Covers the cloud hand-off: creating exactly one web session per run no matter how often the loop prompts, surfacing the session link the way other targets surface theirs, failing fast on an untrusted workspace with the one-time fix named, keeping user text out of the shell, and the driver declaring itself hands-off.

## Before writing SPEC.md files

Read https://raw.githubusercontent.com/brillout/sdd/refs/heads/main/sdd.md
