test(browser): constrain semantic observation evidence schema

[seonghobae]

Partial implementation of #28, stacked on unchanged exact PR #128 head 24446c9cacd05bab370d8a636552514d656fcf42.

Buyer/security gap

PR #128 bounds the controlled Agent Task semantic-observation bytes, but byte size alone does not constrain evidence meaning. A later runner change could add unreviewed raw page text, hidden prompt-injection content, or arbitrary instruction-like fields while remaining under 4,096 bytes. The controlled compatibility lane therefore needs an exact reviewed evidence-schema contract at the executable construction site without pretending that the generic byte-measurement helper is a semantic validator.

Dependency

This Draft targets unchanged exact #128 head 24446c9cacd05bab370d8a636552514d656fcf42 and must remain Draft while #128/#105/#100 and their prerequisites remain active. PR #132 and its descendants already depend on this exact head, so ancestry must be preserved. No prerequisite check, review, status, artifact, coverage, mergeability, or synthetic-merge result transfers.

TDD and RCA sequence

1. Exact test-only head 5791b650ccd7f1f9c40ea49ed565fc051d9f018d initially required the generic _measure_agent_task_semantic_observation_bytes helper to reject extra or malformed fields. CI run 31625916343, Rust contracts job 94212118955, failed in Python repository contracts as expected.
2. RCA rejected that remedy at the wrong abstraction layer. The helper's contract is canonical byte measurement for an arbitrary non-empty object; hard-coding the controlled fixture schema there would conflate size enforcement with evidence semantics and break feat(browser): fail closed on oversized Agent Task observation #128's reusable exact-limit contract.
3. Head 46efc3d530494b41f84c25ae50bc8fd1e623e027 moved the fail-closed contract to the actual executable semantic_observation construction. The AST-level repository test requires one exact construction and one exact bounded-helper call.
4. Current exact head d199a0d1f30746aafc67986bf9dbc3ca88d802c6 adds only the truthful Unreleased security changelog entry.

Implemented contract

The repository contract parses the controlled runner AST and now requires:

• exactly one semantic_observation assignment in the executable Agent Task path;
• exactly two top-level fields: input and submit;
• exactly two fields inside each object: role and name;
• values sourced only from the previously browser-computed and exact-checked input_role, input_name, submit_role, and submit_name variables;
• exactly one _measure_agent_task_semantic_observation_bytes(semantic_observation) call;
• no alternate positional or keyword object supplied to the measurement helper; and
• no silent raw page text, hidden content, generic instruction field, arbitrary metadata, or parallel unbounded construction in this controlled evidence path.

The byte helper remains separately responsible only for canonical compact UTF-8 serialization and the finite 4,096-byte ceiling.

Exact-head proof

On unchanged exact head d199a0d1f30746aafc67986bf9dbc3ca88d802c6 against unchanged exact prerequisite 24446c9cacd05bab370d8a636552514d656fcf42:

• CI run 31626768646: success;
• Rust contracts job 94215037538: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 94215037655: exact owned production function/line/region/branch enforcement success;
• CodeRabbit exact-head status: success;
• GitHub reports the Draft mergeable against its unchanged prerequisite base; and
• no formal reviews or inline review threads are currently returned.

No predecessor-head or prerequisite evidence is promoted as current proof.

Truth boundary

This lane hardens only the controlled pinned-browser compatibility evidence shape. It does not define the final product-wide semantic observation schema, authenticate browser semantics, make accessible names trusted instructions, authorize model context, expose raw HTML, grant capabilities, inspect all browser channels, or complete the end-to-end browser adapter. A trusted production adapter still needs versioned structured-observation contracts and immediate authority checks at its real browser boundary.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 05e48f3e-0b3a-4def-bf54-1c4e8c3997c5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}