fix(policy): revalidate current semantic state at dispatch

[seonghobae]

Partial implementation of #28, stacked on exact PR #102 head c751865412d5642357203f917f16c6c2bbd12324.

Buyer/correctness gap

PR #96 makes browser-authority revalidation and adapter callback invocation one call, and PR #102 adds exact current semantic-observation revalidation at the core target boundary. Those checks were still independently callable: the policy dispatch boundary could validate session/context/origin/document epoch and invoke the adapter while ignoring a same-document semantic change such as the target becoming disabled, the selected action disappearing, or a different node being observed.

This slice composes one freshly supplied semantic observation into the policy-authorized dispatch boundary so that stale same-document semantic state cannot be ignored immediately before the callback.

Dependency

This Draft targets PR #102 branch fix/semantic-node-current-observation-revalidation at unchanged exact head c751865412d5642357203f917f16c6c2bbd12324. Keep Draft while #102/#101/#96/#95/#93/#58/#57/#52/#40 remain active. No prerequisite check, review, status, coverage, or mergeability evidence transfers.

TDD / RCA sequence

1. Exact test-only head 64bc330d801dcaddad29cb907fce68a9de367afa required PolicyAuthorizedSemanticNodeAction::dispatch_if_current_observation. CI run 31555786236, Rust contracts job 93987800295, passed repository contracts and canonical formatting and then failed at the Rust workspace check because the production boundary did not yet exist. That is the intended production-boundary RED.
2. Production added the narrow composition and reached head 2bf613a1d185f6d6dbdc6ede23ebad710d067103. Rust contracts job 93988351769 succeeded, but Production coverage job 93988351855 failed the exact gate. Coverage artifact 9126022747 localized the gap to a generic-monomorphization region around validate_current_observation(current_observation)?: separate test closure types had exercised success and rejection through different monomorphized copies.
3. Head 1c033b60250d2119a4ecece0ce541dd7b6b9d087 routes success, semantic rejection, and adapter-failure cases through one shared typed dispatch helper so one monomorphization exercises both success and error paths. CI run 31556160372 then exposed only canonical rustfmt wrapping in that test helper.
4. Current exact head c4c32d4305d6485a5e9f2bf202316b216d95f71f applies only that formatting delta.

Implemented boundary

PolicyAuthorizedSemanticNodeAction::dispatch_if_current_observation now:

• requires one fresh SemanticNodeObservation before callback invocation;
• reuses the exact fix(core): revalidate semantic action against current observation #102 target check, so the observation must describe the same OriginWeave-owned node across browser session, context, canonical origin, document epoch, and node identifier;
• requires the selected node-local action to still be advertised;
• requires the node to remain enabled when the selected action requires enabled state;
• invokes the supplied callback only after those checks pass; and
• leaves adapter return/failure as a separate result after successful semantic-state validation.

Focused regressions prove exact-current dispatch, newly disabled denial, removed-action denial, different same-document-node denial, callback non-invocation on every semantic rejection, and separation of adapter failure after successful validation.

Exact-head proof

On unchanged exact current head c4c32d4305d6485a5e9f2bf202316b216d95f71f against unchanged exact prerequisite #102 head c751865412d5642357203f917f16c6c2bbd12324:

• CI run 31556233043: success;
• Rust contracts job 93989132459: success, including repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc;
• Production coverage job 93989132433: success, including exact owned production function/line/region/branch enforcement;
• exact-head CodeRabbit commit status: success;
• GitHub reports the Draft mergeable against its exact prerequisite base; and
• no formal reviews or inline review threads are currently returned.

No predecessor-head or prerequisite evidence is transferred.

Truth boundary

This slice does not obtain or authenticate the observation, decide when browser mutation requires re-observation, rotate document epochs, execute Chromium input by itself, authorize destination/network/TLS/HTTP, mint approval, resolve secrets, or prove a post-condition. Its safety value depends on a trusted runtime supplying the fresh bounded observation immediately before the side effect.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 31722f03-f8ad-449b-8596-e447d986ea0e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}