[seonghobae]

Buyer-visible gap

Partial implementation of #28. OriginWeave needs a bounded session-scoped authority registry between raw WebDriver BiDi/CDP/renderer identifiers and durable OriginWeave browser authority so protocol-local strings never become reusable authorization tokens.

Implemented boundary

The branch provides stable internal session/context identity, document-epoch rotation, stale-node invalidation, exact session/context/origin binding, bounded opaque external identifiers, monotonic non-reused internal identifiers, explicit node/context/session retirement, reverse-index node lookup, deterministic credential-safe contract errors, and explicit extension-to-Agent authority. Registered node handles carry an in-process registry-instance issuance token so a structurally identical caller-constructed or cross-registry tuple cannot become live node authority.

Raw protocol identifiers remain private lookup keys and cannot directly become OriginWeave Agent authority. Registry removal is local authority revocation only; it does not claim that the external Chromium process/context terminated. The lineage also rejects browser-special ambiguous numeric host spellings, including bare 0x final labels, before they can become OriginWeave origin authority.

Fresh protected-main adoption

Protected main is exact c789b802fc98a8d7fd8c09d9327f36828054d2a1. This PR previously targeted main@542ca1e9c0a863595b8b6697790005d2471f5413 at contributor head 3c6bcd47773132fbd6584390a2e57988b2539454. The two protected-main commits between those bases have no net file delta.

Commit c376ed889ce2e7bbe1097e5c4e1289f6c795bd4f adopts current protected main as a second parent while preserving the predecessor product tree exactly. The branch update was a normal non-force fast-forward; no destructive rebase or force-push was used.

Fresh current-main compare is 126 ahead / 0 behind with merge base exactly c789b802.... The effective semantic delta is 21 browser-authority/core-contract/test/ADR/changelog paths and contains no .github/** mutation. The historical commit count is stack lineage, not 126 independent buyer changes.

Exact-current evidence

Current exact head is c376ed889ce2e7bbe1097e5c4e1289f6c795bd4f. GitHub reports this PR open, Draft, and content-mergeable. Predecessor exact 3c6bcd... had CI, Manifest V3, SAST, Security Scan, CodeRabbit, and Devin success, but those results do not transfer after the head movement.

Fresh workflows have materialized for c376ed... and remain non-terminal:

• CI 33776293270: queued;
• Manifest V3 Compatibility 33776293129: queued;
• SAST Semgrep 33776293094: queued;
• Security Scan 33776293935: queued;
• OSV-Scanner PR 33776293846: queued;
• Scorecard PR 33776293069: queued; and
• one-shot Materialize Rust nightly refresh once 33776293084: completed as skipped and is not product evidence.

No exact-current GREEN or independent approval is claimed. Keep Draft until the unchanged head proves repository contracts, strict Rust checks/rustdoc, exact 100% owned-production function/line/region/branch coverage, applicable pinned-Chromium/security/review evidence, and live governance acceptance.

Scope boundary

This slice adds no browser I/O, Chromium fork, BiDi/CDP transport, unrestricted JavaScript execution, persistent authorization, secret handling, network permission, model call, or ambient Chrome-permission inheritance. It remains the dependency root for the real pinned-Chromium observation → policy → typed action → observed post-condition → evidence vertical, not completion of that runtime.

Protected-main AGENTS.md and live governance remain authoritative. This scheduled writer does not merge, self-approve, bypass, force-push, destructively rebase, alter workflows/rulesets/secrets, weaken checks, tag, release, or publish.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

OriginWeave에 보안 계약, 브라우저 권한 레지스트리, 확장 프로그램 접근 평가를 추가했습니다. 레지스트리는 세션·컨텍스트·노드 식별자와 origin 및 document epoch를 관리합니다. 커버리지 누락 라인은 파일과 CI 로그에 함께 출력합니다.

Changes

브라우저 권한 계약

Layer / File(s)	Summary
보안 계약 및 접근 평가 crates/originweave-core/src/contracts.rs, crates/originweave-core/src/contract_errors.rs, crates/originweave-core/src/lib.rs, crates/originweave-core/tests/extension_authority.rs, crates/originweave-core/tests/public_error_contract.rs	Origin 정규화, 세션·컨텍스트·문서 식별자, 노드 핸들, 액션·승인 계약, Chromium extension ID, capability grant 및 접근 평가를 추가합니다. 공개 오류 타입의 표시와 표준 오류 계약을 구현합니다.
브라우저 권한 레지스트리 crates/originweave-core/src/browser_registry.rs	외부 세션·컨텍스트·노드 식별자를 내부 권한 식별자로 매핑합니다. 컨텍스트별 origin과 document epoch를 관리하고, 문서 전환 시 기존 노드를 무효화합니다.
레지스트리 검증 crates/originweave-core/src/browser_registry.rs, crates/originweave-core/src/browser_registry_coverage.rs, crates/originweave-core/tests/browser_authority_registry.rs	식별자 재사용, 세션 및 컨텍스트 소유권, stale 노드, origin 변경, 입력 길이, 식별자 고갈 및 오류 표시를 검증합니다.

커버리지 로그 출력

Layer / File(s)	Summary
커버리지 출력 변경 .github/workflows/ci.yml	커버리지 누락 라인을 missing-lines.txt에 저장하면서 CI 로그에도 출력합니다.

Estimated code review effort: 5 (Critical) | ~90 minutes

Merge Risk: 🟠 High · up to 2203d

The extension authorization path currently does not enforce exact origin or expiry, allowing a grant to be reused across origins or after its deadline, while the accompanying tests reference missing denial variants. This is a high-impact security and correctness issue, so the PR is not merge-ready until the fail-closed checks and contract variants are implemented.

Sequence Diagram(s)

sequenceDiagram
  participant BrowserProtocol
  participant BrowserAuthorityRegistry
  participant Contracts
  BrowserProtocol->>BrowserAuthorityRegistry: 세션·컨텍스트·노드 등록
  BrowserAuthorityRegistry->>Contracts: 식별자 및 origin 검증
  Contracts-->>BrowserAuthorityRegistry: 검증 결과 반환
  BrowserAuthorityRegistry-->>BrowserProtocol: 권한 식별자 또는 오류 반환
  BrowserProtocol->>BrowserAuthorityRegistry: 문서 전환 요청
  BrowserAuthorityRegistry-->>BrowserProtocol: 새 epoch 반환 및 기존 노드 무효화

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 프로토콜 식별자를 OriginWeave 권한 식별자에 바인딩하는 이번 변경의 핵심을 명확하게 요약합니다.

✨ Finishing Touches 💡 1

⚔️ Resolve merge conflicts 💡

• Resolve merge conflict in branch feat/browser-authority-registry

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/browser-authority-registry

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 5157366a025f62cdccdff8b795a05f167f09e6e8.

• Head SHA: 5157366a025f62cdccdff8b795a05f167f09e6e8

• Workflow run: 32648835146

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (14 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (14 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs: 0013-manifest-v3-extension-authority.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: 0013-manifest-v3-extension-authority.md"]
  R2 --> V2["docs review"]

Loading

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 93ce1e7efad0a1e8c107f1f465a5260ba568d466.

• Head SHA: 93ce1e7efad0a1e8c107f1f465a5260ba568d466

• Workflow run: 32785566524

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (15 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (15 files)"]
  R1 --> V1["required checks"]
  Evidence --> S2["Docs: 0013-manifest-v3-extension-authority.md"]
  S2 --> I2["operator or user guidance"]
  I2 --> R2["Review risk: Docs: 0013-manifest-v3-extension-authority.md"]
  R2 --> V2["docs review"]

Loading

[seonghobae]

Integrated protected main at 8c97b09dbd3fc145cb2d90ab442b2177b9e47646 without changing the browser authority production contract. Current code and focused tests cover the earlier origin, expiry, registry-instance, node-retirement, and public-rustdoc findings; the current unresolved review-thread count is zero. Exact local verification passed: originweave-core tests; Python 152 tests; workspace fmt, strict Clippy, all-target/all-feature tests, rustdoc; LLVM functions, lines, regions, and branches each 100%. Hosted exact-head checks and eligible review remain authoritative.