a/apps/api/src/framework-editor-versions/framework-manifest-builder.spec.ts
+++ b/apps/api/src/framework-editor-versions/framework-manifest-builder.spec.ts
@@ -57,6 +57,39 @@ describe('buildManifestForFramework', () => {
     expect(manifest.tasks).toHaveLength(1);
   });
 
+  // FRAME-18: the frozen manifest must order requirements by sortOrder, then by
+  // the stable identifier key, then name. Tiebreaking by name alone would let a
+  // published manifest reorder unsorted requirements whenever a name is edited.
+  it('requests canonical requirement ordering (sortOrder → identifier → name) and preserves sortOrder', async () => {
+    (db.frameworkEditorFramework.findUnique as jest.Mock).mockResolvedValue({
+      id: 'frk_csf',
+      name: 'NIST CSF',
+      version: '2.0',
+      description: null,
+      requirements: [
+        {
+          id: 'frk_rq_gv',
+          identifier: 'GV.OC-01',
+          name: 'Organizational Context',
+          description: 'd',
+          sortOrder: 10,
+          controlTemplates: [],
+        },
+      ],
+    });
+
+    const manifest = await buildManifestForFramework('frk_csf');
+
+    const findUniqueArg = (db.frameworkEditorFramework.findUnique as jest.Mock).mock
+      .calls[0][0];
+    expect(findUniqueArg.include.requirements.orderBy).toEqual([
+      { sortOrder: { sort: 'asc', nulls: 'last' } },
+      { identifier: 'asc' },
+      { name: 'asc' },
+    ]);
+    expect(manifest.requirements[0].sortOrder).toBe(10);
+  });
+
   it('dedupes controls/policies/tasks that appear under multiple requirements', async () => {
     (db.frameworkEditorFramework.findUnique as jest.Mock).mockResolvedValue({
       id: 'frk_iso',
diff --git a/apps/api/src/framework-editor-versions/framework-manifest-builder.ts b/apps/api/src/framework-editor-versions/framework-manifest-builder.ts
index 4f429634b2..36411ebdbb 100644
--- a/apps/api/src/framework-editor-versions/framework-manifest-builder.ts
+++ b/apps/api/src/framework-editor-versions/framework-manifest-builder.ts
@@ -12,6 +12,16 @@ export async function buildManifestForFramework(frameworkId: string): Promise<Fr
     where: { id: frameworkId },
     include: {
       requirements: {
+        // FRAME-18: freeze requirements into the manifest in their configured
+        // order so newly-built instances inherit the framework's sort order.
+        // Secondary key is identifier (stable canonical-order key) then name —
+        // using name alone would let the frozen order shift when a descriptive
+        // name is edited.
+        orderBy: [
+          { sortOrder: { sort: 'asc', nulls: 'last' } },
+          { identifier: 'asc' },
+          { name: 'asc' },
+        ],
         include: {
           controlTemplates: {
             include: {
@@ -108,6 +118,7 @@ export async function buildManifestForFramework(frameworkId: string): Promise<Fr
       name: r.name,
       description: r.description,
       requirementFamily: r.requirementFamily || null,
+      sortOrder: r.sortOrder ?? null,
     })),
     controls: [...controlsMap.values()],
     policies: [...policiesMap.values()],
diff --git a/apps/api/src/framework-editor/framework-family/dto/create-framework-family.dto.ts b/apps/api/src/framework-editor/framework-family/dto/create-framework-family.dto.ts
new file mode 100644
index 0000000000..bbd83c5342
--- /dev/null
+++ b/apps/api/src/framework-editor/framework-family/dto/create-framework-family.dto.ts
@@ -0,0 +1,25 @@
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { FrameworkEditorFrameworkFamilyStatus } from '@db';
+import { IsEnum, IsOptional, IsString, MaxLength, MinLength } from 'class-validator';
+
+export class CreateFrameworkFamilyDto {
+  @ApiProperty({ example: 'NIST SP800-53' })
+  @IsString()
+  @MinLength(1)
+  @MaxLength(255)
+  name: string;
+
+  @ApiPropertyOptional({ example: 'All NIST SP800-53 control families' })
+  @IsString()
+  @IsOptional()
+  @MaxLength(2000)
+  description?: string;
+
+  @ApiPropertyOptional({
+    enum: FrameworkEditorFrameworkFamilyStatus,
+    example: FrameworkEditorFrameworkFamilyStatus.hidden,
+  })
+  @IsEnum(FrameworkEditorFrameworkFamilyStatus)
+  @IsOptional()
+  status?: FrameworkEditorFrameworkFamilyStatus;
+}
diff --git a/apps/api/src/framework-editor/framework-family/dto/move-frameworks.dto.ts b/apps/api/src/framework-editor/framework-family/dto/move-frameworks.dto.ts
new file mode 100644
index 0000000000..616c5004ec
--- /dev/null
+++ b/apps/api/src/framework-editor/framework-family/dto/move-frameworks.dto.ts
@@ -0,0 +1,20 @@
+import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
+import { ArrayNotEmpty, IsArray, IsOptional, IsString } from 'class-validator';
+
+export class MoveFrameworksDto {
+  @ApiProperty({ type: [String], example: ['frk_abc', 'frk_def'] })
+  @IsArray()
+  @ArrayNotEmpty()
+  @IsString({ each: true })
+  frameworkIds: string[];
+
+  // Destination family id. null/omitted moves the frameworks to the root
+  // (ungrouped). @IsOptional() lets both null and undefined through.
+  @ApiPropertyOptional({
+    nullable: true,
+    description: 'Destination family id; null or omitted moves to the root.',
+  })
+  @IsString()
+  @IsOptional()
+  familyId?: string | null;
+}
diff --git a/apps/api/src/framework-editor/framework-family/dto/update-framework-family.dto.spec.ts b/apps/api/src/framework-editor/framework-family/dto/update-framework-family.dto.spec.ts
new file mode 100644
index 0000000000..335abc679c
--- /dev/null
+++ b/apps/api/src/framework-editor/framework-family/dto/update-framework-family.dto.spec.ts
@@ -0,0 +1,56 @@
+// Importing a DTO that re-exports from '@db' would otherwise boot the Prisma
+// client; mock it down to just the enum the DTO needs.
+jest.mock('@db', () => ({
+  FrameworkEditorFrameworkFamilyStatus: {
+    visible: 'visible',
+    hidden: 'hidden',
+    under_construction: 'under_construction',
+    partial: 'partial',
+  },
+}));
+
+import { plainToInstance } from 'class-transformer';
+import { validate } from 'class-validator';
+import { UpdateFrameworkFamilyDto } from './update-framework-family.dto';
+
+function toDto(plain: Record<string, unknown>): UpdateFrameworkFamilyDto {
+  return plainToInstance(UpdateFrameworkFamilyDto, plain, {
+    enableImplicitConversion: true,
+  });
+}
+
+describe('UpdateFrameworkFamilyDto', () => {
+  it('accepts an empty payload (every field is optional)', async () => {
+    const errors = await validate(toDto({}), { whitelist: true, forbidNonWhitelisted: true });
+    expect(errors).toHaveLength(0);
+  });
+
+  it('accepts a partial valid update', async () => {
+    const errors = await validate(toDto({ name: 'NIST', status: 'partial' }), {
+      whitelist: true,
+      forbidNonWhitelisted: true,
+    });
+    expect(errors).toHaveLength(0);
+  });
+
+  // Regression: null must be rejected, not silently passed to a non-nullable column.
+  it('rejects null name', async () => {
+    const errors = await validate(toDto({ name: null }), { whitelist: true });
+    expect(errors.some((e) => e.property === 'name')).toBe(true);
+  });
+
+  it('rejects null status', async () => {
+    const errors = await validate(toDto({ status: null }), { whitelist: true });
+    expect(errors.some((e) => e.property === 'status')).toBe(true);
+  });
+
+  it('rejects an empty-string name', async () => {
+    const errors = await validate(toDto({ name: '' }), { whitelist: true });
+    expect(errors.some((e) => e.property === 'name')).toBe(true);
+  });
+
+  it('rejects an invalid status value', async () => {
+    const errors = await validate(toDto({ status: 'bogus' }), { whitelist: true });
+    expect(errors.some((e) => e.property === 'status')).toBe(true);
+  });
+});
diff --git a/apps/api/src/framework-editor/framework-family/dto/update-framework-family.dto.ts b/apps/api/src/framework-editor/framework-family/dto/update-framework-family.dto.ts
new file mode 100644
index 0000000000..327e89a912
--- /dev/null
+++ b/apps/api/src/framework-editor/framework-family/dto/update-framework-family.dto.ts
@@ -0,0 +1,27 @@
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import { FrameworkEditorFrameworkFamilyStatus } from '@db';
+import { IsEnum, IsString, MaxLength, MinLength, ValidateIf } from 'class-validator';
+
+// Each field is optional (may be omitted) but must NOT be null when present —
+// @ValidateIf runs the validators whenever the key is sent (incl. null), so a
+// null reaches @IsString/@IsEnum and is rejected with a 400 instead of slipping
+// through to a non-nullable Prisma column. (@IsOptional() would skip null.)
+export class UpdateFrameworkFamilyDto {
+  @ApiPropertyOptional()
+  @ValidateIf((o) => o.name !== undefined)
+  @IsString()
+  @MinLength(1)
+  @MaxLength(255)
+  name?: string;
+
+  @ApiPropertyOptional()
+  @ValidateIf((o) => o.description !== undefined)
+  @IsString()
+  @MaxLength(2000)
+  description?: string;
+
+  @ApiPropertyOptional({ enum: FrameworkEditorFrameworkFamilyStatus })
+  @ValidateIf((o) => o.status !== undefined)
+  @IsEnum(FrameworkEditorFrameworkFamilyStatus)
+  status?: FrameworkEditorFrameworkFamilyStatus;
+}
diff --git a/apps/api/src/framework-editor/framework-family/framework-family.controller.ts b/apps/api/src/framework-editor/framework-family/framework-family.controller.ts
new file mode 100644
index 0000000000..663687fdf1
--- /dev/null
+++ b/apps/api/src/framework-editor/framework-family/framework-family.controller.ts
@@ -0,0 +1,58 @@
+import {
+  Body,
+  Controller,
+  Delete,
+  Get,
+  Param,
+  Patch,
+  Post,
+  UseGuards,
+  UsePipes,
+  ValidationPipe,
+} from '@nestjs/common';
+import { ApiOperation, ApiTags } from '@nestjs/swagger';
+import { PlatformAdminGuard } from '../../auth/platform-admin.guard';
+import { CreateFrameworkFamilyDto } from './dto/create-framework-family.dto';
+import { MoveFrameworksDto } from './dto/move-frameworks.dto';
+import { UpdateFrameworkFamilyDto } from './dto/update-framework-family.dto';
+import { FrameworkFamilyService } from './framework-family.service';
+
+@ApiTags('Framework Editor Framework Families')
+@Controller({ path: 'framework-editor/framework-family', version: '1' })
+@UseGuards(PlatformAdminGuard)
+export class FrameworkFamilyController {
+  constructor(private readonly service: FrameworkFamilyService) {}
+
+  @Get()
+  @ApiOperation({ summary: 'List framework families with framework counts' })
+  async findAll() {
+    return this.service.findAll();
+  }
+
+  @Post()
+  @ApiOperation({ summary: 'Create a framework family' })
+  @UsePipes(new ValidationPipe({ whitelist: true, transform: true }))
+  async create(@Body() dto: CreateFrameworkFamilyDto) {
+    return this.service.create(dto);
+  }
+
+  @Post('move')
+  @ApiOperation({ summary: 'Move frameworks into a family (or to the root)' })
+  @UsePipes(new ValidationPipe({ whitelist: true, transform: true }))
+  async move(@Body() dto: MoveFrameworksDto) {
+    return this.service.moveFrameworks(dto.frameworkIds, dto.familyId ?? null);
+  }
+
+  @Patch(':id')
+  @ApiOperation({ summary: 'Update a framework family' })
+  @UsePipes(new ValidationPipe({ whitelist: true, transform: true }))
+  async update(@Param('id') id: string, @Body() dto: UpdateFrameworkFamilyDto) {
+    return this.service.update(id, dto);
+  }
+
+  @Delete(':id')
+  @ApiOperation({ summary: 'Delete a framework family (must be empty)' })
+  async delete(@Param('id') id: string) {
+    return this.service.delete(id);
+  }
+}
diff --git a/apps/api/src/framework-editor/framework-family/framework-family.module.ts b/apps/api/src/framework-editor/framework-family/framework-family.module.ts
new file mode 100644
index 0000000000..0c0871f6bb
--- /dev/null
+++ b/apps/api/src/framework-editor/framework-family/framework-family.module.ts
@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { AuthModule } from '../../auth/auth.module';
+import { FrameworkFamilyController } from './framework-family.controller';
+import { FrameworkFamilyService } from './framework-family.service';
+
+@Module({
+  imports: [AuthModule],
+  controllers: [FrameworkFamilyController],
+  providers: [FrameworkFamilyService],
+  exports: [FrameworkFamilyService],
+})
+export class FrameworkFamilyModule {}
diff --git a/apps/api/src/framework-editor/framework-family/framework-family.service.spec.ts b/apps/api/src/framework-editor/framework-family/framework-family.service.spec.ts
new file mode 100644
index 0000000000..3b6a819052
--- /dev/null
+++ b/apps/api/src/framework-editor/framework-family/framework-family.service.spec.ts
@@ -0,0 +1,159 @@
+jest.mock('@db', () => ({
+  db: {
+    frameworkEditorFrameworkFamily: {
+      findMany: jest.fn(),
+      findUnique: jest.fn(),
+      create: jest.fn(),
+      update: jest.fn(),
+      delete: jest.fn(),
+      deleteMany: jest.fn(),
+    },
+    frameworkEditorFramework: {
+      updateMany: jest.fn(),
+    },
+  },
+  FrameworkEditorFrameworkFamilyStatus: {
+    visible: 'visible',
+    hidden: 'hidden',
+    under_construction: 'under_construction',
+    partial: 'partial',
+  },
+}));
+
+import { BadRequestException, NotFoundException } from '@nestjs/common';
+import { db } from '@db';
+import { FrameworkFamilyService } from './framework-family.service';
+
+const mockDb = db as jest.Mocked<typeof db>;
+const familyDb = mockDb.frameworkEditorFrameworkFamily as unknown as Record<string, jest.Mock>;
+const frameworkDb = mockDb.frameworkEditorFramework as unknown as Record<string, jest.Mock>;
+
+describe('FrameworkFamilyService', () => {
+  let service: FrameworkFamilyService;
+
+  beforeEach(() => {
+    service = new FrameworkFamilyService();
+    jest.clearAllMocks();
+  });
+
+  describe('findAll', () => {
+    it('maps the framework _count into frameworksCount and strips _count', async () => {
+      familyDb.findMany.mockResolvedValue([
+        { id: 'frk_fam_1', name: 'NIST', _count: { frameworks: 3 } },
+      ]);
+      const result = await service.findAll();
+      expect(result[0]).toEqual({ id: 'frk_fam_1', name: 'NIST', frameworksCount: 3, _count: undefined });
+    });
+  });
+
+  describe('create', () => {
+    it('defaults description to "" and status to hidden when omitted', async () => {
+      familyDb.create.mockResolvedValue({ id: 'frk_fam_new', name: 'X' });
+      await service.create({ name: 'X' } as never);
+      expect(familyDb.create.mock.calls[0][0].data).toEqual({
+        name: 'X',
+        description: '',
+        status: 'hidden',
+      });
+    });
+
+    it('persists a provided status and description', async () => {
+      familyDb.create.mockResolvedValue({ id: 'frk_fam_new', name: 'X' });
+      await service.create({ name: 'X', description: 'd', status: 'partial' } as never);
+      expect(familyDb.create.mock.calls[0][0].data).toEqual({
+        name: 'X',
+        description: 'd',
+        status: 'partial',
+      });
+    });
+  });
+
+  describe('update', () => {
+    it('throws NotFound when the family does not exist', async () => {
+      familyDb.findUnique.mockResolvedValue(null);
+      await expect(service.update('missing', { name: 'Y' } as never)).rejects.toBeInstanceOf(
+        NotFoundException,
+      );
+    });
+
+    it('only writes provided fields', async () => {
+      familyDb.findUnique.mockResolvedValue({ id: 'frk_fam_1', _count: { frameworks: 0 } });
+      familyDb.update.mockResolvedValue({ id: 'frk_fam_1', name: 'Y' });
+      await service.update('frk_fam_1', { name: 'Y' } as never);
+      expect(familyDb.update.mock.calls[0][0].data).toEqual({ name: 'Y' });
+    });
+
+    it('ignores explicit null fields (does not write null to non-nullable columns)', async () => {
+      familyDb.findUnique.mockResolvedValue({ id: 'frk_fam_1', _count: { frameworks: 0 } });
+      familyDb.update.mockResolvedValue({ id: 'frk_fam_1' });
+      await service.update('frk_fam_1', {
+        name: null,
+        description: null,
+        status: null,
+      } as never);
+      expect(familyDb.update.mock.calls[0][0].data).toEqual({});
+    });
+  });
+
+  describe('delete', () => {
+    it('refuses to delete a non-empty family (atomic conditional delete is a no-op)', async () => {
+      familyDb.findUnique.mockResolvedValue({
+        id: 'frk_fam_1',
+        name: 'NIST',
+        _count: { frameworks: 2 },
+      });
+      familyDb.deleteMany.mockResolvedValue({ count: 0 });
+      await expect(service.delete('frk_fam_1')).rejects.toBeInstanceOf(BadRequestException);
+    });
+
+    it('atomically deletes only when empty (frameworks: none filter)', async () => {
+      familyDb.findUnique.mockResolvedValue({
+        id: 'frk_fam_1',
+        name: 'NIST',
+        _count: { frameworks: 0 },
+      });
+      familyDb.deleteMany.mockResolvedValue({ count: 1 });
+      await service.delete('frk_fam_1');
+      expect(familyDb.deleteMany).toHaveBeenCalledWith({
+        where: { id: 'frk_fam_1', frameworks: { none: {} } },
+      });
+    });
+
+    it('throws NotFound for a missing family', async () => {
+      familyDb.findUnique.mockResolvedValue(null);
+      await expect(service.delete('missing')).rejects.toBeInstanceOf(NotFoundException);
+      expect(familyDb.deleteMany).not.toHaveBeenCalled();
+    });
+  });
+
+  describe('moveFrameworks', () => {
+    it('validates the destination family exists before moving', async () => {
+      familyDb.findUnique.mockResolvedValue(null);
+      await expect(service.moveFrameworks(['frk_1'], 'frk_fam_missing')).rejects.toBeInstanceOf(
+        NotFoundException,
+      );
+      expect(frameworkDb.updateMany).not.toHaveBeenCalled();
+    });
+
+    it('moves frameworks into a family', async () => {
+      familyDb.findUnique.mockResolvedValue({ id: 'frk_fam_1' });
+      frameworkDb.updateMany.mockResolvedValue({ count: 2 });
+      const result = await service.moveFrameworks(['frk_1', 'frk_2'], 'frk_fam_1');
+      expect(frameworkDb.updateMany).toHaveBeenCalledWith({
+        where: { id: { in: ['frk_1', 'frk_2'] } },
+        data: { familyId: 'frk_fam_1' },
+      });
+      expect(result).toEqual({ count: 2 });
+    });
+
+    it('moves frameworks to the root (null) without a family lookup', async () => {
+      frameworkDb.updateMany.mockResolvedValue({ count: 1 });
+      await service.moveFrameworks(['frk_1'], null);
+      expect(familyDb.findUnique).not.toHaveBeenCalled();
+      expect(frameworkDb.updateMany).toHaveBeenCalledWith({
+        where: { id: { in: ['frk_1'] } },
+        data: { familyId: null },
+      });
+    });
+  });
+});
diff --git a/apps/api/src/framework-editor/framework-family/framework-family.service.ts b/apps/api/src/framework-editor/framework-family/framework-family.service.ts
new file mode 100644
index 0000000000..912e8fafbf
--- /dev/null
+++ b/apps/api/src/framework-editor/framework-family/framework-family.service.ts
@@ -0,0 +1,113 @@
+import {
+  BadRequestException,
+  Injectable,
+  Logger,
+  NotFoundException,
+} from '@nestjs/common';
+import { db, FrameworkEditorFrameworkFamilyStatus } from '@db';
+import { CreateFrameworkFamilyDto } from './dto/create-framework-family.dto';
+import { UpdateFrameworkFamilyDto } from './dto/update-framework-family.dto';
+
+@Injectable()
+export class FrameworkFamilyService {
+  private readonly logger = new Logger(FrameworkFamilyService.name);
+
+  /** List families alphabetically with the number of frameworks in each. */
+  async findAll() {
+    const families = await db.frameworkEditorFrameworkFamily.findMany({
+      orderBy: { name: 'asc' },
+      include: { _count: { select: { frameworks: true } } },
+    });
+    return families.map((family) => ({
+      ...family,
+      frameworksCount: family._count.frameworks,
+      _count: undefined,
+    }));
+  }
+
+  async create(dto: CreateFrameworkFamilyDto) {
+    const family = await db.frameworkEditorFrameworkFamily.create({
+      data: {
+        name: dto.name,
+        description: dto.description ?? '',
+        status: dto.status ?? FrameworkEditorFrameworkFamilyStatus.hidden,
+      },
+    });
+    this.logger.log(`Created framework family: ${family.name} (${family.id})`);
+    return family;
+  }
+
+  async update(id: string, dto: UpdateFrameworkFamilyDto) {
+    await this.getOrThrow(id);
+    const updated = await db.frameworkEditorFrameworkFamily.update({
+      where: { id },
+      data: {
+        // `!= null` (not `!== undefined`) so an explicit null is ignored rather
+        // than written to these non-nullable columns (which would 500).
+        ...(dto.name != null && { name: dto.name }),
+        ...(dto.description != null && { description: dto.description }),
+        ...(dto.status != null && { status: dto.status }),
+      },
+    });
+    this.logger.log(`Updated framework family: ${updated.name} (${id})`);
+    return updated;
+  }
+
+  /**
+   * Delete a family — only allowed once it contains no frameworks.
+   *
+   * The emptiness check and the delete are a single atomic statement
+   * (`deleteMany` with a `frameworks: { none: {} }` predicate the DB evaluates
+   * at delete time), so a concurrent move that adds a framework can't slip
+   * between a check and the delete: it simply makes this a no-op (count 0). The
+   * RESTRICT FK is a second backstop.
+   */
+  async delete(id: string) {
+    const family = await this.getOrThrow(id);
+    const { count } = await db.frameworkEditorFrameworkFamily.deleteMany({
+      where: { id, frameworks: { none: {} } },
+    });
+    if (count === 0) {
+      throw new BadRequestException(
+        `Cannot delete "${family.name}": move or remove its frameworks first.`,
+      );
+    }
+    this.logger.log(`Deleted framework family ${id}`);
+    return { message: 'Framework family deleted successfully' };
+  }
+
+  /**
+   * Move frameworks into a family, or to the root when familyId is null.
+   * Validates the destination family exists before moving.
+   */
+  async moveFrameworks(frameworkIds: string[], familyId: string | null) {
+    if (familyId !== null) {
+      const family = await db.frameworkEditorFrameworkFamily.findUnique({
+        where: { id: familyId },
+        select: { id: true },
+      });
+      if (!family) {
+        throw new NotFoundException(`Framework family ${familyId} not found`);
+      }
+    }
+    const { count } = await db.frameworkEditorFramework.updateMany({
+      where: { id: { in: frameworkIds } },
+      data: { familyId },
+    });
+    this.logger.log(
+      `Moved ${count} framework(s) to ${familyId ?? 'root'}`,
+    );
+    return { count };
+  }
+
+  private async getOrThrow(id: string) {
+    const family = await db.frameworkEditorFrameworkFamily.findUnique({
+      where: { id },
+      include: { _count: { select: { frameworks: true } } },
+    });
+    if (!family) {
+      throw new NotFoundException(`Framework family ${id} not found`);
+    }
+    return family;
+  }
+}
diff --git a/apps/api/src/framework-editor/framework/dto/import-framework.dto.ts b/apps/api/src/framework-editor/framework/dto/import-framework.dto.ts
index c5f3b91463..a20d31d2f1 100644
--- a/apps/api/src/framework-editor/framework/dto/import-framework.dto.ts
+++ b/apps/api/src/framework-editor/framework/dto/import-framework.dto.ts
@@ -73,6 +73,13 @@ class ImportRequirementDto {
   @IsOptional()
   @MaxLength(255)
   requirementFamily?: string;
+
+  // FRAME-18: per-framework display order, preserved across export/import.
+  @ApiPropertyOptional({ nullable: true })
+  @IsInt()
+  @Min(0)
+  @IsOptional()
+  sortOrder?: number | null;
 }
 
 class ImportControlTemplateDto {
diff --git a/apps/api/src/framework-editor/framework/framework-export.service.ts b/apps/api/src/framework-editor/framework/framework-export.service.ts
index da66a42d1c..cad02aa48a 100644
--- a/apps/api/src/framework-editor/framework/framework-export.service.ts
+++ b/apps/api/src/framework-editor/framework/framework-export.service.ts
@@ -22,6 +22,7 @@ export interface ExportedFramework {
     identifier: string;
     description: string;
     requirementFamily?: string | null;
+    sortOrder?: number | null;
   }>;
   controlTemplates: Array<{
     name: string;
@@ -63,7 +64,13 @@ export class FrameworkExportService {
 
     const requirements = await db.frameworkEditorRequirement.findMany({
       where: { frameworkId },
-      orderBy: { name: 'asc' },
+      // FRAME-18: export in configured order; identifier (canonical key) then
+      // name as the secondary/tertiary tiebreak, matching the manifest builder.
+      orderBy: [
+        { sortOrder: { sort: 'asc', nulls: 'last' } },
+        { identifier: 'asc' },
+        { name: 'asc' },
+      ],
     });
 
     const controlTemplates = await db.frameworkEditorControlTemplate.findMany({
@@ -131,6 +138,7 @@ export class FrameworkExportService {
         identifier: r.identifier,
         description: r.description,
         requirementFamily: r.requirementFamily || null,
+        sortOrder: r.sortOrder ?? null,
       })),
       controlTemplates: controlTemplates.map((ct) => ({
         name: ct.name,
@@ -194,6 +202,7 @@ export class FrameworkExportService {
               identifier: r.identifier ?? '',
               description: r.description,
               requirementFamily: r.requirementFamily || null,
+              sortOrder: r.sortOrder ?? null,
             },
           }),
         ),
diff --git a/apps/api/src/framework-editor/framework/framework.service.ts b/apps/api/src/framework-editor/framework/framework.service.ts
index a75413541d..d2e4234863 100644
--- a/apps/api/src/framework-editor/framework/framework.service.ts
+++ b/apps/api/src/framework-editor/framework/framework.service.ts
@@ -53,7 +53,14 @@ export class FrameworkEditorFrameworkService {
       where: { id },
       include: {
         requirements: {
-          orderBy: { name: 'asc' },
+          // FRAME-18: surface requirements in the framework's configured order
+          // (numbered first, unset last), tiebreaking by identifier (the
+          // canonical-order key) then name, so the editor grid opens pre-sorted.
+          orderBy: [
+            { sortOrder: { sort: 'asc', nulls: 'last' } },
+            { identifier: 'asc' },
+            { name: 'asc' },
+          ],
           include: {
             controlTemplates: { select: { id: true, name: true } },
           },
diff --git a/apps/api/src/framework-editor/requirement/dto/batch-update-requirements.dto.ts b/apps/api/src/framework-editor/requirement/dto/batch-update-requirements.dto.ts
index 250da0f694..bea2a7b885 100644
--- a/apps/api/src/framework-editor/requirement/dto/batch-update-requirements.dto.ts
+++ b/apps/api/src/framework-editor/requirement/dto/batch-update-requirements.dto.ts
@@ -2,10 +2,12 @@ import { ApiProperty } from '@nestjs/swagger';
 import { Type } from 'class-transformer';
 import {
   IsArray,
+  IsInt,
   IsNotEmpty,
   IsString,
   IsOptional,
   MaxLength,
+  Min,
   ValidateNested,
 } from 'class-validator';
 
@@ -38,6 +40,13 @@ class BatchUpdateRequirementItem {
   @IsOptional()
   @MaxLength(255)
   requirementFamily?: string;
+
+  // Nullable so a batch update can clear an order back to "unset".
+  @ApiProperty({ required: false, nullable: true })
+  @IsInt()
+  @Min(0)
+  @IsOptional()
+  sortOrder?: number | null;
 }
 
 export class BatchUpdateRequirementsDto {
diff --git a/apps/api/src/framework-editor/requirement/dto/create-requirement.dto.spec.ts b/apps/api/src/framework-editor/requirement/dto/create-requirement.dto.spec.ts
index 693976958b..41576de3b0 100644
--- a/apps/api/src/framework-editor/requirement/dto/create-requirement.dto.spec.ts
+++ b/apps/api/src/framework-editor/requirement/dto/create-requirement.dto.spec.ts
@@ -47,4 +47,29 @@ describe('CreateRequirementDto', () => {
     expect(errors.length).toBeGreaterThan(0);
     expect(errors[0].property).toBe('description');
   });
+
+  // ── sortOrder (FRAME-18) ───────────────────────────────────────────
+  it('accepts a non-negative integer sortOrder', async () => {
+    const dto = toDto({ ...VALID_BASE, sortOrder: 10 });
+    const errors = await validate(dto, { whitelist: true, forbidNonWhitelisted: true });
+    expect(errors).toHaveLength(0);
+  });
+
+  it('accepts a payload with no sortOrder', async () => {
+    const dto = toDto(VALID_BASE);
+    const errors = await validate(dto, { whitelist: true, forbidNonWhitelisted: true });
+    expect(errors.some((e) => e.property === 'sortOrder')).toBe(false);
+  });
+
+  it('rejects a negative sortOrder', async () => {
+    const dto = toDto({ ...VALID_BASE, sortOrder: -1 });
+    const errors = await validate(dto, { whitelist: true, forbidNonWhitelisted: true });
+    expect(errors.some((e) => e.property === 'sortOrder')).toBe(true);
+  });
+
+  it('rejects a non-integer sortOrder', async () => {
+    const dto = toDto({ ...VALID_BASE, sortOrder: 1.5 });
+    const errors = await validate(dto, { whitelist: true, forbidNonWhitelisted: true });
+    expect(errors.some((e) => e.property === 'sortOrder')).toBe(true);
+  });
 });
diff --git a/apps/api/src/framework-editor/requirement/dto/create-requirement.dto.ts b/apps/api/src/framework-editor/requirement/dto/create-requirement.dto.ts
index 8c21671c00..479f379e26 100644
--- a/apps/api/src/framework-editor/requirement/dto/create-requirement.dto.ts
+++ b/apps/api/src/framework-editor/requirement/dto/create-requirement.dto.ts
@@ -1,5 +1,5 @@
 import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';
-import { IsString, IsNotEmpty, IsOptional, MaxLength } from 'class-validator';
+import { IsInt, IsNotEmpty, IsOptional, IsString, MaxLength, Min } from 'class-validator';
 
 export class CreateRequirementDto {
   @ApiProperty({ example: 'frk_abc123' })
@@ -30,4 +30,13 @@ export class CreateRequirementDto {
   @IsOptional()
   @MaxLength(255)
   requirementFamily?: string;
+
+  @ApiPropertyOptional({
+    example: 10,
+    description: 'Display order within the framework (lower sorts first).',
+  })
+  @IsInt()
+  @Min(0)
+  @IsOptional()
+  sortOrder?: number;
 }
diff --git a/apps/api/src/framework-editor/requirement/dto/update-requirement.dto.ts b/apps/api/src/framework-editor/requirement/dto/update-requirement.dto.ts
index 705707934d..367bcdc0e3 100644
--- a/apps/api/src/framework-editor/requirement/dto/update-requirement.dto.ts
+++ b/apps/api/src/framework-editor/requirement/dto/update-requirement.dto.ts
@@ -1,5 +1,5 @@
 import { ApiPropertyOptional } from '@nestjs/swagger';
-import { IsString, IsOptional, MaxLength } from 'class-validator';
+import { IsInt, IsOptional, IsString, MaxLength, Min } from 'class-validator';
 
 export class UpdateRequirementDto {
   @ApiPropertyOptional()
@@ -25,4 +25,12 @@ export class UpdateRequirementDto {
   @IsOptional()
   @MaxLength(255)
   requirementFamily?: string;
+
+  // Nullable so the editor can clear an order back to "unset". @IsOptional()
+  // skips validation for both null and undefined, letting null pass through.
+  @ApiPropertyOptional({ nullable: true })
+  @IsInt()
+  @Min(0)
+  @IsOptional()
+  sortOrder?: number | null;
 }
diff --git a/apps/api/src/framework-editor/requirement/requirement.service.spec.ts b/apps/api/src/framework-editor/requirement/requirement.service.spec.ts
new file mode 100644
index 0000000000..db45a26fc9
--- /dev/null
+++ b/apps/api/src/framework-editor/requirement/requirement.service.spec.ts
@@ -0,0 +1,135 @@
+jest.mock('@db', () => ({
+  db: {
+    frameworkEditorRequirement: {
+      create: jest.fn(),
+      findUnique: jest.fn(),
+      findMany: jest.fn(),
+      update: jest.fn(),
+      delete: jest.fn(),
+    },
+    frameworkEditorFramework: {
+      findUnique: jest.fn(),
+    },
+    $transaction: jest.fn(),
+  },
+}));
+
+import { db } from '@db';
+import { RequirementService } from './requirement.service';
+
+const mockDb = db as jest.Mocked<typeof db>;
+
+describe('RequirementService — sortOrder (FRAME-18)', () => {
+  let service: RequirementService;
+
+  beforeEach(() => {
+    service = new RequirementService();
+    jest.clearAllMocks();
+    (mockDb.frameworkEditorFramework.findUnique as jest.Mock).mockResolvedValue({
+      id: 'frk_1',
+    });
+    (mockDb.frameworkEditorRequirement.create as jest.Mock).mockResolvedValue({
+      id: 'frk_rq_new',
+      name: 'New',
+    });
+    (mockDb.frameworkEditorRequirement.findUnique as jest.Mock).mockResolvedValue({
+      id: 'frk_rq_1',
+    });
+    (mockDb.frameworkEditorRequirement.update as jest.Mock).mockResolvedValue({
+      id: 'frk_rq_1',
+      name: 'Updated',
+    });
+    // batchUpdate wraps the per-row update() promises in a transaction.
+    (mockDb.$transaction as jest.Mock).mockImplementation((ops: Promise<unknown>[]) =>
+      Promise.all(ops),
+    );
+  });
+
+  const createDataOf = () =>
+    (mockDb.frameworkEditorRequirement.create as jest.Mock).mock.calls[0][0].data;
+  const updateDataOf = (i = 0) =>
+    (mockDb.frameworkEditorRequirement.update as jest.Mock).mock.calls[i][0].data;
+
+  describe('create', () => {
+    it('persists a provided sortOrder', async () => {
+      await service.create({
+        frameworkId: 'frk_1',
+        name: 'R1',
+        description: 'd',
+        sortOrder: 5,
+      } as never);
+
+      expect(createDataOf().sortOrder).toBe(5);
+    });
+
+    it('defaults sortOrder to null when omitted', async () => {
+      await service.create({
+        frameworkId: 'frk_1',
+        name: 'R1',
+        description: 'd',
+      } as never);
+
+      expect(createDataOf().sortOrder).toBeNull();
+    });
+  });
+
+  describe('update', () => {
+    it('persists a provided sortOrder', async () => {
+      await service.update('frk_rq_1', { sortOrder: 7 } as never);
+      expect(updateDataOf().sortOrder).toBe(7);
+    });
+
+    it('clears sortOrder when null is sent', async () => {
+      await service.update('frk_rq_1', { sortOrder: null } as never);
+      expect(updateDataOf().sortOrder).toBeNull();
+    });
+
+    it('leaves sortOrder untouched when not provided', async () => {
+      await service.update('frk_rq_1', { name: 'Renamed' } as never);
+      expect(updateDataOf().sortOrder).toBeUndefined();
+    });
+  });
+
+  describe('batchUpdate', () => {
+    it('persists sortOrder for rows that include it (including null to clear)', async () => {
+      await service.batchUpdate([
+        { id: 'a', sortOrder: 3 },
+        { id: 'b', sortOrder: null },
+        { id: 'c', name: 'NoOrder' },
+      ]);
+
+      expect(updateDataOf(0).sortOrder).toBe(3);
+      expect(updateDataOf(1).sortOrder).toBeNull();
+      // Row without sortOrder must not include the key at all (untouched).
+      expect('sortOrder' in updateDataOf(2)).toBe(false);
+    });
+  });
+
+  describe('findAll / findAllForFramework ordering', () => {
+    beforeEach(() => {
+      (mockDb.frameworkEditorRequirement.findMany as jest.Mock).mockResolvedValue([]);
+    });
+
+    it('orders by sortOrder ascending with nulls last, then name', async () => {
+      await service.findAll();
+      const orderBy = (mockDb.frameworkEditorRequirement.findMany as jest.Mock).mock
+        .calls[0][0].orderBy;
+      expect(orderBy).toEqual([
+        { sortOrder: { sort: 'asc', nulls: 'last' } },
+        { identifier: 'asc' },
+        { name: 'asc' },
+      ]);
+    });
+
+    it('orders per-framework requirements the same way', async () => {
+      await service.findAllForFramework('frk_1');
+      const orderBy = (mockDb.frameworkEditorRequirement.findMany as jest.Mock).mock
+        .calls[0][0].orderBy;
+      expect(orderBy).toEqual([
+        { sortOrder: { sort: 'asc', nulls: 'last' } },
+        { identifier: 'asc' },
+        { name: 'asc' },
+      ]);
+    });
+  });
+});
diff --git a/apps/api/src/framework-editor/requirement/requirement.service.ts b/apps/api/src/framework-editor/requirement/requirement.service.ts
index 42732802dd..7b1ab35409 100644
--- a/apps/api/src/framework-editor/requirement/requirement.service.ts
+++ b/apps/api/src/framework-editor/requirement/requirement.service.ts
@@ -11,7 +11,15 @@ export class RequirementService {
     return db.frameworkEditorRequirement.findMany({
       take,
       skip,
-      orderBy: { name: 'asc' },
+      // FRAME-18: numbered requirements first (ascending), unset rows last,
+      // then by identifier (the canonical-order key, e.g. CC6.1 / GV.OC-01),
+      // with name as a final stable tiebreak. Identifier — not name — matches
+      // the editor/app comparators and is stable when descriptive names change.
+      orderBy: [
+        { sortOrder: { sort: 'asc', nulls: 'last' } },
+        { identifier: 'asc' },
+        { name: 'asc' },
+      ],
       include: {
         framework: { select: { id: true, name: true } },
       },
@@ -21,7 +29,11 @@ export class RequirementService {
   async findAllForFramework(frameworkId: string) {
     return db.frameworkEditorRequirement.findMany({
       where: { frameworkId },
-      orderBy: { name: 'asc' },
+      orderBy: [
+        { sortOrder: { sort: 'asc', nulls: 'last' } },
+        { identifier: 'asc' },
+        { name: 'asc' },
+      ],
       include: {
         controlTemplates: { select: { id: true, name: true } },
       },
@@ -43,6 +55,7 @@ export class RequirementService {
         identifier: dto.identifier ?? '',
         description: dto.description ?? '',
         requirementFamily: dto.requirementFamily || null,
+        sortOrder: dto.sortOrder ?? null,
       },
     });
     this.logger.log(`Created requirement: ${req.name} (${req.id})`);
@@ -77,6 +90,7 @@ export class RequirementService {
       identifier?: string;
       description?: string;
       requirementFamily?: string;
+      sortOrder?: number | null;
     }>,
   ) {
     return db.$transaction(
@@ -95,6 +109,8 @@ export class RequirementService {
             ...(data.requirementFamily !== undefined && {
               requirementFamily: data.requirementFamily || null,
             }),
+            // null clears the order; undefined leaves it untouched.
+            ...(data.sortOrder !== undefined && { sortOrder: data.sortOrder }),
           },
         });
       }),
diff --git a/apps/api/src/frameworks/framework-versioning/manifest.types.ts b/apps/api/src/frameworks/framework-versioning/manifest.types.ts
index f47ae009ac..e76a66e594 100644
--- a/apps/api/src/frameworks/framework-versioning/manifest.types.ts
+++ b/apps/api/src/frameworks/framework-versioning/manifest.types.ts
@@ -21,6 +21,7 @@ export interface ManifestRequirement {
   name: string;
   description: string | null;
   requirementFamily?: string | null;
+  sortOrder?: number | null; // FRAME-18: per-framework display order
 }
 
 export interface ManifestControl {
diff --git a/apps/api/src/frameworks/frameworks.service.spec.ts b/apps/api/src/frameworks/frameworks.service.spec.ts
index 81b4e28e69..dad4f7b141 100644
--- a/apps/api/src/frameworks/frameworks.service.spec.ts
+++ b/apps/api/src/frameworks/frameworks.service.spec.ts
@@ -30,6 +30,12 @@ jest.mock('@db', () => ({
     evidenceSubmission: {
       findMany: jest.fn(),
     },
+    frameworkEditorFramework: {
+      findMany: jest.fn(),
+    },
+    customFramework: {
+      findMany: jest.fn(),
+    },
   },
   // The frameworks-timeline helper imports FindingType (a Prisma enum) at module
   // load. Stub it so the spec file can be evaluated without the real client.
@@ -163,6 +169,40 @@ describe('FrameworksService', () => {
     });
   });
 
+  // Regression coverage for "GDPR framework showing as HIPAA": findAvailable
+  // feeds the setup screen, which auto-selects visibleFrameworks[0] when the
+  // user hasn't toggled a pill. Without a deterministic orderBy, Postgres
+  // returned platform frameworks in arbitrary order, so the silent default
+  // could land on the wrong framework (e.g. HIPAA when GDPR was expected).
+  describe('findAvailable', () => {
+    beforeEach(() => {
+      (mockDb.frameworkEditorFramework.findMany as jest.Mock).mockResolvedValue(
+        [],
+      );
+      (mockDb.customFramework.findMany as jest.Mock).mockResolvedValue([]);
+    });
+
+    it('orders platform frameworks deterministically by name', async () => {
+      await service.findAvailable();
+
+      expect(mockDb.frameworkEditorFramework.findMany).toHaveBeenCalledWith({
+        where: { visible: true },
+        include: { requirements: true },
+        orderBy: { name: 'asc' },
+      });
+    });
+
+    it('orders an org\'s custom frameworks deterministically by name', async () => {
+      await service.findAvailable('org_1');
+
+      expect(mockDb.customFramework.findMany).toHaveBeenCalledWith({
+        where: { organizationId: 'org_1' },
+        include: { requirements: true },
+        orderBy: { name: 'asc' },
+      });
+    });
+  });
+
   // Regression coverage for the cross-tenant leak that existed on this branch
   // before the split: previously both findOne and findRequirement read from
   // FrameworkEditorRequirement without filtering by organizationId, so an org's
diff --git a/apps/api/src/frameworks/frameworks.service.ts b/apps/api/src/frameworks/frameworks.service.ts
index 2230f4a089..7ee1d65b7f 100644
--- a/apps/api/src/frameworks/frameworks.service.ts
+++ b/apps/api/src/frameworks/frameworks.service.ts
@@ -25,11 +25,31 @@ type RequirementDef = {
   identifier: string;
   description: string;
   requirementFamily?: string | null;
+  sortOrder?: number | null;
   frameworkId: string | null;
   customFrameworkId: string | null;
   kind: 'platform' | 'custom';
 };
 
+// FRAME-18: numbered requirements first (ascending), unset rows (incl. per-instance
+// custom requirements) last, then by identifier (the canonical-order key, e.g.
+// CC6.1 / GV.OC-01) with name as a final tiebreak. Mirrors the app-side
+// `compareRequirementsByOrder` so server and client agree on the order.
+function compareRequirementDefs(a: RequirementDef, b: RequirementDef): number {
+  const ao = a.sortOrder ?? null;
+  const bo = b.sortOrder ?? null;
+  if (ao !== bo) {
+    if (ao === null) return 1;
+    if (bo === null) return -1;
+    return ao - bo;
+  }
+  const byIdentifier = (a.identifier ?? '').localeCompare(b.identifier ?? '', undefined, {
+    numeric: true,
+  });
+  if (byIdentifier !== 0) return byIdentifier;
+  return a.name.localeCompare(b.name);
+}
+
 @Injectable()
 export class FrameworksService {
   private readonly logger = new Logger(FrameworksService.name);
@@ -106,20 +126,23 @@ export class FrameworksService {
               identifier: r.identifier,
               description: r.description ?? '',
               requirementFamily: r.requirementFamily ?? null,
+              sortOrder: r.sortOrder ?? null,
               frameworkId: fi.frameworkId,
               customFrameworkId: null,
               kind: 'platform',
             }),
           );
-          return [...platformDefs, ...customDefs].sort((a, b) =>
-            a.name.localeCompare(b.name),
-          );
+          return [...platformDefs, ...customDefs].sort(compareRequirementDefs);
         }
       }
       // Fallback: instances with no pinned version (shouldn't happen post-backfill).
       const rows = await db.frameworkEditorRequirement.findMany({
         where: { frameworkId: fi.frameworkId },
-        orderBy: { name: 'asc' },
+        orderBy: [
+          { sortOrder: { sort: 'asc', nulls: 'last' } },
+          { identifier: 'asc' },
+          { name: 'asc' },
+        ],
       });
       const platformDefs: RequirementDef[] = rows.map((r) => ({
         id: r.id,
@@ -127,13 +150,12 @@ export class FrameworksService {
         identifier: r.identifier,
         description: r.description,
         requirementFamily: r.requirementFamily ?? null,
+        sortOrder: r.sortOrder ?? null,
         frameworkId: r.frameworkId,
         customFrameworkId: null,
         kind: 'platform',
       }));
-      return [...platformDefs, ...customDefs].sort((a, b) =>
-        a.name.localeCompare(b.name),
-      );
+      return [...platformDefs, ...customDefs].sort(compareRequirementDefs);
     }
     return [];
   }
@@ -403,11 +425,13 @@ export class FrameworksService {
       db.frameworkEditorFramework.findMany({
         where: { visible: true },
         include: { requirements: true },
+        orderBy: { name: 'asc' },
       }),
       organizationId
         ? db.customFramework.findMany({
             where: { organizationId },
             include: { requirements: true },
+            orderBy: { name: 'asc' },
           })
         : Promise.resolve([]),
     ]);
diff --git a/apps/api/src/people/utils/member-queries.spec.ts b/apps/api/src/people/utils/member-queries.spec.ts
index 90f53ba7a3..ac804e8443 100644
--- a/apps/api/src/people/utils/member-queries.spec.ts
+++ b/apps/api/src/people/utils/member-queries.spec.ts
@@ -88,3 +88,40 @@ describe('MemberQueries.updateMember — background-check exemption fields', ()
     expect(call.data).not.toHaveProperty('backgroundCheckExemptJustification');
   });
 });
+
+describe('MemberQueries.updateMember — reactivation', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (mockedDb.member.update as jest.Mock).mockResolvedValue({ id: 'mem_1' });
+  });
+
+  // Regression for "Unable to reactivate user": a member deactivated via
+  // offboarding carries deactivated:true. The status dropdown reactivates by
+  // sending { isActive: true }; without also clearing deactivated the member
+  // stays hidden from the people list, so isActive alone is not enough.
+  it('clears deactivated when reactivating via isActive: true', async () => {
+    await MemberQueries.updateMember('mem_1', 'org_1', { isActive: true });
+
+    expect(mockedDb.member.update).toHaveBeenCalledWith(
+      expect.objectContaining({
+        where: { id: 'mem_1', organizationId: 'org_1' },
+        data: expect.objectContaining({ isActive: true, deactivated: false }),
+      }),
+    );
+  });
+
+  it('does not touch deactivated when the patch omits isActive', async () => {
+    await MemberQueries.updateMember('mem_1', 'org_1', { jobTitle: 'Engineer' });
+
+    const call = (mockedDb.member.update as jest.Mock).mock.calls[0][0];
+    expect(call.data).not.toHaveProperty('deactivated');
+  });
+
+  it('does not reactivate when deactivating via isActive: false', async () => {
+    await MemberQueries.updateMember('mem_1', 'org_1', { isActive: false });
+
+    const call = (mockedDb.member.update as jest.Mock).mock.calls[0][0];
+    expect(call.data.isActive).toBe(false);
+    expect(call.data).not.toHaveProperty('deactivated');
+  });
+});
diff --git a/apps/api/src/people/utils/member-queries.ts b/apps/api/src/people/utils/member-queries.ts
index d9f70cd356..abf56d24f9 100644
--- a/apps/api/src/people/utils/member-queries.ts
+++ b/apps/api/src/people/utils/member-queries.ts
@@ -169,6 +169,14 @@ export class MemberQueries {
       updatePayload.backgroundCheckExemptJustification = null;
     }
 
+    // Reactivation: the status dropdown sends { isActive: true } via PATCH. A
+    // member deactivated via offboarding (or the skip-offboarding path) carries
+    // deactivated:true, which hides them from the people list. Clear it so
+    // isActive and deactivated stay in sync and the member is fully restored.
+    if (updatePayload.isActive === true) {
+      updatePayload.deactivated = false;
+    }
+
     const hasUserUpdates = name !== undefined || email !== undefined;
     const hasMemberUpdates = Object.keys(updatePayload).length > 0;
 
diff --git a/apps/api/src/people/utils/member-validator.spec.ts b/apps/api/src/people/utils/member-validator.spec.ts
new file mode 100644
index 0000000000..4fb06bf5d7
--- /dev/null
+++ b/apps/api/src/people/utils/member-validator.spec.ts
@@ -0,0 +1,81 @@
+import { NotFoundException } from '@nestjs/common';
+import { MemberValidator } from './member-validator';
+
+jest.mock('@db', () => ({
+  db: {
+    member: {
+      findFirst: jest.fn(),
+    },
+  },
+}));
+
+import { db } from '@db';
+
+const mockedDb = db as jest.Mocked<typeof db>;
+
+describe('MemberValidator.validateMemberExists — deactivated members', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  // Regression for "Unable to reactivate user": reactivation flows through the
+  // member-update path, which calls validateMemberExists first. A member
+  // deactivated via offboarding (deactivated:true) must still be found here, or
+  // the update 404s before it can clear the flag.
+  it('finds a deactivated member (does not filter deactivated:false)', async () => {
+    const deactivatedMember = {
+      id: 'mem_1',
+      userId: 'usr_1',
+      role: 'employee',
+      deactivated: true,
+      organizationId: 'org_1',
+    };
+
+    // Emulate Prisma: a query restricting deactivated:false cannot match a
+    // member whose deactivated is true.
+    (mockedDb.member.findFirst as jest.Mock).mockImplementation(
+      ({ where }: { where: Record<string, unknown> }) => {
+        if (
+          where.id !== deactivatedMember.id ||
+          where.organizationId !== deactivatedMember.organizationId
+        ) {
+          return Promise.resolve(null);
+        }
+        if (where.deactivated === false && deactivatedMember.deactivated) {
+          return Promise.resolve(null);
+        }
+        return Promise.resolve({
+          id: deactivatedMember.id,
+          userId: deactivatedMember.userId,
+          role: deactivatedMember.role,
+        });
+      },
+    );
+
+    await expect(
+      MemberValidator.validateMemberExists('mem_1', 'org_1'),
+    ).resolves.toEqual({ id: 'mem_1', userId: 'usr_1', role: 'employee' });
+  });
+
+  it('throws NotFoundException when the member is not in the organization', async () => {
+    (mockedDb.member.findFirst as jest.Mock).mockResolvedValue(null);
+
+    await expect(
+      MemberValidator.validateMemberExists('mem_x', 'org_1'),
+    ).rejects.toThrow(NotFoundException);
+  });
+
+  it('scopes the lookup to the organization', async () => {
+    (mockedDb.member.findFirst as jest.Mock).mockResolvedValue({
+      id: 'mem_1',
+      userId: 'usr_1',
+      role: 'employee',
+    });
+
+    await MemberValidator.validateMemberExists('mem_1', 'org_1');
+
+    const call = (mockedDb.member.findFirst as jest.Mock).mock.calls[0][0];
+    expect(call.where.id).toBe('mem_1');
+    expect(call.where.organizationId).toBe('org_1');
+  });
+});
diff --git a/apps/api/src/people/utils/member-validator.ts b/apps/api/src/people/utils/member-validator.ts
index a412eb0b92..e8b43969f5 100644
--- a/apps/api/src/people/utils/member-validator.ts
+++ b/apps/api/src/people/utils/member-validator.ts
@@ -37,7 +37,12 @@ export class MemberValidator {
   }
 
   /**
-   * Validates that a member exists in an organization
+   * Validates that a member exists in an organization.
+   *
+   * Deactivated members are intentionally included. This check guards the
+   * member-update path, and reactivating a deactivated member (the status
+   * dropdown sends PATCH { isActive: true }) must be able to find them.
+   * Organization scoping is preserved.
    */
   static async validateMemberExists(
     memberId: string,
@@ -47,7 +52,6 @@ export class MemberValidator {
       where: {
         id: memberId,
         organizationId,
-        deactivated: false,
       },
       select: { id: true, userId: true, role: true },
     });
diff --git a/apps/api/src/trigger/browser-automation/run-browser-automation.spec.ts b/apps/api/src/trigger/browser-automation/run-browser-automation.spec.ts
new file mode 100644
index 0000000000..d445fa8497
--- /dev/null
+++ b/apps/api/src/trigger/browser-automation/run-browser-automation.spec.ts
@@ -0,0 +1,54 @@
+jest.mock('@db', () => ({
+  db: {
+    browserAutomation: { findUnique: jest.fn(), update: jest.fn() },
+    browserAutomationRun: { create: jest.fn() },
+    task: { findUnique: jest.fn(), update: jest.fn() },
+    organization: { findUnique: jest.fn() },
+    member: { findMany: jest.fn() },
+  },
+}));
+
+jest.mock('@trigger.dev/sdk', () => ({
+  logger: { info: jest.fn(), warn: jest.fn(), error: jest.fn() },
+  tags: { add: jest.fn() },
+  task: (config: unknown) => config,
+}));
+
+jest.mock('../../email/trigger-email', () => ({
+  triggerEmail: jest.fn(),
+}));
+
+jest.mock('@trycompai/email', () => ({
+  isUserUnsubscribed: jest.fn().mockResolvedValue(false),
+}));
+
+import { shouldMarkTaskDoneAfterBrowserRun } from './run-browser-automation';
+
+describe('shouldMarkTaskDoneAfterBrowserRun', () => {
+  it('allows screenshot-only automations to complete tasks', () => {
+    expect(
+      shouldMarkTaskDoneAfterBrowserRun({
+        screenshotUrl: 'https://example.com/screenshot.jpg',
+        evaluationCriteria: null,
+      }),
+    ).toBe(true);
+  });
+
+  it('requires a passing evaluation when criteria are configured', () => {
+    expect(
+      shouldMarkTaskDoneAfterBrowserRun({
+        screenshotUrl: 'https://example.com/screenshot.jpg',
+        evaluationCriteria: 'Branch protection is enabled',
+        evaluationStatus: 'pass',
+      }),
+    ).toBe(true);
+
+    expect(
+      shouldMarkTaskDoneAfterBrowserRun({
+        screenshotUrl: 'https://example.com/screenshot.jpg',
+        evaluationCriteria: 'Branch protection is enabled',
+        evaluationStatus: 'fail',
+      }),
+    ).toBe(false);
+  });
+});
diff --git a/apps/api/src/trigger/browser-automation/run-browser-automation.ts b/apps/api/src/trigger/browser-automation/run-browser-automation.ts
index 26b54945a2..05dbf1d024 100644
--- a/apps/api/src/trigger/browser-automation/run-browser-automation.ts
+++ b/apps/api/src/trigger/browser-automation/run-browser-automation.ts
@@ -7,6 +7,25 @@ import { isUserUnsubscribed } from '@trycompai/email';
 
 const browserbaseService = new BrowserbaseService();
 
+const browserAutomationConcurrencyLimit = (): number => {
+  const parsed = Number.parseInt(
+    process.env.BROWSER_AUTOMATION_GLOBAL_CONCURRENCY ?? '20',
+    10,
+  );
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 20;
+};
+
+export function shouldMarkTaskDoneAfterBrowserRun(input: {
+  screenshotUrl?: string;
+  evaluationCriteria?: string | null;
+  evaluationStatus?: 'pass' | 'fail';
+}): boolean {
+  if (!input.screenshotUrl) return false;
+  const criteria = input.evaluationCriteria?.trim();
+  if (!criteria) return true;
+  return input.evaluationStatus === 'pass';
+}
+
 /**
  * Send email notifications for task status change
  */
@@ -171,7 +190,7 @@ export const runBrowserAutomation = task({
   id: 'run-browser-automation',
   maxDuration: 1000 * 60 * 10, // 10 minutes per automation
   queue: {
-    concurrencyLimit: 80,
+    concurrencyLimit: browserAutomationConcurrencyLimit(),
   },
   retry: {
     maxAttempts: 2,
@@ -217,29 +236,6 @@ export const runBrowserAutomation = task({
     });
     const taskTitle = taskDetails?.title ?? 'Unknown Task';
 
-    // Check if org has browser context
-    const context = await browserbaseService.getOrgContext(organizationId);
-    if (!context) {
-      logger.error(`No browser context for org ${organizationId}`);
-
-      // Create a failed run record
-      await db.browserAutomationRun.create({
-        data: {
-          automationId,
-          status: 'failed',
-          startedAt: new Date(),
-          completedAt: new Date(),
-          error: 'No browser context. Please connect your browser in settings.',
-        },
-      });
-
-      return {
-        success: false,
-        error: 'No browser context',
-        needsReauth: true,
-      };
-    }
-
     // Run the automation
     const result = await browserbaseService.runBrowserAutomation(
       automationId,
@@ -252,8 +248,13 @@ export const runBrowserAutomation = task({
         screenshotUrl: result.screenshotUrl ? 'captured' : 'none',
       });
 
-      // Update task status to done if screenshot was captured
-      if (result.screenshotUrl) {
+      if (
+        shouldMarkTaskDoneAfterBrowserRun({
+          screenshotUrl: result.screenshotUrl,
+          evaluationCriteria: automation.evaluationCriteria,
+          evaluationStatus: result.evaluationStatus,
+        })
+      ) {
         const currentTask = await db.task.findUnique({
           where: { id: taskId },
           select: { status: true, frequency: true },
@@ -349,6 +350,7 @@ export const runBrowserAutomation = task({
       screenshotUrl: result.screenshotUrl,
       error: result.error,
       needsReauth: result.needsReauth,
+      failureCode: result.failureCode,
     };
   },
 });
diff --git a/apps/api/src/trigger/browser-automation/run-browser-automations-schedule.spec.ts b/apps/api/src/trigger/browser-automation/run-browser-automations-schedule.spec.ts
index 2ae7fb5a7d..6e09e8e537 100644
--- a/apps/api/src/trigger/browser-automation/run-browser-automations-schedule.spec.ts
+++ b/apps/api/src/trigger/browser-automation/run-browser-automations-schedule.spec.ts
@@ -1,5 +1,8 @@
 import { TaskFrequency } from '@trycompai/db';
-import { filterDueAutomations } from './run-browser-automations-schedule';
+import {
+  filterDueAutomations,
+  limitAutomationBatch,
+} from './run-browser-automations-schedule';
 
 // Mock @db at the module boundary so importing the orchestrator does not try
 // to connect to Postgres. We never call the scheduled `run` function itself
@@ -116,3 +119,98 @@ describe('filterDueAutomations (browser automation orchestrator)', () => {
     expect(due).toEqual([]);
   });
 });
+
+describe('limitAutomationBatch', () => {
+  it('limits due automations by organization and hostname', () => {
+    const automations = [
+      {
+        id: 'ba_1',
+        targetUrl: 'https://github.com/a',
+        task: { organizationId: 'org_1' },
+      },
+      {
+        id: 'ba_2',
+        targetUrl: 'https://github.com/b',
+        task: { organizationId: 'org_1' },
+      },
+      {
+        id: 'ba_3',
+        targetUrl: 'https://gitlab.com/a',
+        task: { organizationId: 'org_1' },
+      },
+      {
+        id: 'ba_4',
+        targetUrl: 'https://github.com/c',
+        task: { organizationId: 'org_2' },
+      },
+    ];
+
+    const limited = limitAutomationBatch({
+      automations,
+      maxPerOrg: 2,
+      maxPerHostname: 2,
+    });
+
+    expect(limited.map((automation) => automation.id)).toEqual([
+      'ba_1',
+      'ba_2',
+    ]);
+  });
+
+  it('prioritizes never-run and oldest automations before applying caps', () => {
+    const automations = [
+      {
+        id: 'ba_newer',
+        lastRunAt: atUtc('2026-04-20'),
+        targetUrl: 'https://github.com/newer',
+        task: { organizationId: 'org_1' },
+      },
+      {
+        id: 'ba_never',
+        lastRunAt: null,
+        targetUrl: 'https://github.com/never',
+        task: { organizationId: 'org_1' },
+      },
+      {
+        id: 'ba_older',
+        lastRunAt: atUtc('2026-04-01'),
+        targetUrl: 'https://gitlab.com/older',
+        task: { organizationId: 'org_1' },
+      },
+    ];
+
+    const limited = limitAutomationBatch({
+      automations,
+      maxPerOrg: 2,
+      maxPerHostname: 2,
+    });
+
+    expect(limited.map((automation) => automation.id)).toEqual([
+      'ba_never',
+      'ba_older',
+    ]);
+  });
+
+  it('skips malformed target URLs without dropping valid automations', () => {
+    const automations = [
+      {
+        id: 'ba_bad',
+        targetUrl: 'not-a-url',
+        task: { organizationId: 'org_1' },
+      },
+      {
+        id: 'ba_good',
+        targetUrl: 'https://github.com/a',
+        task: { organizationId: 'org_1' },
+      },
+    ];
+
+    const limited = limitAutomationBatch({
+      automations,
+      maxPerOrg: 2,
+      maxPerHostname: 2,
+    });
+
+    expect(limited.map((automation) => automation.id)).toEqual(['ba_good']);
+  });
+});
diff --git a/apps/api/src/trigger/browser-automation/run-browser-automations-schedule.ts b/apps/api/src/trigger/browser-automation/run-browser-automations-schedule.ts
index dedd4b5660..d3aceb930b 100644
--- a/apps/api/src/trigger/browser-automation/run-browser-automations-schedule.ts
+++ b/apps/api/src/trigger/browser-automation/run-browser-automations-schedule.ts
@@ -2,6 +2,7 @@ import { db, TaskFrequency } from '@db';
 import { logger, schedules } from '@trigger.dev/sdk';
 import { runBrowserAutomation } from './run-browser-automation';
 import { isDueToday } from '../shared/is-due-today';
+import { normalizeHostnameFromUrl } from '../../browserbase/browserbase-url';
 
 /**
  * Pure helper extracted for unit testing. Filters a list of candidate
@@ -25,6 +26,66 @@ export function filterDueAutomations<
   );
 }
 
+const parsePositiveInt = (
+  value: string | undefined,
+  fallback: number,
+): number => {
+  if (!value) return fallback;
+  const parsed = Number.parseInt(value, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+};
+
+export function limitAutomationBatch<
+  T extends {
+    id?: string;
+    lastRunAt?: Date | null;
+    targetUrl: string;
+    task: { organizationId: string };
+  },
+>({
+  automations,
+  maxPerOrg,
+  maxPerHostname,
+}: {
+  automations: T[];
+  maxPerOrg: number;
+  maxPerHostname: number;
+}): T[] {
+  const orgCounts = new Map<string, number>();
+  const hostnameCounts = new Map<string, number>();
+  const selected: T[] = [];
+  const sortedAutomations = [...automations].sort(
+    (a, b) => (a.lastRunAt?.getTime() ?? 0) - (b.lastRunAt?.getTime() ?? 0),
+  );
+
+  for (const automation of sortedAutomations) {
+    const organizationId = automation.task.organizationId;
+    let hostname: string;
+    try {
+      hostname = normalizeHostnameFromUrl(automation.targetUrl);
+    } catch (error) {
+      logger.warn('Skipping browser automation with invalid target URL', {
+        automationId: automation.id,
+        targetUrl: automation.targetUrl,
+        error: error instanceof Error ? error.message : String(error),
+      });
+      continue;
+    }
+    const orgCount = orgCounts.get(organizationId) ?? 0;
+    const hostnameCount = hostnameCounts.get(hostname) ?? 0;
+
+    if (orgCount >= maxPerOrg || hostnameCount >= maxPerHostname) {
+      continue;
+    }
+
+    orgCounts.set(organizationId, orgCount + 1);
+    hostnameCounts.set(hostname, hostnameCount + 1);
+    selected.push(automation);
+  }
+
+  return selected;
+}
+
 /**
  * Daily scheduled task (orchestrator) that finds all enabled browser automations
  * and triggers individual runs for each.
@@ -48,6 +109,7 @@ export const browserAutomationsSchedule = schedules.task({
         id: true,
         name: true,
         taskId: true,
+        targetUrl: true,
         scheduleFrequency: true,
         lastRunAt: true,
         task: {
@@ -89,8 +151,26 @@ export const browserAutomationsSchedule = schedules.task({
       return { success: true, automationsTriggered: 0 };
     }
 
+    const limitedAutomations = limitAutomationBatch({
+      automations,
+      maxPerOrg: parsePositiveInt(
+        process.env.BROWSER_AUTOMATION_ORG_CONCURRENCY,
+        5,
+      ),
+      maxPerHostname: parsePositiveInt(
+        process.env.BROWSER_AUTOMATION_HOST_CONCURRENCY,
+        3,
+      ),
+    });
+
+    if (limitedAutomations.length < automations.length) {
+      logger.info(
+        `Deferred ${automations.length - limitedAutomations.length} automation(s) due to org/domain concurrency limits`,
+      );
+    }
+
     // Build payloads for batch triggering
-    const triggerPayloads = automations.map((automation) => ({
+    const triggerPayloads = limitedAutomations.map((automation) => ({
       payload: {
         automationId: automation.id,
         automationName: automation.name,
diff --git a/apps/api/src/trigger/policies/update-policy.ts b/apps/api/src/trigger/policies/update-policy.ts
index 93caa20eb7..284b283c33 100644
--- a/apps/api/src/trigger/policies/update-policy.ts
+++ b/apps/api/src/trigger/policies/update-policy.ts
@@ -26,6 +26,9 @@ export const updatePolicy = schemaTask({
         description: z.string(),
         visible: z.boolean(),
         organizationId: z.string().nullable().default(null),
+        // FRAME-20: frameworks now carry a family pointer; keep this payload
+        // schema in step with the FrameworkEditorFramework shape it's typed as.
+        familyId: z.string().nullable().default(null),
         createdAt: z.date(),
         updatedAt: z.date(),
       }),
diff --git a/apps/api/src/trust-portal/trust-access.service.spec.ts b/apps/api/src/trust-portal/trust-access.service.spec.ts
index f5bab9ac1a..5443807487 100644
--- a/apps/api/src/trust-portal/trust-access.service.spec.ts
+++ b/apps/api/src/trust-portal/trust-access.service.spec.ts
@@ -1,6 +1,7 @@
 import { GetObjectCommand } from '@aws-sdk/client-s3';
 import { db } from '@db';
 import { getSignedUrl } from '../app/s3';
+import { CreateAccessRequestDto } from './dto/trust-access.dto';
 import { TrustAccessService } from './trust-access.service';
 
 jest.mock('@db', () => ({
@@ -445,3 +446,51 @@ describe('TrustAccessService signNda NDA copy', () => {
     );
   });
 });
+
+describe('TrustAccessService access request notification', () => {
+  const emailService = {
+    sendAccessRequestNotification: jest.fn(),
+  };
+  const service = new TrustAccessService(
+    ...([{}, emailService, {}, {}, {}] as unknown as ConstructorParameters<
+      typeof TrustAccessService
+    >),
+  );
+
+  const ORIGINAL_BETTER_AUTH_URL = process.env.BETTER_AUTH_URL;
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    process.env.BETTER_AUTH_URL = 'https://app.trycomp.ai';
+  });
+
+  afterAll(() => {
+    process.env.BETTER_AUTH_URL = ORIGINAL_BETTER_AUTH_URL;
+  });
+
+  it('points the review button at the access requests page, not the trust overview', async () => {
+    // contactEmail present -> single recipient, no member fallback lookup.
+    mockDb.trust.findUnique.mockResolvedValue({ contactEmail: 'owner@acme.com' });
+
+    const dto: CreateAccessRequestDto = {
+      name: 'Jane Doe',
+      email: 'jane@example.com',
+    };
+
+    await service['sendAccessRequestNotificationToOrg'](
+      'org_123',
+      'tar_456',
+      'Acme Inc',
+      dto,
+    );
+
+    expect(emailService.sendAccessRequestNotification).toHaveBeenCalledTimes(1);
+    // Must deep-link to the pending requests list, NOT /org_123/trust (the
+    // trust portal settings/overview page).
+    expect(emailService.sendAccessRequestNotification).toHaveBeenCalledWith(
+      expect.objectContaining({
+        reviewUrl: 'https://app.trycomp.ai/org_123/trust/access-requests',
+      }),
+    );
+  });
+});
diff --git a/apps/api/src/trust-portal/trust-access.service.ts b/apps/api/src/trust-portal/trust-access.service.ts
index 6af1bc5c04..899aad5c83 100644
--- a/apps/api/src/trust-portal/trust-access.service.ts
+++ b/apps/api/src/trust-portal/trust-access.service.ts
@@ -430,8 +430,9 @@ export class TrustAccessService {
       return;
     }
 
-    // Construct review URL
-    const reviewUrl = `${process.env.BETTER_AUTH_URL}/${organizationId}/trust`;
+    // Construct review URL pointing at the pending access requests list, not
+    // the trust portal settings/overview page.
+    const reviewUrl = `${process.env.BETTER_AUTH_URL}/${organizationId}/trust/access-requests`;
 
     // Send notification to all recipients
     const emailPromises = notificationEmails.map((email) =>
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.test.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.test.tsx
new file mode 100644
index 0000000000..8499955e51
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.test.tsx
@@ -0,0 +1,165 @@
+import { fireEvent, render, screen } from '@testing-library/react';
+import type { ChangeEventHandler, ReactNode } from 'react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+// Capture client-side navigation so we can assert when the wizard leaves the page.
+const mockPush = vi.fn();
+vi.mock('next/navigation', () => ({
+  useRouter: () => ({ push: mockPush, refresh: vi.fn() }),
+}));
+
+// next/link is only referenced by the pre-fix Cancel control; keep it inert.
+vi.mock('next/link', () => ({
+  default: ({ children }: { children?: ReactNode }) => <a>{children}</a>,
+}));
+
+vi.mock('@trycompai/company', () => ({ meetingFields: () => [] }));
+vi.mock('@/components/file-uploader', () => ({ FileUploader: () => null }));
+vi.mock('@/lib/api-client', () => ({ api: { post: vi.fn() } }));
+vi.mock('sonner', () => ({
+  toast: { success: vi.fn(), error: vi.fn(), info: vi.fn() },
+}));
+
+// Minimal evidence form: one text field on step 1 is enough to exercise the
+// unsaved-changes guard without depending on real form catalog content.
+vi.mock('@/app/(app)/[orgId]/documents/forms', async () => {
+  const { z } = await import('zod');
+  return {
+    evidenceFormDefinitions: {
+      'tabletop-exercise': {
+        title: 'Tabletop Exercise',
+        submissionDateMode: 'auto',
+        fields: [{ key: 'summary', label: 'Summary', type: 'text' }],
+      },
+    },
+    evidenceFormSubmissionSchemaMap: {
+      'tabletop-exercise': z.object({ summary: z.string().min(1) }),
+    },
+    meetingMinutesPlaceholders: {},
+    meetingSubTypes: [],
+  };
+});
+
+// Faithful-enough design system: AlertDialog honours `open`, inputs/buttons
+// forward the handlers the wizard relies on.
+vi.mock('@trycompai/design-system', () => ({
+  Alert: ({ title, description }: { title?: ReactNode; description?: ReactNode }) => (
+    <div>
+      {title}
+      {description}
+    </div>
+  ),
+  Button: ({
+    children,
+    onClick,
+    type,
+    disabled,
+  }: {
+    children?: ReactNode;
+    onClick?: () => void;
+    type?: 'button' | 'submit' | 'reset';
+    disabled?: boolean;
+  }) => (
+    <button onClick={onClick} type={type} disabled={disabled}>
+      {children}
+    </button>
+  ),
+  Field: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
+  FieldError: () => null,
+  FieldGroup: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
+  FieldLabel: ({ children, htmlFor }: { children?: ReactNode; htmlFor?: string }) => (
+    <label htmlFor={htmlFor}>{children}</label>
+  ),
+  Input: ({
+    id,
+    type,
+    value,
+    onChange,
+    placeholder,
+  }: {
+    id?: string;
+    type?: string;
+    value?: string;
+    onChange?: ChangeEventHandler<HTMLInputElement>;
+    placeholder?: string;
+  }) => (
+    <input id={id} type={type} value={value} onChange={onChange} placeholder={placeholder} />
+  ),
+  Section: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
+  Select: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
+  SelectContent: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
+  SelectItem: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
+  SelectTrigger: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
+  SelectValue: ({ children }: { children?: ReactNode }) => <span>{children}</span>,
+  Text: ({ children }: { children?: ReactNode }) => <span>{children}</span>,
+  Textarea: ({
+    id,
+    value,
+    onChange,
+    placeholder,
+  }: {
+    id?: string;
+    value?: string;
+    onChange?: ChangeEventHandler<HTMLTextAreaElement>;
+    placeholder?: string;
+  }) => <textarea id={id} value={value} onChange={onChange} placeholder={placeholder} />,
+  AlertDialog: ({ children, open }: { children?: ReactNode; open?: boolean }) =>
+    open ? <div>{children}</div> : null,
+  AlertDialogAction: ({ children, onClick }: { children?: ReactNode; onClick?: () => void }) => (
+    <button onClick={onClick}>{children}</button>
+  ),
+  AlertDialogCancel: ({ children }: { children?: ReactNode }) => <button>{children}</button>,
+  AlertDialogContent: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
+  AlertDialogDescription: ({ children }: { children?: ReactNode }) => <p>{children}</p>,
+  AlertDialogFooter: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
+  AlertDialogHeader: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
+  AlertDialogTitle: ({ children }: { children?: ReactNode }) => <h2>{children}</h2>,
+}));
+
+import { CompanySubmissionWizard } from './CompanySubmissionWizard';
+
+const ORG_ID = 'org_test';
+const DOCS_URL = `/${ORG_ID}/documents/tabletop-exercise`;
+
+function renderWizard() {
+  return render(
+    <CompanySubmissionWizard
+      organizationId={ORG_ID}
+      formType={'tabletop-exercise' as never}
+    />,
+  );
+}
+
+describe('CompanySubmissionWizard cancel guard', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('confirms before discarding when the form has unsaved changes', async () => {
+    renderWizard();
+
+    // Enter data so the form becomes dirty.
+    fireEvent.change(screen.getByRole('textbox'), {
+      target: { value: 'Annual DR tabletop' },
+    });
+
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    // Instead of navigating away, the wizard asks for confirmation.
+    expect(await screen.findByText('Discard submission?')).toBeInTheDocument();
+    expect(mockPush).not.toHaveBeenCalled();
+
+    // Only after confirming does it leave the page.
+    fireEvent.click(screen.getByRole('button', { name: 'Discard' }));
+    expect(mockPush).toHaveBeenCalledWith(DOCS_URL);
+  });
+
+  it('navigates immediately when there are no unsaved changes', () => {
+    renderWizard();
+
+    fireEvent.click(screen.getByRole('button', { name: 'Cancel' }));
+
+    expect(screen.queryByText('Discard submission?')).not.toBeInTheDocument();
+    expect(mockPush).toHaveBeenCalledWith(DOCS_URL);
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx
index 253951df87..4fbe2ebac5 100644
--- a/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx
+++ b/apps/app/src/app/(app)/[orgId]/documents/components/CompanySubmissionWizard.tsx
@@ -17,6 +17,14 @@ import { meetingFields } from '@trycompai/company';
 import { zodResolver } from '@hookform/resolvers/zod';
 import {
   Alert,
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
   Button,
   Field,
   FieldError,
@@ -32,7 +40,6 @@ import {
   Text,
   Textarea,
 } from '@trycompai/design-system';
-import Link from 'next/link';
 import { useRouter } from 'next/navigation';
 import { useMemo, useState } from 'react';
 import { Controller, useForm } from 'react-hook-form';
@@ -125,6 +132,7 @@ export function CompanySubmissionWizard({
   const [isAnalyzing, setIsAnalyzing] = useState(false);
   const [analysisError, setAnalysisError] = useState<string | null>(null);
   const [analysisSkipped, setAnalysisSkipped] = useState(false);
+  const [isCancelConfirmOpen, setIsCancelConfirmOpen] = useState(false);
 
   const activeFormDefinition = useMemo(() => {
     if (!isMeeting) return evidenceFormDefinitions[formType];
@@ -207,7 +215,7 @@ export function CompanySubmissionWizard({
     setValue,
     trigger,
     watch,
-    formState: { errors, isSubmitting },
+    formState: { errors, isSubmitting, isDirty },
   } = useForm<Record<string, unknown>>({
     resolver: zodResolver(formSchema as never),
     mode: 'onChange',
@@ -216,6 +224,23 @@ export function CompanySubmissionWizard({
 
   const values = watch();
 
+  const cancelDestination = `/${organizationId}/documents/${formType}`;
+
+  const handleCancel = () => {
+    // Pressing Cancel with unsaved input would silently discard the entire
+    // multi-step submission, so confirm before navigating away.
+    if (isDirty) {
+      setIsCancelConfirmOpen(true);
+      return;
+    }
+    router.push(cancelDestination);
+  };
+
+  const handleDiscardConfirmed = () => {
+    setIsCancelConfirmOpen(false);
+    router.push(cancelDestination);
+  };
+
   const handleFileUpload = async (fieldKey: string, file: File) => {
     setUploadingField(fieldKey);
     try {
@@ -1146,9 +1171,9 @@ export function CompanySubmissionWizard({
         )}
 
         <div className="flex items-center justify-between">
-          <Link href={`/${organizationId}/documents/${formType}`}>
-            <Button variant="ghost">Cancel</Button>
-          </Link>
+          <Button type="button" variant="ghost" onClick={handleCancel}>
+            Cancel
+          </Button>
           <div className="flex items-center gap-2">
             {step > 1 && (
               <Button type="button" variant="secondary" onClick={() => setStep((step - 1) as Step)}>
@@ -1205,6 +1230,22 @@ export function CompanySubmissionWizard({
           </div>
         </div>
       </form>
+
+      <AlertDialog open={isCancelConfirmOpen} onOpenChange={setIsCancelConfirmOpen}>
+        <AlertDialogContent>
+          <AlertDialogHeader>
+            <AlertDialogTitle>Discard submission?</AlertDialogTitle>
+            <AlertDialogDescription>
+              You have unsaved changes. Leaving now discards everything you have entered on
+              every step of this submission, and it cannot be recovered.
+            </AlertDialogDescription>
+          </AlertDialogHeader>
+          <AlertDialogFooter>
+            <AlertDialogCancel>Keep editing</AlertDialogCancel>
+            <AlertDialogAction onClick={handleDiscardConfirmed}>Discard</AlertDialogAction>
+          </AlertDialogFooter>
+        </AlertDialogContent>
+      </AlertDialog>
     </Section>
   );
 }
diff --git a/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/WizardClient.test.tsx b/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/WizardClient.test.tsx
index 6038e5072b..acb6d9a669 100644
--- a/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/WizardClient.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/WizardClient.test.tsx
@@ -1,6 +1,6 @@
 import { fireEvent, render, screen, waitFor } from '@testing-library/react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
-import type { WizardProfileResponse } from './wizard-types';
+import type { PartialWizardAnswers, WizardProfileResponse } from './wizard-types';
 
 // ─── Mock the wizard hook ────────────────────────────────────
 const mockSaveAnswers = vi.fn().mockResolvedValue({ id: 'p1', answers: {}, completedAt: null });
@@ -198,6 +198,32 @@ describe('WizardClient', () => {
     expect(screen.getByText('Alice Owner')).toBeInTheDocument();
   });
 
+  it('resumes on the first unsaved step after saving and returning', () => {
+    // Saved answers covering steps 1–3 (leadership, commitments, workforce &
+    // scope). Each Next / Save persists that step's full field slice, so a saved
+    // step is one whose every field is present in the stored answers.
+    const resumedAnswers: PartialWizardAnswers = {
+      deputySpo: { memberId: 'm2', toBeNamed: false },
+      internalAuditApproach: 'in_house',
+      certificationBody: 'BSI Group',
+      insurance: { has: true, insurerName: 'Acme Insure' },
+      sectorRegulators: ['FINMA'],
+      hasContractors: true,
+      capabilitiesInProduction: ['Web app'],
+      cloudScopeSplit: { customer: ['Data'], provider: ['Underlying infrastructure'] },
+    };
+    const resumedProfile: WizardProfileResponse = { ...PROFILE, answers: resumedAnswers };
+    hookState.profile = resumedProfile;
+
+    render(<WizardClient {...baseProps} fallbackData={resumedProfile} />);
+
+    // Steps 1–3 are saved → the wizard opens on step 4 (Privacy & data), not
+    // back at step 1 with the progress reset.
+    expect(screen.getByText('Step 4 of 6')).toBeInTheDocument();
+    expect(screen.getByText('Privacy & data')).toBeInTheDocument();
+    expect(screen.queryByText('Leadership & accountability')).not.toBeInTheDocument();
+  });
+
   it('saves the active step partial then advances on Next', async () => {
     render(<WizardClient {...baseProps} />);
 
diff --git a/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/WizardClient.tsx b/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/WizardClient.tsx
index 6fb71601db..df2af82cb1 100644
--- a/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/WizardClient.tsx
+++ b/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/WizardClient.tsx
@@ -9,7 +9,7 @@ import { useForm } from 'react-hook-form';
 import { toast } from 'sonner';
 import { useIsmsWizard } from '../hooks/useIsmsWizard';
 import { buildWizardDefaults } from './wizard-form-defaults';
-import { pickStepAnswers, WIZARD_STEPS } from './wizard-steps';
+import { pickStepAnswers, resumeStepIndex, WIZARD_STEPS } from './wizard-steps';
 import { WizardProgress } from './WizardProgress';
 import { WizardStepContent } from './WizardStepContent';
 import {
@@ -76,18 +76,23 @@ export function WizardClient({ organizationId, frameworkId, fallbackData }: Wiza
     defaultValues,
   });
 
-  const [stepIndex, setStepIndex] = useState(0);
+  // Resume on the first unsaved step so the progress rail (done / current) matches
+  // the pre-filled answers after Save progress / leaving and returning.
+  const [stepIndex, setStepIndex] = useState(() =>
+    resumeStepIndex({ answers: initialProfile?.answers ?? null }),
+  );
   const [isSaving, setIsSaving] = useState(false);
   const [isFinishing, setIsFinishing] = useState(false);
 
   // Re-seed the form if the profile arrives after mount (e.g. SSR fallback was
   // null and SWR resolved later). Only while the user hasn't edited anything, so
-  // in-progress answers are never clobbered.
+  // in-progress answers are never clobbered; also restore the resume step.
   const hasReseeded = useRef(false);
   useEffect(() => {
     if (hasReseeded.current || !profile || formState.isDirty) return;
     hasReseeded.current = true;
     reset(defaultValues);
+    setStepIndex(resumeStepIndex({ answers: profile.answers ?? null }));
   }, [profile, defaultValues, formState.isDirty, reset]);
 
   const members = Array.isArray(initialProfile?.members) ? initialProfile.members : [];
diff --git a/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/wizard-steps.ts b/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/wizard-steps.ts
index 7001a27b6b..e43760b454 100644
--- a/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/wizard-steps.ts
+++ b/apps/app/src/app/(app)/[orgId]/documents/isms/wizard/wizard-steps.ts
@@ -5,7 +5,7 @@
  * answers for that step.
  */
 
-import type { WizardFormValues } from './wizard-types';
+import type { PartialWizardAnswers, WizardFormValues } from './wizard-types';
 
 export type WizardFieldName = keyof WizardFormValues;
 
@@ -62,3 +62,23 @@ export function pickStepAnswers({
     {},
   );
 }
+
+/**
+ * Resolve which step to open on when the wizard is reopened. A step counts as
+ * saved once every one of its fields is present in the persisted answers — each
+ * Next / Save progress POSTs that step's full field slice, so saved steps form a
+ * prefix of the rail. Returns the first not-yet-saved step (so the progress rail
+ * and the pre-filled answers stay in sync), the last step when everything is
+ * saved, and step 0 when nothing is saved.
+ */
+export function resumeStepIndex({
+  answers,
+}: {
+  answers: PartialWizardAnswers | null;
+}): number {
+  if (!answers) return 0;
+  const firstUnsaved = WIZARD_STEPS.findIndex(
+    (step) => !step.fields.every((field) => answers[field] !== undefined),
+  );
+  return firstUnsaved === -1 ? WIZARD_STEPS.length - 1 : firstUnsaved;
+}
diff --git a/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/FrameworkRequirements.tsx b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/FrameworkRequirements.tsx
index 1399b4e70b..dde567881f 100644
--- a/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/FrameworkRequirements.tsx
+++ b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/FrameworkRequirements.tsx
@@ -27,6 +27,7 @@ import { Search } from '@trycompai/design-system/icons';
 import { useParams, useRouter } from 'next/navigation';
 import { useEffect, useMemo, useState } from 'react';
 import { ExpandableDescription } from './ExpandableDescription';
+import { compareRequirementsByOrder } from './framework-controls-shared';
 import {
   REQUIREMENTS_TABLE_COLUMN_COUNT,
   REQUIREMENTS_TABLE_STYLE,
@@ -112,13 +113,9 @@ export function FrameworkRequirements({
     });
   }, [requirementDefinitions, frameworkInstanceWithControls.controls, tasks, evidenceSubmissions]);
 
-  const sortedItems = useMemo(
-    () =>
-      [...items].sort((a, b) =>
-        (a.identifier ?? '').localeCompare(b.identifier ?? '', undefined, { numeric: true }),
-      ),
-    [items],
-  );
+  // FRAME-18: order by the framework's configured sort order (numbered first,
+  // unset last), falling back to identifier for ties.
+  const sortedItems = useMemo(() => [...items].sort(compareRequirementsByOrder), [items]);
 
   const filteredItems = useMemo(() => {
     if (!searchTerm.trim()) return sortedItems;
diff --git a/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/framework-controls-shared.test.ts b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/framework-controls-shared.test.ts
index 45e1c79423..1ccc5db6e0 100644
--- a/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/framework-controls-shared.test.ts
+++ b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/framework-controls-shared.test.ts
@@ -4,10 +4,13 @@ import type { FrameworkInstanceWithControls } from '@/lib/types/framework';
 import {
   buildControlItems,
   buildRequirementMap,
+  compareRequirementsByOrder,
   getStatusBadge,
   groupByFamily,
+  groupRequirementsByFamily,
   UNCATEGORIZED_FAMILY,
   type ControlItem,
+  type RequirementItem,
 } from './framework-controls-shared';
 
 // ---------------------------------------------------------------------------
@@ -264,3 +267,106 @@ describe('groupByFamily', () => {
     expect(groups[0].items).toHaveLength(2);
   });
 });
+
+// ---------------------------------------------------------------------------
+// compareRequirementsByOrder (FRAME-18)
+// ---------------------------------------------------------------------------
+
+function reqItem(overrides: {
+  name?: string;
+  identifier?: string;
+  sortOrder?: number | null;
+  requirementFamily?: string | null;
+}): RequirementItem {
+  return makeRequirement(overrides as Partial<FrameworkEditorRequirement>) as unknown as RequirementItem;
+}
+
+describe('compareRequirementsByOrder', () => {
+  const orderOf = (sortOrders: Array<number | null>) =>
+    sortOrders
+      .map((sortOrder, i) => reqItem({ identifier: `R-${i}`, sortOrder }))
+      .sort(compareRequirementsByOrder)
+      .map((r) => r.sortOrder ?? null);
+
+  it('orders numbered requirements ascending', () => {
+    expect(orderOf([3, 1, 2])).toEqual([1, 2, 3]);
+  });
+
+  it('places unset (null) rows after numbered rows', () => {
+    expect(orderOf([null, 2, null, 1])).toEqual([1, 2, null, null]);
+  });
+
+  it('treats undefined sortOrder the same as null (sorts last)', () => {
+    const items = [
+      reqItem({ identifier: 'R-2', sortOrder: undefined }),
+      reqItem({ identifier: 'R-1', sortOrder: 5 }),
+    ];
+    expect(items.sort(compareRequirementsByOrder).map((r) => r.identifier)).toEqual([
+      'R-1',
+      'R-2',
+    ]);
+  });
+
+  it('falls back to numeric identifier order for unset rows', () => {
+    const items = [
+      reqItem({ identifier: 'R-10', sortOrder: null }),
+      reqItem({ identifier: 'R-2', sortOrder: null }),
+    ];
+    expect(items.sort(compareRequirementsByOrder).map((r) => r.identifier)).toEqual([
+      'R-2',
+      'R-10',
+    ]);
+  });
+
+  it('falls back to identifier when two rows share a sortOrder', () => {
+    const items = [
+      reqItem({ identifier: 'B', sortOrder: 1 }),
+      reqItem({ identifier: 'A', sortOrder: 1 }),
+    ];
+    expect(items.sort(compareRequirementsByOrder).map((r) => r.identifier)).toEqual(['A', 'B']);
+  });
+});
+
+// ---------------------------------------------------------------------------
+// groupRequirementsByFamily (FRAME-18)
+// ---------------------------------------------------------------------------
+
+describe('groupRequirementsByFamily', () => {
+  it('orders families by their lowest sortOrder (NIST CSF canonical order)', () => {
+    // Canonical NIST CSF order is GV → ID → PR → DE → RS → RC, which is NOT
+    // alphabetical. Numbering requirements drives the family order.
+    const items = [
+      reqItem({ identifier: 'PR.AA', sortOrder: 30, requirementFamily: 'Protect' }),
+      reqItem({ identifier: 'GV.OC', sortOrder: 10, requirementFamily: 'Govern' }),
+      reqItem({ identifier: 'ID.AM', sortOrder: 20, requirementFamily: 'Identify' }),
+      reqItem({ identifier: 'DE.CM', sortOrder: 40, requirementFamily: 'Detect' }),
+    ];
+
+    const families = groupRequirementsByFamily(items).map((g) => g.family);
+
+    expect(families).toEqual(['Govern', 'Identify', 'Protect', 'Detect']);
+  });
+
+  it('sorts requirements within a family by sortOrder', () => {
+    const items = [
+      reqItem({ identifier: 'GV.B', sortOrder: 12, requirementFamily: 'Govern' }),
+      reqItem({ identifier: 'GV.A', sortOrder: 11, requirementFamily: 'Govern' }),
+    ];
+
+    const order = groupRequirementsByFamily(items)[0].items.map((r) => r.identifier);
+
+    expect(order).toEqual(['GV.A', 'GV.B']);
+  });
+
+  it('falls back to alphabetical family order when no sortOrder is set', () => {
+    // Every existing framework today has null sortOrder — behavior is unchanged.
+    const items = [
+      reqItem({ identifier: 'Z-1', sortOrder: null, requirementFamily: 'Zoning' }),
+      reqItem({ identifier: 'A-1', sortOrder: null, requirementFamily: 'Access Control' }),
+    ];
+
+    const families = groupRequirementsByFamily(items).map((g) => g.family);
+
+    expect(families).toEqual(['Access Control', 'Zoning']);
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/framework-controls-shared.ts b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/framework-controls-shared.ts
index 51b50d4c60..8754e60305 100644
--- a/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/framework-controls-shared.ts
+++ b/apps/app/src/app/(app)/[orgId]/frameworks/[frameworkInstanceId]/components/framework-controls-shared.ts
@@ -125,6 +125,27 @@ export interface RequirementFamilyGroup {
   items: RequirementItem[];
 }
 
+/**
+ * FRAME-18: order requirements by their per-framework `sortOrder` (numbered
+ * rows first, ascending), falling back to identifier (then name) for unset
+ * rows and ties. Unset (`null`/`undefined`) rows always sort last.
+ */
+export function compareRequirementsByOrder(
+  a: Pick<FrameworkEditorRequirement, 'sortOrder' | 'identifier' | 'name'>,
+  b: Pick<FrameworkEditorRequirement, 'sortOrder' | 'identifier' | 'name'>,
+): number {
+  const ao = a.sortOrder ?? null;
+  const bo = b.sortOrder ?? null;
+  if (ao !== bo) {
+    if (ao == null) return 1;
+    if (bo == null) return -1;
+    return ao - bo;
+  }
+  return (a.identifier ?? a.name).localeCompare(b.identifier ?? b.name, undefined, {
+    numeric: true,
+  });
+}
+
 export function groupRequirementsByFamily(items: RequirementItem[]): RequirementFamilyGroup[] {
   const familyMap = new Map<string, RequirementItem[]>();
   const otherItems: RequirementItem[] = [];
@@ -143,12 +164,31 @@ export function groupRequirementsByFamily(items: RequirementItem[]): Requirement
     }
   }
 
-  const sortedFamilies = Array.from(familyMap.entries()).sort(([a], [b]) =>
-    a.localeCompare(b),
-  );
+  // FRAME-18: order families by the lowest sortOrder among their requirements so
+  // a framework's configured order also drives the family order (e.g. NIST CSF
+  // Functions GV → ID → PR → DE → RS → RC). When no requirement has a sortOrder
+  // (every existing framework today), every family's min is null and this falls
+  // back to alphabetical — identical to the previous behavior.
+  const minSortOrder = (familyItems: RequirementItem[]): number | null => {
+    let min: number | null = null;
+    for (const item of familyItems) {
+      if (item.sortOrder == null) continue;
+      if (min === null || item.sortOrder < min) min = item.sortOrder;
+    }
+    return min;
+  };
+  const sortedFamilies = Array.from(familyMap.entries()).sort(([fa, ia], [fb, ib]) => {
+    const ma = minSortOrder(ia);
+    const mb = minSortOrder(ib);
+    if (ma !== mb) {
+      if (ma === null) return 1;
+      if (mb === null) return -1;
+      return ma - mb;
+    }
+    return fa.localeCompare(fb);
+  });
 
-  const sortItems = (a: RequirementItem, b: RequirementItem) =>
-    (a.identifier ?? a.name).localeCompare(b.identifier ?? b.name, undefined, { numeric: true });
+  const sortItems = compareRequirementsByOrder;
 
   const groups: RequirementFamilyGroup[] = sortedFamilies.map(([family, familyItems]) => ({
     family,
diff --git a/apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.framework-filter.test.tsx b/apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.framework-filter.test.tsx
new file mode 100644
index 0000000000..4891a4d46e
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.framework-filter.test.tsx
@@ -0,0 +1,167 @@
+import { render, screen } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  setMockPermissions,
+  AUDITOR_PERMISSIONS,
+  mockHasPermission,
+} from '@/test-utils/mocks/permissions';
+import type { Finding } from '@/hooks/use-findings-api';
+
+vi.mock('@/hooks/use-permissions', () => ({
+  usePermissions: () => ({ permissions: {}, hasPermission: mockHasPermission }),
+}));
+
+// Drives the framework filter options: FindingsTab fetches
+// `/v1/frameworks?includeScores=false` via useApiSWR and derives the filter
+// options from whichever frameworks the org has enabled.
+const mockUseApiSWR = vi.fn();
+vi.mock('@/hooks/use-api-swr', () => ({
+  useApiSWR: (...args: unknown[]) => mockUseApiSWR(...args),
+}));
+
+const mockUseOrganizationFindings = vi.fn();
+vi.mock('@/hooks/use-findings-api', async () => {
+  const actual = await vi.importActual<typeof import('@/hooks/use-findings-api')>(
+    '@/hooks/use-findings-api',
+  );
+  return {
+    ...actual,
+    useOrganizationFindings: (...args: unknown[]) =>
+      mockUseOrganizationFindings(...args),
+  };
+});
+
+vi.mock('./CreateFindingSheet', () => ({
+  CreateFindingSheet: () => <div data-testid="create-sheet" />,
+}));
+
+vi.mock('./FindingDetailSheet', () => ({
+  FindingDetailSheet: () => <div data-testid="detail-sheet" />,
+}));
+
+// Render the design-system Select inline. Radix portals its content, so the
+// options are otherwise hidden until the trigger is opened; flattening them
+// keeps the dropdown options queryable.
+vi.mock('@trycompai/design-system', () => ({
+  Badge: ({ children }: any) => <span>{children}</span>,
+  Empty: ({ children }: any) => <div>{children}</div>,
+  EmptyDescription: ({ children }: any) => <p>{children}</p>,
+  EmptyHeader: ({ children }: any) => <div>{children}</div>,
+  EmptyMedia: ({ children }: any) => <div>{children}</div>,
+  EmptyTitle: ({ children }: any) => <h3>{children}</h3>,
+  InputGroup: ({ children }: any) => <div>{children}</div>,
+  InputGroupAddon: ({ children }: any) => <span>{children}</span>,
+  InputGroupInput: (props: any) => <input {...props} />,
+  Select: ({ children }: any) => <div data-testid="select">{children}</div>,
+  SelectContent: ({ children }: any) => <div>{children}</div>,
+  SelectItem: ({ children, value }: any) => (
+    <button data-value={value}>{children}</button>
+  ),
+  SelectTrigger: ({ children }: any) => <div>{children}</div>,
+  SelectValue: ({ children, placeholder }: any) => (
+    <span>{children ?? placeholder}</span>
+  ),
+  Stack: ({ children }: any) => <div>{children}</div>,
+  Table: ({ children }: any) => <table>{children}</table>,
+  TableBody: ({ children }: any) => <tbody>{children}</tbody>,
+  TableCell: ({ children }: any) => <td>{children}</td>,
+  TableHead: ({ children }: any) => <th>{children}</th>,
+  TableHeader: ({ children }: any) => <thead>{children}</thead>,
+  TableRow: ({ children, onClick }: any) => <tr onClick={onClick}>{children}</tr>,
+  Text: ({ children }: any) => <span>{children}</span>,
+}));
+
+vi.mock('@trycompai/design-system/icons', () => ({
+  Search: () => <span data-testid="search-icon" />,
+  WarningAlt: () => <span data-testid="warning-icon" />,
+}));
+
+import { FindingsTab } from './FindingsTab';
+
+function makeFinding(overrides: Partial<Finding> = {}): Finding {
+  return {
+    id: 'fnd_1',
+    type: 'soc2',
+    status: 'open',
+    severity: 'medium',
+    content: 'Evidence missing a timestamp',
+    revisionNote: null,
+    area: null,
+    createdAt: '2026-04-01T00:00:00Z',
+    updatedAt: '2026-04-02T00:00:00Z',
+    taskId: 'tsk_1',
+    evidenceSubmissionId: null,
+    evidenceFormType: null,
+    policyId: null,
+    vendorId: null,
+    riskId: null,
+    memberId: null,
+    deviceId: null,
+    templateId: null,
+    createdById: 'mem_1',
+    organizationId: 'org_1',
+    createdBy: null,
+    createdByAdmin: null,
+    template: null,
+    task: { id: 'tsk_1', title: 'Upload MFA evidence' },
+    evidenceSubmission: null,
+    policy: null,
+    vendor: null,
+    risk: null,
+    member: null,
+    device: null,
+    ...overrides,
+  };
+}
+
+/**
+ * Stub the `/v1/frameworks` response to mark `names` as the org's enabled
+ * frameworks. Mirrors the wrapped shape useApiSWR returns:
+ * `{ data: { data: [...], count } }`.
+ */
+function setEnabledFrameworks(names: string[]) {
+  const rows = names.map((name) => ({ framework: { name } }));
+  mockUseApiSWR.mockReturnValue({
+    data: { data: { data: rows, count: rows.length } },
+  });
+}
+
+describe('FindingsTab framework filter', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    setMockPermissions(AUDITOR_PERMISSIONS);
+    mockUseOrganizationFindings.mockReturnValue({
+      data: { data: [makeFinding()], status: 200 },
+      mutate: vi.fn(),
+    });
+  });
+
+  it('offers every framework the org has enabled, not a hardcoded SOC 2 / ISO 27001 pair', () => {
+    // Repro for CS-554: Aiden Risk has SOC 2 + ISO 42001 enabled (no ISO 27001).
+    setEnabledFrameworks(['SOC 2', 'ISO 42001']);
+
+    render(<FindingsTab organizationId="org_1" />);
+
+    // "All frameworks" labels both the trigger's current value and the reset
+    // option, so it renders more than once.
+    expect(screen.getAllByText('All frameworks').length).toBeGreaterThanOrEqual(1);
+    expect(screen.getByText('SOC 2')).toBeInTheDocument();
+    // The bug: ISO 42001 findings could not be filtered because the filter
+    // list was hardcoded to SOC 2 / ISO 27001.
+    expect(screen.getByText('ISO 42001')).toBeInTheDocument();
+    // ISO 27001 is NOT enabled for this org, so it must not be offered — the
+    // old hardcoded list wrongly included it.
+    expect(screen.queryByText('ISO 27001')).not.toBeInTheDocument();
+  });
+
+  it('offers HIPAA and GDPR when those are the enabled frameworks', () => {
+    setEnabledFrameworks(['HIPAA', 'GDPR']);
+
+    render(<FindingsTab organizationId="org_1" />);
+
+    expect(screen.getByText('HIPAA')).toBeInTheDocument();
+    expect(screen.getByText('GDPR')).toBeInTheDocument();
+    expect(screen.queryByText('SOC 2')).not.toBeInTheDocument();
+    expect(screen.queryByText('ISO 27001')).not.toBeInTheDocument();
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.test.tsx b/apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.test.tsx
index 4988ea2ec7..ab47250cdb 100644
--- a/apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.test.tsx
@@ -12,6 +12,13 @@ vi.mock('@/hooks/use-permissions', () => ({
   usePermissions: () => ({ permissions: {}, hasPermission: mockHasPermission }),
 }));
 
+// FindingsTab fetches the org's enabled frameworks via useApiSWR to build the
+// framework filter. Stub it so these tests don't hit the real SWR hook (which
+// reaches for next/navigation's useParams).
+vi.mock('@/hooks/use-api-swr', () => ({
+  useApiSWR: () => ({ data: undefined }),
+}));
+
 const mockUseOrganizationFindings = vi.fn();
 vi.mock('@/hooks/use-findings-api', async () => {
   const actual = await vi.importActual<typeof import('@/hooks/use-findings-api')>(
diff --git a/apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.tsx b/apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.tsx
index 6b7b07269a..d59da85a94 100644
--- a/apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.tsx
+++ b/apps/app/src/app/(app)/[orgId]/overview/components/FindingsTab.tsx
@@ -1,6 +1,8 @@
 'use client';
 
+import { useApiSWR } from '@/hooks/use-api-swr';
 import {
+  extractOrgFrameworkTypes,
   FINDING_SEVERITY_CONFIG,
   FINDING_STATUS_CONFIG,
   FINDING_TYPE_LABELS,
@@ -56,12 +58,6 @@ const SEVERITY_OPTIONS: { value: FindingSeverity | 'all'; label: string }[] = [
   { value: FindingSeverity.low, label: 'Low' },
 ];
 
-const FRAMEWORK_OPTIONS: { value: FindingType | 'all'; label: string }[] = [
-  { value: 'all', label: 'All frameworks' },
-  { value: FindingType.soc2, label: FINDING_TYPE_LABELS.soc2 },
-  { value: FindingType.iso27001, label: FINDING_TYPE_LABELS.iso27001 },
-];
-
 const capitalize = (s: string) => (s ? s.charAt(0).toUpperCase() + s.slice(1) : s);
 
 function targetLabel(f: Finding): string {
@@ -134,6 +130,26 @@ export function FindingsTab({
   );
   const findings: Finding[] = Array.isArray(data?.data) ? data.data : [];
 
+  // Mirror the Create Finding form: the framework filter must offer every
+  // framework the org has actually enabled — not a hardcoded SOC 2 / ISO 27001
+  // pair — so findings logged against ISO 42001, HIPAA, etc. are filterable.
+  const { data: frameworksData } = useApiSWR<unknown>(
+    '/v1/frameworks?includeScores=false',
+    { refreshInterval: 0 },
+  );
+  const frameworkOptions = useMemo<
+    { value: FindingType | 'all'; label: string }[]
+  >(
+    () => [
+      { value: 'all', label: 'All frameworks' },
+      ...extractOrgFrameworkTypes(frameworksData).map((type) => ({
+        value: type,
+        label: FINDING_TYPE_LABELS[type],
+      })),
+    ],
+    [frameworksData],
+  );
+
   // Support deep links (e.g. emails + in-app notifications) that land on
   // `/overview/findings?open=<id>`. Auto-open the matching finding's sheet
   // once we've loaded the list, then strip the query param so a page
@@ -184,7 +200,7 @@ export function FindingsTab({
   const severityLabel =
     SEVERITY_OPTIONS.find((o) => o.value === severityFilter)?.label ?? 'Severity';
   const frameworkLabel =
-    FRAMEWORK_OPTIONS.find((o) => o.value === frameworkFilter)?.label ??
+    frameworkOptions.find((o) => o.value === frameworkFilter)?.label ??
     'Framework';
 
   const hasAnyFinding = findings.length > 0;
@@ -255,7 +271,7 @@ export function FindingsTab({
                   <SelectValue placeholder="Framework">{frameworkLabel}</SelectValue>
                 </SelectTrigger>
                 <SelectContent>
-                  {FRAMEWORK_OPTIONS.map((opt) => (
+                  {frameworkOptions.map((opt) => (
                     <SelectItem key={opt.value} value={opt.value}>
                       {opt.label}
                     </SelectItem>
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.test.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.test.tsx
new file mode 100644
index 0000000000..b054d6e75a
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.test.tsx
@@ -0,0 +1,90 @@
+import type { Member, User } from '@db';
+import { render, screen, waitFor } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { toast } from 'sonner';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { EmployeeDetails } from './EmployeeDetails';
+
+const { mockPatch } = vi.hoisted(() => ({ mockPatch: vi.fn() }));
+
+vi.mock('@/hooks/use-api', () => ({
+  useApi: () => ({
+    organizationId: 'org_1',
+    patch: mockPatch,
+    get: vi.fn(),
+    post: vi.fn(),
+    put: vi.fn(),
+    delete: vi.fn(),
+  }),
+}));
+
+// DepartmentSelect pulls the runtime `Departments` enum from @db; its behaviour
+// is irrelevant to email editing.
+vi.mock('@/components/DepartmentSelect', () => ({
+  DepartmentSelect: () => null,
+}));
+
+vi.mock('sonner', () => ({
+  toast: { success: vi.fn(), error: vi.fn(), info: vi.fn() },
+}));
+
+const employee = {
+  id: 'mem_1',
+  userId: 'usr_1',
+  organizationId: 'org_1',
+  role: 'employee',
+  createdAt: new Date(),
+  department: 'engineering',
+  jobTitle: 'Engineer',
+  isActive: true,
+  onboardDate: null,
+  offboardDate: null,
+  user: {
+    id: 'usr_1',
+    name: 'Manoj Madhavan',
+    email: 'manoj.madhavan@plurilock.com',
+  },
+} as unknown as Member & { user: User };
+
+describe('EmployeeDetails email editing', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockPatch.mockResolvedValue({ data: {}, status: 200 });
+  });
+
+  it('lets an admin change the login email and PATCHes it to the people endpoint', async () => {
+    const user = userEvent.setup();
+    render(<EmployeeDetails employee={employee} canEdit />);
+
+    const emailInput = screen.getByLabelText('Email');
+    // Regression: the field used to be hardcoded disabled+readOnly.
+    expect(emailInput).not.toBeDisabled();
+
+    await user.clear(emailInput);
+    await user.type(emailInput, 'mmadhavan@aurorait.com');
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    await waitFor(() => {
+      expect(mockPatch).toHaveBeenCalledWith('/v1/people/mem_1', {
+        email: 'mmadhavan@aurorait.com',
+      });
+    });
+  });
+
+  it('disables the email field for read-only users', () => {
+    render(<EmployeeDetails employee={employee} canEdit={false} />);
+    expect(screen.getByLabelText('Email')).toBeDisabled();
+  });
+
+  it('blocks save and does not PATCH when the email is cleared', async () => {
+    const user = userEvent.setup();
+    render(<EmployeeDetails employee={employee} canEdit />);
+
+    const emailInput = screen.getByLabelText('Email');
+    await user.clear(emailInput);
+    await user.click(screen.getByRole('button', { name: 'Save' }));
+
+    expect(toast.error).toHaveBeenCalledWith('Email is required');
+    expect(mockPatch).not.toHaveBeenCalled();
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx
index 29acab4bc5..8a5e3f6244 100644
--- a/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/[employeeId]/components/EmployeeDetails.tsx
@@ -29,6 +29,11 @@ const STATUS_OPTIONS = [
   { value: 'inactive', label: 'Inactive' },
 ];
 
+// Mirrors the backend's @IsEmail() on UpdatePeopleDto.email so the form rejects
+// values the PATCH /v1/people/:id endpoint would reject anyway.
+const EMAIL_REGEX = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const isValidEmail = (value: string) => EMAIL_REGEX.test(value);
+
 export const EmployeeDetails = ({
   employee,
   canEdit,
@@ -39,6 +44,7 @@ export const EmployeeDetails = ({
   canEdit: boolean;
 }) => {
   const [name, setName] = useState(employee.user.name ?? '');
+  const [email, setEmail] = useState(employee.user.email ?? '');
   const [jobTitle, setJobTitle] = useState(employee.jobTitle ?? '');
   const [department, setDepartment] = useState<string>(employee.department ?? 'none');
   const [status, setStatus] = useState<string>(employee.isActive ? 'active' : 'inactive');
@@ -55,6 +61,7 @@ export const EmployeeDetails = ({
 
   const hasChanges = useMemo(() => {
     const nameChanged = name !== (employee.user.name ?? '');
+    const emailChanged = email !== (employee.user.email ?? '');
     const jobTitleChanged = jobTitle !== (employee.jobTitle ?? '');
     const departmentChanged = department !== (employee.department ?? 'none');
     const statusChanged = status !== (employee.isActive ? 'active' : 'inactive');
@@ -65,8 +72,8 @@ export const EmployeeDetails = ({
       (offboardDate?.toISOString() ?? null) !==
       (employee.offboardDate ? new Date(employee.offboardDate).toISOString() : null);
 
-    return nameChanged || jobTitleChanged || departmentChanged || statusChanged || onboardDateChanged || offboardDateChanged;
-  }, [name, jobTitle, department, status, onboardDate, offboardDate, employee]);
+    return nameChanged || emailChanged || jobTitleChanged || departmentChanged || statusChanged || onboardDateChanged || offboardDateChanged;
+  }, [name, email, jobTitle, department, status, onboardDate, offboardDate, employee]);
 
   const handleSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
     e.preventDefault();
@@ -76,8 +83,19 @@ export const EmployeeDetails = ({
       return;
     }
 
+    const trimmedEmail = email.trim();
+    if (!trimmedEmail) {
+      toast.error('Email is required');
+      return;
+    }
+    if (!isValidEmail(trimmedEmail)) {
+      toast.error('Enter a valid email address');
+      return;
+    }
+
     const updateData: {
       name?: string;
+      email?: string;
       department?: string;
       isActive?: boolean;
       jobTitle?: string;
@@ -88,6 +106,9 @@ export const EmployeeDetails = ({
     if (name !== (employee.user.name ?? '')) {
       updateData.name = name;
     }
+    if (trimmedEmail !== (employee.user.email ?? '')) {
+      updateData.email = trimmedEmail;
+    }
     if (jobTitle !== (employee.jobTitle ?? '')) {
       updateData.jobTitle = jobTitle;
     }
@@ -151,15 +172,16 @@ export const EmployeeDetails = ({
               />
             </Stack>
 
-            {/* Email Field (read-only) */}
+            {/* Email Field (login email) */}
             <Stack gap="sm">
               <Label htmlFor="email">Email</Label>
               <Input
                 id="email"
                 type="email"
-                value={employee.user.email ?? ''}
-                disabled
-                readOnly
+                value={email}
+                onChange={(e) => setEmail(e.target.value)}
+                placeholder="employee@example.com"
+                disabled={!canEdit}
               />
             </Stack>
 
diff --git a/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionClient.test.tsx b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionClient.test.tsx
index 08992aced7..be1e1bdca1 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionClient.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionClient.test.tsx
@@ -1,4 +1,11 @@
 import { render, screen } from '@testing-library/react';
+import type {
+  ButtonHTMLAttributes,
+  HTMLAttributes,
+  InputHTMLAttributes,
+  LabelHTMLAttributes,
+  ReactNode,
+} from 'react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import {
   setMockPermissions,
@@ -16,44 +23,46 @@ vi.mock('@/hooks/use-permissions', () => ({
 
 vi.mock('@/lib/api-client', () => ({
   apiClient: {
-    get: vi.fn().mockResolvedValue({ data: { hasContext: false } }),
+    get: vi.fn(() => new Promise(() => undefined)),
     post: vi.fn().mockResolvedValue({ data: {} }),
   },
 }));
 
-vi.mock('@trycompai/ui/badge', () => ({
-  Badge: ({ children }: any) => <span data-testid="badge">{children}</span>,
-}));
-
-vi.mock('@trycompai/ui/button', () => ({
-  Button: ({ children, disabled, onClick, ...props }: any) => (
-    <button disabled={disabled} onClick={onClick} {...props}>
+vi.mock('@trycompai/design-system', () => ({
+  Badge: ({ children }: { children?: ReactNode }) => <span data-testid="badge">{children}</span>,
+  Button: ({
+    children,
+    iconLeft,
+    iconRight,
+    loading,
+    ...props
+  }: ButtonHTMLAttributes<HTMLButtonElement> & {
+    iconLeft?: ReactNode;
+    iconRight?: ReactNode;
+    loading?: boolean;
+  }) => (
+    <button data-loading={loading || undefined} {...props}>
+      {iconLeft}
       {children}
+      {iconRight}
     </button>
   ),
+  Card: ({ children }: HTMLAttributes<HTMLDivElement>) => <div>{children}</div>,
+  CardContent: ({ children }: HTMLAttributes<HTMLDivElement>) => <div>{children}</div>,
+  CardDescription: ({ children }: HTMLAttributes<HTMLParagraphElement>) => <p>{children}</p>,
+  CardHeader: ({ children }: HTMLAttributes<HTMLDivElement>) => <div>{children}</div>,
+  CardTitle: ({ children }: HTMLAttributes<HTMLHeadingElement>) => <h3>{children}</h3>,
+  Input: (props: InputHTMLAttributes<HTMLInputElement>) => <input {...props} />,
+  Label: ({ children, ...props }: LabelHTMLAttributes<HTMLLabelElement>) => (
+    <label {...props}>{children}</label>
+  ),
+  Spinner: () => <span data-testid="loader-icon" />,
 }));
 
-vi.mock('@trycompai/ui/card', () => ({
-  Card: ({ children }: any) => <div>{children}</div>,
-  CardContent: ({ children }: any) => <div>{children}</div>,
-  CardDescription: ({ children }: any) => <p>{children}</p>,
-  CardHeader: ({ children }: any) => <div>{children}</div>,
-  CardTitle: ({ children }: any) => <h3>{children}</h3>,
-}));
-
-vi.mock('@trycompai/ui/input', () => ({
-  Input: (props: any) => <input {...props} />,
-}));
-
-vi.mock('@trycompai/ui/label', () => ({
-  Label: ({ children, ...props }: any) => <label {...props}>{children}</label>,
-}));
-
-vi.mock('lucide-react', () => ({
+vi.mock('@trycompai/design-system/icons', () => ({
   Globe: () => <span data-testid="globe-icon" />,
-  Loader2: () => <span data-testid="loader-icon" />,
-  MonitorSmartphone: () => <span data-testid="monitor-icon" />,
-  RefreshCw: () => <span data-testid="refresh-icon" />,
+  Renew: () => <span data-testid="refresh-icon" />,
+  Screen: () => <span data-testid="monitor-icon" />,
 }));
 
 import { BrowserConnectionClient } from './BrowserConnectionClient';
diff --git a/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionClient.tsx b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionClient.tsx
index 6dbcdf7638..5064647673 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionClient.tsx
+++ b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionClient.tsx
@@ -1,17 +1,30 @@
 'use client';
 
-import { apiClient } from '@/lib/api-client';
 import { usePermissions } from '@/hooks/use-permissions';
-import { Badge } from '@trycompai/ui/badge';
-import { Button } from '@trycompai/ui/button';
-import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@trycompai/ui/card';
-import { Input } from '@trycompai/ui/input';
-import { Label } from '@trycompai/ui/label';
-import { Globe, Loader2, MonitorSmartphone, RefreshCw } from 'lucide-react';
+import { apiClient } from '@/lib/api-client';
+import {
+  Badge,
+  Button,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+  Input,
+  Label,
+  Spinner,
+} from '@trycompai/design-system';
+import { Globe, Screen } from '@trycompai/design-system/icons';
 import { useCallback, useEffect, useState } from 'react';
+import { BrowserConnectionInstructions } from './BrowserConnectionInstructions';
+import { BrowserConnectionLiveView } from './BrowserConnectionLiveView';
+import {
+  BrowserConnectionProfileList,
+  type BrowserConnectionProfile,
+} from './BrowserConnectionProfileList';
 
-interface ContextResponse {
-  contextId: string;
+interface ResolveProfileResponse {
+  profile: BrowserConnectionProfile & { contextId: string };
   isNew: boolean;
 }
 
@@ -25,6 +38,11 @@ interface AuthStatusResponse {
   username?: string;
 }
 
+interface VerifyProfileResponse {
+  profile: BrowserConnectionProfile;
+  auth: AuthStatusResponse;
+}
+
 type Status = 'idle' | 'loading' | 'session-active' | 'checking';
 
 interface BrowserConnectionClientProps {
@@ -35,23 +53,23 @@ export function BrowserConnectionClient({ organizationId }: BrowserConnectionCli
   const { hasPermission } = usePermissions();
   const canManageBrowser = hasPermission('integration', 'create');
   const [status, setStatus] = useState<Status>('idle');
-  const [hasContext, setHasContext] = useState(false);
-  const [contextId, setContextId] = useState<string | null>(null);
+  const [profileId, setProfileId] = useState<string | null>(null);
+  const [profiles, setProfiles] = useState<BrowserConnectionProfile[]>([]);
   const [sessionId, setSessionId] = useState<string | null>(null);
   const [liveViewUrl, setLiveViewUrl] = useState<string | null>(null);
   const [urlToCheck, setUrlToCheck] = useState('https://github.com');
   const [authStatus, setAuthStatus] = useState<AuthStatusResponse | null>(null);
   const [error, setError] = useState<string | null>(null);
+  const hasContext = profiles.some((profile) => profile.status === 'verified');
 
-  // Check if org has a browser context
   const checkContextStatus = useCallback(async () => {
     try {
-      const res = await apiClient.get<{ hasContext: boolean; contextId?: string }>(
-        '/v1/browserbase/org-context',
-      );
+      const res = await apiClient.get<BrowserConnectionProfile[]>('/v1/browserbase/profiles');
       if (res.data) {
-        setHasContext(res.data.hasContext);
-        setContextId(res.data.contextId || null);
+        setProfiles(res.data);
+        const verifiedProfile = res.data.find((profile) => profile.status === 'verified');
+        const firstProfile = verifiedProfile ?? res.data[0];
+        setProfileId(firstProfile?.id ?? null);
       }
     } catch {
       // Ignore
@@ -68,21 +86,24 @@ export function BrowserConnectionClient({ organizationId }: BrowserConnectionCli
       setError(null);
       setStatus('loading');
 
-      // Get or create org context
-      const contextRes = await apiClient.post<ContextResponse>(
-        '/v1/browserbase/org-context',
-        {},
+      const profileRes = await apiClient.post<ResolveProfileResponse>(
+        '/v1/browserbase/profiles/resolve',
+        { url: urlToCheck },
       );
-      if (contextRes.error || !contextRes.data) {
-        throw new Error(contextRes.error || 'Failed to create context');
+      if (profileRes.error || !profileRes.data) {
+        throw new Error(profileRes.error || 'Failed to create auth profile');
       }
-      setContextId(contextRes.data.contextId);
-      setHasContext(true);
+      setProfileId(profileRes.data.profile.id);
+      setProfiles((currentProfiles) => {
+        const rest = currentProfiles.filter(
+          (profile) => profile.id !== profileRes.data?.profile.id,
+        );
+        return profileRes.data ? [profileRes.data.profile, ...rest] : currentProfiles;
+      });
 
-      // Create session
       const sessionRes = await apiClient.post<SessionResponse>(
-        '/v1/browserbase/session',
-        { contextId: contextRes.data.contextId },
+        `/v1/browserbase/profiles/${profileRes.data.profile.id}/session`,
+        {},
       );
       if (sessionRes.error || !sessionRes.data) {
         throw new Error(sessionRes.error || 'Failed to create session');
@@ -92,10 +113,10 @@ export function BrowserConnectionClient({ organizationId }: BrowserConnectionCli
       setLiveViewUrl(sessionRes.data.liveViewUrl);
 
       // Navigate to the URL
-      await apiClient.post(
-        '/v1/browserbase/navigate',
-        { sessionId: startedSessionId, url: urlToCheck },
-      );
+      await apiClient.post('/v1/browserbase/navigate', {
+        sessionId: startedSessionId,
+        url: urlToCheck,
+      });
 
       setStatus('session-active');
     } catch (err) {
@@ -107,10 +128,7 @@ export function BrowserConnectionClient({ organizationId }: BrowserConnectionCli
       // If we created a session but navigation failed, close it to avoid orphaned sessions
       if (startedSessionId) {
         try {
-          await apiClient.post(
-            '/v1/browserbase/session/close',
-            { sessionId: startedSessionId },
-          );
+          await apiClient.post('/v1/browserbase/session/close', { sessionId: startedSessionId });
         } catch {
           // Ignore cleanup errors (don't mask original error)
         }
@@ -119,26 +137,31 @@ export function BrowserConnectionClient({ organizationId }: BrowserConnectionCli
   };
 
   const handleCheckAuth = async () => {
-    if (!sessionId) return;
+    if (!sessionId || !profileId) return;
 
     try {
       setError(null);
       setStatus('checking');
 
-      const res = await apiClient.post<AuthStatusResponse>(
-        '/v1/browserbase/check-auth',
+      const res = await apiClient.post<VerifyProfileResponse>(
+        `/v1/browserbase/profiles/${profileId}/verify`,
         { sessionId, url: urlToCheck },
       );
       if (res.error || !res.data) {
         throw new Error(res.error || 'Failed to check auth');
       }
 
-      setAuthStatus(res.data);
+      setAuthStatus(res.data.auth);
+      setProfiles((currentProfiles) => {
+        const rest = currentProfiles.filter((profile) => profile.id !== res.data?.profile.id);
+        return res.data ? [res.data.profile, ...rest] : currentProfiles;
+      });
 
       // Close the session after checking
       await apiClient.post('/v1/browserbase/session/close', { sessionId });
       setSessionId(null);
       setLiveViewUrl(null);
+      setProfileId(null);
       setStatus('idle');
     } catch (err) {
       setError(err instanceof Error ? err.message : 'Failed to check auth');
@@ -156,6 +179,7 @@ export function BrowserConnectionClient({ organizationId }: BrowserConnectionCli
     }
     setSessionId(null);
     setLiveViewUrl(null);
+    setProfileId(null);
     setStatus('idle');
   };
 
@@ -167,14 +191,14 @@ export function BrowserConnectionClient({ organizationId }: BrowserConnectionCli
           <div className="flex items-center justify-between">
             <div className="flex items-center gap-3">
               <div className="rounded-lg bg-muted p-2">
-                <MonitorSmartphone className="h-5 w-5 text-muted-foreground" />
+                <Screen className="h-5 w-5 text-muted-foreground" />
               </div>
               <div>
-                <CardTitle className="text-base">Browser Session</CardTitle>
+                <CardTitle>Browser Session</CardTitle>
                 <CardDescription>
                   {hasContext
-                    ? 'Your organization has a browser context configured'
-                    : 'No browser context configured yet'}
+                    ? 'At least one browser auth profile is verified'
+                    : 'No verified browser auth profile yet'}
                 </CardDescription>
               </div>
             </div>
@@ -191,16 +215,20 @@ export function BrowserConnectionClient({ organizationId }: BrowserConnectionCli
               <div className="flex flex-col gap-2">
                 <Label htmlFor="url">Website URL</Label>
                 <div className="flex gap-2">
-                  <Input
-                    id="url"
-                    placeholder="https://github.com"
-                    value={urlToCheck}
-                    onChange={(e) => setUrlToCheck(e.target.value)}
-                    className="flex-1"
-                  />
+                  <div className="flex-1">
+                    <Input
+                      id="url"
+                      placeholder="https://github.com"
+                      value={urlToCheck}
+                      onChange={(e) => setUrlToCheck(e.target.value)}
+                    />
+                  </div>
                   {canManageBrowser && (
-                    <Button onClick={handleStartSession} disabled={!urlToCheck}>
-                      <Globe className="mr-2 h-4 w-4" />
+                    <Button
+                      onClick={handleStartSession}
+                      disabled={!urlToCheck}
+                      iconLeft={<Globe size={16} />}
+                    >
                       {hasContext ? 'Open Browser' : 'Connect Browser'}
                     </Button>
                   )}
@@ -232,89 +260,25 @@ export function BrowserConnectionClient({ organizationId }: BrowserConnectionCli
 
           {status === 'loading' && (
             <div className="flex items-center gap-2 text-sm text-muted-foreground">
-              <Loader2 className="h-4 w-4 animate-spin" />
+              <Spinner />
               Starting browser session...
             </div>
           )}
         </CardContent>
       </Card>
 
-      {/* Live View */}
       {(status === 'session-active' || status === 'checking') && liveViewUrl && (
-        <Card>
-          <CardHeader>
-            <div className="flex items-center justify-between">
-              <div>
-                <CardTitle className="text-base">Browser Session</CardTitle>
-                <CardDescription>
-                  Log in to websites below. Your session will be saved for automations.
-                </CardDescription>
-              </div>
-              <div className="flex gap-2">
-                <Button
-                  variant="outline"
-                  size="sm"
-                  onClick={handleCheckAuth}
-                  disabled={status === 'checking' || !canManageBrowser}
-                >
-                  {status === 'checking' ? (
-                    <>
-                      <Loader2 className="mr-2 h-4 w-4 animate-spin" />
-                      Checking...
-                    </>
-                  ) : (
-                    <>
-                      <RefreshCw className="mr-2 h-4 w-4" />
-                      Check & Save
-                    </>
-                  )}
-                </Button>
-                <Button variant="ghost" size="sm" onClick={handleCloseSession}>
-                  Cancel
-                </Button>
-              </div>
-            </div>
-          </CardHeader>
-          <CardContent>
-            <div className="overflow-hidden rounded-lg border">
-              <iframe
-                src={liveViewUrl}
-                className="h-[600px] w-full"
-                sandbox="allow-same-origin allow-scripts allow-forms allow-popups"
-                allow="clipboard-read; clipboard-write"
-              />
-            </div>
-          </CardContent>
-        </Card>
+        <BrowserConnectionLiveView
+          liveViewUrl={liveViewUrl}
+          isChecking={status === 'checking'}
+          canManageBrowser={canManageBrowser}
+          onCheckAuth={handleCheckAuth}
+          onClose={handleCloseSession}
+        />
       )}
 
-      {/* Instructions */}
-      <Card>
-        <CardHeader>
-          <CardTitle className="text-base">How it works</CardTitle>
-        </CardHeader>
-        <CardContent>
-          <ol className="list-inside list-decimal space-y-2 text-sm text-muted-foreground">
-            <li>
-              <strong className="text-foreground">Create a service account</strong> - We recommend
-              creating a dedicated account (e.g., &quot;comp-automation@yourcompany.com&quot;) for
-              browser automations.
-            </li>
-            <li>
-              <strong className="text-foreground">Authenticate once</strong> - Open the browser
-              above and log in to the websites you want to automate (GitHub, Jira, etc.).
-            </li>
-            <li>
-              <strong className="text-foreground">Session is shared</strong> - All browser
-              automations in your organization will use this authenticated session.
-            </li>
-            <li>
-              <strong className="text-foreground">Re-authenticate when needed</strong> - If a
-              session expires, come back here to log in again.
-            </li>
-          </ol>
-        </CardContent>
-      </Card>
+      <BrowserConnectionProfileList profiles={profiles} />
+      <BrowserConnectionInstructions />
     </div>
   );
 }
diff --git a/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionInstructions.tsx b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionInstructions.tsx
new file mode 100644
index 0000000000..fa9e4fbed4
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionInstructions.tsx
@@ -0,0 +1,33 @@
+'use client';
+
+import { Card, CardContent, CardHeader, CardTitle } from '@trycompai/design-system';
+
+export function BrowserConnectionInstructions() {
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>How it works</CardTitle>
+      </CardHeader>
+      <CardContent>
+        <ol className="list-inside list-decimal space-y-2 text-sm text-muted-foreground">
+          <li>
+            <strong className="text-foreground">Create a service account</strong> - Use a
+            dedicated account for browser automations when possible.
+          </li>
+          <li>
+            <strong className="text-foreground">Authenticate per site</strong> - Each hostname gets
+            its own auth profile and Browserbase context.
+          </li>
+          <li>
+            <strong className="text-foreground">Complete 2FA manually</strong> - Live View supports
+            manual approvals; Comp does not store passwords or TOTP secrets.
+          </li>
+          <li>
+            <strong className="text-foreground">Reconnect when needed</strong> - Expired or blocked
+            profiles are shown above and skipped by scheduled runs.
+          </li>
+        </ol>
+      </CardContent>
+    </Card>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionLiveView.tsx b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionLiveView.tsx
new file mode 100644
index 0000000000..43ffa900d4
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionLiveView.tsx
@@ -0,0 +1,65 @@
+'use client';
+
+import {
+  Button,
+  Card,
+  CardContent,
+  CardDescription,
+  CardHeader,
+  CardTitle,
+} from '@trycompai/design-system';
+import { Renew } from '@trycompai/design-system/icons';
+
+export function BrowserConnectionLiveView({
+  liveViewUrl,
+  isChecking,
+  canManageBrowser,
+  onCheckAuth,
+  onClose,
+}: {
+  liveViewUrl: string;
+  isChecking: boolean;
+  canManageBrowser: boolean;
+  onCheckAuth: () => void;
+  onClose: () => void;
+}) {
+  return (
+    <Card>
+      <CardHeader>
+        <div className="flex items-center justify-between">
+          <div>
+            <CardTitle>Browser Session</CardTitle>
+            <CardDescription>
+              Log in to websites below. Your session will be saved for automations.
+            </CardDescription>
+          </div>
+          <div className="flex gap-2">
+            <Button
+              variant="outline"
+              size="sm"
+              onClick={onCheckAuth}
+              disabled={isChecking || !canManageBrowser}
+              loading={isChecking}
+              iconLeft={!isChecking ? <Renew size={14} /> : undefined}
+            >
+              {isChecking ? 'Checking...' : 'Check & Save'}
+            </Button>
+            <Button variant="ghost" size="sm" onClick={onClose}>
+              Cancel
+            </Button>
+          </div>
+        </div>
+      </CardHeader>
+      <CardContent>
+        <div className="overflow-hidden rounded-lg border">
+          <iframe
+            src={liveViewUrl}
+            className="h-[600px] w-full"
+            sandbox="allow-same-origin allow-scripts allow-forms allow-popups"
+            allow="clipboard-read; clipboard-write"
+          />
+        </div>
+      </CardContent>
+    </Card>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionProfileList.tsx b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionProfileList.tsx
new file mode 100644
index 0000000000..633e8c826c
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/components/BrowserConnectionProfileList.tsx
@@ -0,0 +1,71 @@
+'use client';
+
+import { Badge, Card, CardContent, CardHeader, CardTitle } from '@trycompai/design-system';
+
+export interface BrowserConnectionProfile {
+  id: string;
+  hostname: string;
+  loginIdentity: string;
+  displayName: string;
+  status: 'unverified' | 'verified' | 'needs_reauth' | 'blocked';
+  lastVerifiedAt?: string | null;
+  blockedReason?: string | null;
+  vaultProvider?: string | null;
+}
+
+const statusLabel: Record<BrowserConnectionProfile['status'], string> = {
+  unverified: 'Unverified',
+  verified: 'Verified',
+  needs_reauth: 'Needs reauth',
+  blocked: 'Blocked',
+};
+
+const statusVariant = (status: BrowserConnectionProfile['status']) => {
+  if (status === 'verified') return 'default';
+  if (status === 'blocked' || status === 'needs_reauth') return 'destructive';
+  return 'secondary';
+};
+
+export function BrowserConnectionProfileList({
+  profiles,
+}: {
+  profiles: BrowserConnectionProfile[];
+}) {
+  if (profiles.length === 0) {
+    return null;
+  }
+
+  return (
+    <Card>
+      <CardHeader>
+        <CardTitle>Auth Profiles</CardTitle>
+      </CardHeader>
+      <CardContent>
+        <div className="divide-y rounded-md border">
+          {profiles.map((profile) => (
+            <div key={profile.id} className="flex items-center justify-between gap-4 p-3">
+              <div className="min-w-0">
+                <p className="truncate text-sm font-medium">{profile.displayName}</p>
+                <p className="text-xs text-muted-foreground">
+                  {profile.hostname}
+                  {profile.loginIdentity ? ` · ${profile.loginIdentity}` : ''}
+                </p>
+                {profile.blockedReason && (
+                  <p className="mt-1 text-xs text-destructive">{profile.blockedReason}</p>
+                )}
+              </div>
+              <div className="flex shrink-0 items-center gap-2">
+                {profile.vaultProvider && (
+                  <Badge variant="outline">{profile.vaultProvider}</Badge>
+                )}
+                <Badge variant={statusVariant(profile.status)}>
+                  {statusLabel[profile.status]}
+                </Badge>
+              </div>
+            </div>
+          ))}
+        </div>
+      </CardContent>
+    </Card>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/settings/browser-connection/page.tsx b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/page.tsx
index 139dd13261..8257b84b61 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/browser-connection/page.tsx
+++ b/apps/app/src/app/(app)/[orgId]/settings/browser-connection/page.tsx
@@ -1,38 +1,10 @@
 import type { Metadata } from 'next';
-import { getFeatureFlags } from '@/app/posthog';
-import { requireRoutePermission } from '@/lib/permissions.server';
-import { auth } from '@/utils/auth';
-import { headers } from 'next/headers';
 import { notFound } from 'next/navigation';
-import { BrowserConnectionClient } from './components/BrowserConnectionClient';
 
 export const metadata: Metadata = {
   title: 'Browser Connection',
 };
 
-export default async function BrowserConnectionPage({
-  params,
-}: {
-  params: Promise<{ orgId: string }>;
-}) {
-  const { orgId } = await params;
-
-  await requireRoutePermission('settings/browser-connection', orgId);
-
-  const session = await auth.api.getSession({
-    headers: await headers(),
-  });
-  if (!session?.user?.id) {
-    return notFound();
-  }
-
-  const flags = await getFeatureFlags(session.user.id);
-  const isWebAutomationsEnabled =
-    flags['is-web-automations-enabled'] === true || flags['is-web-automations-enabled'] === 'true';
-
-  if (!isWebAutomationsEnabled) {
-    return notFound();
-  }
-
-  return <BrowserConnectionClient organizationId={orgId} />;
+export default function BrowserConnectionPage() {
+  return notFound();
 }
diff --git a/apps/app/src/app/(app)/[orgId]/settings/components/SettingsSidebar.test.tsx b/apps/app/src/app/(app)/[orgId]/settings/components/SettingsSidebar.test.tsx
index 6359083953..37eedfdce1 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/components/SettingsSidebar.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/settings/components/SettingsSidebar.test.tsx
@@ -24,4 +24,10 @@ describe('SettingsSidebar', () => {
 
     expect(screen.queryByRole('link', { name: 'Billing' })).not.toBeInTheDocument();
   });
+
+  it('hides Browser even when the browser tab flag is enabled', () => {
+    render(<SettingsSidebar orgId="org-1" showBillingTab={true} showBrowserTab={true} />);
+
+    expect(screen.queryByRole('link', { name: 'Browser' })).not.toBeInTheDocument();
+  });
 });
diff --git a/apps/app/src/app/(app)/[orgId]/settings/components/SettingsSidebar.tsx b/apps/app/src/app/(app)/[orgId]/settings/components/SettingsSidebar.tsx
index 694bc0457c..c80d87df2b 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/components/SettingsSidebar.tsx
+++ b/apps/app/src/app/(app)/[orgId]/settings/components/SettingsSidebar.tsx
@@ -17,7 +17,7 @@ type SettingsNavItem = {
   hidden?: boolean;
 };
 
-export function SettingsSidebar({ orgId, showBrowserTab, showBillingTab }: SettingsSidebarProps) {
+export function SettingsSidebar({ orgId, showBillingTab }: SettingsSidebarProps) {
   const pathname = usePathname() ?? '';
 
   const items: SettingsNavItem[] = [
@@ -38,7 +38,7 @@ export function SettingsSidebar({ orgId, showBrowserTab, showBillingTab }: Setti
       id: 'browser',
       label: 'Browser',
       path: `/${orgId}/settings/browser-connection`,
-      hidden: !showBrowserTab,
+      hidden: true,
     },
     { id: 'user', label: 'User Settings', path: `/${orgId}/settings/user` },
   ];
diff --git a/apps/app/src/app/(app)/[orgId]/settings/layout.tsx b/apps/app/src/app/(app)/[orgId]/settings/layout.tsx
index 41981b7da1..fdea4a78be 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/layout.tsx
+++ b/apps/app/src/app/(app)/[orgId]/settings/layout.tsx
@@ -1,4 +1,3 @@
-import { getFeatureFlags } from '@/app/posthog';
 import { requireRoutePermission } from '@/lib/permissions.server';
 import { auth } from '@/utils/auth';
 import { headers } from 'next/headers';
@@ -24,16 +23,8 @@ export default async function Layout({
     return redirect('/');
   }
 
-  let isWebAutomationsEnabled = false;
-  if (session.user?.id) {
-    const flags = await getFeatureFlags(session.user.id);
-    isWebAutomationsEnabled =
-      flags['is-web-automations-enabled'] === true ||
-      flags['is-web-automations-enabled'] === 'true';
-  }
-
   return (
-    <SettingsTabs orgId={orgId} showBrowserTab={isWebAutomationsEnabled}>
+    <SettingsTabs orgId={orgId} showBrowserTab={false}>
       {children}
     </SettingsTabs>
   );
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/BrowserAutomations.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/BrowserAutomations.tsx
index fd529b5cff..2506f33978 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/BrowserAutomations.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/BrowserAutomations.tsx
@@ -26,14 +26,27 @@ export function BrowserAutomations({ taskId, isManualTask = false }: BrowserAuto
     automation?: BrowserAutomation;
   }>({ open: false, mode: 'create' });
   const [authUrl, setAuthUrl] = useState('https://github.com');
+  const authHostname = (() => {
+    try {
+      return new URL(authUrl).hostname;
+    } catch {
+      return 'this website';
+    }
+  })();
 
   // Hooks
   const context = useBrowserContext();
   const automations = useBrowserAutomations({ taskId });
 
-  const handleNeedsReauth = useCallback(() => {
-    context.startAuth(authUrl);
-  }, [context, authUrl]);
+  const handleNeedsReauth = useCallback(
+    (automationId: string) => {
+      const automation = automations.automations.find((item) => item.id === automationId);
+      const targetUrl = automation?.targetUrl ?? authUrl;
+      setAuthUrl(targetUrl);
+      context.startAuth(targetUrl);
+    },
+    [automations.automations, authUrl, context],
+  );
 
   const execution = useBrowserExecution({
     onNeedsReauth: handleNeedsReauth,
@@ -71,8 +84,8 @@ export function BrowserAutomations({ taskId, isManualTask = false }: BrowserAuto
   if (context.showAuthFlow && context.liveViewUrl) {
     return (
       <BrowserLiveView
-        title="Connect Browser"
-        subtitle="Log in to the website below to enable automations"
+        title={`Log in to ${authHostname}`}
+        subtitle="Complete login in this browser, then check and save the profile for this site."
         liveViewUrl={context.liveViewUrl}
         variant="auth"
         isChecking={context.status === 'checking'}
@@ -128,7 +141,9 @@ export function BrowserAutomations({ taskId, isManualTask = false }: BrowserAuto
         hasContext={context.status === 'has-context'}
         runningAutomationId={execution.runningAutomationId}
         onRun={execution.runAutomation}
-        onCreateClick={isManualTask ? undefined : () => setDialogState({ open: true, mode: 'create' })}
+        onCreateClick={
+          isManualTask ? undefined : () => setDialogState({ open: true, mode: 'create' })
+        }
         onEditClick={(automation) => setDialogState({ open: true, mode: 'edit', automation })}
         onDelete={automations.deleteAutomation}
         onToggleEnabled={automations.toggleAutomation}
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/AutomationItem.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/AutomationItem.tsx
index 1bc4b61eb4..a520db2fe6 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/AutomationItem.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/AutomationItem.tsx
@@ -1,16 +1,14 @@
 'use client';
 
 import { cn } from '@/lib/utils';
-import { Button } from '@trycompai/ui/button';
+import { Button } from '@trycompai/design-system';
 import {
   ChevronDown,
-  Loader2,
-  MonitorPlay,
-  Pencil,
+  Edit,
+  Play,
   Power,
-  PowerOff,
-  Trash2,
-} from 'lucide-react';
+  TrashCan,
+} from '@trycompai/design-system/icons';
 import { formatDistanceToNow } from 'date-fns';
 import { useState } from 'react';
 import { ScheduleSummary } from '@/components/schedule-summary';
@@ -95,34 +93,38 @@ export function AutomationItem({
               />
             </div>
           )}
+          {latestRun?.failureCode && (
+            <p className="mt-1 text-xs text-destructive">
+              {latestRun.blockedReason ||
+                latestRun.error ||
+                latestRun.failureCode.replaceAll('_', ' ')}
+            </p>
+          )}
         </div>
 
         <div className="flex items-center gap-1.5">
           {!readOnly && (
             <Button
               variant="ghost"
-              size="icon"
-              className="h-8 w-8"
+              size="icon-lg"
               onClick={() => onToggleEnabled(!automation.isEnabled)}
               aria-label={automation.isEnabled ? 'Pause automation' : 'Enable automation'}
             >
-              {automation.isEnabled ? (
-                <Power className="h-3.5 w-3.5 text-primary" />
-              ) : (
-                <PowerOff className="h-3.5 w-3.5 text-muted-foreground" />
-              )}
+              <Power
+                size={14}
+                className={automation.isEnabled ? 'text-primary' : 'text-muted-foreground'}
+              />
             </Button>
           )}
 
           {!readOnly && (
             <Button
               variant="ghost"
-              size="icon"
-              className="h-8 w-8"
+              size="icon-lg"
               onClick={onEdit}
               aria-label="Edit automation"
             >
-              <Pencil className="h-3.5 w-3.5" />
+              <Edit size={14} />
             </Button>
           )}
 
@@ -132,7 +134,6 @@ export function AutomationItem({
                 <Button
                   variant="destructive"
                   size="sm"
-                  className="h-7 text-xs"
                   onClick={() => { onDelete(); setConfirmDelete(false); }}
                 >
                   Confirm
@@ -140,7 +141,6 @@ export function AutomationItem({
                 <Button
                   variant="ghost"
                   size="sm"
-                  className="h-7 text-xs"
                   onClick={() => setConfirmDelete(false)}
                 >
                   Cancel
@@ -149,12 +149,11 @@ export function AutomationItem({
             ) : (
               <Button
                 variant="ghost"
-                size="icon"
-                className="h-8 w-8"
+                size="icon-lg"
                 onClick={() => setConfirmDelete(true)}
                 aria-label="Delete automation"
               >
-                <Trash2 className="h-3.5 w-3.5 text-muted-foreground hover:text-destructive" />
+                <TrashCan size={14} className="text-muted-foreground hover:text-destructive" />
               </Button>
             )
           )}
@@ -165,26 +164,19 @@ export function AutomationItem({
               size="sm"
               onClick={onRun}
               disabled={isRunning || isDisabled}
+              loading={isRunning}
+              iconLeft={!isRunning ? <Play size={12} /> : undefined}
             >
-              {isRunning ? (
-                <>
-                  <Loader2 className="mr-1.5 h-3 w-3 animate-spin" />
-                  Running...
-                </>
-              ) : (
-                <>
-                  <MonitorPlay className="mr-1.5 h-3 w-3" />
-                  Run
-                </>
-              )}
+              {isRunning ? 'Running...' : 'Run'}
             </Button>
           )}
 
           {runs.length > 0 && (
-            <Button size="sm" variant="ghost" className="h-8 w-8 p-0" onClick={onToggleExpand}>
+            <Button size="icon-lg" variant="ghost" onClick={onToggleExpand}>
               <ChevronDown
+                size={16}
                 className={cn(
-                  'h-4 w-4 transition-transform duration-300',
+                  'transition-transform duration-300',
                   isExpanded && 'rotate-180',
                 )}
               />
@@ -208,5 +200,3 @@ export function AutomationItem({
     </div>
   );
 }
-
-
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationConfigDialog.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationConfigDialog.tsx
index 29c0bb65fe..584e89231d 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationConfigDialog.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationConfigDialog.tsx
@@ -1,20 +1,19 @@
 'use client';
 
 import { SchedulePicker } from '@/components/schedule-picker';
-import { Button } from '@trycompai/ui/button';
 import {
+  Button,
   Dialog,
   DialogContent,
   DialogDescription,
   DialogFooter,
   DialogHeader,
   DialogTitle,
-} from '@trycompai/ui/dialog';
-import { Input } from '@trycompai/ui/input';
-import { Label } from '@trycompai/ui/label';
-import { Textarea } from '@trycompai/ui/textarea';
+  Input,
+  Label,
+  Textarea,
+} from '@trycompai/design-system';
 import { zodResolver } from '@hookform/resolvers/zod';
-import { Loader2 } from 'lucide-react';
 import { useEffect } from 'react';
 import { Controller, useForm } from 'react-hook-form';
 import { z } from 'zod';
@@ -57,6 +56,7 @@ export function BrowserAutomationConfigDialog({
     register,
     handleSubmit,
     reset,
+    watch,
     formState: { errors },
   } = useForm<AutomationConfigFormData>({
     resolver: zodResolver(automationConfigSchema),
@@ -124,6 +124,14 @@ export function BrowserAutomationConfigDialog({
       ? 'Update where the AI starts and what it should do before taking a screenshot.'
       : 'Configure an automation to navigate to a page and capture a screenshot.';
   const submitLabel = mode === 'edit' ? 'Save changes' : 'Create automation';
+  const targetUrl = watch('targetUrl');
+  const profileHostname = (() => {
+    try {
+      return new URL(targetUrl).hostname.toLowerCase();
+    } catch {
+      return null;
+    }
+  })();
 
   return (
     <Dialog open={isOpen} onOpenChange={(open) => !open && handleClose()}>
@@ -155,6 +163,11 @@ export function BrowserAutomationConfigDialog({
             />
             {errors.targetUrl?.message ? (
               <p className="text-sm text-destructive">{errors.targetUrl.message}</p>
+            ) : profileHostname ? (
+              <p className="text-xs text-muted-foreground">
+                Uses the browser auth profile for {profileHostname}. Verify that profile before
+                scheduled runs.
+              </p>
             ) : (
               <p className="text-xs text-muted-foreground">
                 The URL where the automation will start navigating from.
@@ -218,15 +231,8 @@ export function BrowserAutomationConfigDialog({
             <Button type="button" variant="outline" onClick={handleClose} disabled={isSaving}>
               Cancel
             </Button>
-            <Button type="submit" disabled={isSaving}>
-              {isSaving ? (
-                <>
-                  <Loader2 className="mr-2 h-4 w-4 animate-spin" />
-                  Saving...
-                </>
-              ) : (
-                submitLabel
-              )}
+            <Button type="submit" disabled={isSaving} loading={isSaving}>
+              {isSaving ? 'Saving...' : submitLabel}
             </Button>
           </DialogFooter>
         </form>
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationsList.test.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationsList.test.tsx
index 0f376dcd69..f2e52d3831 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationsList.test.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationsList.test.tsx
@@ -1,4 +1,5 @@
 import { render, screen } from '@testing-library/react';
+import type { HTMLAttributes } from 'react';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 import {
   setMockPermissions,
@@ -15,9 +16,10 @@ vi.mock('@/hooks/use-permissions', () => ({
   }),
 }));
 
-// Mock @trycompai/ui/badge
-vi.mock('@trycompai/ui/badge', () => ({
-  Badge: ({ children, ...props }: any) => <span {...props}>{children}</span>,
+vi.mock('@trycompai/design-system', () => ({
+  Badge: ({ children, ...props }: HTMLAttributes<HTMLSpanElement>) => (
+    <span {...props}>{children}</span>
+  ),
 }));
 
 // Mock date-fns
@@ -27,7 +29,13 @@ vi.mock('date-fns', () => ({
 
 // Mock AutomationItem
 vi.mock('./AutomationItem', () => ({
-  AutomationItem: ({ automation, readOnly }: any) => (
+  AutomationItem: ({
+    automation,
+    readOnly,
+  }: {
+    automation: { id: string; name: string };
+    readOnly?: boolean;
+  }) => (
     <div data-testid={`automation-item-${automation.id}`} data-readonly={String(readOnly)}>
       {automation.name}
     </div>
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationsList.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationsList.tsx
index d3c5a77cee..14456ea5f3 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationsList.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserAutomationsList.tsx
@@ -1,8 +1,8 @@
 'use client';
 
-import { Badge } from '@trycompai/ui/badge';
+import { Badge } from '@trycompai/design-system';
 import { formatDistanceToNow } from 'date-fns';
-import { Globe, Plus } from 'lucide-react';
+import { Add, Globe } from '@trycompai/design-system/icons';
 import { useState } from 'react';
 import type { BrowserAutomation } from '../../hooks/types';
 import { AutomationItem } from './AutomationItem';
@@ -84,7 +84,7 @@ export function BrowserAutomationsList({
             )}
 
             {hasContext && (
-              <Badge variant="outline" className="text-xs">
+              <Badge variant="outline">
                 <div className="w-1.5 h-1.5 rounded-full bg-green-500 mr-1.5" />
                 Connected
               </Badge>
@@ -118,7 +118,7 @@ export function BrowserAutomationsList({
             onClick={onCreateClick}
             className="w-full flex items-center justify-center gap-2 py-2.5 mt-3 rounded-lg border border-dashed border-border/60 hover:border-border hover:bg-muted/30 transition-all text-xs text-muted-foreground hover:text-foreground"
           >
-            <Plus className="w-3.5 h-3.5" />
+            <Add className="w-3.5 h-3.5" />
             Create Another
           </button>
         )}
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserEmptyStates.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserEmptyStates.tsx
index 035adf9007..5f49793f84 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserEmptyStates.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserEmptyStates.tsx
@@ -1,9 +1,7 @@
 'use client';
 
-import { Badge } from '@trycompai/ui/badge';
-import { Button } from '@trycompai/ui/button';
-import { Input } from '@trycompai/ui/input';
-import { ArrowRight, Globe, Loader2, MonitorSmartphone, Plus } from 'lucide-react';
+import { Badge, Button, Input } from '@trycompai/design-system';
+import { Add, ArrowRight, Globe, Screen } from '@trycompai/design-system/icons';
 import { useState } from 'react';
 
 interface NoContextStateProps {
@@ -32,27 +30,32 @@ export function NoContextState({ isStartingAuth, onStartAuth }: NoContextStatePr
       <div className="p-5">
         <div className="rounded-lg border border-dashed border-border p-6 text-center">
           <div className="mx-auto w-12 h-12 rounded-full bg-muted flex items-center justify-center mb-4">
-            <MonitorSmartphone className="h-6 w-6 text-muted-foreground" />
+            <Screen className="h-6 w-6 text-muted-foreground" />
           </div>
-          <h4 className="text-sm font-medium mb-2">Connect your browser first</h4>
+          <h4 className="text-sm font-medium mb-2">Log in to the website first</h4>
           <p className="text-xs text-muted-foreground mb-4 max-w-sm mx-auto">
-            Browser automations require authentication. Log in to sites like GitHub, Jira, or AWS to
-            capture screenshots as evidence.
+            Enter the site you want to automate. We will save a browser profile for that hostname
+            and reuse it for future evidence runs.
           </p>
           <div className="flex flex-col gap-3 max-w-xs mx-auto">
             <div className="flex gap-2">
-              <Input
-                placeholder="https://github.com"
-                value={authUrl}
-                onChange={(e) => setAuthUrl(e.target.value)}
-                className="flex-1"
-              />
-              <Button onClick={() => onStartAuth(authUrl)} disabled={isStartingAuth || !authUrl}>
-                {isStartingAuth ? <Loader2 className="h-4 w-4 animate-spin" /> : 'Connect'}
+              <div className="flex-1">
+                <Input
+                  placeholder="https://github.com"
+                  value={authUrl}
+                  onChange={(e) => setAuthUrl(e.target.value)}
+                />
+              </div>
+              <Button
+                onClick={() => onStartAuth(authUrl)}
+                disabled={isStartingAuth || !authUrl}
+                loading={isStartingAuth}
+              >
+                {isStartingAuth ? 'Connecting...' : 'Connect'}
               </Button>
             </div>
             <p className="text-xs text-muted-foreground">
-              Tip: Use a dedicated service account for automations
+              Use a dedicated service account for automations when possible.
             </p>
           </div>
         </div>
@@ -81,7 +84,7 @@ export function EmptyWithContextState({ onCreateClick }: EmptyWithContextStatePr
               </p>
             </div>
           </div>
-          <Badge variant="outline" className="text-xs">
+          <Badge variant="outline">
             <div className="w-1.5 h-1.5 rounded-full bg-green-500 mr-1.5" />
             Connected
           </Badge>
@@ -93,7 +96,7 @@ export function EmptyWithContextState({ onCreateClick }: EmptyWithContextStatePr
           className="w-full flex items-center gap-4 p-4 rounded-lg border border-dashed border-border hover:border-primary/50 hover:bg-primary/5 transition-all group text-left"
         >
           <div className="w-10 h-10 rounded-lg bg-primary/10 flex items-center justify-center group-hover:bg-primary/20 transition-colors shrink-0">
-            <Plus className="w-5 h-5 text-primary" />
+            <Add className="w-5 h-5 text-primary" />
           </div>
           <div className="flex-1 min-w-0">
             <p className="text-sm font-medium text-foreground group-hover:text-primary transition-colors">
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserLiveView.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserLiveView.tsx
index 4fcfb6ad09..f7ced581c9 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserLiveView.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/BrowserLiveView.tsx
@@ -1,7 +1,7 @@
 'use client';
 
-import { Button } from '@trycompai/ui/button';
-import { Loader2, MonitorPlay, MonitorSmartphone, RefreshCw } from 'lucide-react';
+import { Button, Spinner } from '@trycompai/design-system';
+import { Play, Renew, Screen } from '@trycompai/design-system/icons';
 
 interface BrowserLiveViewProps {
   title: string;
@@ -22,7 +22,7 @@ export function BrowserLiveView({
   onSave,
   onCancel,
 }: BrowserLiveViewProps) {
-  const Icon = variant === 'auth' ? MonitorSmartphone : MonitorPlay;
+  const Icon = variant === 'auth' ? Screen : Play;
   const iconClass = variant === 'execution' ? 'text-primary animate-pulse' : 'text-primary';
   const bgClass = variant === 'execution' ? 'bg-primary/10' : 'bg-muted';
 
@@ -42,23 +42,20 @@ export function BrowserLiveView({
           <div className="flex items-center gap-3">
             {variant === 'execution' && (
               <div className="flex items-center gap-2 text-xs text-muted-foreground">
-                <Loader2 className="h-3 w-3 animate-spin" />
+                <Spinner />
                 Executing...
               </div>
             )}
             {variant === 'auth' && onSave && (
-              <Button variant="outline" size="sm" onClick={onSave} disabled={isChecking}>
-                {isChecking ? (
-                  <>
-                    <Loader2 className="mr-2 h-3 w-3 animate-spin" />
-                    Checking...
-                  </>
-                ) : (
-                  <>
-                    <RefreshCw className="mr-2 h-3 w-3" />
-                    Save & Close
-                  </>
-                )}
+              <Button
+                variant="outline"
+                size="sm"
+                onClick={onSave}
+                disabled={isChecking}
+                loading={isChecking}
+                iconLeft={!isChecking ? <Renew size={12} /> : undefined}
+              >
+                {isChecking ? 'Checking...' : 'Check & Save'}
               </Button>
             )}
             <Button variant="ghost" size="sm" onClick={onCancel}>
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/RunItem.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/RunItem.tsx
index eca742e8e4..44ca2144bd 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/RunItem.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/components/browser-automations/RunItem.tsx
@@ -1,7 +1,7 @@
 'use client';
 
 import { cn } from '@/lib/utils';
-import { Badge } from '@trycompai/ui/badge';
+import { Badge } from '@trycompai/design-system';
 import { formatDistanceToNow } from 'date-fns';
 import {
   ChevronDown,
@@ -24,6 +24,7 @@ export function RunItem({ run, isLatest }: RunItemProps) {
 
   const timeAgo = formatDistanceToNow(new Date(run.createdAt), { addSuffix: true });
   const hasFailed = run.status === 'failed';
+  const isBlocked = run.status === 'blocked';
   const isCompleted = run.status === 'completed';
   const hasScreenshot = !!run.screenshotUrl;
   const evaluationPassed = run.evaluationStatus === 'pass';
@@ -34,15 +35,17 @@ export function RunItem({ run, isLatest }: RunItemProps) {
   const downloadHref = `${fullSizeHref}?download=true`;
 
   // Determine overall status: failed run, or completed but evaluation failed
-  const hasIssue = hasFailed || evaluationFailed;
+  const hasIssue = hasFailed || isBlocked || evaluationFailed;
   const statusColor = hasIssue
     ? 'text-destructive'
     : isCompleted
       ? 'text-primary'
       : 'text-muted-foreground';
-  const statusText = hasFailed
-    ? 'Failed'
-    : evaluationFailed
+  const statusText = isBlocked
+    ? 'Blocked'
+    : hasFailed
+      ? 'Failed'
+      : evaluationFailed
       ? 'Issues Found'
       : evaluationPassed
         ? 'Passed'
@@ -76,9 +79,8 @@ export function RunItem({ run, isLatest }: RunItemProps) {
                 <span className="text-muted-foreground">•</span>
                 <Badge
                   variant={evaluationPassed ? 'default' : 'destructive'}
-                  className="text-[10px] px-1.5 py-0 !text-white"
                 >
-                  {evaluationPassed ? '✓ Pass' : '✗ Fail'}
+                  {evaluationPassed ? 'Pass' : 'Fail'}
                 </Badge>
               </>
             )}
@@ -138,9 +140,16 @@ export function RunItem({ run, isLatest }: RunItemProps) {
             )}
 
             {/* Error */}
-            {run.error && (
+            {(run.error || run.blockedReason || run.failureCode) && (
               <div className="p-2 rounded-md bg-destructive/10 border border-destructive/20">
-                <p className="text-xs text-destructive">{run.error}</p>
+                {run.failureCode && (
+                  <p className="mb-1 text-[10px] font-medium uppercase tracking-wide text-destructive">
+                    {run.failureCode.replaceAll('_', ' ')}
+                  </p>
+                )}
+                <p className="text-xs text-destructive">
+                  {run.blockedReason || run.error || 'Automation did not complete.'}
+                </p>
               </div>
             )}
 
@@ -222,5 +231,3 @@ export function RunItem({ run, isLatest }: RunItemProps) {
     </div>
   );
 }
-
-
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/types.ts b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/types.ts
index 7675f22086..0cdccdc611 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/types.ts
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/types.ts
@@ -2,6 +2,7 @@ import type { TaskFrequency } from '@db';
 
 export interface BrowserAutomationRun {
   id: string;
+  profileId?: string | null;
   status: string;
   createdAt: string;
   completedAt?: string;
@@ -9,6 +10,11 @@ export interface BrowserAutomationRun {
   evaluationStatus?: 'pass' | 'fail' | null;
   evaluationReason?: string | null;
   error?: string;
+  failureCode?: string | null;
+  failureStage?: string | null;
+  blockedReason?: string | null;
+  finalUrl?: string | null;
+  attemptCount?: number;
 }
 
 export interface BrowserAutomation {
@@ -31,11 +37,38 @@ export interface ContextResponse {
   isNew: boolean;
 }
 
+export type BrowserAuthProfileStatus = 'unverified' | 'verified' | 'needs_reauth' | 'blocked';
+
+export interface BrowserAuthProfile {
+  id: string;
+  hostname: string;
+  loginIdentity: string;
+  displayName: string;
+  contextId: string;
+  status: BrowserAuthProfileStatus;
+  lastVerifiedAt?: string | null;
+  lastAuthCheckUrl?: string | null;
+  blockedReason?: string | null;
+  vaultProvider?: string | null;
+  vaultExternalItemRef?: string | null;
+  vaultConnectionId?: string | null;
+}
+
+export interface ResolveAuthProfileResponse {
+  profile: BrowserAuthProfile;
+  isNew: boolean;
+}
+
 export interface SessionResponse {
   sessionId: string;
   liveViewUrl: string;
 }
 
+export interface NavigateResponse {
+  success: boolean;
+  error?: string;
+}
+
 export interface AuthStatusResponse {
   isLoggedIn: boolean;
   username?: string;
@@ -45,6 +78,7 @@ export interface StartLiveResponse {
   runId: string;
   sessionId: string;
   liveViewUrl: string;
+  profileId?: string;
   error?: string;
   needsReauth?: boolean;
 }
@@ -54,6 +88,8 @@ export interface ExecuteResponse {
   screenshotUrl?: string;
   error?: string;
   needsReauth?: boolean;
+  failureCode?: string;
+  blockedReason?: string;
 }
 
 export type BrowserContextStatus = 'loading' | 'no-context' | 'has-context' | 'checking';
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/useBrowserContext.test.tsx b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/useBrowserContext.test.tsx
new file mode 100644
index 0000000000..f96600b63e
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/useBrowserContext.test.tsx
@@ -0,0 +1,134 @@
+import { apiClient } from '@/lib/api-client';
+import { act, renderHook, waitFor } from '@testing-library/react';
+import { toast } from 'sonner';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { BrowserAuthProfile } from './types';
+import { useBrowserContext } from './useBrowserContext';
+
+vi.mock('@/lib/api-client', () => ({
+  apiClient: {
+    get: vi.fn(),
+    post: vi.fn(),
+  },
+}));
+
+vi.mock('sonner', () => ({
+  toast: {
+    error: vi.fn(),
+    success: vi.fn(),
+  },
+}));
+
+const unverifiedProfile = {
+  id: 'bap_1',
+  hostname: 'github.com',
+  loginIdentity: '',
+  displayName: 'github.com browser profile',
+  contextId: 'ctx_1',
+  status: 'unverified',
+} satisfies BrowserAuthProfile;
+
+describe('useBrowserContext', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('does not treat unverified profiles as connected', async () => {
+    vi.mocked(apiClient.get).mockResolvedValue({
+      data: [unverifiedProfile],
+      error: undefined,
+      status: 200,
+    });
+
+    const { result } = renderHook(() => useBrowserContext());
+
+    await act(async () => {
+      await result.current.checkContextStatus();
+    });
+
+    expect(result.current.status).toBe('no-context');
+    expect(result.current.contextId).toBeNull();
+    expect(result.current.profileId).toBeNull();
+  });
+
+  it('does not show auth Live View when target navigation fails', async () => {
+    vi.mocked(apiClient.post)
+      .mockResolvedValueOnce({
+        data: { profile: unverifiedProfile, isNew: false },
+        error: undefined,
+        status: 200,
+      })
+      .mockResolvedValueOnce({
+        data: { sessionId: 'bbs_1', liveViewUrl: 'https://live.browserbase.test/session' },
+        error: undefined,
+        status: 200,
+      })
+      .mockResolvedValueOnce({
+        data: { success: false, error: 'Navigation failed' },
+        error: undefined,
+        status: 200,
+      })
+      .mockResolvedValueOnce({ data: null, error: undefined, status: 200 });
+
+    const { result } = renderHook(() => useBrowserContext());
+
+    await act(async () => {
+      await result.current.startAuth('https://github.com');
+    });
+
+    await waitFor(() => {
+      expect(result.current.showAuthFlow).toBe(false);
+    });
+    expect(result.current.liveViewUrl).toBeNull();
+    expect(toast.error).toHaveBeenCalledWith('Navigation failed');
+    expect(apiClient.post).toHaveBeenLastCalledWith('/v1/browserbase/session/close', {
+      sessionId: 'bbs_1',
+    });
+  });
+
+  it('keeps auth Live View open when verification has not logged in yet', async () => {
+    vi.mocked(apiClient.post)
+      .mockResolvedValueOnce({
+        data: { profile: unverifiedProfile, isNew: false },
+        error: undefined,
+        status: 200,
+      })
+      .mockResolvedValueOnce({
+        data: { sessionId: 'bbs_1', liveViewUrl: 'https://live.browserbase.test/session' },
+        error: undefined,
+        status: 200,
+      })
+      .mockResolvedValueOnce({
+        data: { success: true },
+        error: undefined,
+        status: 200,
+      })
+      .mockResolvedValueOnce({
+        data: { auth: { isLoggedIn: false }, profile: unverifiedProfile },
+        error: undefined,
+        status: 200,
+      });
+
+    const { result } = renderHook(() => useBrowserContext());
+
+    await act(async () => {
+      await result.current.startAuth('https://github.com');
+    });
+
+    expect(result.current.showAuthFlow).toBe(true);
+
+    await act(async () => {
+      await result.current.checkAuth('https://github.com');
+    });
+
+    expect(result.current.showAuthFlow).toBe(true);
+    expect(result.current.liveViewUrl).toBe('https://live.browserbase.test/session');
+    expect(result.current.sessionId).toBe('bbs_1');
+    expect(apiClient.post).not.toHaveBeenCalledWith('/v1/browserbase/session/close', {
+      sessionId: 'bbs_1',
+    });
+    expect(toast.error).toHaveBeenCalledWith(
+      'Still not logged in. Finish login, then click Check & Save again.',
+    );
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/useBrowserContext.ts b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/useBrowserContext.ts
index 80f902b8d1..b3abbffb71 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/useBrowserContext.ts
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/useBrowserContext.ts
@@ -5,14 +5,17 @@ import { useCallback, useState } from 'react';
 import { toast } from 'sonner';
 import type {
   AuthStatusResponse,
+  BrowserAuthProfile,
   BrowserContextStatus,
-  ContextResponse,
+  NavigateResponse,
+  ResolveAuthProfileResponse,
   SessionResponse,
 } from './types';
 
 export function useBrowserContext() {
   const [status, setStatus] = useState<BrowserContextStatus>('loading');
   const [contextId, setContextId] = useState<string | null>(null);
+  const [profileId, setProfileId] = useState<string | null>(null);
   const [sessionId, setSessionId] = useState<string | null>(null);
   const [liveViewUrl, setLiveViewUrl] = useState<string | null>(null);
   const [isStartingAuth, setIsStartingAuth] = useState(false);
@@ -20,80 +23,84 @@ export function useBrowserContext() {
 
   const checkContextStatus = useCallback(async () => {
     try {
-      const res = await apiClient.get<{ hasContext: boolean; contextId?: string }>(
-        '/v1/browserbase/org-context',
-      );
+      const res = await apiClient.get<BrowserAuthProfile[]>('/v1/browserbase/profiles');
       if (res.data) {
-        if (res.data.hasContext && res.data.contextId) {
-          setContextId(res.data.contextId);
+        const verifiedProfile = res.data.find((profile) => profile.status === 'verified');
+        if (verifiedProfile) {
+          setContextId(verifiedProfile.contextId);
+          setProfileId(verifiedProfile.id);
           setStatus('has-context');
         } else {
+          setContextId(null);
+          setProfileId(null);
           setStatus('no-context');
         }
+      } else {
+        setContextId(null);
+        setProfileId(null);
+        setStatus('no-context');
       }
     } catch {
       setStatus('no-context');
     }
   }, []);
 
-  const startAuth = useCallback(
-    async (url: string) => {
-      let startedSessionId: string | null = null;
-      try {
-        setIsStartingAuth(true);
+  const startAuth = useCallback(async (url: string) => {
+    let startedSessionId: string | null = null;
+    try {
+      setIsStartingAuth(true);
 
-        // Get or create org context
-        const contextRes = await apiClient.post<ContextResponse>(
-          '/v1/browserbase/org-context',
-          {},
-        );
-        if (contextRes.error || !contextRes.data) {
-          throw new Error(contextRes.error || 'Failed to create context');
-        }
-        setContextId(contextRes.data.contextId);
+      const profileRes = await apiClient.post<ResolveAuthProfileResponse>(
+        '/v1/browserbase/profiles/resolve',
+        { url },
+      );
+      if (profileRes.error || !profileRes.data) {
+        throw new Error(profileRes.error || 'Failed to create auth profile');
+      }
+      setProfileId(profileRes.data.profile.id);
 
-        // Create session
-        const sessionRes = await apiClient.post<SessionResponse>(
-          '/v1/browserbase/session',
-          { contextId: contextRes.data.contextId },
-        );
-        if (sessionRes.error || !sessionRes.data) {
-          throw new Error(sessionRes.error || 'Failed to create session');
-        }
-        startedSessionId = sessionRes.data.sessionId;
-        setSessionId(startedSessionId);
-        setLiveViewUrl(sessionRes.data.liveViewUrl);
-
-        // Navigate to the URL
-        await apiClient.post(
-          '/v1/browserbase/navigate',
-          { sessionId: startedSessionId, url },
+      const sessionRes = await apiClient.post<SessionResponse>(
+        `/v1/browserbase/profiles/${profileRes.data.profile.id}/session`,
+        {},
+      );
+      if (sessionRes.error || !sessionRes.data) {
+        throw new Error(sessionRes.error || 'Failed to create session');
+      }
+      startedSessionId = sessionRes.data.sessionId;
+      setSessionId(startedSessionId);
+      setLiveViewUrl(sessionRes.data.liveViewUrl);
+
+      const navigateRes = await apiClient.post<NavigateResponse>('/v1/browserbase/navigate', {
+        sessionId: startedSessionId,
+        url,
+      });
+      if (navigateRes.error || !navigateRes.data?.success) {
+        throw new Error(
+          navigateRes.error ||
+            navigateRes.data?.error ||
+            'Failed to open the website in the browser session',
         );
+      }
 
-        setShowAuthFlow(true);
-        setIsStartingAuth(false);
-      } catch (err) {
-        toast.error(err instanceof Error ? err.message : 'Failed to start authentication');
-        setShowAuthFlow(false);
-        setLiveViewUrl(null);
-        setSessionId(null);
-        setIsStartingAuth(false);
-
-        // If we created a session but navigation failed, close it to avoid orphaned sessions
-        if (startedSessionId) {
-          try {
-            await apiClient.post(
-              '/v1/browserbase/session/close',
-              { sessionId: startedSessionId },
-            );
-          } catch {
-            // Ignore cleanup errors (don't mask original error)
-          }
+      setShowAuthFlow(true);
+      setIsStartingAuth(false);
+    } catch (err) {
+      toast.error(err instanceof Error ? err.message : 'Failed to start authentication');
+      setShowAuthFlow(false);
+      setLiveViewUrl(null);
+      setSessionId(null);
+      setIsStartingAuth(false);
+
+      // If we created a session but navigation failed, close it to avoid orphaned sessions
+      if (startedSessionId) {
+        try {
+          await apiClient.post('/v1/browserbase/session/close', { sessionId: startedSessionId });
+        } catch {
+          // Ignore cleanup errors (don't mask original error)
         }
       }
-    },
-    [],
-  );
+    }
+  }, []);
 
   const checkAuth = useCallback(
     async (url: string) => {
@@ -102,32 +109,44 @@ export function useBrowserContext() {
       try {
         setStatus('checking');
 
-        const res = await apiClient.post<AuthStatusResponse>(
-          '/v1/browserbase/check-auth',
-          { sessionId, url },
-        );
+        if (!profileId) throw new Error('No auth profile selected');
 
-        // Close session
-        await apiClient.post('/v1/browserbase/session/close', { sessionId });
-        setSessionId(null);
-        setLiveViewUrl(null);
-        setShowAuthFlow(false);
+        const res = await apiClient.post<{
+          auth: AuthStatusResponse;
+          profile: BrowserAuthProfile;
+        }>(`/v1/browserbase/profiles/${profileId}/verify`, { sessionId, url });
 
-        if (res.data?.isLoggedIn) {
+        if (res.error || !res.data) {
+          throw new Error(res.error || 'Failed to check authentication');
+        }
+
+        if (res.data.auth.isLoggedIn) {
+          try {
+            await apiClient.post('/v1/browserbase/session/close', { sessionId });
+          } catch {
+            // Ignore cleanup errors after auth was already verified
+          }
+          setSessionId(null);
+          setLiveViewUrl(null);
+          setShowAuthFlow(false);
           toast.success(
-            res.data.username ? `Authenticated as ${res.data.username}` : 'Authentication saved',
+            res.data.auth.username
+              ? `Authenticated as ${res.data.auth.username}`
+              : 'Authentication saved',
           );
+          setContextId(res.data.profile.contextId);
+          setProfileId(res.data.profile.id);
           setStatus('has-context');
         } else {
-          toast.error('Not logged in. Please try again.');
-          setStatus('has-context');
+          toast.error('Still not logged in. Finish login, then click Check & Save again.');
+          setStatus('no-context');
         }
       } catch (err) {
         toast.error(err instanceof Error ? err.message : 'Failed to check auth');
-        setStatus('has-context');
+        setStatus('no-context');
       }
     },
-    [sessionId],
+    [sessionId, profileId],
   );
 
   const cancelAuth = useCallback(async () => {
@@ -147,6 +166,7 @@ export function useBrowserContext() {
   return {
     status,
     contextId,
+    profileId,
     sessionId,
     liveViewUrl,
     isStartingAuth,
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/useBrowserExecution.ts b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/useBrowserExecution.ts
index ac903d2f3c..b042d9f3e4 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/useBrowserExecution.ts
+++ b/apps/app/src/app/(app)/[orgId]/tasks/[taskId]/hooks/useBrowserExecution.ts
@@ -6,14 +6,11 @@ import { toast } from 'sonner';
 import type { ExecuteResponse, StartLiveResponse } from './types';
 
 interface UseBrowserExecutionOptions {
-  onNeedsReauth: () => void;
+  onNeedsReauth: (automationId: string) => void;
   onComplete: () => void;
 }
 
-export function useBrowserExecution({
-  onNeedsReauth,
-  onComplete,
-}: UseBrowserExecutionOptions) {
+export function useBrowserExecution({ onNeedsReauth, onComplete }: UseBrowserExecutionOptions) {
   const [runningAutomationId, setRunningAutomationId] = useState<string | null>(null);
   const [liveViewUrl, setLiveViewUrl] = useState<string | null>(null);
   const [sessionId, setSessionId] = useState<string | null>(null);
@@ -34,7 +31,7 @@ export function useBrowserExecution({
 
         if (startRes.data?.needsReauth) {
           toast.error('Session expired. Please re-authenticate below.');
-          onNeedsReauth();
+          onNeedsReauth(automationId);
           return;
         }
 
@@ -76,10 +73,7 @@ export function useBrowserExecution({
 
         if (startedSessionId) {
           try {
-            await apiClient.post(
-              '/v1/browserbase/session/close',
-              { sessionId: startedSessionId },
-            );
+            await apiClient.post('/v1/browserbase/session/close', { sessionId: startedSessionId });
           } catch {
             // Ignore cleanup errors (don't block UI / don't mask original error)
           }
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/components/ModernTaskListItem.tsx b/apps/app/src/app/(app)/[orgId]/tasks/components/ModernTaskListItem.tsx
index a2409cd353..4144ac1ea4 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/components/ModernTaskListItem.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/components/ModernTaskListItem.tsx
@@ -124,7 +124,9 @@ export function ModernTaskListItem({
                 />
               ) : (
                 <span className="text-muted-foreground text-xs font-medium">
-                  {member.user?.name?.charAt(0) ?? '?'}
+                  {member.user?.name?.charAt(0) ||
+                    member.user?.email?.charAt(0).toUpperCase() ||
+                    '?'}
                 </span>
               )}
             </div>
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/components/TaskAssigneeDisplay.test.tsx b/apps/app/src/app/(app)/[orgId]/tasks/components/TaskAssigneeDisplay.test.tsx
new file mode 100644
index 0000000000..ce600f8036
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/tasks/components/TaskAssigneeDisplay.test.tsx
@@ -0,0 +1,111 @@
+import { render, screen } from '@testing-library/react';
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+import { ModernTaskListItem } from './ModernTaskListItem';
+import { TaskList } from './TaskList';
+import { TasksByCategory } from './TasksByCategory';
+
+// next/navigation is mocked locally (not via the global setup) so we can add
+// useParams (needed by TaskList) and vary the search params per test.
+const nav = vi.hoisted(() => ({ search: new URLSearchParams() }));
+const nuqs = vi.hoisted(() => ({ assignee: null as string | null }));
+
+vi.mock('next/navigation', () => ({
+  useRouter: () => ({ push: vi.fn(), replace: vi.fn(), refresh: vi.fn(), back: vi.fn() }),
+  usePathname: () => '/org_1/tasks',
+  useSearchParams: () => nav.search,
+  useParams: () => ({ orgId: 'org_1' }),
+  redirect: vi.fn(),
+}));
+
+vi.mock('nuqs', () => ({
+  useQueryState: (key: string) => [key === 'assignee' ? nuqs.assignee : null, vi.fn()],
+}));
+
+type TasksByCategoryProps = Parameters<typeof TasksByCategory>[0];
+type CategoryTask = TasksByCategoryProps['tasks'][number];
+type MemberWithUser = TasksByCategoryProps['members'][number];
+
+function makeTask(overrides: Partial<CategoryTask> = {}): CategoryTask {
+  return {
+    id: 'tsk_1',
+    title: 'Evidence item',
+    description: null,
+    status: 'todo',
+    assigneeId: 'mem_1',
+    controls: [{ id: 'ctl_1', name: 'Access Control' }],
+    evidenceAutomations: [],
+    ...overrides,
+  } as unknown as CategoryTask;
+}
+
+function makeMember({
+  name,
+  email,
+  role = 'employee',
+}: {
+  name: string;
+  email: string;
+  role?: string;
+}): MemberWithUser {
+  return {
+    id: 'mem_1',
+    role,
+    user: { id: 'usr_1', name, email, image: null },
+  } as unknown as MemberWithUser;
+}
+
+afterEach(() => {
+  nav.search = new URLSearchParams();
+  nuqs.assignee = null;
+});
+
+// An employee whose User.name is empty (e.g. "Akmal") must still be identified
+// by email instead of rendering blank in the evidence list.
+const AKMAL_EMAIL = 'akmal@example.com';
+
+describe('TasksByCategory assignee cell', () => {
+  it('falls back to the email when the assignee has no name', () => {
+    nav.search = new URLSearchParams('category=ctl_1');
+
+    render(
+      <TasksByCategory
+        tasks={[makeTask()]}
+        members={[makeMember({ name: '', email: AKMAL_EMAIL })]}
+      />,
+    );
+
+    expect(screen.getByText(AKMAL_EMAIL)).toBeInTheDocument();
+  });
+});
+
+describe('ModernTaskListItem assignee avatar', () => {
+  it('shows the email initial when the assignee has no name', () => {
+    render(
+      <ModernTaskListItem
+        task={makeTask()}
+        members={[makeMember({ name: '', email: AKMAL_EMAIL })]}
+        onClick={vi.fn()}
+      />,
+    );
+
+    expect(screen.getByText('A')).toBeInTheDocument();
+  });
+});
+
+describe('TaskList "Everyone" assignee filter', () => {
+  it('falls back to the email when the selected assignee has no name', () => {
+    nuqs.assignee = 'mem_1';
+
+    render(
+      <TaskList
+        tasks={[]}
+        members={[makeMember({ name: '', email: AKMAL_EMAIL, role: 'owner' })]}
+        frameworkInstances={[]}
+        activeTab="categories"
+      />,
+    );
+
+    expect(screen.getByText(AKMAL_EMAIL)).toBeInTheDocument();
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/components/TaskList.tsx b/apps/app/src/app/(app)/[orgId]/tasks/components/TaskList.tsx
index 06c9b2347d..5d2f8084c9 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/components/TaskList.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/components/TaskList.tsx
@@ -709,7 +709,9 @@ export function TaskList({
                               </AvatarFallback>
                             </Avatar>
                             <span className="truncate">
-                              {selectedMember.user.name ?? 'Unknown member'}
+                              {selectedMember.user.name ||
+                                selectedMember.user.email ||
+                                'Unknown member'}
                             </span>
                           </div>
                         );
@@ -732,7 +734,7 @@ export function TaskList({
                               {member.user.name?.charAt(0)?.toUpperCase() ?? '?'}
                             </AvatarFallback>
                           </Avatar>
-                          <span>{member.user.name ?? 'Unknown member'}</span>
+                          <span>{member.user.name || member.user.email || 'Unknown member'}</span>
                         </div>
                       </SelectItem>
                     ))}
diff --git a/apps/app/src/app/(app)/[orgId]/tasks/components/TasksByCategory.tsx b/apps/app/src/app/(app)/[orgId]/tasks/components/TasksByCategory.tsx
index db1a61766e..159e932472 100644
--- a/apps/app/src/app/(app)/[orgId]/tasks/components/TasksByCategory.tsx
+++ b/apps/app/src/app/(app)/[orgId]/tasks/components/TasksByCategory.tsx
@@ -353,7 +353,9 @@ export function TasksByCategory({ tasks, members, statusFilter }: TasksByCategor
                                 </span>
                               )}
                             </div>
-                            <span className="truncate">{member.user?.name ?? 'Unassigned'}</span>
+                            <span className="truncate">
+                              {member.user?.name || member.user?.email || 'Unassigned'}
+                            </span>
                           </div>
                         ) : (
                           <span className="text-xs text-muted-foreground">Unassigned</span>
diff --git a/apps/app/src/trigger/tasks/onboarding/update-policy.ts b/apps/app/src/trigger/tasks/onboarding/update-policy.ts
index da53708a0e..65cb3a3354 100644
--- a/apps/app/src/trigger/tasks/onboarding/update-policy.ts
+++ b/apps/app/src/trigger/tasks/onboarding/update-policy.ts
@@ -23,6 +23,9 @@ export const updatePolicy = schemaTask({
         description: z.string(),
         visible: z.boolean(),
         organizationId: z.string().nullable().default(null),
+        // FRAME-20: frameworks now carry a family pointer; keep this payload
+        // schema in step with the FrameworkEditorFramework shape it's typed as.
+        familyId: z.string().nullable().default(null),
         createdAt: z.date(),
         updatedAt: z.date(),
       }),
diff --git a/apps/framework-editor/app/(pages)/frameworks/FrameworksClientPage.tsx b/apps/framework-editor/app/(pages)/frameworks/FrameworksClientPage.tsx
index 3136d4b749..7485aeecf2 100644
--- a/apps/framework-editor/app/(pages)/frameworks/FrameworksClientPage.tsx
+++ b/apps/framework-editor/app/(pages)/frameworks/FrameworksClientPage.tsx
@@ -1,15 +1,17 @@
 'use client';
 
-import { DataTable } from '@/app/components/DataTable';
 import PageLayout from '@/app/components/PageLayout';
-import type { FrameworkEditorFramework } from '@/db';
+import type { FrameworkEditorFramework, FrameworkEditorFrameworkFamilyStatus } from '@/db';
 import { Button } from '@trycompai/ui/button';
-import { Upload } from 'lucide-react';
-import { useRouter } from 'next/navigation';
-import { useState } from 'react';
-import { columns } from './components/columns';
+import { Input } from '@trycompai/ui/input';
+import { FolderPlus, Plus, Upload } from 'lucide-react';
+import { useMemo, useState } from 'react';
 import { CreateFrameworkDialog } from './components/CreateFrameworkDialog';
+import { DeleteFrameworkFamilyDialog } from './components/DeleteFrameworkFamilyDialog';
+import { FrameworkFamilyDialog } from './components/FrameworkFamilyDialog';
+import { FrameworkFamilySection } from './components/FrameworkFamilySection';
 import { ImportFrameworkDialog } from './components/ImportFrameworkDialog';
+import { MoveFrameworkDialog } from './components/MoveFrameworkDialog';
 
 export interface FrameworkWithCounts extends Omit<FrameworkEditorFramework, 'requirements'> {
   requirementsCount: number;
@@ -17,47 +19,168 @@ export interface FrameworkWithCounts extends Omit<FrameworkEditorFramework, 'req
   latestVersion: { id: string; version: string; publishedAt: string } | null;
 }
 
+export interface FrameworkFamilyWithCount {
+  id: string;
+  name: string;
+  description: string;
+  status: FrameworkEditorFrameworkFamilyStatus;
+  frameworksCount: number;
+  createdAt: string;
+  updatedAt: string;
+}
+
 interface FrameworksClientPageProps {
   initialFrameworks: FrameworkWithCounts[];
+  initialFamilies: FrameworkFamilyWithCount[];
 }
 
-export function FrameworksClientPage({ initialFrameworks }: FrameworksClientPageProps) {
-  const [isCreateDialogOpen, setIsCreateDialogOpen] = useState(false);
-  const [isImportDialogOpen, setIsImportDialogOpen] = useState(false);
-  const router = useRouter();
+export function FrameworksClientPage({
+  initialFrameworks,
+  initialFamilies,
+}: FrameworksClientPageProps) {
+  const [search, setSearch] = useState('');
+  const [isCreateFrameworkOpen, setIsCreateFrameworkOpen] = useState(false);
+  const [isImportOpen, setIsImportOpen] = useState(false);
+  // Move is scoped to the section it's opened from ("frameworks in the current
+  // family", per FRAME-20) — these are the source frameworks for the dialog.
+  const [moveDialog, setMoveDialog] = useState<{
+    open: boolean;
+    frameworks: FrameworkWithCounts[];
+  }>({ open: false, frameworks: [] });
+  const [familyDialog, setFamilyDialog] = useState<{
+    open: boolean;
+    family: FrameworkFamilyWithCount | null;
+  }>({ open: false, family: null });
+  const [deleteDialog, setDeleteDialog] = useState<{
+    open: boolean;
+    family: FrameworkFamilyWithCount | null;
+  }>({ open: false, family: null });
+
+  const searching = search.trim().length > 0;
+
+  const filtered = useMemo(() => {
+    const term = search.trim().toLowerCase();
+    if (!term) return initialFrameworks;
+    return initialFrameworks.filter((fw) => fw.name.toLowerCase().includes(term));
+  }, [initialFrameworks, search]);
 
-  const handleRowClick = (framework: FrameworkWithCounts) => {
-    router.push(`/frameworks/${framework.id}`);
-  };
+  const { byFamilyId, ungrouped } = useMemo(() => {
+    const map = new Map<string, FrameworkWithCounts[]>();
+    const root: FrameworkWithCounts[] = [];
+    for (const fw of filtered) {
+      if (fw.familyId) {
+        const arr = map.get(fw.familyId);
+        if (arr) arr.push(fw);
+        else map.set(fw.familyId, [fw]);
+      } else {
+        root.push(fw);
+      }
+    }
+    return { byFamilyId: map, ungrouped: root };
+  }, [filtered]);
+
+  const sortedFamilies = useMemo(
+    () => [...initialFamilies].sort((a, b) => a.name.localeCompare(b.name)),
+    [initialFamilies],
+  );
+
+  // True (unfiltered) count of ungrouped frameworks — drives the label and the
+  // move scope regardless of the search filter.
+  const ungroupedTotal = useMemo(
+    () => initialFrameworks.filter((fw) => !fw.familyId).length,
+    [initialFrameworks],
+  );
+
+  // The full (unfiltered) framework list for a given family (null = ungrouped),
+  // used as the move dialog's scoped source.
+  const frameworksOf = (familyId: string | null) =>
+    initialFrameworks.filter((fw) => (fw.familyId ?? null) === familyId);
 
   return (
     <PageLayout breadcrumbs={[{ label: 'Frameworks', href: '/frameworks' }]}>
-      <DataTable
-        data={initialFrameworks}
-        columns={columns}
-        searchPlaceholder="Search frameworks..."
-        onCreateClick={() => setIsCreateDialogOpen(true)}
-        createButtonLabel="Create New Framework"
-        onRowClick={handleRowClick}
-        additionalActions={
-          <Button
-            variant="outline"
-            onClick={() => setIsImportDialogOpen(true)}
-          >
-            <Upload className="mr-2 h-4 w-4" />
-            Import Framework
-          </Button>
-        }
-      />
+      <div className="flex flex-col gap-4">
+        <div className="flex flex-wrap items-center justify-between gap-2">
+          <Input
+            placeholder="Search frameworks..."
+            value={search}
+            onChange={(e) => setSearch(e.target.value)}
+            className="max-w-xs"
+          />
+          <div className="flex flex-wrap items-center gap-2">
+            <Button variant="outline" onClick={() => setIsImportOpen(true)}>
+              <Upload className="mr-2 h-4 w-4" />
+              Import
+            </Button>
+            <Button
+              variant="outline"
+              onClick={() => setFamilyDialog({ open: true, family: null })}
+            >
+              <FolderPlus className="mr-2 h-4 w-4" />
+              Create New Framework Family
+            </Button>
+            <Button onClick={() => setIsCreateFrameworkOpen(true)}>
+              <Plus className="mr-2 h-4 w-4" />
+              Create New Framework
+            </Button>
+          </div>
+        </div>
+
+        <div className="flex flex-col gap-3">
+          {sortedFamilies.map((family) => {
+            const frameworks = byFamilyId.get(family.id) ?? [];
+            // While searching, hide families with no matching frameworks.
+            if (searching && frameworks.length === 0) return null;
+            return (
+              <FrameworkFamilySection
+                key={family.id}
+                title={family.name}
+                status={family.status}
+                count={family.frameworksCount}
+                frameworks={frameworks}
+                onMove={() =>
+                  setMoveDialog({ open: true, frameworks: frameworksOf(family.id) })
+                }
+                onEdit={() => setFamilyDialog({ open: true, family })}
+                onDelete={() => setDeleteDialog({ open: true, family })}
+              />
+            );
+          })}
+          {(!searching || ungrouped.length > 0) && (
+            <FrameworkFamilySection
+              title="Ungrouped"
+              count={ungroupedTotal}
+              frameworks={ungrouped}
+              onMove={() => setMoveDialog({ open: true, frameworks: frameworksOf(null) })}
+            />
+          )}
+        </div>
+      </div>
+
       <CreateFrameworkDialog
-        isOpen={isCreateDialogOpen}
-        onOpenChange={setIsCreateDialogOpen}
-        onFrameworkCreated={() => setIsCreateDialogOpen(false)}
+        isOpen={isCreateFrameworkOpen}
+        onOpenChange={setIsCreateFrameworkOpen}
+        onFrameworkCreated={() => setIsCreateFrameworkOpen(false)}
+      />
+      <ImportFrameworkDialog isOpen={isImportOpen} onOpenChange={setIsImportOpen} />
+      <MoveFrameworkDialog
+        isOpen={moveDialog.open}
+        onOpenChange={(open) => setMoveDialog((s) => ({ ...s, open }))}
+        frameworks={moveDialog.frameworks}
+        families={initialFamilies}
       />
-      <ImportFrameworkDialog
-        isOpen={isImportDialogOpen}
-        onOpenChange={setIsImportDialogOpen}
+      <FrameworkFamilyDialog
+        isOpen={familyDialog.open}
+        onOpenChange={(open) => setFamilyDialog((s) => ({ ...s, open }))}
+        family={familyDialog.family}
       />
+      {deleteDialog.family && (
+        <DeleteFrameworkFamilyDialog
+          isOpen={deleteDialog.open}
+          onOpenChange={(open) => setDeleteDialog((s) => ({ ...s, open }))}
+          familyId={deleteDialog.family.id}
+          familyName={deleteDialog.family.name}
+        />
+      )}
     </PageLayout>
   );
 }
diff --git a/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/FrameworkRequirementsClientPage.tsx b/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/FrameworkRequirementsClientPage.tsx
index da517c096c..aae08cffa5 100644
--- a/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/FrameworkRequirementsClientPage.tsx
+++ b/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/FrameworkRequirementsClientPage.tsx
@@ -37,6 +37,7 @@ interface RequirementInput {
   identifier: string;
   description: string;
   requirementFamily?: string | null;
+  sortOrder?: number | null;
   frameworkId: string;
   createdAt: string | Date;
   updatedAt: string | Date;
@@ -85,6 +86,7 @@ export function FrameworkRequirementsClientPage({
         identifier: r.identifier ?? null,
         description: r.description ?? null,
         requirementFamily: r.requirementFamily ?? null,
+        sortOrder: r.sortOrder ?? null,
         controlTemplates: r.controlTemplates ?? [],
         controlTemplatesLength: r.controlTemplates?.length ?? 0,
         createdAt: r.createdAt ? new Date(r.createdAt) : null,
@@ -117,6 +119,38 @@ export function FrameworkRequirementsClientPage({
 
   const columns = useMemo(
     () => [
+      columnHelper.accessor('sortOrder', {
+        header: 'Order',
+        size: 90,
+        // Numbered rows ascending, unset rows last, identifier as a tiebreak.
+        // (tanstack inverts this for the desc toggle.)
+        sortingFn: (a, b) => {
+          const ao = a.original.sortOrder;
+          const bo = b.original.sortOrder;
+          if (ao !== bo) {
+            if (ao == null) return 1;
+            if (bo == null) return -1;
+            return ao - bo;
+          }
+          return (a.original.identifier ?? '').localeCompare(
+            b.original.identifier ?? '',
+            undefined,
+            { numeric: true },
+          );
+        },
+        cell: ({ row, getValue }) => {
+          const value = getValue();
+          return (
+            <EditableCell
+              value={value == null ? null : String(value)}
+              rowId={row.original.id}
+              columnId="sortOrder"
+              onUpdate={updateCell}
+              placeholder="—"
+            />
+          );
+        },
+      }),
       columnHelper.accessor('requirementFamily', {
         header: 'Family',
         size: 200,
@@ -232,7 +266,9 @@ export function FrameworkRequirementsClientPage({
     [uniqueFamilies, updateCell, updateRelational, deleteRow, createdIds],
   );
 
-  const [sorting, setSorting] = useState<SortingState>([{ id: 'identifier', desc: false }]);
+  // FRAME-18: default to the framework's configured order. Numbered requirements
+  // come first; unset rows fall back to identifier order and sort last.
+  const [sorting, setSorting] = useState<SortingState>([{ id: 'sortOrder', desc: false }]);
 
   const table = useReactTable({
     data,
@@ -251,6 +287,7 @@ export function FrameworkRequirementsClientPage({
       identifier: '',
       description: '',
       requirementFamily: null,
+      sortOrder: null,
       controlTemplates: [],
       controlTemplatesLength: 0,
       createdAt: new Date(),
diff --git a/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/hooks/useRequirementChangeTracking.test.tsx b/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/hooks/useRequirementChangeTracking.test.tsx
index 9f91bc66ff..589c89bc77 100644
--- a/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/hooks/useRequirementChangeTracking.test.tsx
+++ b/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/hooks/useRequirementChangeTracking.test.tsx
@@ -28,6 +28,7 @@ function makeRow(overrides: Partial<RequirementGridRow> = {}): RequirementGridRo
     identifier: '10.3',
     description: '',
     requirementFamily: 'Access Control',
+    sortOrder: null,
     controlTemplates: [],
     controlTemplatesLength: 0,
     createdAt: new Date(),
diff --git a/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/hooks/useRequirementChangeTracking.ts b/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/hooks/useRequirementChangeTracking.ts
index 3d699e390d..b55885ba2c 100644
--- a/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/hooks/useRequirementChangeTracking.ts
+++ b/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/hooks/useRequirementChangeTracking.ts
@@ -10,12 +10,23 @@ export interface RequirementGridRow {
   identifier: string | null;
   description: string | null;
   requirementFamily: string | null;
+  // FRAME-18: per-framework display order. null = unset (sorts last).
+  sortOrder: number | null;
   controlTemplates: Array<{ id: string; name: string }>;
   controlTemplatesLength: number;
   createdAt: Date | null;
   updatedAt: Date | null;
 }
 
+// Parse the free-text Order cell into a non-negative integer, or null when blank
+// / invalid. Keeps the grid's sortOrder numeric so the column sorts correctly.
+function parseSortOrder(value: string): number | null {
+  const trimmed = value.trim();
+  if (trimmed === '') return null;
+  const parsed = Number.parseInt(trimmed, 10);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+}
+
 export const simpleUUID = () => crypto.randomUUID();
 
 export function useRequirementChangeTracking(
@@ -43,6 +54,11 @@ export function useRequirementChangeTracking(
       setData((prev) =>
         prev.map((row) => {
           if (row.id !== rowId) return row;
+          // sortOrder is numeric — coerce the free-text cell to number | null
+          // so the grid sorts correctly and the API receives a valid value.
+          if (columnId === 'sortOrder') {
+            return { ...row, sortOrder: parseSortOrder(value), updatedAt: new Date() };
+          }
           return { ...row, [columnId]: value, updatedAt: new Date() };
         }),
       );
@@ -142,6 +158,7 @@ export function useRequirementChangeTracking(
             identifier: row.identifier ?? '',
             description: row.description ?? '',
             requirementFamily: row.requirementFamily ?? undefined,
+            sortOrder: row.sortOrder ?? undefined,
           }),
         });
         // Persist control links the user picked on the uncommitted row.
@@ -180,6 +197,7 @@ export function useRequirementChangeTracking(
       identifier: string;
       description: string;
       requirementFamily: string | null;
+      sortOrder: number | null;
     }> = [];
     for (const id of updatedIds) {
       if (createdIds.has(id) || deletedIds.has(id)) continue;
@@ -191,6 +209,7 @@ export function useRequirementChangeTracking(
         identifier: row.identifier ?? '',
         description: row.description ?? '',
         requirementFamily: row.requirementFamily ?? null,
+        sortOrder: row.sortOrder ?? null,
       });
     }
     if (updatesToSend.length > 0) {
diff --git a/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/page.tsx b/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/page.tsx
index 3d292c8dd7..c7fa91865d 100644
--- a/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/page.tsx
+++ b/apps/framework-editor/app/(pages)/frameworks/[frameworkId]/page.tsx
@@ -14,6 +14,8 @@ interface FrameworkDetail {
     name: string;
     identifier: string;
     description: string;
+    requirementFamily: string | null;
+    sortOrder: number | null;
     frameworkId: string;
     createdAt: string;
     updatedAt: string;
diff --git a/apps/framework-editor/app/(pages)/frameworks/components/DeleteFrameworkFamilyDialog.tsx b/apps/framework-editor/app/(pages)/frameworks/components/DeleteFrameworkFamilyDialog.tsx
new file mode 100644
index 0000000000..145fe45834
--- /dev/null
+++ b/apps/framework-editor/app/(pages)/frameworks/components/DeleteFrameworkFamilyDialog.tsx
@@ -0,0 +1,74 @@
+'use client';
+
+import { apiClient } from '@/app/lib/api-client';
+import {
+  AlertDialog,
+  AlertDialogAction,
+  AlertDialogCancel,
+  AlertDialogContent,
+  AlertDialogDescription,
+  AlertDialogFooter,
+  AlertDialogHeader,
+  AlertDialogTitle,
+} from '@trycompai/ui/alert-dialog';
+import { useRouter } from 'next/navigation';
+import { useState } from 'react';
+import { toast } from 'sonner';
+
+interface DeleteFrameworkFamilyDialogProps {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  familyId: string;
+  familyName: string;
+}
+
+export function DeleteFrameworkFamilyDialog({
+  isOpen,
+  onOpenChange,
+  familyId,
+  familyName,
+}: DeleteFrameworkFamilyDialogProps) {
+  const router = useRouter();
+  const [isDeleting, setIsDeleting] = useState(false);
+
+  async function handleDelete() {
+    setIsDeleting(true);
+    try {
+      await apiClient(`/framework-family/${familyId}`, { method: 'DELETE' });
+      toast.success('Framework family deleted');
+      onOpenChange(false);
+      router.refresh();
+    } catch (error) {
+      toast.error(
+        error instanceof Error ? error.message : 'Failed to delete framework family.',
+      );
+    } finally {
+      setIsDeleting(false);
+    }
+  }
+
+  return (
+    <AlertDialog open={isOpen} onOpenChange={onOpenChange}>
+      <AlertDialogContent>
+        <AlertDialogHeader>
+          <AlertDialogTitle>Delete &ldquo;{familyName}&rdquo;?</AlertDialogTitle>
+          <AlertDialogDescription>
+            Are you sure? This cannot be undone.
+          </AlertDialogDescription>
+        </AlertDialogHeader>
+        <AlertDialogFooter>
+          <AlertDialogCancel disabled={isDeleting}>Cancel</AlertDialogCancel>
+          <AlertDialogAction
+            onClick={(event) => {
+              event.preventDefault();
+              handleDelete();
+            }}
+            disabled={isDeleting}
+          >
+            {isDeleting ? 'Deleting...' : 'Delete'}
+          </AlertDialogAction>
+        </AlertDialogFooter>
+      </AlertDialogContent>
+    </AlertDialog>
+  );
+}
diff --git a/apps/framework-editor/app/(pages)/frameworks/components/FrameworkFamilyDialog.tsx b/apps/framework-editor/app/(pages)/frameworks/components/FrameworkFamilyDialog.tsx
new file mode 100644
index 0000000000..4ec32be7f0
--- /dev/null
+++ b/apps/framework-editor/app/(pages)/frameworks/components/FrameworkFamilyDialog.tsx
@@ -0,0 +1,207 @@
+'use client';
+
+import { apiClient } from '@/app/lib/api-client';
+import { zodResolver } from '@hookform/resolvers/zod';
+import { Button } from '@trycompai/ui/button';
+import {
+  Dialog,
+  DialogClose,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@trycompai/ui/dialog';
+import { Form, FormControl, FormField, FormItem, FormLabel, FormMessage } from '@trycompai/ui/form';
+import { Input } from '@trycompai/ui/input';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@trycompai/ui/select';
+import { Textarea } from '@trycompai/ui/textarea';
+import { useRouter } from 'next/navigation';
+import { useEffect } from 'react';
+import { useForm } from 'react-hook-form';
+import { toast } from 'sonner';
+import type { z } from 'zod';
+import type { FrameworkFamilyWithCount } from '../FrameworksClientPage';
+import { FrameworkFamilyBaseSchema } from '../schemas';
+import { FRAMEWORK_FAMILY_STATUSES } from './family-status';
+
+type FamilyFormValues = z.infer<typeof FrameworkFamilyBaseSchema>;
+
+// Stops password managers (NordPass, 1Password, LastPass, Dashlane, Bitwarden)
+// from popping autofill widgets over these non-credential fields.
+const NO_AUTOFILL = {
+  autoComplete: 'off',
+  'data-1p-ignore': true,
+  'data-lpignore': 'true',
+  'data-form-type': 'other',
+  'data-bwignore': true,
+} as const;
+
+interface FrameworkFamilyDialogProps {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  // When provided, the dialog edits this family; otherwise it creates a new one.
+  family?: FrameworkFamilyWithCount | null;
+}
+
+export function FrameworkFamilyDialog({
+  isOpen,
+  onOpenChange,
+  family,
+}: FrameworkFamilyDialogProps) {
+  const router = useRouter();
+  const isEdit = Boolean(family);
+
+  const form = useForm<FamilyFormValues>({
+    resolver: zodResolver(FrameworkFamilyBaseSchema),
+    defaultValues: { name: '', description: '', status: 'hidden' },
+    mode: 'onChange',
+  });
+
+  // Prefill on open (and when the target family changes).
+  useEffect(() => {
+    if (isOpen) {
+      form.reset({
+        name: family?.name ?? '',
+        description: family?.description ?? '',
+        status: family?.status ?? 'hidden',
+      });
+    }
+  }, [isOpen, family, form]);
+
+  async function onSubmit(values: FamilyFormValues) {
+    try {
+      if (isEdit && family) {
+        await apiClient(`/framework-family/${family.id}`, {
+          method: 'PATCH',
+          body: JSON.stringify(values),
+        });
+        toast.success('Framework family updated');
+      } else {
+        await apiClient('/framework-family', {
+          method: 'POST',
+          body: JSON.stringify(values),
+        });
+        toast.success('Framework family created');
+      }
+      onOpenChange(false);
+      form.reset();
+      router.refresh();
+    } catch (error) {
+      const message =
+        error instanceof Error ? error.message : 'Failed to save framework family.';
+      toast.error(message);
+    }
+  }
+
+  return (
+    <Dialog
+      open={isOpen}
+      onOpenChange={(open) => {
+        if (!open) form.reset();
+        onOpenChange(open);
+      }}
+    >
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>
+            {isEdit ? 'Edit Framework Family' : 'Create New Framework Family'}
+          </DialogTitle>
+          <DialogDescription>
+            {isEdit
+              ? 'Update the family details below.'
+              : "Fill in the details below to create a new framework family. This family should contain 1 or more pieces that relate to framework, including down-level controls. Click create when you're done."}
+          </DialogDescription>
+        </DialogHeader>
+        <Form {...form}>
+          <form
+            onSubmit={form.handleSubmit(onSubmit)}
+            className="grid gap-2 py-4"
+            autoComplete="off"
+          >
+            <FormField
+              control={form.control}
+              name="name"
+              render={({ field }) => (
+                <FormItem className="grid grid-cols-4 items-center gap-2">
+                  <FormLabel className="text-right">Name</FormLabel>
+                  <FormControl className="col-span-3">
+                    <Input placeholder="e.g., NIST SP800-53" {...NO_AUTOFILL} {...field} />
+                  </FormControl>
+                  <div className="col-span-3 col-start-2">
+                    <FormMessage />
+                  </div>
+                </FormItem>
+              )}
+            />
+            <FormField
+              control={form.control}
+              name="description"
+              render={({ field }) => (
+                <FormItem className="grid grid-cols-4 items-center gap-2">
+                  <FormLabel className="text-right">Description</FormLabel>
+                  <FormControl className="col-span-3">
+                    <Textarea
+                      placeholder="What this family groups together"
+                      {...NO_AUTOFILL}
+                      {...field}
+                    />
+                  </FormControl>
+                  <div className="col-span-3 col-start-2">
+                    <FormMessage />
+                  </div>
+                </FormItem>
+              )}
+            />
+            <FormField
+              control={form.control}
+              name="status"
+              render={({ field }) => (
+                <FormItem className="grid grid-cols-4 items-center gap-2">
+                  <FormLabel className="text-right">Status</FormLabel>
+                  <FormControl className="col-span-3">
+                    <Select onValueChange={field.onChange} value={field.value}>
+                      <SelectTrigger>
+                        <SelectValue placeholder="Select a status" />
+                      </SelectTrigger>
+                      <SelectContent>
+                        {FRAMEWORK_FAMILY_STATUSES.map((s) => (
+                          <SelectItem key={s.value} value={s.value}>
+                            {s.label}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                  </FormControl>
+                  <div className="col-span-3 col-start-2">
+                    <FormMessage />
+                  </div>
+                </FormItem>
+              )}
+            />
+            <DialogFooter>
+              <DialogClose asChild>
+                <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
+                  Cancel
+                </Button>
+              </DialogClose>
+              <Button type="submit" disabled={form.formState.isSubmitting}>
+                {form.formState.isSubmitting
+                  ? 'Saving...'
+                  : isEdit
+                    ? 'Save Changes'
+                    : 'Create Family'}
+              </Button>
+            </DialogFooter>
+          </form>
+        </Form>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/apps/framework-editor/app/(pages)/frameworks/components/FrameworkFamilySection.tsx b/apps/framework-editor/app/(pages)/frameworks/components/FrameworkFamilySection.tsx
new file mode 100644
index 0000000000..4375cf9bb5
--- /dev/null
+++ b/apps/framework-editor/app/(pages)/frameworks/components/FrameworkFamilySection.tsx
@@ -0,0 +1,135 @@
+'use client';
+
+import type { FrameworkEditorFrameworkFamilyStatus } from '@/db';
+import { Button } from '@trycompai/ui/button';
+import { ChevronDown, ChevronRight, MoveRight, Pencil, Trash2 } from 'lucide-react';
+import Link from 'next/link';
+import { useState } from 'react';
+import type { FrameworkWithCounts } from '../FrameworksClientPage';
+import { FamilyStatusBadge, FrameworkVisibilityBadge } from './family-status';
+
+interface FrameworkFamilySectionProps {
+  title: string;
+  // Undefined for the "Ungrouped" pseudo-section (no status / actions).
+  status?: FrameworkEditorFrameworkFamilyStatus;
+  // True framework count (drives the "n frameworks / Empty" label and the
+  // empty-only delete rule) — independent of the possibly-filtered rows below.
+  count: number;
+  frameworks: FrameworkWithCounts[];
+  onMove?: () => void;
+  onEdit?: () => void;
+  onDelete?: () => void;
+  defaultOpen?: boolean;
+}
+
+export function FrameworkFamilySection({
+  title,
+  status,
+  count,
+  frameworks,
+  onMove,
+  onEdit,
+  onDelete,
+  defaultOpen = true,
+}: FrameworkFamilySectionProps) {
+  const [open, setOpen] = useState(defaultOpen);
+  const isFamily = status !== undefined;
+  const countLabel = count === 0 ? 'Empty' : `${count} framework${count === 1 ? '' : 's'}`;
+
+  return (
+    <div className="rounded-md border">
+      <div className="bg-muted/40 flex items-center gap-3 px-3 py-2">
+        <button
+          type="button"
+          onClick={() => setOpen((o) => !o)}
+          className="flex flex-1 items-center gap-2 text-left"
+        >
+          {open ? (
+            <ChevronDown className="h-4 w-4 shrink-0" />
+          ) : (
+            <ChevronRight className="h-4 w-4 shrink-0" />
+          )}
+          <span className="font-medium">{title}</span>
+          <span className="text-muted-foreground text-xs">{countLabel}</span>
+          {status && <FamilyStatusBadge status={status} />}
+        </button>
+        <div className="flex items-center gap-1">
+          {onMove && count > 0 && (
+            <Button
+              variant="ghost"
+              size="icon"
+              className="h-7 w-7"
+              onClick={onMove}
+              aria-label="Move frameworks"
+              title="Move frameworks from this group"
+            >
+              <MoveRight className="h-4 w-4" />
+            </Button>
+          )}
+          {isFamily && onEdit && (
+            <Button
+              variant="ghost"
+              size="icon"
+              className="h-7 w-7"
+              onClick={onEdit}
+              aria-label="Edit family"
+            >
+              <Pencil className="h-4 w-4" />
+            </Button>
+          )}
+          {isFamily && onDelete && (
+            <Button
+              variant="ghost"
+              size="icon"
+              className="text-muted-foreground hover:text-destructive h-7 w-7"
+              onClick={onDelete}
+              disabled={count > 0}
+              title={count > 0 ? 'Family must be empty to delete' : 'Delete family'}
+              aria-label="Delete family"
+            >
+              <Trash2 className="h-4 w-4" />
+            </Button>
+          )}
+        </div>
+      </div>
+      {open && (
+        <div className="overflow-x-auto">
+          {frameworks.length === 0 ? (
+            <p className="text-muted-foreground px-3 py-4 text-sm">
+              No frameworks in this {isFamily ? 'family' : 'group'}.
+            </p>
+          ) : (
+            <table className="w-full text-sm">
+              <thead className="text-muted-foreground border-b text-left text-xs">
+                <tr>
+                  <th className="px-3 py-2 font-medium">Name</th>
+                  <th className="px-3 py-2 font-medium">Version</th>
+                  <th className="px-3 py-2 font-medium">Status</th>
+                  <th className="px-3 py-2 font-medium">Requirements</th>
+                  <th className="px-3 py-2 font-medium">Controls</th>
+                </tr>
+              </thead>
+              <tbody>
+                {frameworks.map((fw) => (
+                  <tr key={fw.id} className="hover:bg-muted/30 border-b last:border-0">
+                    <td className="px-3 py-2">
+                      <Link href={`/frameworks/${fw.id}`} className="hover:underline">
+                        {fw.name}
+                      </Link>
+                    </td>
+                    <td className="px-3 py-2">{fw.latestVersion?.version ?? fw.version}</td>
+                    <td className="px-3 py-2">
+                      <FrameworkVisibilityBadge visible={fw.visible} />
+                    </td>
+                    <td className="px-3 py-2">{fw.requirementsCount}</td>
+                    <td className="px-3 py-2">{fw.controlsCount}</td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          )}
+        </div>
+      )}
+    </div>
+  );
+}
diff --git a/apps/framework-editor/app/(pages)/frameworks/components/MoveFrameworkDialog.tsx b/apps/framework-editor/app/(pages)/frameworks/components/MoveFrameworkDialog.tsx
new file mode 100644
index 0000000000..9fac91237c
--- /dev/null
+++ b/apps/framework-editor/app/(pages)/frameworks/components/MoveFrameworkDialog.tsx
@@ -0,0 +1,153 @@
+'use client';
+
+import { apiClient } from '@/app/lib/api-client';
+import { Button } from '@trycompai/ui/button';
+import { Checkbox } from '@trycompai/ui/checkbox';
+import {
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+} from '@trycompai/ui/dialog';
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@trycompai/ui/select';
+import { useRouter } from 'next/navigation';
+import { useEffect, useMemo, useState } from 'react';
+import { toast } from 'sonner';
+import type { FrameworkFamilyWithCount, FrameworkWithCounts } from '../FrameworksClientPage';
+
+// Sentinel for "move to the root" (Select can't hold a null value).
+const ROOT_VALUE = '__root__';
+
+interface MoveFrameworkDialogProps {
+  isOpen: boolean;
+  onOpenChange: (isOpen: boolean) => void;
+  frameworks: FrameworkWithCounts[];
+  families: FrameworkFamilyWithCount[];
+}
+
+export function MoveFrameworkDialog({
+  isOpen,
+  onOpenChange,
+  frameworks,
+  families,
+}: MoveFrameworkDialogProps) {
+  const router = useRouter();
+  const [selected, setSelected] = useState<Set<string>>(new Set());
+  const [destination, setDestination] = useState<string>(ROOT_VALUE);
+  const [isSubmitting, setIsSubmitting] = useState(false);
+
+  useEffect(() => {
+    if (isOpen) {
+      setSelected(new Set());
+      setDestination(ROOT_VALUE);
+    }
+  }, [isOpen]);
+
+  const familyNameById = useMemo(
+    () => new Map(families.map((f) => [f.id, f.name])),
+    [families],
+  );
+
+  const toggle = (id: string) =>
+    setSelected((prev) => {
+      const next = new Set(prev);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+
+  async function handleMove() {
+    if (selected.size === 0) {
+      toast.error('Select at least one framework to move.');
+      return;
+    }
+    setIsSubmitting(true);
+    try {
+      await apiClient('/framework-family/move', {
+        method: 'POST',
+        body: JSON.stringify({
+          frameworkIds: [...selected],
+          familyId: destination === ROOT_VALUE ? null : destination,
+        }),
+      });
+      toast.success(`Moved ${selected.size} framework(s).`);
+      onOpenChange(false);
+      router.refresh();
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : 'Failed to move frameworks.');
+    } finally {
+      setIsSubmitting(false);
+    }
+  }
+
+  return (
+    <Dialog open={isOpen} onOpenChange={onOpenChange}>
+      <DialogContent>
+        <DialogHeader>
+          <DialogTitle>Move Framework</DialogTitle>
+          <DialogDescription>
+            Pick the frameworks to move, then choose the destination family.
+          </DialogDescription>
+        </DialogHeader>
+        <div className="space-y-4 py-2">
+          <div>
+            <p className="mb-2 text-sm font-medium">Frameworks</p>
+            <div className="max-h-64 overflow-y-auto rounded-md border">
+              {frameworks.length === 0 ? (
+                <p className="text-muted-foreground p-3 text-sm">No frameworks yet.</p>
+              ) : (
+                frameworks.map((fw) => (
+                  <label
+                    key={fw.id}
+                    className="hover:bg-muted/40 flex cursor-pointer items-center gap-2 border-b px-3 py-2 last:border-0"
+                  >
+                    <Checkbox
+                      checked={selected.has(fw.id)}
+                      onCheckedChange={() => toggle(fw.id)}
+                    />
+                    <span className="text-sm">{fw.name}</span>
+                    <span className="text-muted-foreground ml-auto text-xs">
+                      {fw.familyId ? (familyNameById.get(fw.familyId) ?? 'Unknown') : '/'}
+                    </span>
+                  </label>
+                ))
+              )}
+            </div>
+          </div>
+          <div>
+            <p className="mb-2 text-sm font-medium">Destination family</p>
+            <Select value={destination} onValueChange={setDestination}>
+              <SelectTrigger>
+                <SelectValue />
+              </SelectTrigger>
+              <SelectContent>
+                <SelectItem value={ROOT_VALUE}>/ (Root)</SelectItem>
+                {families.map((f) => (
+                  <SelectItem key={f.id} value={f.id}>
+                    {f.name}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+        </div>
+        <DialogFooter>
+          <Button variant="outline" onClick={() => onOpenChange(false)}>
+            Cancel
+          </Button>
+          <Button onClick={handleMove} disabled={isSubmitting || selected.size === 0}>
+            {isSubmitting ? 'Moving...' : 'Move'}
+          </Button>
+        </DialogFooter>
+      </DialogContent>
+    </Dialog>
+  );
+}
diff --git a/apps/framework-editor/app/(pages)/frameworks/components/columns.tsx b/apps/framework-editor/app/(pages)/frameworks/components/columns.tsx
deleted file mode 100644
index 4c270e3c1a..0000000000
--- a/apps/framework-editor/app/(pages)/frameworks/components/columns.tsx
+++ /dev/null
@@ -1,77 +0,0 @@
-'use client';
-
-import type { ColumnDef } from '@tanstack/react-table';
-import Link from 'next/link';
-// We will import the new type from the client page
-import { Badge } from '@trycompai/ui'; // Import the Badge component
-import type { FrameworkWithCounts } from '../FrameworksClientPage';
-
-// TODO: Replace 'any' with the actual Framework type from your database schema
-// e.g., import type { Framework } from "@trycompai/db";
-// For now, we'll use a placeholder type.
-export interface Framework {
-  id: string; // Assuming ID is a string, adjust if it's a number
-  name: string;
-  // Add other properties of a framework that you might want to display or use
-}
-
-export const columns: ColumnDef<FrameworkWithCounts>[] = [
-  {
-    accessorKey: 'name',
-    header: 'Name',
-    size: 200,
-    cell: ({ row }) => {
-      const framework = row.original;
-      return (
-        <Link href={`/frameworks/${framework.id}`} className="hover:underline">
-          {framework.name}
-        </Link>
-      );
-    },
-  },
-  {
-    accessorKey: 'version',
-    header: 'Version',
-    size: 100, // Adjusted size
-  },
-  {
-    accessorKey: 'visible',
-    header: 'Status',
-    size: 100,
-    cell: ({ row }) => {
-      const framework = row.original;
-      return (
-        <Badge variant={framework.visible ? 'default' : 'outline'}>
-          {framework.visible ? 'Visible' : 'Hidden'}
-        </Badge>
-      );
-    },
-  },
-  {
-    accessorKey: 'requirementsCount',
-    header: 'Requirements',
-    size: 150, // Adjusted size
-    cell: ({ row }) => <Badge variant="secondary">{row.original.requirementsCount}</Badge>,
-  },
-  {
-    accessorKey: 'controlsCount',
-    header: 'Controls',
-    size: 150, // Adjusted size
-    cell: ({ row }) => <Badge variant="secondary">{row.original.controlsCount}</Badge>,
-  },
-  {
-    accessorKey: 'description',
-    header: 'Description',
-    size: 400, // Adjusted size
-    minSize: 250, // Adjusted size
-  },
-  // Add more columns here if needed, for example:
-  // {
-  //   accessorKey: "createdAt",
-  //   header: "Created At",
-  //   cell: ({ row }) => {
-  //     const date = new Date(row.getValue("createdAt"));
-  //     return <span>{date.toLocaleDateString()}</span>;
-  //   }
-  // }
-];
diff --git a/apps/framework-editor/app/(pages)/frameworks/components/family-status.test.ts b/apps/framework-editor/app/(pages)/frameworks/components/family-status.test.ts
new file mode 100644
index 0000000000..b8e4b7815e
--- /dev/null
+++ b/apps/framework-editor/app/(pages)/frameworks/components/family-status.test.ts
@@ -0,0 +1,43 @@
+import { describe, expect, it } from 'vitest';
+import {
+  FRAMEWORK_FAMILY_STATUSES,
+  getFamilyStatusClassName,
+  getFamilyStatusLabel,
+} from './family-status';
+
+describe('framework family status', () => {
+  it('exposes the four statuses in dropdown order', () => {
+    expect(FRAMEWORK_FAMILY_STATUSES.map((s) => s.value)).toEqual([
+      'visible',
+      'hidden',
+      'under_construction',
+      'partial',
+    ]);
+  });
+
+  it('labels statuses for display', () => {
+    expect(getFamilyStatusLabel('visible')).toBe('Visible');
+    expect(getFamilyStatusLabel('hidden')).toBe('Hidden');
+    expect(getFamilyStatusLabel('under_construction')).toBe('Under Construction');
+    expect(getFamilyStatusLabel('partial')).toBe('Partial');
+  });
+
+  // The exact color rules Joe specified in the ticket.
+  it('color-codes visible green with white text', () => {
+    const cls = getFamilyStatusClassName('visible');
+    expect(cls).toContain('bg-green-600');
+    expect(cls).toContain('text-white');
+  });
+
+  it('color-codes hidden black', () => {
+    expect(getFamilyStatusClassName('hidden')).toContain('bg-black');
+  });
+
+  it('color-codes under construction red', () => {
+    expect(getFamilyStatusClassName('under_construction')).toContain('bg-red-600');
+  });
+
+  it('color-codes partial amber', () => {
+    expect(getFamilyStatusClassName('partial')).toContain('bg-amber-500');
+  });
+});
diff --git a/apps/framework-editor/app/(pages)/frameworks/components/family-status.tsx b/apps/framework-editor/app/(pages)/frameworks/components/family-status.tsx
new file mode 100644
index 0000000000..12f70a4b6a
--- /dev/null
+++ b/apps/framework-editor/app/(pages)/frameworks/components/family-status.tsx
@@ -0,0 +1,59 @@
+import type { FrameworkEditorFrameworkFamilyStatus } from '@/db';
+
+// FRAME-20: the four family statuses, in the order shown in the dropdown.
+export const FRAMEWORK_FAMILY_STATUSES: {
+  value: FrameworkEditorFrameworkFamilyStatus;
+  label: string;
+}[] = [
+  { value: 'visible', label: 'Visible' },
+  { value: 'hidden', label: 'Hidden' },
+  { value: 'under_construction', label: 'Under Construction' },
+  { value: 'partial', label: 'Partial' },
+];
+
+// Color rules per the ticket: visible=green/white, hidden=black, under
+// construction=red, partial=amber.
+const STATUS_STYLES: Record<FrameworkEditorFrameworkFamilyStatus, string> = {
+  visible: 'bg-green-600 text-white',
+  hidden: 'bg-black text-white',
+  under_construction: 'bg-red-600 text-white',
+  partial: 'bg-amber-500 text-black',
+};
+
+const STATUS_LABELS: Record<FrameworkEditorFrameworkFamilyStatus, string> = {
+  visible: 'Visible',
+  hidden: 'Hidden',
+  under_construction: 'Under Construction',
+  partial: 'Partial',
+};
+
+/** Human label for a family status (e.g. 'under_construction' → 'Under Construction'). */
+export function getFamilyStatusLabel(status: FrameworkEditorFrameworkFamilyStatus): string {
+  return STATUS_LABELS[status];
+}
+
+/** Tailwind background/text classes for a family status badge. */
+export function getFamilyStatusClassName(status: FrameworkEditorFrameworkFamilyStatus): string {
+  return STATUS_STYLES[status];
+}
+
+export function FamilyStatusBadge({
+  status,
+}: {
+  status: FrameworkEditorFrameworkFamilyStatus;
+}) {
+  return (
+    <span
+      className={`inline-flex items-center rounded-md px-2 py-0.5 text-xs font-medium ${getFamilyStatusClassName(
+        status,
+      )}`}
+    >
+      {getFamilyStatusLabel(status)}
+    </span>
+  );
+}
+
+/** A framework's own visibility, rendered with the same green/black palette. */
+export function FrameworkVisibilityBadge({ visible }: { visible: boolean }) {
+  return <FamilyStatusBadge status={visible ? 'visible' : 'hidden'} />;
+}
diff --git a/apps/framework-editor/app/(pages)/frameworks/page.tsx b/apps/framework-editor/app/(pages)/frameworks/page.tsx
index 2afd672f9e..bd1115b371 100644
--- a/apps/framework-editor/app/(pages)/frameworks/page.tsx
+++ b/apps/framework-editor/app/(pages)/frameworks/page.tsx
@@ -1,20 +1,25 @@
 import { serverApi } from '@/app/lib/api-server';
 import { isAuthorized } from '@/app/lib/utils';
 import { redirect } from 'next/navigation';
-import { FrameworksClientPage, type FrameworkWithCounts } from './FrameworksClientPage';
+import {
+  FrameworksClientPage,
+  type FrameworkFamilyWithCount,
+  type FrameworkWithCounts,
+} from './FrameworksClientPage';
 
 export default async function Page() {
   const isAllowed = await isAuthorized();
   if (!isAllowed) redirect('/auth');
 
-  // `/framework` now returns latestVersion per framework in a single query,
-  // so we no longer need the N+1 loop that fetched versions per framework.
-  const frameworks = await serverApi<FrameworkWithCounts[]>('/framework');
+  // `/framework` returns latestVersion + counts per framework; `/framework-family`
+  // returns the families (folders) with their framework counts (FRAME-20). The
+  // grouped view does the version fallback per row, so no pre-mapping needed.
+  const [frameworks, families] = await Promise.all([
+    serverApi<FrameworkWithCounts[]>('/framework'),
+    serverApi<FrameworkFamilyWithCount[]>('/framework-family'),
+  ]);
 
-  const enriched = frameworks.map((fw) => ({
-    ...fw,
-    version: fw.latestVersion?.version ?? fw.version,
-  }));
-
-  return <FrameworksClientPage initialFrameworks={enriched} />;
+  return (
+    <FrameworksClientPage initialFrameworks={frameworks} initialFamilies={families} />
+  );
 }
diff --git a/apps/framework-editor/app/(pages)/frameworks/schemas.ts b/apps/framework-editor/app/(pages)/frameworks/schemas.ts
index 15b2a88004..78b6aa8bc7 100644
--- a/apps/framework-editor/app/(pages)/frameworks/schemas.ts
+++ b/apps/framework-editor/app/(pages)/frameworks/schemas.ts
@@ -7,6 +7,14 @@ export const FrameworkBaseSchema = z.object({
   visible: z.boolean().optional(),
 });
 
+// FRAME-20: a framework family (folder). No version — it's an organisational
+// unit, not a published artifact.
+export const FrameworkFamilyBaseSchema = z.object({
+  name: z.string().min(1, { message: 'Name is required.' }),
+  description: z.string().optional(),
+  status: z.enum(['visible', 'hidden', 'under_construction', 'partial']),
+});
+
 export const RequirementBaseSchema = z.object({
   name: z.string().min(1, { message: 'Requirement name is required.' }),
   description: z.string().optional(), // Assuming description can be optional
diff --git a/packages/db/prisma/migrations/20260618120000_browser_auth_profiles/migration.sql b/packages/db/prisma/migrations/20260618120000_browser_auth_profiles/migration.sql
new file mode 100644
index 0000000000..e04c4dbf42
--- /dev/null
+++ b/packages/db/prisma/migrations/20260618120000_browser_auth_profiles/migration.sql
@@ -0,0 +1,86 @@
+CREATE TYPE "BrowserAuthProfileStatus" AS ENUM (
+    'unverified',
+    'verified',
+    'needs_reauth',
+    'blocked'
+);
+
+CREATE TYPE "BrowserAutomationFailureCode" AS ENUM (
+    'needs_reauth',
+    'needs_user_action',
+    'rate_limited',
+    'captcha_blocked',
+    'timeout',
+    'browser_session_lost',
+    'evaluation_failed',
+    'unknown'
+);
+
+CREATE TYPE "BrowserAutomationFailureStage" AS ENUM (
+    'auth',
+    'navigation',
+    'action',
+    'screenshot',
+    'evaluation',
+    'upload',
+    'session',
+    'unknown'
+);
+
+ALTER TYPE "BrowserAutomationRunStatus" ADD VALUE IF NOT EXISTS 'blocked';
+
+CREATE TABLE "BrowserAuthProfile" (
+    "id" TEXT NOT NULL DEFAULT generate_prefixed_cuid('bap'::text),
+    "organizationId" TEXT NOT NULL,
+    "hostname" TEXT NOT NULL,
+    "loginIdentity" TEXT NOT NULL DEFAULT '',
+    "displayName" TEXT NOT NULL,
+    "contextId" TEXT NOT NULL,
+    "status" "BrowserAuthProfileStatus" NOT NULL DEFAULT 'unverified',
+    "lastVerifiedAt" TIMESTAMP(3),
+    "lastAuthCheckUrl" TEXT,
+    "blockedReason" TEXT,
+    "vaultProvider" TEXT,
+    "vaultExternalItemRef" TEXT,
+    "vaultConnectionId" TEXT,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+    CONSTRAINT "BrowserAuthProfile_pkey" PRIMARY KEY ("id")
+);
+
+ALTER TABLE "BrowserAutomationRun"
+ADD COLUMN "profileId" TEXT,
+ADD COLUMN "failureCode" "BrowserAutomationFailureCode",
+ADD COLUMN "failureStage" "BrowserAutomationFailureStage",
+ADD COLUMN "attemptCount" INTEGER NOT NULL DEFAULT 1,
+ADD COLUMN "blockedReason" TEXT,
+ADD COLUMN "finalUrl" TEXT,
+ADD COLUMN "logs" JSONB;
+
+CREATE UNIQUE INDEX "BrowserAuthProfile_organizationId_hostname_loginIdentity_key"
+ON "BrowserAuthProfile"("organizationId", "hostname", "loginIdentity");
+
+CREATE INDEX "BrowserAuthProfile_organizationId_idx"
+ON "BrowserAuthProfile"("organizationId");
+
+CREATE INDEX "BrowserAuthProfile_organizationId_hostname_idx"
+ON "BrowserAuthProfile"("organizationId", "hostname");
+
+CREATE INDEX "BrowserAuthProfile_status_idx"
+ON "BrowserAuthProfile"("status");
+
+CREATE INDEX "BrowserAutomationRun_profileId_idx"
+ON "BrowserAutomationRun"("profileId");
+
+CREATE INDEX "BrowserAutomationRun_failureCode_idx"
+ON "BrowserAutomationRun"("failureCode");
+
+ALTER TABLE "BrowserAuthProfile"
+ADD CONSTRAINT "BrowserAuthProfile_organizationId_fkey"
+FOREIGN KEY ("organizationId") REFERENCES "Organization"("id")
+ON DELETE CASCADE ON UPDATE CASCADE;
+
+ALTER TABLE "BrowserAutomationRun"
+ADD CONSTRAINT "BrowserAutomationRun_profileId_fkey"
+FOREIGN KEY ("profileId") REFERENCES "BrowserAuthProfile"("id")
+ON DELETE SET NULL ON UPDATE CASCADE;
diff --git a/packages/db/prisma/migrations/20260622000000_add_requirement_sort_order/migration.sql b/packages/db/prisma/migrations/20260622000000_add_requirement_sort_order/migration.sql
new file mode 100644
index 0000000000..caa2c152af
--- /dev/null
+++ b/packages/db/prisma/migrations/20260622000000_add_requirement_sort_order/migration.sql
@@ -0,0 +1,3 @@
+-- FRAME-18: per-framework requirement display order.
+-- Nullable so existing requirements keep their current (identifier-based) ordering.
+ALTER TABLE "FrameworkEditorRequirement" ADD COLUMN "sortOrder" INTEGER;
diff --git a/packages/db/prisma/migrations/20260622120000_add_framework_families/migration.sql b/packages/db/prisma/migrations/20260622120000_add_framework_families/migration.sql
new file mode 100644
index 0000000000..284ccd961c
--- /dev/null
+++ b/packages/db/prisma/migrations/20260622120000_add_framework_families/migration.sql
@@ -0,0 +1,25 @@
+-- FRAME-20: framework families (folders that group frameworks in the editor).
+
+-- CreateEnum
+CREATE TYPE "FrameworkEditorFrameworkFamilyStatus" AS ENUM ('visible', 'hidden', 'under_construction', 'partial');
+
+-- CreateTable
+CREATE TABLE "FrameworkEditorFrameworkFamily" (
+    "id" TEXT NOT NULL DEFAULT generate_prefixed_cuid('frk_fam'::text),
+    "name" TEXT NOT NULL,
+    "description" TEXT NOT NULL DEFAULT '',
+    "status" "FrameworkEditorFrameworkFamilyStatus" NOT NULL DEFAULT 'hidden',
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "updatedAt" TIMESTAMP(3) NOT NULL,
+
+    CONSTRAINT "FrameworkEditorFrameworkFamily_pkey" PRIMARY KEY ("id")
+);
+
+-- AlterTable: link frameworks to a family (null = ungrouped / root).
+ALTER TABLE "FrameworkEditorFramework" ADD COLUMN "familyId" TEXT;
+
+-- CreateIndex
+CREATE INDEX "FrameworkEditorFramework_familyId_idx" ON "FrameworkEditorFramework"("familyId");
+
+-- AddForeignKey: Restrict enforces "delete a family only when empty" at the DB level.
+ALTER TABLE "FrameworkEditorFramework" ADD CONSTRAINT "FrameworkEditorFramework_familyId_fkey" FOREIGN KEY ("familyId") REFERENCES "FrameworkEditorFrameworkFamily"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
diff --git a/packages/db/prisma/schema/browserbase-context.prisma b/packages/db/prisma/schema/browserbase-context.prisma
index 9c29d19778..1354a49a51 100644
--- a/packages/db/prisma/schema/browserbase-context.prisma
+++ b/packages/db/prisma/schema/browserbase-context.prisma
@@ -16,6 +16,39 @@ model BrowserbaseContext {
   @@index([organizationId])
 }
 
+/// Auth state for one website identity backed by a Browserbase context.
+/// Credentials and TOTP secrets are intentionally not stored here.
+model BrowserAuthProfile {
+  id String @id @default(dbgenerated("generate_prefixed_cuid('bap'::text)"))
+
+  organizationId String
+  organization   Organization @relation(fields: [organizationId], references: [id], onDelete: Cascade)
+
+  hostname      String
+  loginIdentity String @default("")
+  displayName   String
+
+  contextId        String
+  status           BrowserAuthProfileStatus @default(unverified)
+  lastVerifiedAt   DateTime?
+  lastAuthCheckUrl String?
+  blockedReason    String?
+
+  vaultProvider        String?
+  vaultExternalItemRef String?
+  vaultConnectionId    String?
+
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+
+  runs BrowserAutomationRun[]
+
+  @@unique([organizationId, hostname, loginIdentity])
+  @@index([organizationId])
+  @@index([organizationId, hostname])
+  @@index([status])
+}
+
 /// Browser automation configuration linked to a task
 model BrowserAutomation {
   id          String  @id @default(dbgenerated("generate_prefixed_cuid('bau'::text)"))
@@ -58,6 +91,10 @@ model BrowserAutomationRun {
   automationId String
   automation   BrowserAutomation @relation(fields: [automationId], references: [id], onDelete: Cascade)
 
+  /// Auth profile/context used by this run
+  profileId String?
+  profile   BrowserAuthProfile? @relation(fields: [profileId], references: [id], onDelete: SetNull)
+
   /// Execution status
   status BrowserAutomationRunStatus @default(pending)
 
@@ -80,13 +117,32 @@ model BrowserAutomationRun {
   /// Error message (if failed)
   error String?
 
+  /// Stable failure metadata for retries, UI copy, and profile repair flows
+  failureCode  BrowserAutomationFailureCode?
+  failureStage BrowserAutomationFailureStage?
+  attemptCount Int                            @default(1)
+  blockedReason String?
+
+  /// Final browser URL and structured execution events
+  finalUrl String?
+  logs     Json?
+
   createdAt DateTime @default(now())
 
   @@index([automationId])
+  @@index([profileId])
   @@index([status])
+  @@index([failureCode])
   @@index([createdAt])
 }
 
+enum BrowserAuthProfileStatus {
+  unverified
+  verified
+  needs_reauth
+  blocked
+}
+
 enum BrowserAutomationEvaluationStatus {
   pass
   fail
@@ -97,4 +153,27 @@ enum BrowserAutomationRunStatus {
   running
   completed
   failed
+  blocked
+}
+
+enum BrowserAutomationFailureCode {
+  needs_reauth
+  needs_user_action
+  rate_limited
+  captcha_blocked
+  timeout
+  browser_session_lost
+  evaluation_failed
+  unknown
+}
+
+enum BrowserAutomationFailureStage {
+  auth
+  navigation
+  action
+  screenshot
+  evaluation
+  upload
+  session
+  unknown
 }
diff --git a/packages/db/prisma/schema/framework-editor.prisma b/packages/db/prisma/schema/framework-editor.prisma
index fe1cdd86fc..16489ac6c8 100644
--- a/packages/db/prisma/schema/framework-editor.prisma
+++ b/packages/db/prisma/schema/framework-editor.prisma
@@ -11,6 +11,34 @@ model FrameworkEditorVideo {
   updatedAt DateTime @default(now()) @updatedAt
 }
 
+// FRAME-20: status shown for a framework family in the editor list. Drives the
+// color-coded badge: visible=green, hidden=black, under_construction=red,
+// partial=amber. Distinct from a framework's own `visible` boolean.
+enum FrameworkEditorFrameworkFamilyStatus {
+  visible
+  hidden
+  under_construction
+  partial
+}
+
+// FRAME-20: a "framework family" is a folder that groups related frameworks
+// (e.g. all of NIST SP800-53, or DORA's pieces) for organisation in the editor.
+// Purely organisational — no version (it's a folder, not a published artifact).
+// NOT related to `controlFamily`/`requirementFamily`, which group items WITHIN a
+// single framework.
+model FrameworkEditorFrameworkFamily {
+  id          String                               @id @default(dbgenerated("generate_prefixed_cuid('frk_fam'::text)"))
+  name        String
+  description String                               @default("")
+  status      FrameworkEditorFrameworkFamilyStatus @default(hidden)
+
+  frameworks FrameworkEditorFramework[]
+
+  // Dates
+  createdAt DateTime @default(now())
+  updatedAt DateTime @default(now()) @updatedAt
+}
+
 model FrameworkEditorFramework {
   id          String  @id @default(dbgenerated("generate_prefixed_cuid('frk'::text)"))
   name        String // e.g., "soc2", "iso27001"
@@ -18,6 +46,12 @@ model FrameworkEditorFramework {
   description String
   visible     Boolean @default(false)
 
+  // FRAME-20: the family (folder) this framework belongs to. Null = ungrouped
+  // (shown at the root "/"). Restrict enforces the "delete only when empty" rule
+  // at the DB level — the API also checks first to return a friendly error.
+  familyId String?
+  family   FrameworkEditorFrameworkFamily? @relation(fields: [familyId], references: [id], onDelete: Restrict)
+
   requirements         FrameworkEditorRequirement[]
   frameworkInstances   FrameworkInstance[]
   soaConfigurations    SOAFrameworkConfiguration[] // Multiple SOA config versions per framework
@@ -35,6 +69,8 @@ model FrameworkEditorFramework {
   // Dates
   createdAt DateTime @default(now())
   updatedAt DateTime @default(now()) @updatedAt
+
+  @@index([familyId])
 }
 
 model FrameworkEditorRequirement {
@@ -46,6 +82,10 @@ model FrameworkEditorRequirement {
   identifier        String @default("") // Unique identifier for the requirement, e.g., "cc1-1"
   description       String
   requirementFamily String?
+  // Per-framework display order (FRAME-18). Lower numbers sort first; null rows
+  // fall back to identifier ordering and sort after numbered rows. Lets frameworks
+  // like NIST CSF use their canonical order (GV → ID → PR → DE → RS → RC).
+  sortOrder         Int?
 
   controlTemplates FrameworkEditorControlTemplate[]
   requirementMaps  RequirementMap[]
diff --git a/packages/db/prisma/schema/organization.prisma b/packages/db/prisma/schema/organization.prisma
index 22d6b2ba4d..406dfef709 100644
--- a/packages/db/prisma/schema/organization.prisma
+++ b/packages/db/prisma/schema/organization.prisma
@@ -87,7 +87,8 @@ model Organization {
   billingCreditEvents   BillingCreditEvent[]
 
   // Browser Automation
-  browserbaseContext BrowserbaseContext?
+  browserbaseContext  BrowserbaseContext?
+  browserAuthProfiles BrowserAuthProfile[]
   fleetPolicyResults FleetPolicyResult[]
 
   // Findings
diff --git a/packages/docs/openapi.json b/packages/docs/openapi.json
index 5f00c592f9..f96bec56ef 100644
--- a/packages/docs/openapi.json
+++ b/packages/docs/openapi.json
@@ -13942,6 +13942,98 @@
         }
       }
     },
+    "/v1/trust-portal/custom-frameworks/badge": {
+      "post": {
+        "description": "Stores a PNG/JPEG/WebP badge (max 256KB) in the organization assets bucket. Does not change the framework's portal visibility.",
+        "operationId": "TrustPortalController_uploadCustomFrameworkBadge_v1",
+        "parameters": [],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UploadCustomFrameworkBadgeDto"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Badge uploaded successfully",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CustomFrameworkBadgeResponseDto"
+                }
+              }
+            }
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Upload or replace a custom framework's Trust Portal badge image",
+        "tags": [
+          "Trust Portal"
+        ],
+        "x-mint": {
+          "metadata": {
+            "title": "Upload or replace a custom framework's Trust | Comp AI API",
+            "sidebarTitle": "Upload or replace a custom framework's Trust Portal badge image",
+            "description": "Stores a PNG/JPEG/WebP badge (max 256KB) in the organization assets bucket. Does not change the framework's portal visibility.",
+            "og:title": "Upload or replace a custom framework's Trust | Comp AI API",
+            "og:description": "Stores a PNG/JPEG/WebP badge (max 256KB) in the organization assets bucket. Does not change the framework's portal visibility."
+          }
+        },
+        "x-speakeasy-mcp": {
+          "name": "upload-custom-framework-badge"
+        }
+      },
+      "delete": {
+        "operationId": "TrustPortalController_removeCustomFrameworkBadge_v1",
+        "parameters": [
+          {
+            "name": "customFrameworkId",
+            "required": true,
+            "in": "query",
+            "description": "Org-authored custom framework ID whose badge to remove",
+            "schema": {
+              "example": "cfrm_6914cd0e16e4c7dccbb54426",
+              "type": "string"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": ""
+          }
+        },
+        "security": [
+          {
+            "apikey": []
+          }
+        ],
+        "summary": "Remove a custom framework's Trust Portal badge image",
+        "tags": [
+          "Trust Portal"
+        ],
+        "description": "Remove a custom framework's Trust Portal badge image in Comp AI. Configure the live Trust Center, custom domain, public overview, FAQs, compliance resources, documents, links, and vendor disclosures.",
+        "x-mint": {
+          "metadata": {
+            "title": "Remove a custom framework's Trust Portal | Comp AI API",
+            "sidebarTitle": "Remove a custom framework's Trust Portal badge image",
+            "description": "Remove a custom framework's Trust Portal badge image in Comp AI. Configure the live Trust Center, custom domain, public overview, FAQs, compliance.",
+            "og:title": "Remove a custom framework's Trust Portal | Comp AI API",
+            "og:description": "Remove a custom framework's Trust Portal badge image in Comp AI. Configure the live Trust Center, custom domain, public overview, FAQs, compliance."
+          }
+        },
+        "x-speakeasy-mcp": {
+          "name": "remove-custom-framework-badge"
+        }
+      }
+    },
     "/v1/trust-portal/overview": {
       "post": {
         "operationId": "TrustPortalController_updateOverview_v1",
@@ -17836,9 +17928,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Ensure ISMS foundational documents exist",
@@ -17881,9 +17970,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Get an ISMS document with its latest version",
@@ -17936,9 +18022,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Map organization controls to an ISMS document",
@@ -17989,9 +18072,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Remove a control mapping from an ISMS document",
@@ -18034,9 +18114,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Derive Context-of-the-Organization issues",
@@ -18058,159 +18135,6 @@
         }
       }
     },
-    "/v1/isms/documents/{id}/context-issues": {
-      "post": {
-        "operationId": "IsmsController_createContextIssue_v1",
-        "parameters": [
-          {
-            "name": "id",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateContextIssueDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Context issue created"
-          }
-        },
-        "security": [
-          {
-            "apikey": []
-          },
-          {
-            "oauth2": []
-          }
-        ],
-        "summary": "Create a manual context issue",
-        "tags": [
-          "ISMS"
-        ],
-        "description": "Create a manual context issue in Comp AI.",
-        "x-mint": {
-          "metadata": {
-            "title": "Create a manual context issue | Comp AI API",
-            "sidebarTitle": "Create a manual context issue",
-            "description": "Create a manual context issue in Comp AI.",
-            "og:title": "Create a manual context issue | Comp AI API",
-            "og:description": "Create a manual context issue in Comp AI."
-          }
-        },
-        "x-speakeasy-mcp": {
-          "name": "create-context-issue"
-        }
-      }
-    },
-    "/v1/isms/context-issues/{issueId}": {
-      "post": {
-        "operationId": "IsmsController_updateContextIssue_v1",
-        "parameters": [
-          {
-            "name": "issueId",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/UpdateContextIssueDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Context issue updated"
-          }
-        },
-        "security": [
-          {
-            "apikey": []
-          },
-          {
-            "oauth2": []
-          }
-        ],
-        "summary": "Update a context issue",
-        "tags": [
-          "ISMS"
-        ],
-        "description": "Update a context issue in Comp AI.",
-        "x-mint": {
-          "metadata": {
-            "title": "Update a context issue | Comp AI API",
-            "sidebarTitle": "Update a context issue",
-            "description": "Update a context issue in Comp AI.",
-            "og:title": "Update a context issue | Comp AI API",
-            "og:description": "Update a context issue in Comp AI."
-          }
-        },
-        "x-speakeasy-mcp": {
-          "name": "update-context-issue"
-        }
-      },
-      "delete": {
-        "operationId": "IsmsController_deleteContextIssue_v1",
-        "parameters": [
-          {
-            "name": "issueId",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Context issue deleted"
-          }
-        },
-        "security": [
-          {
-            "apikey": []
-          },
-          {
-            "oauth2": []
-          }
-        ],
-        "summary": "Delete a context issue",
-        "tags": [
-          "ISMS"
-        ],
-        "description": "Delete a context issue in Comp AI.",
-        "x-mint": {
-          "metadata": {
-            "title": "Delete a context issue | Comp AI API",
-            "sidebarTitle": "Delete a context issue",
-            "description": "Delete a context issue in Comp AI.",
-            "og:title": "Delete a context issue | Comp AI API",
-            "og:description": "Delete a context issue in Comp AI."
-          }
-        },
-        "x-speakeasy-mcp": {
-          "name": "delete-context-issue"
-        }
-      }
-    },
     "/v1/isms/documents/{id}/submit-for-approval": {
       "post": {
         "operationId": "IsmsController_submitForApproval_v1",
@@ -18242,9 +18166,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Submit an ISMS document for approval",
@@ -18287,9 +18208,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Approve an ISMS document",
@@ -18332,9 +18250,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Decline an ISMS document",
@@ -18377,9 +18292,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Detect drift against the approved snapshot",
@@ -18432,9 +18344,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Export an ISMS document as PDF or DOCX",
@@ -18456,318 +18365,20 @@
         }
       }
     },
-    "/v1/isms/documents/{id}/interested-parties": {
+    "/v1/isms/documents/{id}/registers/{register}": {
       "post": {
-        "operationId": "IsmsRegistersController_createInterestedParty_v1",
+        "operationId": "IsmsRegistersController_createRow_v1",
         "parameters": [
           {
             "name": "id",
             "required": true,
             "in": "path",
             "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateInterestedPartyDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Interested party created"
-          }
-        },
-        "security": [
-          {
-            "apikey": []
-          },
-          {
-            "oauth2": []
-          }
-        ],
-        "summary": "Create a manual interested party",
-        "tags": [
-          "ISMS"
-        ],
-        "description": "Create a manual interested party in Comp AI.",
-        "x-mint": {
-          "metadata": {
-            "title": "Create a manual interested party | Comp AI API",
-            "sidebarTitle": "Create a manual interested party",
-            "description": "Create a manual interested party in Comp AI.",
-            "og:title": "Create a manual interested party | Comp AI API",
-            "og:description": "Create a manual interested party in Comp AI."
-          }
-        },
-        "x-speakeasy-mcp": {
-          "name": "create-interested-party"
-        }
-      }
-    },
-    "/v1/isms/interested-parties/{partyId}": {
-      "post": {
-        "operationId": "IsmsRegistersController_updateInterestedParty_v1",
-        "parameters": [
-          {
-            "name": "partyId",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/UpdateInterestedPartyDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Interested party updated"
-          }
-        },
-        "security": [
-          {
-            "apikey": []
-          },
-          {
-            "oauth2": []
-          }
-        ],
-        "summary": "Update an interested party",
-        "tags": [
-          "ISMS"
-        ],
-        "description": "Update an interested party in Comp AI.",
-        "x-mint": {
-          "metadata": {
-            "title": "Update an interested party | Comp AI API",
-            "sidebarTitle": "Update an interested party",
-            "description": "Update an interested party in Comp AI.",
-            "og:title": "Update an interested party | Comp AI API",
-            "og:description": "Update an interested party in Comp AI."
-          }
-        },
-        "x-speakeasy-mcp": {
-          "name": "update-interested-party"
-        }
-      },
-      "delete": {
-        "operationId": "IsmsRegistersController_deleteInterestedParty_v1",
-        "parameters": [
-          {
-            "name": "partyId",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Interested party deleted"
-          }
-        },
-        "security": [
-          {
-            "apikey": []
-          },
-          {
-            "oauth2": []
-          }
-        ],
-        "summary": "Delete an interested party",
-        "tags": [
-          "ISMS"
-        ],
-        "description": "Delete an interested party in Comp AI.",
-        "x-mint": {
-          "metadata": {
-            "title": "Delete an interested party | Comp AI API",
-            "sidebarTitle": "Delete an interested party",
-            "description": "Delete an interested party in Comp AI.",
-            "og:title": "Delete an interested party | Comp AI API",
-            "og:description": "Delete an interested party in Comp AI."
-          }
-        },
-        "x-speakeasy-mcp": {
-          "name": "delete-interested-party"
-        }
-      }
-    },
-    "/v1/isms/documents/{id}/requirements": {
-      "post": {
-        "operationId": "IsmsRegistersController_createRequirement_v1",
-        "parameters": [
-          {
-            "name": "id",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/CreateRequirementDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Requirement created"
-          }
-        },
-        "security": [
-          {
-            "apikey": []
-          },
-          {
-            "oauth2": []
-          }
-        ],
-        "summary": "Create a manual requirement",
-        "tags": [
-          "ISMS"
-        ],
-        "description": "Create a manual requirement in Comp AI.",
-        "x-mint": {
-          "metadata": {
-            "title": "Create a manual requirement | Comp AI API",
-            "sidebarTitle": "Create a manual requirement",
-            "description": "Create a manual requirement in Comp AI.",
-            "og:title": "Create a manual requirement | Comp AI API",
-            "og:description": "Create a manual requirement in Comp AI."
-          }
-        },
-        "x-speakeasy-mcp": {
-          "name": "create-requirement"
-        }
-      }
-    },
-    "/v1/isms/requirements/{requirementId}": {
-      "post": {
-        "operationId": "IsmsRegistersController_updateRequirement_v1",
-        "parameters": [
-          {
-            "name": "requirementId",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "required": true,
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/UpdateRequirementDto"
-              }
-            }
-          }
-        },
-        "responses": {
-          "200": {
-            "description": "Requirement updated"
-          }
-        },
-        "security": [
-          {
-            "apikey": []
-          },
-          {
-            "oauth2": []
-          }
-        ],
-        "summary": "Update a requirement",
-        "tags": [
-          "ISMS"
-        ],
-        "description": "Update a requirement in Comp AI.",
-        "x-mint": {
-          "metadata": {
-            "title": "Update a requirement | Comp AI API",
-            "sidebarTitle": "Update a requirement",
-            "description": "Update a requirement in Comp AI.",
-            "og:title": "Update a requirement | Comp AI API",
-            "og:description": "Update a requirement in Comp AI."
-          }
-        },
-        "x-speakeasy-mcp": {
-          "name": "update-requirement"
-        }
-      },
-      "delete": {
-        "operationId": "IsmsRegistersController_deleteRequirement_v1",
-        "parameters": [
-          {
-            "name": "requirementId",
-            "required": true,
-            "in": "path",
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Requirement deleted"
-          }
-        },
-        "security": [
-          {
-            "apikey": []
-          },
-          {
-            "oauth2": []
-          }
-        ],
-        "summary": "Delete a requirement",
-        "tags": [
-          "ISMS"
-        ],
-        "description": "Delete a requirement in Comp AI.",
-        "x-mint": {
-          "metadata": {
-            "title": "Delete a requirement | Comp AI API",
-            "sidebarTitle": "Delete a requirement",
-            "description": "Delete a requirement in Comp AI.",
-            "og:title": "Delete a requirement | Comp AI API",
-            "og:description": "Delete a requirement in Comp AI."
-          }
-        },
-        "x-speakeasy-mcp": {
-          "name": "delete-requirement"
-        }
-      }
-    },
-    "/v1/isms/documents/{id}/objectives": {
-      "post": {
-        "operationId": "IsmsRegistersController_createObjective_v1",
-        "parameters": [
+              "type": "string"
+            }
+          },
           {
-            "name": "id",
+            "name": "register",
             "required": true,
             "in": "path",
             "schema": {
@@ -18777,52 +18388,125 @@
         ],
         "requestBody": {
           "required": true,
+          "description": "Register row fields (per-register; validated at runtime by zod)",
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/CreateObjectiveDto"
+                "type": "object",
+                "properties": {
+                  "kind": {
+                    "type": "string",
+                    "enum": [
+                      "internal",
+                      "external"
+                    ]
+                  },
+                  "category": {
+                    "type": "string"
+                  },
+                  "description": {
+                    "type": "string"
+                  },
+                  "effect": {
+                    "type": "string"
+                  },
+                  "name": {
+                    "type": "string"
+                  },
+                  "needsExpectations": {
+                    "type": "string"
+                  },
+                  "interestedPartyId": {
+                    "type": "string"
+                  },
+                  "partyName": {
+                    "type": "string"
+                  },
+                  "requirement": {
+                    "type": "string"
+                  },
+                  "treatment": {
+                    "type": "string"
+                  },
+                  "objective": {
+                    "type": "string"
+                  },
+                  "target": {
+                    "type": "string"
+                  },
+                  "ownerMemberId": {
+                    "type": "string"
+                  },
+                  "cadence": {
+                    "type": "string"
+                  },
+                  "plan": {
+                    "type": "string"
+                  },
+                  "measurementMethod": {
+                    "type": "string"
+                  },
+                  "status": {
+                    "type": "string",
+                    "enum": [
+                      "not_started",
+                      "on_track",
+                      "at_risk",
+                      "met"
+                    ]
+                  },
+                  "position": {
+                    "type": "integer",
+                    "minimum": 0
+                  }
+                }
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Objective created"
+            "description": "Register row created"
           }
         },
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
-        "summary": "Create a manual objective",
+        "summary": "Create a row in an ISMS register",
         "tags": [
           "ISMS"
         ],
-        "description": "Create a manual objective in Comp AI.",
+        "description": "Create a row in an ISMS register in Comp AI.",
         "x-mint": {
           "metadata": {
-            "title": "Create a manual objective | Comp AI API",
-            "sidebarTitle": "Create a manual objective",
-            "description": "Create a manual objective in Comp AI.",
-            "og:title": "Create a manual objective | Comp AI API",
-            "og:description": "Create a manual objective in Comp AI."
+            "title": "Create a row in an ISMS register | Comp AI API",
+            "sidebarTitle": "Create a row in an ISMS register",
+            "description": "Create a row in an ISMS register in Comp AI.",
+            "og:title": "Create a row in an ISMS register | Comp AI API",
+            "og:description": "Create a row in an ISMS register in Comp AI."
           }
         },
         "x-speakeasy-mcp": {
-          "name": "create-objective"
+          "name": "create-row"
         }
       }
     },
-    "/v1/isms/objectives/{objectiveId}": {
-      "post": {
-        "operationId": "IsmsRegistersController_updateObjective_v1",
+    "/v1/isms/registers/{register}/{rowId}": {
+      "patch": {
+        "operationId": "IsmsRegistersController_updateRow_v1",
         "parameters": [
           {
-            "name": "objectiveId",
+            "name": "register",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "rowId",
             "required": true,
             "in": "path",
             "schema": {
@@ -18832,50 +18516,123 @@
         ],
         "requestBody": {
           "required": true,
+          "description": "Register row fields (per-register; validated at runtime by zod)",
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/UpdateObjectiveDto"
+                "type": "object",
+                "properties": {
+                  "kind": {
+                    "type": "string",
+                    "enum": [
+                      "internal",
+                      "external"
+                    ]
+                  },
+                  "category": {
+                    "type": "string"
+                  },
+                  "description": {
+                    "type": "string"
+                  },
+                  "effect": {
+                    "type": "string"
+                  },
+                  "name": {
+                    "type": "string"
+                  },
+                  "needsExpectations": {
+                    "type": "string"
+                  },
+                  "interestedPartyId": {
+                    "type": "string"
+                  },
+                  "partyName": {
+                    "type": "string"
+                  },
+                  "requirement": {
+                    "type": "string"
+                  },
+                  "treatment": {
+                    "type": "string"
+                  },
+                  "objective": {
+                    "type": "string"
+                  },
+                  "target": {
+                    "type": "string"
+                  },
+                  "ownerMemberId": {
+                    "type": "string"
+                  },
+                  "cadence": {
+                    "type": "string"
+                  },
+                  "plan": {
+                    "type": "string"
+                  },
+                  "measurementMethod": {
+                    "type": "string"
+                  },
+                  "status": {
+                    "type": "string",
+                    "enum": [
+                      "not_started",
+                      "on_track",
+                      "at_risk",
+                      "met"
+                    ]
+                  },
+                  "position": {
+                    "type": "integer",
+                    "minimum": 0
+                  }
+                }
               }
             }
           }
         },
         "responses": {
           "200": {
-            "description": "Objective updated"
+            "description": "Register row updated"
           }
         },
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
-        "summary": "Update an objective",
+        "summary": "Update a row in an ISMS register",
         "tags": [
           "ISMS"
         ],
-        "description": "Update an objective in Comp AI.",
+        "description": "Update a row in an ISMS register in Comp AI.",
         "x-mint": {
           "metadata": {
-            "title": "Update an objective | Comp AI API",
-            "sidebarTitle": "Update an objective",
-            "description": "Update an objective in Comp AI.",
-            "og:title": "Update an objective | Comp AI API",
-            "og:description": "Update an objective in Comp AI."
+            "title": "Update a row in an ISMS register | Comp AI API",
+            "sidebarTitle": "Update a row in an ISMS register",
+            "description": "Update a row in an ISMS register in Comp AI.",
+            "og:title": "Update a row in an ISMS register | Comp AI API",
+            "og:description": "Update a row in an ISMS register in Comp AI."
           }
         },
         "x-speakeasy-mcp": {
-          "name": "update-objective"
+          "name": "update-row"
         }
       },
       "delete": {
-        "operationId": "IsmsRegistersController_deleteObjective_v1",
+        "operationId": "IsmsRegistersController_deleteRow_v1",
         "parameters": [
           {
-            "name": "objectiveId",
+            "name": "register",
+            "required": true,
+            "in": "path",
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "rowId",
             "required": true,
             "in": "path",
             "schema": {
@@ -18885,33 +18642,30 @@
         ],
         "responses": {
           "200": {
-            "description": "Objective deleted"
+            "description": "Register row deleted"
           }
         },
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
-        "summary": "Delete an objective",
+        "summary": "Delete a row in an ISMS register",
         "tags": [
           "ISMS"
         ],
-        "description": "Delete an objective in Comp AI.",
+        "description": "Delete a row in an ISMS register in Comp AI.",
         "x-mint": {
           "metadata": {
-            "title": "Delete an objective | Comp AI API",
-            "sidebarTitle": "Delete an objective",
-            "description": "Delete an objective in Comp AI.",
-            "og:title": "Delete an objective | Comp AI API",
-            "og:description": "Delete an objective in Comp AI."
+            "title": "Delete a row in an ISMS register | Comp AI API",
+            "sidebarTitle": "Delete a row in an ISMS register",
+            "description": "Delete a row in an ISMS register in Comp AI.",
+            "og:title": "Delete a row in an ISMS register | Comp AI API",
+            "og:description": "Delete a row in an ISMS register in Comp AI."
           }
         },
         "x-speakeasy-mcp": {
-          "name": "delete-objective"
+          "name": "delete-row"
         }
       }
     },
@@ -18928,6 +18682,27 @@
             }
           }
         ],
+        "requestBody": {
+          "required": true,
+          "description": "Singleton document narrative payload",
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "narrative": {
+                    "type": "object",
+                    "description": "Per-type narrative object (e.g. ISMS scope or leadership commitment), validated at runtime by zod",
+                    "additionalProperties": true
+                  }
+                },
+                "required": [
+                  "narrative"
+                ]
+              }
+            }
+          }
+        },
         "responses": {
           "200": {
             "description": "Narrative saved"
@@ -18936,9 +18711,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Save a singleton document narrative",
@@ -18981,9 +18753,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Get the ISMS wizard profile, defaults and members",
@@ -19007,6 +18776,35 @@
       "post": {
         "operationId": "IsmsProfileController_saveProfile_v1",
         "parameters": [],
+        "requestBody": {
+          "required": true,
+          "description": "Partial ISMS wizard answers (validated at runtime by zod)",
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "frameworkId": {
+                    "type": "string"
+                  },
+                  "answers": {
+                    "type": "object",
+                    "description": "Deeply-partial wizard answers (any subset of the wizard steps)",
+                    "additionalProperties": true
+                  },
+                  "complete": {
+                    "type": "boolean",
+                    "description": "Whether the wizard is being finalized"
+                  }
+                },
+                "required": [
+                  "frameworkId",
+                  "answers"
+                ]
+              }
+            }
+          }
+        },
         "responses": {
           "200": {
             "description": "Saved profile"
@@ -19015,9 +18813,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Save (partial) ISMS wizard answers",
@@ -19061,9 +18856,6 @@
         "security": [
           {
             "apikey": []
-          },
-          {
-            "oauth2": []
           }
         ],
         "summary": "Ensure and regenerate all ISMS documents",
@@ -23585,7 +23377,7 @@
           }
         },
         "x-speakeasy-mcp": {
-          "name": "frameworks-create-requirement"
+          "name": "create-requirement"
         }
       }
     },
@@ -24488,6 +24280,14 @@
               "type": "string"
             }
           },
+          {
+            "name": "frameworkInstanceId",
+            "required": true,
+            "in": "query",
+            "schema": {
+              "type": "string"
+            }
+          },
           {
             "name": "formType",
             "required": true,
@@ -24511,14 +24311,6 @@
               ],
               "type": "string"
             }
-          },
-          {
-            "name": "frameworkInstanceId",
-            "required": true,
-            "in": "query",
-            "schema": {
-              "type": "string"
-            }
           }
         ],
         "responses": {
@@ -29046,6 +28838,52 @@
           "emails"
         ]
       },
+      "UploadCustomFrameworkBadgeDto": {
+        "type": "object",
+        "properties": {
+          "customFrameworkId": {
+            "type": "string",
+            "description": "Org-authored custom framework ID the badge belongs to",
+            "example": "cfrm_6914cd0e16e4c7dccbb54426"
+          },
+          "fileName": {
+            "type": "string",
+            "description": "Original file name (PNG, JPEG, or WebP)",
+            "example": "acme-framework-badge.png"
+          },
+          "fileType": {
+            "type": "string",
+            "description": "MIME type of the image",
+            "example": "image/png"
+          },
+          "fileData": {
+            "type": "string",
+            "description": "Base64 encoded image content (PNG/JPEG/WebP, max 256KB decoded)"
+          }
+        },
+        "required": [
+          "customFrameworkId",
+          "fileName",
+          "fileType",
+          "fileData"
+        ]
+      },
+      "CustomFrameworkBadgeResponseDto": {
+        "type": "object",
+        "properties": {
+          "success": {
+            "type": "boolean"
+          },
+          "badgeUrl": {
+            "type": "string",
+            "description": "Signed URL to the uploaded badge for immediate display"
+          }
+        },
+        "required": [
+          "success",
+          "badgeUrl"
+        ]
+      },
       "CreateAccessRequestDto": {
         "type": "object",
         "properties": {
@@ -29116,14 +28954,6 @@
           "email"
         ]
       },
-      "CreateRequirementDto": {
-        "type": "object",
-        "properties": {}
-      },
-      "UpdateRequirementDto": {
-        "type": "object",
-        "properties": {}
-      },
       "CreateFindingDto": {
         "type": "object",
         "properties": {
@@ -29577,47 +29407,78 @@
       },
       "EnsureIsmsSetupDto": {
         "type": "object",
-        "properties": {}
+        "properties": {
+          "frameworkId": {
+            "type": "string",
+            "description": "ID of the framework to scope the ISMS setup to",
+            "example": "frk_abc123def456"
+          }
+        },
+        "required": [
+          "frameworkId"
+        ]
       },
       "LinkIsmsControlsDto": {
         "type": "object",
-        "properties": {}
-      },
-      "CreateContextIssueDto": {
-        "type": "object",
-        "properties": {}
-      },
-      "UpdateContextIssueDto": {
-        "type": "object",
-        "properties": {}
+        "properties": {
+          "controlIds": {
+            "description": "IDs of the controls to link to the ISMS document",
+            "example": [
+              "ctl_abc123def456",
+              "ctl_ghi789jkl012"
+            ],
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        },
+        "required": [
+          "controlIds"
+        ]
       },
       "SubmitIsmsForApprovalDto": {
         "type": "object",
-        "properties": {}
+        "properties": {
+          "approverId": {
+            "type": "string",
+            "description": "Member ID of the approver to submit the ISMS to",
+            "example": "mem_abc123def456"
+          }
+        },
+        "required": [
+          "approverId"
+        ]
       },
       "ExportIsmsDocumentDto": {
         "type": "object",
-        "properties": {}
-      },
-      "CreateInterestedPartyDto": {
-        "type": "object",
-        "properties": {}
-      },
-      "UpdateInterestedPartyDto": {
-        "type": "object",
-        "properties": {}
-      },
-      "CreateObjectiveDto": {
-        "type": "object",
-        "properties": {}
-      },
-      "UpdateObjectiveDto": {
-        "type": "object",
-        "properties": {}
+        "properties": {
+          "format": {
+            "type": "string",
+            "description": "File format to export the ISMS document as",
+            "enum": [
+              "pdf",
+              "docx"
+            ],
+            "example": "pdf"
+          }
+        },
+        "required": [
+          "format"
+        ]
       },
       "GenerateAllDto": {
         "type": "object",
-        "properties": {}
+        "properties": {
+          "frameworkId": {
+            "type": "string",
+            "description": "ID of the framework to generate all ISMS profile documents for",
+            "example": "frk_abc123def456"
+          }
+        },
+        "required": [
+          "frameworkId"
+        ]
       },
       "CreateConnectionDto": {
         "type": "object",
diff --git a/packages/integration-platform/src/runtime/__tests__/check-context.test.ts b/packages/integration-platform/src/runtime/__tests__/check-context.test.ts
new file mode 100644
index 0000000000..ab9e36fdda
--- /dev/null
+++ b/packages/integration-platform/src/runtime/__tests__/check-context.test.ts
@@ -0,0 +1,91 @@
+import { afterEach, describe, expect, it } from 'bun:test';
+import type { IntegrationManifest } from '../../types';
+import { createCheckContext, isTransientTransportError } from '../check-context';
+
+// Minimal manifest for a dynamic single-fetch availability check (Neon/Cloudflare
+// shape): api_key auth, one baseUrl, no checks defined in code.
+const manifest: IntegrationManifest = {
+  id: 'neon',
+  name: 'Neon',
+  description: 'test',
+  category: 'Infrastructure',
+  logoUrl: 'https://example.com/logo.png',
+  auth: { type: 'api_key', config: { in: 'header', name: 'X-Api-Key' } },
+  baseUrl: 'https://api.example.com',
+  capabilities: ['checks'],
+  isActive: true,
+};
+
+function makeCtx() {
+  return createCheckContext({
+    manifest,
+    credentials: { api_key: 'k' },
+    connectionId: 'conn_1',
+    organizationId: 'org_1',
+  });
+}
+
+// undici/Node surfaces a transport failure as `TypeError: fetch failed` with the
+// underlying errno on `.cause` — exactly what a TCP reset / DNS blip looks like.
+function fetchFailed(code: string): Error {
+  const cause = Object.assign(new Error(`read ${code}`), { code });
+  return Object.assign(new TypeError('fetch failed'), { cause });
+}
+
+const jsonResponse = (body: unknown) =>
+  new Response(JSON.stringify(body), {
+    status: 200,
+    headers: { 'Content-Type': 'application/json' },
+  });
+
+const originalFetch = globalThis.fetch;
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+});
+
+describe('isTransientTransportError', () => {
+  it('classifies transport-level fetch errors as transient', () => {
+    expect(isTransientTransportError(fetchFailed('ECONNRESET'))).toBe(true);
+    expect(isTransientTransportError(fetchFailed('ETIMEDOUT'))).toBe(true);
+    expect(isTransientTransportError(fetchFailed('EAI_AGAIN'))).toBe(true);
+    expect(isTransientTransportError(new TypeError('fetch failed'))).toBe(true);
+    expect(isTransientTransportError(new Error('socket hang up'))).toBe(true);
+  });
+
+  it('does NOT classify HTTP or parse errors as transient', () => {
+    const httpErr = Object.assign(new Error('HTTP 403: Forbidden'), { status: 403 });
+    expect(isTransientTransportError(httpErr)).toBe(false);
+    expect(isTransientTransportError(new SyntaxError('Unexpected token < in JSON'))).toBe(false);
+    expect(isTransientTransportError(null)).toBe(false);
+    expect(isTransientTransportError(undefined)).toBe(false);
+  });
+});
+
+describe('withRetry — transient transport errors (Neon/Cloudflare availability checks)', () => {
+  it('retries a transient transport error and then succeeds', async () => {
+    let calls = 0;
+    globalThis.fetch = (async () => {
+      calls++;
+      if (calls === 1) throw fetchFailed('ECONNRESET');
+      return jsonResponse({ ok: true });
+    }) as typeof fetch;
+
+    const { ctx } = makeCtx();
+    const data = await ctx.fetch<{ ok: boolean }>('/availability');
+
+    expect(calls).toBe(2);
+    expect(data).toEqual({ ok: true });
+  }, 10000);
+
+  it('still throws after exhausting retries on a persistent transport error', async () => {
+    let calls = 0;
+    globalThis.fetch = (async () => {
+      calls++;
+      throw fetchFailed('ETIMEDOUT');
+    }) as typeof fetch;
+
+    const { ctx } = makeCtx();
+    await expect(ctx.fetch('/availability')).rejects.toThrow();
+    expect(calls).toBe(4); // initial attempt + MAX_RETRIES (3)
+  }, 20000);
+});
diff --git a/packages/integration-platform/src/runtime/check-context.ts b/packages/integration-platform/src/runtime/check-context.ts
index 27527a67d2..6fbd016aa1 100644
--- a/packages/integration-platform/src/runtime/check-context.ts
+++ b/packages/integration-platform/src/runtime/check-context.ts
@@ -80,6 +80,49 @@ function parseLinkHeader(header: string | null): { next?: string } {
   return links;
 }
 
+/**
+ * errno-style codes for transient transport-level failures — the connection
+ * never completed (TCP reset, DNS hiccup, connect/read timeout), so the request
+ * is safe to retry. Node/undici surfaces these as a thrown error (not an HTTP
+ * Response) and wraps the real network error as `TypeError: fetch failed` with
+ * the underlying error on `.cause`.
+ */
+const TRANSIENT_TRANSPORT_CODES = new Set([
+  'ECONNRESET',
+  'ECONNREFUSED',
+  'ECONNABORTED',
+  'EPIPE',
+  'ETIMEDOUT',
+  'EHOSTUNREACH',
+  'ENETUNREACH',
+  'ENETDOWN',
+  'EAI_AGAIN', // transient DNS failure
+  'ENOTFOUND', // DNS resolution failure
+  'UND_ERR_CONNECT_TIMEOUT',
+  'UND_ERR_HEADERS_TIMEOUT',
+  'UND_ERR_BODY_TIMEOUT',
+  'UND_ERR_SOCKET',
+]);
+
+const TRANSIENT_TRANSPORT_MESSAGE =
+  /fetch failed|socket hang up|network|terminated|timeout|timed out|connection (closed|refused|reset)|ECONNRESET|ETIMEDOUT|EAI_AGAIN/i;
+
+/**
+ * True when an error thrown by `fetch` is a transient transport-level failure
+ * rather than an HTTP response. HTTP errors never reach here — `fetch` resolves
+ * them as a Response, so they are handled by the status-code logic in
+ * `withRetry`/`executeRequest`. Walks the `.cause` chain because undici nests
+ * the real network error there under a generic `TypeError: fetch failed`.
+ */
+export function isTransientTransportError(error: unknown, depth = 0): boolean {
+  if (!error || typeof error !== 'object' || depth > 5) return false;
+  const code = (error as { code?: unknown }).code;
+  if (typeof code === 'string' && TRANSIENT_TRANSPORT_CODES.has(code)) return true;
+  const message = (error as { message?: unknown }).message;
+  if (typeof message === 'string' && TRANSIENT_TRANSPORT_MESSAGE.test(message)) return true;
+  return isTransientTransportError((error as { cause?: unknown }).cause, depth + 1);
+}
+
 export function createCheckContext(options: CheckContextOptions): {
   ctx: CheckContext;
   getResults: () => CheckResult;
@@ -171,7 +214,26 @@ export function createCheckContext(options: CheckContextOptions): {
   };
 
   async function withRetry(requestFn: () => Promise<Response>, attempt = 0): Promise<Response> {
-    const response = await requestFn();
+    let response: Response;
+    try {
+      response = await requestFn();
+    } catch (error) {
+      // `fetch` rejects only on transport-level failures (TCP reset, DNS hiccup,
+      // connect/read timeout) — never on HTTP status, which resolves as a Response.
+      // These blips pass on a retry, so back off and retry them exactly like a 5xx.
+      // Without this, one network blip surfaces as a failed check run that then
+      // succeeds on a manual re-run.
+      if (isTransientTransportError(error) && attempt < MAX_RETRIES) {
+        const delayMs = INITIAL_RETRY_DELAY_MS * Math.pow(2, attempt);
+        log.warn(
+          `Network error, retry in ${delayMs}ms: ${error instanceof Error ? error.message : String(error)}`,
+          { attempt: attempt + 1 },
+        );
+        await sleep(delayMs);
+        return withRetry(requestFn, attempt + 1);
+      }
+      throw error;
+    }
 
     if (response.status === 429 && attempt < MAX_RETRIES) {
       const retryAfter = response.headers.get('Retry-After');
@@ -218,7 +280,9 @@ export function createCheckContext(options: CheckContextOptions): {
       try {
         errorBody = await response.text();
       } catch {}
-      const err = new Error(`HTTP ${response.status}: ${response.statusText}${errorBody ? ` - ${errorBody.slice(0, 500)}` : ''}`);
+      const err = new Error(
+        `HTTP ${response.status}: ${response.statusText}${errorBody ? ` - ${errorBody.slice(0, 500)}` : ''}`,
+      );
       (err as Error & { status: number }).status = response.status;
       throw err;
     }