diff --git a/PUBLIC_SOURCE_EXPORT.md b/PUBLIC_SOURCE_EXPORT.md
index 594b910..c3ffd0a 100644
--- a/PUBLIC_SOURCE_EXPORT.md
+++ b/PUBLIC_SOURCE_EXPORT.md
@@ -1,3 +1,3 @@
 # Public source export
 
-This source snapshot was generated from the private canonical repository at revision `6881b54064f5077391e2a4711917ac54f12a877e`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
+This source snapshot was generated from the private canonical repository at revision `aa72a053975f020a793c88ba18c8d6b93bc9f937`. It contains no private Git history or operational evidence. Changes are published from the canonical repository.
diff --git a/PUBLIC_SOURCE_MANIFEST.json b/PUBLIC_SOURCE_MANIFEST.json
index c775b1d..32123fd 100644
--- a/PUBLIC_SOURCE_MANIFEST.json
+++ b/PUBLIC_SOURCE_MANIFEST.json
@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sourceRevision": "6881b54064f5077391e2a4711917ac54f12a877e",
+  "sourceRevision": "aa72a053975f020a793c88ba18c8d6b93bc9f937",
   "files": [
     {
       "path": ".dockerignore",
@@ -1759,8 +1759,8 @@
     },
     {
       "path": "connectors/gitea/server.py",
-      "sha256": "be5f401d9bc75d531f1d082ba8893547fa752d1fad5c22069b165f3cea64db3b",
-      "bytes": 228031
+      "sha256": "f9358c5d53036ad96d0231c0c2f3ba10f99913fb9a77c21b73c2cf799f97efa1",
+      "bytes": 228338
     },
     {
       "path": "connectors/knowledge/__init__.py",
@@ -3012,6 +3012,11 @@
       "sha256": "006648857d313b8f7fcaa62b86d5f453aa565a75a348aefe7b8557e3b4ba8620",
       "bytes": 63
     },
+    {
+      "path": "tests/fixtures/projectbrain-managed-validation-browser.yml",
+      "sha256": "6baaf4ceb2e493f90cc8210953a92f8f2c6da723e9c85446f38670efa285d9cc",
+      "bytes": 9271
+    },
     {
       "path": "tests/fixtures/projectbrain-managed-validation.yml",
       "sha256": "2f78d37ff51f38f0a3b0c9e222eb2dbf83d5108aee3615eb53f2c01283f37f34",
@@ -3184,8 +3189,8 @@
     },
     {
       "path": "tests/test_gitea_connector.py",
-      "sha256": "dd61db44c16f1ecb2fcc2ac099900b3908fa7b5aa7ab397c40648795a4e2ecaa",
-      "bytes": 128560
+      "sha256": "a6ad1f1eceb51107d9b56ceac65185017c4548ffa5d52ddc1808c5f305dfbcdb",
+      "bytes": 130782
     },
     {
       "path": "tests/test_gitea_merge_eligibility.py",
diff --git a/connectors/gitea/server.py b/connectors/gitea/server.py
index e24d54b..2a29cce 100644
--- a/connectors/gitea/server.py
+++ b/connectors/gitea/server.py
@@ -92,12 +92,18 @@ _PROJECTBRAIN_REQUIRED_PROTECTION_LOCKS = {
 # Original source commit for the ProjectBrain-specific profile lineage.
 _PROJECTBRAIN_VALIDATION_PROFILE_SOURCE_SHA = "57157b1b24d3679018b54970c934fc35d1735df7"
 # SHA-256 of JSON-dumped jobs.full (sort_keys, compact separators), parsed with
-# BaseLoader. It pins the reviewed ProjectBrain workflow copy below.
-# Frozen workflow source and copied fixture raw SHA-256:
+# BaseLoader. These two exact jobs pin the reviewed ProjectBrain workflow copies:
+# the original validation profile and the bounded browser-runner profile.
+# Original frozen workflow source and copied fixture raw SHA-256:
 # 2f78d37ff51f38f0a3b0c9e222eb2dbf83d5108aee3615eb53f2c01283f37f34.
+# Bounded browser fixture raw SHA-256:
+# 6baaf4ceb2e493f90cc8210953a92f8f2c6da723e9c85446f38670efa285d9cc.
 # Refresh only after review.
-_PROJECTBRAIN_VALIDATION_FULL_JOB_DIGEST = (
-    "a3fefb8865f0bd0d4a8c10af79eeb5e22367c5e82e9333a2fe04bdaf97d0193b"
+_PROJECTBRAIN_VALIDATION_FULL_JOB_DIGESTS = frozenset(
+    {
+        "a3fefb8865f0bd0d4a8c10af79eeb5e22367c5e82e9333a2fe04bdaf97d0193b",
+        "d2ee4d6b1c727b6e11286274728783533a293b47f23da81b70bbd052c6e8e11a",
+    }
 )
 _PROJECTBRAIN_VALIDATION_MAX_YAML_CHARS = 200_000
 _PROJECTBRAIN_VALIDATION_MAX_YAML_TOKENS = 10_000
@@ -252,7 +258,7 @@ def _projectbrain_managed_validation_is_strong(workflow_content: str) -> bool:
         ).hexdigest()
     except (RecursionError, TypeError, ValueError):
         return False
-    return full_job_digest == _PROJECTBRAIN_VALIDATION_FULL_JOB_DIGEST
+    return full_job_digest in _PROJECTBRAIN_VALIDATION_FULL_JOB_DIGESTS
 
 
 def _managed_validation_profile(
diff --git a/tests/fixtures/projectbrain-managed-validation-browser.yml b/tests/fixtures/projectbrain-managed-validation-browser.yml
new file mode 100644
index 0000000..5007283
--- /dev/null
+++ b/tests/fixtures/projectbrain-managed-validation-browser.yml
@@ -0,0 +1,214 @@
+name: Managed validation
+run-name: "Managed validation / ${{ inputs.profile || 'full' }}"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+    inputs:
+      profile:
+        description: Allowlisted validation profile
+        required: true
+        default: full
+        type: choice
+        options: [test, lint, typecheck, build, security, full]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: managed-validation-${{ gitea.repository }}-${{ gitea.ref }}
+  cancel-in-progress: true
+
+jobs:
+  full:
+    name: full
+    runs-on: itworx-ci-browser
+    timeout-minutes: 30
+    env:
+      CI: "true"
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_DB: projectbrain_integration
+          POSTGRES_USER: projectbrain
+          POSTGRES_PASSWORD: projectbrain-test-password
+        options: >-
+          --cgroup-parent=docker
+          --cpus=0.5
+          --memory=512m
+          --pids-limit=128
+          --health-cmd "pg_isready -U projectbrain -d projectbrain_integration"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - name: Validate repository with a bounded profile
+        shell: bash
+        env:
+          REQUESTED_PROFILE: ${{ inputs.profile }}
+        run: |
+          set -euo pipefail
+          profile="${REQUESTED_PROFILE:-full}"
+          case "${profile}" in
+            test|lint|typecheck|build|security|full) ;;
+            *) echo "Profile is not allowlisted" >&2; exit 2 ;;
+          esac
+          if [[ "${profile}" == security && ( ! -f package.json || ! -f pnpm-lock.yaml ) ]]; then
+            echo "Security profile requires the repository's pinned pnpm audit:security command" >&2
+            exit 2
+          fi
+
+          git diff --check
+          if git grep -nE '^(<<<<<<< |=======$|>>>>>>> )' -- . ':!*.lock' ':!*.patch'; then
+            echo "Unresolved merge markers detected" >&2
+            exit 1
+          fi
+
+          # MANAGED_FAST_PATH: only documentation may skip product tests.
+          # Include deletions and renames; workflow and runner changes must
+          # always execute validation.
+          if [[ -n "${GITHUB_BASE_REF:-}" ]]; then
+            git fetch --no-tags origin "+refs/heads/${GITHUB_BASE_REF}:refs/remotes/origin/${GITHUB_BASE_REF}"
+            managed_base="origin/${GITHUB_BASE_REF}"
+            git diff --check "${managed_base}..HEAD"
+            mapfile -t managed_changed_files < <(
+              git diff --name-only --no-renames "${managed_base}..HEAD"
+            )
+            managed_runtime_change=0
+            for managed_path in "${managed_changed_files[@]}"; do
+              case "${managed_path}" in
+                *.md|*.mdx)
+                  ;;
+                *)
+                  managed_runtime_change=1
+                  break
+                  ;;
+              esac
+            done
+            if [[ "${#managed_changed_files[@]}" -gt 0 && "${managed_runtime_change}" -eq 0 ]]; then
+              printf 'Managed validation fast path: %s non-runtime file(s); full product suite skipped.\n' \
+                "${#managed_changed_files[@]}"
+              if [[ "${profile}" == full ]]; then
+                node scripts/check-doc-links.mjs
+                node scripts/check-unraid-template-readiness.mjs
+              fi
+              exit 0
+            fi
+          fi
+          if [[ -f pyproject.toml || -f requirements.txt ]]; then
+            # Compile only tracked Python sources. Running compileall after a
+            # Node install would otherwise traverse node_modules and turn a
+            # lightweight baseline into a large runner workload.
+            git ls-files -z '*.py' | xargs -0 -r python -m py_compile
+            if [[ -f uv.lock ]]; then
+              python -m venv "${RUNNER_TEMP}/managed-uv"
+              uv_python="${RUNNER_TEMP}/managed-uv/bin/python"
+              "${uv_python}" -m pip install --disable-pip-version-check uv==0.10.0
+              managed_uv="${RUNNER_TEMP}/managed-uv/bin/uv"
+              export UV_PROJECT_ENVIRONMENT="${RUNNER_TEMP}/managed-project-venv"
+              "${managed_uv}" sync --locked
+              export PATH="${UV_PROJECT_ENVIRONMENT}/bin:${PATH}"
+              if [[ "${profile}" == test || "${profile}" == full ]]; then
+                if "${managed_uv}" run python -c 'import pytest' 2>/dev/null; then
+                  "${managed_uv}" run python -m pytest
+                fi
+              fi
+              if [[ "${profile}" == lint || "${profile}" == full ]]; then
+                if "${managed_uv}" run python -c 'import ruff' 2>/dev/null; then
+                  "${managed_uv}" run python -m ruff check .
+                fi
+              fi
+            elif [[ -f requirements.txt ]]; then
+              python -m venv "${RUNNER_TEMP}/managed-python"
+              managed_python="${RUNNER_TEMP}/managed-python/bin/python"
+              "${managed_python}" -m pip install --disable-pip-version-check -r requirements.txt
+              export PATH="${RUNNER_TEMP}/managed-python/bin:${PATH}"
+              if [[ "${profile}" == test || "${profile}" == full ]]; then
+                if "${managed_python}" -c 'import pytest' 2>/dev/null; then
+                  "${managed_python}" -m pytest
+                fi
+              fi
+            fi
+          fi
+
+          # Keep ordinary unit/contract validation database-independent. The
+          # real PostgreSQL suite is enabled only after migrations are applied
+          # in the deployment-authoritative full profile below.
+          if [[ -f package.json ]]; then
+            corepack enable
+            if [[ -f pnpm-lock.yaml ]]; then
+              pnpm install --frozen-lockfile
+              if [[ "${profile}" == test ]]; then
+                pnpm --if-present test
+                [[ -f backend/package.json ]] && pnpm --filter projectbrain-api run test
+              elif [[ "${profile}" == full ]]; then
+                pnpm run test:coverage
+                [[ -f backend/package.json ]] && pnpm --filter projectbrain-api run test:coverage
+              fi
+              if [[ "${profile}" == security ]]; then
+                pnpm run audit:security
+              fi
+              if [[ "${profile}" == lint || "${profile}" == full ]]; then
+                pnpm --if-present lint
+                [[ -f backend/package.json ]] && pnpm --filter projectbrain-api run lint
+              fi
+              if [[ "${profile}" == typecheck || "${profile}" == full ]]; then
+                pnpm --if-present typecheck
+                [[ -f backend/package.json ]] && pnpm --filter projectbrain-api run typecheck
+              fi
+              if [[ "${profile}" == build || "${profile}" == full ]]; then
+                pnpm --if-present build
+                [[ -f backend/package.json ]] && pnpm --filter projectbrain-api run build
+              fi
+              if [[ "${profile}" == full ]]; then
+                pnpm run audit:openapi
+                pnpm run audit:architecture
+                pnpm run audit:docs
+                pnpm run audit:v1-freeze
+                pnpm run audit:unraid-template
+              fi
+              if [[ "${profile}" == full && -f backend/package.json ]]; then
+                export DATABASE_URL="postgresql://projectbrain:projectbrain-test-password@postgres:5432/projectbrain_integration?schema=public"
+                export TEST_DATABASE_URL="${DATABASE_URL}"
+                pnpm --dir backend prisma:generate
+                pnpm --dir backend db:deploy
+                pnpm --dir backend db:seed
+                pnpm --dir backend test:database
+                pnpm --dir backend exec prisma migrate reset --schema prisma/schema.prisma --force --skip-seed
+                pnpm --dir backend db:seed
+              fi
+              if [[ "${profile}" == full && -f playwright.config.ts ]]; then
+                pnpm exec playwright install chromium chromium-headless-shell
+                pnpm test:e2e
+                pnpm test:e2e:real
+              fi
+            elif [[ -f package-lock.json ]]; then
+              npm ci
+              [[ "${profile}" == test || "${profile}" == full ]] && npm run --if-present test
+              [[ "${profile}" == lint || "${profile}" == full ]] && npm run --if-present lint
+              if [[ "${profile}" == typecheck || "${profile}" == full ]]; then
+                npm run --if-present typecheck
+              fi
+              [[ "${profile}" == build || "${profile}" == full ]] && npm run --if-present build
+            fi
+          fi
+
+          if [[ -f go.mod ]]; then
+            if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
+              go test ./...
+            fi
+          fi
+          if [[ -f Cargo.toml ]]; then
+            if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
+              cargo test --locked
+            fi
+          fi
+          if compgen -G '*.sln' >/dev/null; then
+            if [[ "${profile}" == test || "${profile}" == build || "${profile}" == full ]]; then
+              dotnet test --configuration Release
+            fi
+          fi
diff --git a/tests/test_gitea_connector.py b/tests/test_gitea_connector.py
index cbbb4ad..7344c9d 100644
--- a/tests/test_gitea_connector.py
+++ b/tests/test_gitea_connector.py
@@ -46,6 +46,9 @@ ROOT = Path(__file__).resolve().parents[1]
 PROJECTBRAIN_VALIDATION_WORKFLOW = (
     ROOT / "tests" / "fixtures" / "projectbrain-managed-validation.yml"
 ).read_text(encoding="utf-8")
+PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW = (
+    ROOT / "tests" / "fixtures" / "projectbrain-managed-validation-browser.yml"
+).read_text(encoding="utf-8")
 
 
 def projectbrain_connector(
@@ -162,6 +165,15 @@ class GiteaConnectorTests(unittest.TestCase):
             _managed_validation_profile("Jens/projectbrain", PROJECTBRAIN_VALIDATION_WORKFLOW),
             "projectbrain",
         )
+        self.assertEqual(
+            _managed_validation_profile(
+                "Jens/projectbrain", PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW
+            ),
+            "projectbrain",
+        )
+        self.assertIsNone(
+            _managed_validation_profile("Acme/hub", PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW)
+        )
         self.assertIsNone(
             _managed_validation_profile(
                 "Jens/projectbrain",
@@ -207,6 +219,40 @@ class GiteaConnectorTests(unittest.TestCase):
                 PROJECTBRAIN_VALIDATION_WORKFLOW.replace("  pull_request:\n", ""),
             )
         )
+        bounded_browser_mutations = (
+            PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW.replace(
+                "runs-on: itworx-ci-browser", "runs-on: linux-validation"
+            ),
+            PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW.replace(
+                "--cgroup-parent=docker", "--cgroup-parent=untrusted"
+            ),
+            PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW.replace("--cpus=0.5", "--cpus=0.6"),
+            PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW.replace(
+                "--memory=512m", "--memory=513m"
+            ),
+            PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW.replace(
+                "--pids-limit=128", "--pids-limit=129"
+            ),
+            PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW.replace(
+                "image: postgres:16", "image: postgres:15"
+            ),
+            PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW.replace(
+                "pnpm exec playwright install chromium chromium-headless-shell",
+                "pnpm exec playwright install --force chromium chromium-headless-shell",
+            ),
+            PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW.replace(
+                "pnpm exec playwright install chromium chromium-headless-shell",
+                "pnpm exec playwright install --with-deps chromium chromium-headless-shell",
+            ),
+            PROJECTBRAIN_BROWSER_VALIDATION_WORKFLOW.replace(
+                "pnpm test:e2e:real", "echo skipped-e2e"
+            ),
+        )
+        for modified_workflow in bounded_browser_mutations:
+            with self.subTest(modified_workflow=modified_workflow[-160:]):
+                self.assertIsNone(
+                    _managed_validation_profile("Jens/projectbrain", modified_workflow)
+                )
         self.assertIsNone(
             _managed_validation_profile(
                 "Jens/projectbrain",