feat(browser): prove pristine Agent Task profile admission

[seonghobae]

Partial implementation of #28, stacked on unchanged exact PR #132 head 5a352a05ade9e902e6729bcb40ad37b69b485db3.

Buyer/security gap

The pinned-Chromium Agent Task used a temporary profile and disabled extensions, but the executable acceptance boundary did not prove that the profile directory was pristine before launch or that browser-visible cookies and Web Storage were empty before the controlled action. A reused or pre-populated task profile could therefore carry ambient state while still producing a superficially successful workflow. The runner also needed explicit saved-credential service disablement and one aggregate isolation gate.

Dependency

This Draft targets unchanged exact #132 head 5a352a05ade9e902e6729bcb40ad37b69b485db3 and must remain Draft while #132/#129/#128 and their prerequisites remain active. No downstream open PR currently targets this branch. No prerequisite check, review, status, artifact, coverage, mergeability, or synthetic-merge evidence transfers.

TDD and RCA sequence

1. Exact test-only head c9016da784d3a3cafbe8ffb84a38ca686e9e5314 required explicit pristine-profile admission, ambient cookie/Web Storage inspection, saved-credential disablement, per-trial evidence, and an aggregate fail-closed isolation gate before runner support existed. CI run 31648194541, Rust contracts job 94286512210, failed in the Python repository-contract suite when a controlled result with profile_pristine_before_launch = false was still accepted with return code 0. This is the valid RED.
2. Production head 40700a739905bf079e4dc1e43ac6d078f81974aa added the profile-admission and ambient-state boundaries, Chrome credential-manager preferences, evidence propagation, and aggregate gate.
3. Head a805af6ff8bef3e974ea3a4e0a5cdc4ec4dee30f completed the source/test boundary and reached exact-green.
4. Head 5fac5b5c61462f415caadb98a2428907acc0c745 added a release-note entry, but semantic review found that its initial wording overclaimed a browser-observed extension count that the implementation does not collect.
5. Current exact head 8845dbd781f60f0d9ef4ea74ec0a9707b16bbd50 corrects only that documentation claim. It now distinguishes browser-observed cookie/Web Storage evidence from launch-policy extension disablement and explicitly avoids claiming attested absence of every credential mechanism.

Implemented contract

The controlled Agent Task runner now:

• fails before Chromium launch unless the temporary profile path exists as a directory and contains no entry;
• configures Chrome with credentials_enable_service = false and profile.password_manager_enabled = false;
• retains the existing --disable-extensions launch policy;
• after loading the controlled fixture but before the action, queries WebDriver cookies and fails closed unless the returned value is an empty list;
• measures localStorage.length and sessionStorage.length in the controlled page and fails closed unless both are valid non-negative integers equal to zero;
• emits bounded boolean evidence for pristine pre-launch profile, absent ambient cookies, absent ambient Web Storage, disabled saved-credential services, disabled extensions by launch policy, and post-trial profile cleanup; and
• fails the aggregate Agent Task acceptance gate unless every successful trial carries all six isolation facts.

Hostile tests cover a pre-populated profile, ambient cookies, ambient local storage, malformed probe behavior, missing isolation evidence, and exact configuration/gate wiring.

Exact-head proof

On unchanged exact head 8845dbd781f60f0d9ef4ea74ec0a9707b16bbd50 against unchanged exact prerequisite 5a352a05ade9e902e6729bcb40ad37b69b485db3:

• CI run 31654427064: success;
• Rust contracts job 94305616928: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 94305616944: exact owned production function/line/region/branch enforcement success;
• Manifest V3 Compatibility run 31654427093: success;
• CodeRabbit exact-head status: success;
• GitHub reports the Draft mergeable against its unchanged prerequisite base; and
• no formal reviews or inline review threads are currently returned.

No predecessor-head or prerequisite evidence is promoted as current proof.

Truth boundary

This is controlled compatibility/acceptance evidence, not a general browser-attestation mechanism. It does not inspect the human browser profile, prove absence of every Chrome credential store, service worker, cache, IndexedDB, filesystem artifact, operating-system keychain entry, enterprise policy, injected browser component, or out-of-process influence. It does not authenticate the browser/adapter process, authorize Agent actions, disclose secrets, or complete #28. Extensions are disabled by reviewed launch policy; no browser-observed extension-count claim is made.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c4e47422-2629-4fe2-a543-b7b715cb6064

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}