From 1ab7f28631809be2be19dad9bf82a337ccd8e45f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:39:18 +0900 Subject: [PATCH 001/130] docs: expose documentation fitness and complete ADR index --- docs/README.md | 26 +++++++++++++++++++++++--- 1 file changed, 23 insertions(+), 3 deletions(-) diff --git a/docs/README.md b/docs/README.md index fa62037e..4cae2fe0 100644 --- a/docs/README.md +++ b/docs/README.md @@ -10,6 +10,7 @@ - [Conceptual ERD and durable domain model](erd/README.md) - [Data governance and privacy boundary](DATA_GOVERNANCE.md) - [Product and decision traceability](traceability/README.md) +- [Documentation fitness assessment](DOCUMENTATION_FITNESS.md) - [Threat model](THREAT_MODEL.md) - [Product-wide test strategy](TEST_STRATEGY.md) - [Operability and incident-response baseline](OPERABILITY.md) @@ -21,7 +22,7 @@ - [Quality gates](quality-gates.md) - [Security policy](../SECURITY.md) -The PRD/TRD/Architecture/ADR/UML/ERD/data-governance/traceability/security/operations/API/release set is the product-wide documentation graph. Feature-specific design specifications and plans below provide detailed implementation history but do not substitute for the product-wide baseline. Planned or conversation-derived capabilities must remain labelled Planned, Proposed, or Open until reviewed implementation evidence reaches protected `main`. +The PRD/TRD/Architecture/ADR/UML/ERD/data-governance/traceability/security/operations/API/release set is the product-wide documentation graph. The documentation-fitness assessment records where that graph is current, stale, partial, or intentionally proposed. Feature-specific design specifications and plans below provide detailed implementation history but do not substitute for the product-wide baseline. Planned or conversation-derived capabilities must remain labelled Planned, Proposed, or Open until reviewed implementation evidence reaches protected `main`. ## Governance and maintenance @@ -42,7 +43,7 @@ The PRD/TRD/Architecture/ADR/UML/ERD/data-governance/traceability/security/opera - [TLS service-identity design](superpowers/specs/2026-08-06-tls-server-identity-design.md) - [TLS service-identity implementation plan](superpowers/plans/2026-08-06-tls-server-identity.md) -## Protected-main architecture decisions +## Accepted protected-main architecture decisions - [ADR 0001: Chromium compatibility kernel](adr/0001-chromium-compatibility-kernel.md) - [ADR 0002: Agent safety kernel](adr/0002-agent-safety-kernel.md) @@ -50,5 +51,24 @@ The PRD/TRD/Architecture/ADR/UML/ERD/data-governance/traceability/security/opera - [ADR 0004: Logical origin and resolved destination safety](adr/0004-resolved-destination-policy.md) - [ADR 0005: Exact direct TCP peer binding](adr/0005-direct-socket-binding.md) - [ADR 0006: TLS service identity over the verified peer](adr/0006-tls-server-identity.md) +- [ADR 0007: Purpose-bound sensitive-data authority](adr/0007-purpose-bound-sensitive-data-authority.md) +- [ADR 0008: Delegated-task TLS leaf-validity horizon](adr/0008-leaf-validity-horizon.md) +- [ADR 0010: Session/context-bound node authority](adr/0010-session-context-bound-node-authority.md) -See the [ADR index](adr/README.md) for status rules, required decision structure, and the rule that active-PR ADRs do not become Accepted merely because they exist on an unmerged branch. +## Proposed decisions retained on protected main + +Proposed ADRs are reviewable architecture memory, not shipped behavior and not automatically Accepted merely because their files live on protected `main`. + +- [ADR 0009: Hourly agent credential boundary](adr/0009-hourly-agent-credential-boundary.md) +- [ADR 0100: Rust control-plane boundary](adr/0100-rust-control-plane-boundary.md) +- [ADR 0101: Isolated execution/profile modes](adr/0101-isolated-execution-profile-modes.md) +- [ADR 0102: Typed actions over arbitrary JavaScript](adr/0102-typed-actions-and-arbitrary-js.md) +- [ADR 0103: Semantic observation and stale-node identity](adr/0103-semantic-observation-and-stale-node-identity.md) +- [ADR 0104: Prompt-injection and secret authority separation](adr/0104-prompt-injection-and-secret-authority.md) +- [ADR 0105: Resource governor priority](adr/0105-resource-governor-priority.md) +- [ADR 0106: Provenance evidence model](adr/0106-provenance-evidence-model.md) +- [ADR 0107: Browser protocol adapter strategy](adr/0107-browser-protocol-adapter-strategy.md) +- [ADR 0108: Crawler policy](adr/0108-crawler-policy.md) +- [ADR 0109: Hourly automation operational closure](adr/0109-hourly-automation-operational-closure.md) + +See the [ADR index](adr/README.md) for status rules, required decision structure, supersession rules, and active feature ADRs. The index and each ADR's own status metadata must agree; a PR body, chat transcript, automation prompt, or stale issue reference cannot change ADR status. \ No newline at end of file From 3a029aed5392d1de43ee40c4d67bc09f64d5a0cc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:39:51 +0900 Subject: [PATCH 002/130] docs: reconcile ADR lifecycle index with protected main --- docs/adr/README.md | 44 +++++++++++++++++++++++++++++++------------- 1 file changed, 31 insertions(+), 13 deletions(-) diff --git a/docs/adr/README.md b/docs/adr/README.md index 2838a12a..209ab165 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -1,22 +1,22 @@ # OriginWeave Architecture Decision Index -This directory contains durable architecture decisions for OriginWeave. A pull-request body, chat transcript, roadmap bullet, or implementation plan may motivate a decision but does not replace an ADR when the decision changes a governing product or authority boundary. +This directory contains durable architecture decisions for OriginWeave. A pull-request body, chat transcript, roadmap bullet, automation prompt, issue, or implementation plan may motivate a decision but does not replace an ADR when the decision changes a governing product or authority boundary. ## Status vocabulary - **Proposed** — under review; not binding and not a shipped claim. -- **Accepted** — governing design decision on protected `main`; acceptance does not by itself prove that every described capability is implemented. +- **Accepted** — governing design decision on protected `main`; acceptance does not itself prove that every described capability is implemented. - **Superseded** — replaced by a later Accepted ADR; retained for history. - **Deprecated** — still discoverable but no longer recommended for new work. - **Rejected** — evaluated and intentionally not adopted. -An ADR becomes Accepted only through normal protected-branch review and merge. Where live repository policy or explicit CWL/OriginWeave governance requires independent review, acceptance also requires a qualifying non-author formal `APPROVED` review on the unchanged exact head. COMMENTED reviews, check/status results, model verdicts, reactions, author approval, predecessor-head approval, or dismissed reviews never substitute for that requirement. Conversation-derived ideas remain Proposed/Open in PRD/TRD/traceability until the protected process is complete. +An ADR becomes Accepted only through the repository's actual protected-branch governance at the time of the change. Where live GitHub policy or an explicit operationally satisfiable CWL/OriginWeave rule requires independent non-author approval, that approval is part of acceptance. When the repository is operating under its documented solo-maintainer exception and GitHub does not require a counted approval, automation must not invent an impossible approval gate. COMMENTED reviews, check/status results, model verdicts, reactions, author approval, predecessor-head approval, or dismissed reviews never substitute for a review that policy actually requires. -An Accepted ADR is **design authority, not implementation evidence**. Protected-main source, executable tests, built/released artifacts, migrations/configuration, and protected-main operational evidence appropriate to the claim establish current implemented behavior. An ADR may intentionally describe an accepted target that is only partially implemented; the product documents must label that implementation status separately. +An Accepted ADR is **design authority, not implementation evidence**. Protected-main source, executable tests, built/released artifacts, migrations/configuration, and protected-main operational evidence appropriate to the claim establish current implemented behavior. An ADR may intentionally describe an accepted target that is only partially implemented; product documents must label implementation status separately. -## Current protected-main decisions +## Accepted protected-main decisions -| ADR | Decision | Protected-main status | Governs | +| ADR | Decision | Status | Governs | |---|---|---|---| | [0001](0001-chromium-compatibility-kernel.md) | Retain Chromium as the compatibility kernel | Accepted | Blink/V8/graphics/extensions boundary; Rust control-plane integration | | [0002](0002-agent-safety-kernel.md) | Agent safety kernel | Accepted | mode, capability, origin, risk, crawler, secret and approval policy | @@ -24,13 +24,17 @@ An Accepted ADR is **design authority, not implementation evidence**. Protected- | [0004](0004-resolved-destination-policy.md) | Logical origin and resolved destination safety | Accepted | SSRF/rebinding/special-purpose address and redirect authority | | [0005](0005-direct-socket-binding.md) | Exact direct TCP peer binding | Accepted | explicit socket authority and operating-system peer proof | | [0006](0006-tls-server-identity.md) | TLS service identity over the verified peer | Accepted | WebPKI identity, roots, time, ALPN and stream binding | +| [0007](0007-purpose-bound-sensitive-data-authority.md) | Purpose-bound sensitive-data authority | Accepted | tenant/task/field/purpose/destination/classification disclosure authority | +| [0008](0008-leaf-validity-horizon.md) | Delegated-task TLS leaf-validity horizon | Accepted | minimum certificate-validity horizon for bounded delegated tasks | +| [0010](0010-session-context-bound-node-authority.md) | Session/context-bound node authority | Accepted | browser-session, browsing-context, origin, document-epoch and stale-node authority | -## Proposed target-architecture decisions in this change +## Proposed decisions retained on protected main -The following ADRs make the product-wide target architecture reviewable without promoting it to shipped behavior. They remain **Proposed** until their exact branch is reviewed and merged under protected-main policy. Existing feature PRs may independently carry lower-numbered Proposed ADRs; the `0100` range avoids claiming or conflicting with those active decisions. +Proposed ADR files can live on protected `main` as reviewable target architecture without becoming Accepted or shipped behavior. Their own status metadata remains authoritative until a later reviewed change accepts, supersedes, rejects, or deprecates them. | ADR | Decision | Status | Governs | |---|---|---|---| +| [0009](0009-hourly-agent-credential-boundary.md) | Hourly agent credential boundary | Proposed | deterministic gates, NVIDIA credential materialization, local broker and publication separation | | [0100](0100-rust-control-plane-boundary.md) | Rust control-plane boundary | Proposed | Rust-owned product authority versus Chromium compatibility kernel | | [0101](0101-isolated-execution-profile-modes.md) | Isolated execution/profile modes | Proposed | Human, Assist, Agent Task and Crawler session/profile isolation | | [0102](0102-typed-actions-and-arbitrary-js.md) | Typed actions over arbitrary JavaScript authority | Proposed | action API, script escape hatches, risk/policy semantics | @@ -40,9 +44,21 @@ The following ADRs make the product-wide target architecture reviewable without | [0106](0106-provenance-evidence-model.md) | Provenance-native evidence model | Proposed | WARC/PROV-style evidence identities, integrity and disclosure | | [0107](0107-browser-protocol-adapter-strategy.md) | Versioned browser and agent protocol adapters | Proposed | WebDriver BiDi, CDP, WebMCP, MCP and OriginWeave Protocol boundaries | | [0108](0108-crawler-policy.md) | Policy-bound crawler mode | Proposed | robots, rate/resource policy, read-only collection and no-evasion behavior | -| [0109](0109-hourly-automation-operational-closure.md) | Hourly automation secret ordering and operational closure | Proposed | deterministic gates, model secret boundary, retries and protected-main proof | +| [0109](0109-hourly-automation-operational-closure.md) | Hourly automation operational closure | Proposed | deterministic gates, model secret boundary, retries and protected-main proof | + +Active feature PRs may contain additional Proposed ADRs. They are not indexed here as protected-main decisions until their files reach protected `main`. Historical PR checks, stale branch state, or chat decisions never transfer ADR acceptance across a changed head. + +## Index completeness rule + +Every ADR file on protected `main` must be discoverable from this index with a status that agrees with the ADR's own status metadata. A feature ADR in an active PR belongs in that PR's traceability until merge. When an ADR is added, accepted, superseded, deprecated, or rejected, update this index in the same protected change or an immediately coupled documentation reconciliation. + +The machine-checkable documentation contract should fail when: -Active feature PRs may contain additional Proposed ADRs. Those ADRs are not described as Accepted until their exact changes merge. When an ADR becomes protected-main architecture, update this index in the same protected change or an immediately coupled documentation repair. +- an ADR file on protected `main` is absent from this index; +- this index claims `Accepted` while the ADR metadata says `Proposed`, or the reverse; +- a superseded ADR lacks a discoverable successor; +- an active-PR ADR is presented as protected-main implementation evidence; or +- a stale PR number, SHA, run ID, automation prompt, or conversation statement is used as timeless architecture authority. ## Decisions that require a dedicated ADR @@ -59,9 +75,10 @@ A new or superseding ADR is required when a change materially alters any of the 9. resource-governor priority, telemetry or GPU/CPU fallback semantics; 10. evidence/provenance identity, retention or persistence boundaries; 11. WebDriver BiDi, CDP, WebMCP, MCP or OriginWeave Protocol authority/version boundaries; -12. Manifest V3 extension-to-agent authorization; +12. Manifest V3 extension-to-agent authorization or compatibility evidence policy; 13. tenant, privacy, residency, audit, deployment or enterprise-control ownership; -14. release acceptance, rollback/recovery or protected-main operational-proof requirements. +14. hourly automation credential, writer, continuation or protected-main operational-proof authority; or +15. release acceptance, rollback/recovery or protected-main operational-proof requirements. ## Required ADR structure @@ -100,5 +117,6 @@ Material external standards or research belong in APA 7th format in [`../doctori - [`../uml/README.md`](../uml/README.md) visualizes component, sequence, state and deployment relationships. - [`../erd/README.md`](../erd/README.md) defines the conceptual durable domain model. - [`../traceability/README.md`](../traceability/README.md) maps requirements and decisions to implementation and evidence. +- [`../DOCUMENTATION_FITNESS.md`](../DOCUMENTATION_FITNESS.md) records semantic completeness and stale/current findings across the graph. -If these artifacts disagree about what is currently implemented, protected-main source, executable tests, built/released artifacts, configuration/migrations, and protected-main operational evidence appropriate to the claim define implementation truth. Accepted ADRs explain the governing design decision and expected boundary; they do not upgrade missing behavior into shipped behavior. The disagreement is a documentation or implementation defect that must be repaired rather than silently rationalized from conversation history. +If these artifacts disagree about current implementation, protected-main source, executable tests, built/released artifacts, configuration/migrations, and protected-main operational evidence appropriate to the claim define implementation truth. Accepted ADRs explain governing design decisions; they do not upgrade missing behavior into shipped behavior. The disagreement is a documentation or implementation defect that must be repaired rather than silently rationalized from conversation history. \ No newline at end of file From ba527a82f748b3e52c675e2726e3139908c3234b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:40:53 +0900 Subject: [PATCH 003/130] docs: add semantic documentation fitness assessment --- docs/DOCUMENTATION_FITNESS.md | 159 ++++++++++++++++++++++++++++++++++ 1 file changed, 159 insertions(+) create mode 100644 docs/DOCUMENTATION_FITNESS.md diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md new file mode 100644 index 00000000..f5524790 --- /dev/null +++ b/docs/DOCUMENTATION_FITNESS.md @@ -0,0 +1,159 @@ +# OriginWeave Documentation Fitness Assessment + +- **Assessment date:** 2026-08-10 +- **Assessment scope:** protected `main`, current open OriginWeave work, and durable product decisions that must be reconstructable without chat history +- **Assessment type:** semantic fitness, not file-presence inventory +- **Current verdict:** **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL** + +## 1. Meaning of the verdict + +**DESIGN-SUFFICIENT** means the repository now contains enough coherent product, technical, architecture, decision, diagram, data-model, security, testing, operability, protocol and release material to implement and review OriginWeave without reconstructing the original design from conversation history. + +**PROTECTED-MAIN-PARTIAL** means the canonical graph still contains stale implementation-status references and incomplete current-state reconciliation. The documentation set is broad enough, but several documents lag protected-main code and active replacement work. Therefore documentation is not yet a release-quality source of current implementation truth. + +File existence alone is never sufficient. A document can be present and still be stale, contradictory, overclaiming, underclaiming, or disconnected from code and evidence. + +## 2. Fitness matrix + +| Documentation family | Fitness | Evidence / current gap | +|---|---|---| +| PRD | **PARTIAL** | Strong whole-product requirements, modes, product family and buyer outcomes. Some implementation notes are stale: HTTP still points at historical PR #11 rather than the current replacement line; sensitive-data policy text still refers to work that has since integrated on protected main; recent real MV3 compatibility evidence is underrepresented. | +| TRD | **PARTIAL** | Strong authority stack, lifecycle, action, observation, network, secret and resource contracts. Current implementation inventory lags protected-main additions and uses composite phrases such as `Planned / active development` even though the document defines a single controlled status vocabulary. | +| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium-compatibility-kernel + Rust-control-plane direction and explicit authority layers. Must continue to be reconciled when the browser registry, HTTP replacement and Chromium vertical slice integrate. | +| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Previous index omitted Accepted ADRs 0007, 0008 and 0010, omitted Proposed ADR 0009, and described 0100-series ADRs as being `in this change` even after the documentation baseline reached protected main. This branch reconciles discoverability and status categories without promoting Proposed ADRs. | +| Individual ADRs | **PARTIAL** | Core Accepted decisions 0001-0008 and 0010 are durable. Proposed 0009 and 0100-0109 remain explicitly Proposed. HTTP feature ADRs remain active-PR evidence until the replacement merges. A dedicated accepted extension/MV3 authority decision is still required before closing the extension compatibility issue. | +| UML / control-flow diagrams | **PARTIAL** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill and approval flows exist. Missing or incomplete whole-product views include explicit extension-permission-to-agent-capability sequence, resource-pressure/GPU fallback flow, and hourly deterministic-gate -> optional-model -> independent publication/acceptance flow. | +| Conceptual ERD/domain model | **PRESENT-CURRENT with follow-up** | Correctly distinguishes conceptual persistence and includes session/context, action/policy/approval, network/TLS/HTTP, sensitive authority, resources, provenance, downloads and extension grants. Must be updated only when persistence ownership or new durable entities actually change; do not invent a database merely to increase diagram count. | +| Traceability | **PARTIAL** | Requirement/decision/standard/module/test mapping exists but must be reconciled with protected-main MV3 evidence, the HTTP replacement, browser registry work and issue-driven buyer gaps. Active PRs must remain visibly distinct from protected-main implementation. | +| Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, secret, network, provenance and extension risks. Continue adding executable mitigations when HTTP/browser/runtime boundaries integrate. | +| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code coverage, rustdoc and realistic boundary testing are explicit. Real Chromium and MV3 compatibility evidence is now growing and must remain release-bound to pinned browser evidence. | +| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. Protected-main evidence for the hourly model-backed development path remains an operational closure requirement rather than a documentation-only claim. | +| API / protocol contract | **PRESENT-CURRENT as target contract** | The typed OriginWeave Protocol boundary is documented but much of the browser adapter implementation remains Planned. Keep adapter identifiers non-authoritative and versioned. | +| Release / rollback / provenance | **PRESENT-CURRENT** | Correctly prevents feature-level green checks from becoming release readiness. Formal release remains blocked by missing full browser/runtime product evidence. | +| Data governance / PII | **PRESENT-CURRENT as architecture; PARTIAL implementation** | Correctly rejects blanket masking and ambient raw propagation in favor of purpose-bound authorization, opaque handles, encryption, retention and audit. Trusted broker/storage/lifecycle completion remains open work. | +| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary standards and APA 7 doctoring exist. Experimental/draft browser interfaces must remain explicitly separated from final normative standards. | + +## 3. Concrete stale/current discrepancies discovered + +### 3.1 Historical HTTP PR is still named as active product evidence + +Protected-main PRD currently describes bounded HTTP semantics as Planned with `Active PR #11`. PR #11 is historical and intentionally non-integration-ready; current executable replacement work is PR #37. Canonical requirements must not use the historical PR as current implementation evidence after replacement lineage is established. + +**Required repair:** after the current HTTP replacement reaches a stable exact head or protected main, update PRD/TRD/traceability to point to the current lineage and then to protected-main implementation. Never transfer predecessor checks or reviews. + +### 3.2 Sensitive-data implementation status lags protected main + +Protected main has integrated purpose-bound sensitive disclosure foundations, while PRD/TRD still contain `active PR` language for the policy slice. The broader trusted broker, storage, selective model disclosure, revocation and lifecycle issue remains open, so the correct representation is **implemented policy foundation + planned broker/runtime**, not either `all shipped` or `all planned`. + +### 3.3 MV3 compatibility evidence has moved beyond the original roadmap language + +Protected main now has executable pinned-Chromium MV3 evidence covering restart persistence and additional core extension APIs, including bookmarks and history. Issue #27 remains open because the complete declared compatibility matrix, downloads/native-messaging/enterprise-policy boundaries and release integration are not finished. + +**Required repair:** PRD/TRD/traceability should say **partial protected-main compatibility evidence**, while keeping the full product-surface requirement Planned/Open until the issue acceptance criteria are met. + +### 3.4 Browser authority is transitioning from value types to an adapter registry + +Protected main already contains session/context/document/node authority foundations. PR #40 is adding the bounded session-scoped registry that prevents raw BiDi/CDP identifiers from becoming durable OriginWeave authority. The architecture and ERD are directionally correct, but PRD/TRD/UML must be reconciled after that branch reaches a stable integration state. + +### 3.5 ADR lifecycle discoverability had drifted + +The previous ADR index listed only 0001-0006 as current protected-main decisions even though Accepted ADRs 0007, 0008 and 0010 were present on protected main. Proposed ADR 0009 was also absent from both accepted and proposed tables. This created an architecture-discovery defect. The current documentation branch repairs the index while preserving each ADR's own Accepted/Proposed status. + +## 4. Durable conversation decisions that must remain represented + +The following product decisions are durable architecture input and may not live only in chat, scheduler prompts, PR bodies, or implementation plans: + +1. **OriginWeave — Browse. Act. Prove.** is an enterprise agentic web runtime/provenance-native browser platform, not merely a Selenium-style automation library. +2. Chromium remains the compatibility kernel; OriginWeave does not reimplement Blink or V8 for product differentiation. +3. Rust owns new authority-bearing control-plane semantics and remains independently reusable in headless/MSA composition. +4. Human, Assist, Agent Task and Crawler modes have distinct profile/authority semantics. +5. Agent Task Mode must not ambiently inherit a normal human browser profile. +6. Page, extension and WebMCP content are untrusted observations, never policy or goal authority. +7. Structured observation precedes raw HTML and screenshot-only interpretation. +8. Typed actions and observed post-conditions replace arbitrary JavaScript and command-return-as-success. +9. Logical origin, destination, route/proxy, TCP peer, TLS identity and HTTP semantics are separate authorities. +10. Session/context/document epoch/node identity is separate from raw BiDi/CDP identifiers. +11. Extension permissions are not Agent capabilities; Manifest V3 compatibility and Agent authority isolation are tested separately. +12. Raw secrets stay out of model-visible context; sensitive values use purpose-bound disclosure and opaque handles wherever possible. +13. Browser correctness and human interaction outrank optional local-model throughput under resource pressure. +14. Provenance separates source observation, model judgement, policy decision, approval, action and verified outcome; WARC/PROV remain adapters, not collapsed truth. +15. WebDriver BiDi, CDP, WebMCP and MCP remain versioned adapters; no experimental protocol becomes OriginWeave authority by itself. +16. The first product proof is a pinned-stock-Chromium vertical slice before a large Chromium fork. +17. High-risk actions remain approval-bound; Crawler Mode is read-only and does not include CAPTCHA/block-evasion features. +18. Autonomous development uses NVIDIA NIM/OpenCode with deterministic gates and reviewer/publication authority separation; it does not use `COPILOT_GITHUB_TOKEN` as the development-model credential. +19. Documentation, checks, reviews and operational evidence are separate authorities. A green sub-check, model verdict, active PR, chat decision or ADR never silently upgrades missing implementation to shipped behavior. +20. Work-conserving autonomous maintenance continues to another safe lane instead of ending on one merge, one document, one RCA, one queued check or one external approval gap. + +## 5. Missing or incomplete architecture views to add when their executable boundaries stabilize + +### 5.1 Extension authority and compatibility sequence + +Show separately: + +```text +Chromium MV3 permission +-> extension runtime +-> untrusted extension observation/message +-> OriginWeave extension policy/grant +-> Agent capability decision +-> typed action proposal +-> deterministic policy +``` + +The diagram must make it impossible to read Chrome permission as automatic Agent authority. + +### 5.2 Resource-pressure state/sequence + +Show browser/compositor priority, task resource snapshot, soft/hard RAM/VRAM pressure, batch shrink, CPU offload, evidence-cache spill, current-agent pause and new-work rejection as cumulative mitigations. + +### 5.3 Hourly autonomous-development authority flow + +Show deterministic early gates before model-secret materialization, unprivileged model workspace, loopback credential broker, bounded patch validation, credential-free independent verification, publication-only authority, central review separation and protected-main operational acceptance. + +### 5.4 Real Chromium vertical slice + +Once issue #28 begins integrating, diagram and trace: + +```text +isolated profile/context +-> BiDi/CDP adapter +-> OriginWeave registry +-> semantic observation +-> opaque node authority +-> typed policy decision +-> real browser input +-> observed post-condition +-> credential-safe evidence +-> teardown/recovery +``` + +## 6. Immediate repository actions + +### Execute now + +- Keep this fitness assessment discoverable from `docs/README.md`. +- Reconcile the ADR index with every protected-main ADR and its own status. +- Add machine-checkable documentation fitness contracts so ADR discoverability/status drift is caught automatically. +- Continue the existing HTTP replacement, browser-registry and MV3 compatibility work without using documentation as a reason to stop. + +### Defer to stable implementation state + +- Replace historical/current PR references in PRD/TRD/traceability immediately after the relevant active branch reaches a stable exact head or protected merge, so documentation does not race source writers. +- Add detailed new UML views when their executable contracts are stable enough that the diagrams will not encode temporary protocol/field names. +- Promote Proposed ADRs only through an explicit reviewed status change; do not infer Acceptance from file presence on `main`. + +## 7. Completion criteria for documentation fitness + +The whole documentation graph becomes **PROTECTED-MAIN-SUFFICIENT** only when: + +1. PRD and TRD implementation inventories agree with current protected-main crates, APIs and executable browser/extension evidence; +2. no canonical document identifies a superseded/historical PR as current active implementation evidence; +3. the ADR index discovers every ADR and its status agrees with the file metadata; +4. UML covers all current material authority flows, including extension/Agent isolation and operational automation once implemented; +5. ERD/domain models accurately distinguish conceptual, in-memory, persisted, adapter-owned and external entities; +6. traceability maps every material requirement and Accepted decision to current implementation/test/evidence or an explicit open issue; +7. machine-checkable documentation tests catch stale status/index/link/ownership terminology; +8. security, test, operability, data-governance and release docs agree with the same shipped-vs-planned boundary; and +9. protected-main checks/review/governance for the documentation reconciliation itself pass. + +Until then, OriginWeave is **design-documented but not documentation-closed**. That is a product-quality finding, not a release blocker that prevents unrelated safe implementation work. \ No newline at end of file From acf7ce0df4663799bc4ba29eec8a70ac73bd2aae Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:41:30 +0900 Subject: [PATCH 004/130] test: enforce documentation fitness discoverability --- tests/test_documentation_fitness_contract.py | 98 ++++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 tests/test_documentation_fitness_contract.py diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py new file mode 100644 index 00000000..2a770124 --- /dev/null +++ b/tests/test_documentation_fitness_contract.py @@ -0,0 +1,98 @@ +"""Regression contracts for the authoritative OriginWeave documentation graph.""" + +from pathlib import Path +import re +import unittest + + +REPOSITORY_ROOT = Path(__file__).resolve().parents[1] +DOCS_ROOT = REPOSITORY_ROOT / "docs" +ADR_ROOT = DOCS_ROOT / "adr" + + +class DocumentationFitnessContractTests(unittest.TestCase): + """Keep architecture discovery and ADR lifecycle metadata coherent.""" + + def test_documentation_index_links_fitness_assessment(self) -> None: + """The semantic fitness audit must remain discoverable from the docs index.""" + index = (DOCS_ROOT / "README.md").read_text(encoding="utf-8") + self.assertIn("[Documentation fitness assessment](DOCUMENTATION_FITNESS.md)", index) + self.assertTrue((DOCS_ROOT / "DOCUMENTATION_FITNESS.md").is_file()) + + def test_documentation_fitness_distinguishes_design_from_protected_main(self) -> None: + """A broad design pack must not be mislabeled as code-current closure.""" + assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") + self.assertIn("DESIGN-SUFFICIENT", assessment) + self.assertIn("PROTECTED-MAIN-PARTIAL", assessment) + self.assertIn("File existence alone is never sufficient", assessment) + self.assertIn("Historical HTTP PR", assessment) + self.assertIn("MV3 compatibility evidence", assessment) + self.assertIn("Browser authority", assessment) + + def test_accepted_protected_main_adrs_are_discoverable(self) -> None: + """Accepted protected-main ADRs must appear in both documentation indexes.""" + docs_index = (DOCS_ROOT / "README.md").read_text(encoding="utf-8") + adr_index = (ADR_ROOT / "README.md").read_text(encoding="utf-8") + accepted_paths = [ + "0001-chromium-compatibility-kernel.md", + "0002-agent-safety-kernel.md", + "0003-provenance-native-observation.md", + "0004-resolved-destination-policy.md", + "0005-direct-socket-binding.md", + "0006-tls-server-identity.md", + "0007-purpose-bound-sensitive-data-authority.md", + "0008-leaf-validity-horizon.md", + "0010-session-context-bound-node-authority.md", + ] + for path in accepted_paths: + with self.subTest(path=path): + self.assertTrue((ADR_ROOT / path).is_file()) + self.assertIn(path, docs_index) + self.assertIn(path, adr_index) + + def test_proposed_protected_main_adrs_are_discoverable_without_promotion(self) -> None: + """Proposed ADR files may be on main but must remain visibly Proposed.""" + docs_index = (DOCS_ROOT / "README.md").read_text(encoding="utf-8") + adr_index = (ADR_ROOT / "README.md").read_text(encoding="utf-8") + proposed_paths = [ + "0009-hourly-agent-credential-boundary.md", + "0100-rust-control-plane-boundary.md", + "0101-isolated-execution-profile-modes.md", + "0102-typed-actions-and-arbitrary-js.md", + "0103-semantic-observation-and-stale-node-identity.md", + "0104-prompt-injection-and-secret-authority.md", + "0105-resource-governor-priority.md", + "0106-provenance-evidence-model.md", + "0107-browser-protocol-adapter-strategy.md", + "0108-crawler-policy.md", + "0109-hourly-automation-operational-closure.md", + ] + for path in proposed_paths: + with self.subTest(path=path): + file_text = (ADR_ROOT / path).read_text(encoding="utf-8") + self.assertRegex(file_text, r"(?im)^- \*\*Status:\*\* Proposed|^- Status: Proposed") + self.assertIn(path, docs_index) + self.assertIn(path, adr_index) + + def test_adr_index_does_not_use_change_local_language_as_timeless_authority(self) -> None: + """The protected-main ADR index must not describe its ADRs as only `this change`.""" + adr_index = (ADR_ROOT / "README.md").read_text(encoding="utf-8") + self.assertNotIn("Proposed target-architecture decisions in this change", adr_index) + self.assertIn("Index completeness rule", adr_index) + + def test_fitness_audit_tracks_current_replacement_and_buyer_gap_lanes(self) -> None: + """The dated audit must identify the current implementation lanes it evaluated.""" + assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") + for marker in ("PR #37", "PR #40", "Issue #27", "issue #28"): + with self.subTest(marker=marker): + self.assertIn(marker, assessment) + + def test_documentation_index_has_no_duplicate_adr_links(self) -> None: + """Each ADR target should have one index entry per section, not duplicate drift.""" + docs_index = (DOCS_ROOT / "README.md").read_text(encoding="utf-8") + targets = re.findall(r"\(adr/(\d{4}[-\w]*\.md)\)", docs_index) + self.assertEqual(len(targets), len(set(targets))) + + +if __name__ == "__main__": + unittest.main() From b8ef1a3e4d1a9515946dfde462ebb9ea715f1bcf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:48:58 +0900 Subject: [PATCH 005/130] docs: model extension and agent authority separation --- docs/uml/extension-authority.md | 105 ++++++++++++++++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 docs/uml/extension-authority.md diff --git a/docs/uml/extension-authority.md b/docs/uml/extension-authority.md new file mode 100644 index 00000000..e228e84d --- /dev/null +++ b/docs/uml/extension-authority.md @@ -0,0 +1,105 @@ +# Extension Compatibility and Agent Authority UML + +- **Status:** Protected-main architecture visualization with active compatibility work +- **Scope:** Chromium Manifest V3 compatibility plane versus OriginWeave Agent authority +- **Related:** [`README.md`](README.md), [`../PRD.md`](../PRD.md), [`../TRD.md`](../TRD.md), [`../THREAT_MODEL.md`](../THREAT_MODEL.md), issue #27 + +This diagram makes one security invariant visually explicit: + +> **A Chromium extension permission is not an OriginWeave Agent capability.** + +A compatible extension can use the Chromium APIs granted by its manifest and managed browser policy. It cannot thereby grant itself OriginWeave task authority, widen an Agent Task origin, resolve a protected secret, approve a high-risk action, or turn extension/page content into a trusted instruction. + +## Authority sequence + +```mermaid +sequenceDiagram + autonumber + participant Admin as Human / Enterprise Policy + participant Chrome as Chromium MV3 Runtime + participant Ext as Extension Worker / Content Script + participant Observe as OriginWeave Observation Adapter + participant Grant as OriginWeave Extension Grant Policy + participant Agent as Agent Task / Planner + participant Policy as Deterministic Action Policy + participant Broker as Secret / Sensitive Broker + participant Browser as Trusted Browser Adapter + participant Evidence as Evidence Trail + + Admin->>Chrome: install/enable extension under Chromium policy + Chrome-->>Ext: expose manifest-granted Chrome APIs + Note over Chrome,Ext: Chrome permission is compatibility authority only. + + Ext-->>Observe: extension message / page mutation / tool output + Observe-->>Agent: bounded untrusted observation + provenance + Note over Ext,Agent: Extension content cannot become trusted goal or policy. + + Admin->>Grant: issue explicit OriginWeave extension grant for bounded session/context/capability/origin + Ext->>Grant: request OriginWeave interaction + Grant->>Grant: verify extension identity, managed policy, session/context, capability, origin, expiry + + alt no valid OriginWeave grant + Grant-->>Ext: deny + Grant-->>Evidence: denial without sensitive value + else valid grant + Grant-->>Agent: bounded extension-originated proposal/evidence + Agent->>Policy: propose typed action under existing Agent Task authority + Policy->>Policy: revalidate task, action, risk, origin, approval and current browser authority + alt action requires secret/sensitive value + Policy->>Broker: authorize exact opaque handle use + Broker->>Broker: revalidate tenant/task/field/purpose/destination/expiry + Broker-->>Browser: minimum trusted value delivery + end + Policy-->>Browser: authorized typed action + Browser->>Browser: verify session/context/document epoch immediately before dispatch + Browser-->>Evidence: action result + observed post-condition + end +``` + +## Security state flow + +```mermaid +flowchart TD + manifest[Manifest V3 permissions] --> chromium[Chromium extension authority] + chromium --> extension[Extension runtime] + extension --> untrusted[Untrusted observation / message] + untrusted --> grant{Explicit OriginWeave extension grant?} + grant -- no --> deny[Deny Agent-control request] + grant -- yes --> scoped[Bind extension identity + session + context + origin + capability + expiry] + scoped --> proposal[Typed Agent action proposal] + proposal --> policy{Agent Task policy passes?} + policy -- no --> deny + policy -- yes --> approval{Risk-specific approval required?} + approval -- missing/invalid --> deny + approval -- no or valid --> execute[Trusted browser adapter executes] + execute --> verify{Observed post-condition matches?} + verify -- no --> fail[Fail / quarantine] + verify -- yes --> evidence[Credential-safe evidence] + + extension -. cannot mint .-> scoped + extension -. cannot approve .-> approval + extension -. cannot resolve .-> secret[Protected secret / sensitive value] + secret --> execute +``` + +## Compatibility evidence is separate from authority evidence + +```mermaid +flowchart LR + pinned[Pinned Chromium revision] --> fixture[Controlled MV3 fixture suite] + fixture --> compat[Compatibility evidence] + compat --> matrix[Published supported-capability matrix] + + policycode[OriginWeave extension policy] --> isolation[Agent-authority isolation evidence] + isolation --> release[Release acceptance] + matrix --> release + + compat -. does not prove .-> isolation + isolation -. does not prove .-> compat +``` + +The release claim requires both evidence classes. A passing `downloads`, `bookmarks`, `history`, storage, service-worker, DNR, or content-script compatibility test does not prove extension isolation. Conversely, a correct Rust extension-grant kernel does not prove that a real Chromium extension API works. + +## Maturity discipline + +Protected main already contains extension-to-Agent authority foundations and pinned-Chromium MV3 compatibility evidence for several surfaces. Issue #27 remains open because the complete declared capability matrix, remaining compatibility surfaces, managed/native-messaging boundaries and release integration are not yet complete. This diagram therefore represents a mixture of implemented foundations and accepted/planned product flow; it must not be read as a claim of full Chrome extension compatibility. From e0f3642c7fea67eb6da5a39b09477823037332be Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:49:40 +0900 Subject: [PATCH 006/130] docs: correct UML fitness against protected main --- docs/DOCUMENTATION_FITNESS.md | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index f5524790..a4b67c01 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -22,7 +22,7 @@ File existence alone is never sufficient. A document can be present and still be | Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium-compatibility-kernel + Rust-control-plane direction and explicit authority layers. Must continue to be reconciled when the browser registry, HTTP replacement and Chromium vertical slice integrate. | | ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Previous index omitted Accepted ADRs 0007, 0008 and 0010, omitted Proposed ADR 0009, and described 0100-series ADRs as being `in this change` even after the documentation baseline reached protected main. This branch reconciles discoverability and status categories without promoting Proposed ADRs. | | Individual ADRs | **PARTIAL** | Core Accepted decisions 0001-0008 and 0010 are durable. Proposed 0009 and 0100-0109 remain explicitly Proposed. HTTP feature ADRs remain active-PR evidence until the replacement merges. A dedicated accepted extension/MV3 authority decision is still required before closing the extension compatibility issue. | -| UML / control-flow diagrams | **PARTIAL** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill and approval flows exist. Missing or incomplete whole-product views include explicit extension-permission-to-agent-capability sequence, resource-pressure/GPU fallback flow, and hourly deterministic-gate -> optional-model -> independent publication/acceptance flow. | +| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | The product-wide pack already contains component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly deterministic-gate/model/publication flows. This branch adds [`uml/extension-authority.md`](uml/extension-authority.md) so Chromium MV3 permission and OriginWeave Agent capability cannot be visually conflated. The real Chromium vertical-slice sequence remains incomplete until issue #28 stabilizes. | | Conceptual ERD/domain model | **PRESENT-CURRENT with follow-up** | Correctly distinguishes conceptual persistence and includes session/context, action/policy/approval, network/TLS/HTTP, sensitive authority, resources, provenance, downloads and extension grants. Must be updated only when persistence ownership or new durable entities actually change; do not invent a database merely to increase diagram count. | | Traceability | **PARTIAL** | Requirement/decision/standard/module/test mapping exists but must be reconciled with protected-main MV3 evidence, the HTTP replacement, browser registry work and issue-driven buyer gaps. Active PRs must remain visibly distinct from protected-main implementation. | | Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, secret, network, provenance and extension risks. Continue adding executable mitigations when HTTP/browser/runtime boundaries integrate. | @@ -59,6 +59,10 @@ Protected main already contains session/context/document/node authority foundati The previous ADR index listed only 0001-0006 as current protected-main decisions even though Accepted ADRs 0007, 0008 and 0010 were present on protected main. Proposed ADR 0009 was also absent from both accepted and proposed tables. This created an architecture-discovery defect. The current documentation branch repairs the index while preserving each ADR's own Accepted/Proposed status. +### 3.6 UML assessment itself was initially stale + +The first pass of this assessment incorrectly called resource-pressure and hourly automation flows missing. A direct re-read of protected-main `docs/uml/README.md` showed both already exist. This branch corrects the matrix instead of preserving the mistaken audit claim, and adds only the genuinely missing extension-permission-to-Agent-authority view. + ## 4. Durable conversation decisions that must remain represented The following product decisions are durable architecture input and may not live only in chat, scheduler prompts, PR bodies, or implementation plans: @@ -84,11 +88,11 @@ The following product decisions are durable architecture input and may not live 19. Documentation, checks, reviews and operational evidence are separate authorities. A green sub-check, model verdict, active PR, chat decision or ADR never silently upgrades missing implementation to shipped behavior. 20. Work-conserving autonomous maintenance continues to another safe lane instead of ending on one merge, one document, one RCA, one queued check or one external approval gap. -## 5. Missing or incomplete architecture views to add when their executable boundaries stabilize +## 5. Architecture views requiring follow-through -### 5.1 Extension authority and compatibility sequence +### 5.1 Extension authority and compatibility sequence — added in this branch -Show separately: +[`uml/extension-authority.md`](uml/extension-authority.md) now separates: ```text Chromium MV3 permission @@ -100,17 +104,17 @@ Chromium MV3 permission -> deterministic policy ``` -The diagram must make it impossible to read Chrome permission as automatic Agent authority. +It also separates **compatibility evidence** from **Agent-authority isolation evidence**: neither evidence class proves the other. -### 5.2 Resource-pressure state/sequence +### 5.2 Resource-pressure state/sequence — already present -Show browser/compositor priority, task resource snapshot, soft/hard RAM/VRAM pressure, batch shrink, CPU offload, evidence-cache spill, current-agent pause and new-work rejection as cumulative mitigations. +Protected-main `docs/uml/README.md` already models browser/model resource pressure and fallback. Future edits should refine it only when the platform telemetry/admission implementation changes, rather than creating a duplicate diagram merely to satisfy a checklist. -### 5.3 Hourly autonomous-development authority flow +### 5.3 Hourly autonomous-development authority flow — already present -Show deterministic early gates before model-secret materialization, unprivileged model workspace, loopback credential broker, bounded patch validation, credential-free independent verification, publication-only authority, central review separation and protected-main operational acceptance. +Protected-main `docs/uml/README.md` already models deterministic early gates, conditional model-credential use, pristine attempts, bounded validation, publication authority, protected merge and protected-main operational acceptance. Its implementation/evidence status must continue to be reconciled against the actual workflow rather than inferred from the diagram. -### 5.4 Real Chromium vertical slice +### 5.4 Real Chromium vertical slice — incomplete until issue #28 stabilizes Once issue #28 begins integrating, diagram and trace: @@ -134,12 +138,13 @@ isolated profile/context - Keep this fitness assessment discoverable from `docs/README.md`. - Reconcile the ADR index with every protected-main ADR and its own status. - Add machine-checkable documentation fitness contracts so ADR discoverability/status drift is caught automatically. +- Add the missing extension-permission-to-Agent-authority UML without duplicating already-present resource/automation views. - Continue the existing HTTP replacement, browser-registry and MV3 compatibility work without using documentation as a reason to stop. ### Defer to stable implementation state - Replace historical/current PR references in PRD/TRD/traceability immediately after the relevant active branch reaches a stable exact head or protected merge, so documentation does not race source writers. -- Add detailed new UML views when their executable contracts are stable enough that the diagrams will not encode temporary protocol/field names. +- Add the detailed real-Chromium vertical-slice UML when its executable contracts are stable enough that the diagram will not encode temporary protocol/field names. - Promote Proposed ADRs only through an explicit reviewed status change; do not infer Acceptance from file presence on `main`. ## 7. Completion criteria for documentation fitness @@ -149,7 +154,7 @@ The whole documentation graph becomes **PROTECTED-MAIN-SUFFICIENT** only when: 1. PRD and TRD implementation inventories agree with current protected-main crates, APIs and executable browser/extension evidence; 2. no canonical document identifies a superseded/historical PR as current active implementation evidence; 3. the ADR index discovers every ADR and its status agrees with the file metadata; -4. UML covers all current material authority flows, including extension/Agent isolation and operational automation once implemented; +4. UML covers all current material authority flows, including extension/Agent isolation and the real Chromium vertical slice once implemented; 5. ERD/domain models accurately distinguish conceptual, in-memory, persisted, adapter-owned and external entities; 6. traceability maps every material requirement and Accepted decision to current implementation/test/evidence or an explicit open issue; 7. machine-checkable documentation tests catch stale status/index/link/ownership terminology; From 3eccb939ca218dd7bbe697640613f3125401ca88 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:50:15 +0900 Subject: [PATCH 007/130] test: enforce extension authority UML fitness --- tests/test_documentation_fitness_contract.py | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index 2a770124..9331e468 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -8,6 +8,7 @@ REPOSITORY_ROOT = Path(__file__).resolve().parents[1] DOCS_ROOT = REPOSITORY_ROOT / "docs" ADR_ROOT = DOCS_ROOT / "adr" +UML_ROOT = DOCS_ROOT / "uml" class DocumentationFitnessContractTests(unittest.TestCase): @@ -87,6 +88,25 @@ def test_fitness_audit_tracks_current_replacement_and_buyer_gap_lanes(self) -> N with self.subTest(marker=marker): self.assertIn(marker, assessment) + def test_extension_authority_uml_separates_compatibility_from_agent_authority(self) -> None: + """A Chrome permission must never be documented as an Agent capability.""" + diagram = (UML_ROOT / "extension-authority.md").read_text(encoding="utf-8") + self.assertIn("A Chromium extension permission is not an OriginWeave Agent capability", diagram) + self.assertIn("Compatibility evidence is separate from authority evidence", diagram) + self.assertIn("sequenceDiagram", diagram) + self.assertIn("OriginWeave Extension Grant Policy", diagram) + self.assertIn("cannot approve", diagram) + self.assertIn("cannot resolve", diagram) + + def test_fitness_audit_does_not_duplicate_existing_resource_or_hourly_uml(self) -> None: + """The audit must recognize existing product-wide resource and automation diagrams.""" + assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") + uml_index = (UML_ROOT / "README.md").read_text(encoding="utf-8") + self.assertIn("Resource-pressure state/sequence — already present", assessment) + self.assertIn("Hourly autonomous-development authority flow — already present", assessment) + self.assertIn("## 9. Resource-pressure and fallback flow", uml_index) + self.assertIn("## 10. Hourly product-development gate-to-model flow", uml_index) + def test_documentation_index_has_no_duplicate_adr_links(self) -> None: """Each ADR target should have one index entry per section, not duplicate drift.""" docs_index = (DOCS_ROOT / "README.md").read_text(encoding="utf-8") From 19df570c813d9d2e6345081fd8ce1ecc30c65aed Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 10:50:52 +0900 Subject: [PATCH 008/130] docs: expose extension authority UML --- docs/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/README.md b/docs/README.md index 4cae2fe0..c26e957e 100644 --- a/docs/README.md +++ b/docs/README.md @@ -7,6 +7,7 @@ - [Architecture](../ARCHITECTURE.md) - [Architecture Decision Record index](adr/README.md) - [UML and control-flow diagrams](uml/README.md) + - [Extension compatibility and Agent authority UML](uml/extension-authority.md) - [Conceptual ERD and durable domain model](erd/README.md) - [Data governance and privacy boundary](DATA_GOVERNANCE.md) - [Product and decision traceability](traceability/README.md) From 651a030f8e8d2b03b5e3991acd2f09ad0c5b4855 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:03:40 +0900 Subject: [PATCH 009/130] test: derive ADR index completeness from repository files --- tests/test_documentation_fitness_contract.py | 128 +++++++++++-------- 1 file changed, 78 insertions(+), 50 deletions(-) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index 9331e468..a55a4b92 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -10,6 +10,70 @@ ADR_ROOT = DOCS_ROOT / "adr" UML_ROOT = DOCS_ROOT / "uml" +ADR_STATUSES = {"Proposed", "Accepted", "Superseded", "Deprecated", "Rejected"} + + +def _adr_files() -> set[str]: + """Return every numbered ADR Markdown file currently tracked by the repository.""" + return { + path.name + for path in ADR_ROOT.glob("[0-9][0-9][0-9][0-9]-*.md") + if path.is_file() + } + + +def _adr_file_status(path: Path) -> str: + """Read one ADR's explicit lifecycle status from its metadata header.""" + text = path.read_text(encoding="utf-8") + match = re.search(r"(?im)^-\s+(?:\*\*)?Status(?:\*\*)?:\s*(\w+)\s*$", text) + if match is None: + raise AssertionError(f"ADR has no parseable status: {path.name}") + status = match.group(1) + if status not in ADR_STATUSES: + raise AssertionError(f"ADR has unsupported status {status!r}: {path.name}") + return status + + +def _insert_unique(mapping: dict[str, str], path: str, status: str, source: str) -> None: + """Insert one index target while rejecting duplicate or conflicting entries.""" + if path in mapping: + raise AssertionError(f"duplicate ADR index target {path!r} in {source}") + mapping[path] = status + + +def _parse_docs_index(text: str) -> dict[str, str]: + """Parse ADR links from the product documentation index by lifecycle section.""" + mapping: dict[str, str] = {} + current_status: str | None = None + for line in text.splitlines(): + if line.startswith("## "): + current_status = next( + (status for status in ADR_STATUSES if line.startswith(f"## {status}")), + None, + ) + continue + target = re.search(r"\(adr/(\d{4}[-\w]*\.md)\)", line) + if target is not None: + if current_status is None: + raise AssertionError( + f"ADR link {target.group(1)!r} is outside a lifecycle-status section" + ) + _insert_unique(mapping, target.group(1), current_status, "docs/README.md") + return mapping + + +def _parse_adr_index(text: str) -> dict[str, str]: + """Parse the dedicated ADR table into an exact target-to-status mapping.""" + mapping: dict[str, str] = {} + pattern = re.compile( + r"^\|\s*\[\d{4}\]\((\d{4}[-\w]*\.md)\)\s*\|[^|]*\|\s*" + r"(Proposed|Accepted|Superseded|Deprecated|Rejected)\s*\|", + re.MULTILINE, + ) + for path, status in pattern.findall(text): + _insert_unique(mapping, path, status, "docs/adr/README.md") + return mapping + class DocumentationFitnessContractTests(unittest.TestCase): """Keep architecture discovery and ADR lifecycle metadata coherent.""" @@ -30,50 +94,20 @@ def test_documentation_fitness_distinguishes_design_from_protected_main(self) -> self.assertIn("MV3 compatibility evidence", assessment) self.assertIn("Browser authority", assessment) - def test_accepted_protected_main_adrs_are_discoverable(self) -> None: - """Accepted protected-main ADRs must appear in both documentation indexes.""" - docs_index = (DOCS_ROOT / "README.md").read_text(encoding="utf-8") - adr_index = (ADR_ROOT / "README.md").read_text(encoding="utf-8") - accepted_paths = [ - "0001-chromium-compatibility-kernel.md", - "0002-agent-safety-kernel.md", - "0003-provenance-native-observation.md", - "0004-resolved-destination-policy.md", - "0005-direct-socket-binding.md", - "0006-tls-server-identity.md", - "0007-purpose-bound-sensitive-data-authority.md", - "0008-leaf-validity-horizon.md", - "0010-session-context-bound-node-authority.md", - ] - for path in accepted_paths: - with self.subTest(path=path): - self.assertTrue((ADR_ROOT / path).is_file()) - self.assertIn(path, docs_index) - self.assertIn(path, adr_index) - - def test_proposed_protected_main_adrs_are_discoverable_without_promotion(self) -> None: - """Proposed ADR files may be on main but must remain visibly Proposed.""" - docs_index = (DOCS_ROOT / "README.md").read_text(encoding="utf-8") - adr_index = (ADR_ROOT / "README.md").read_text(encoding="utf-8") - proposed_paths = [ - "0009-hourly-agent-credential-boundary.md", - "0100-rust-control-plane-boundary.md", - "0101-isolated-execution-profile-modes.md", - "0102-typed-actions-and-arbitrary-js.md", - "0103-semantic-observation-and-stale-node-identity.md", - "0104-prompt-injection-and-secret-authority.md", - "0105-resource-governor-priority.md", - "0106-provenance-evidence-model.md", - "0107-browser-protocol-adapter-strategy.md", - "0108-crawler-policy.md", - "0109-hourly-automation-operational-closure.md", - ] - for path in proposed_paths: - with self.subTest(path=path): - file_text = (ADR_ROOT / path).read_text(encoding="utf-8") - self.assertRegex(file_text, r"(?im)^- \*\*Status:\*\* Proposed|^- Status: Proposed") - self.assertIn(path, docs_index) - self.assertIn(path, adr_index) + def test_every_adr_is_indexed_once_with_its_file_status(self) -> None: + """Both canonical indexes must exactly cover ADR files and their lifecycle status.""" + actual_files = _adr_files() + file_status = { + path: _adr_file_status(ADR_ROOT / path) + for path in sorted(actual_files) + } + docs_index = _parse_docs_index((DOCS_ROOT / "README.md").read_text(encoding="utf-8")) + adr_index = _parse_adr_index((ADR_ROOT / "README.md").read_text(encoding="utf-8")) + + self.assertEqual(set(docs_index), actual_files) + self.assertEqual(set(adr_index), actual_files) + self.assertEqual(docs_index, file_status) + self.assertEqual(adr_index, file_status) def test_adr_index_does_not_use_change_local_language_as_timeless_authority(self) -> None: """The protected-main ADR index must not describe its ADRs as only `this change`.""" @@ -107,12 +141,6 @@ def test_fitness_audit_does_not_duplicate_existing_resource_or_hourly_uml(self) self.assertIn("## 9. Resource-pressure and fallback flow", uml_index) self.assertIn("## 10. Hourly product-development gate-to-model flow", uml_index) - def test_documentation_index_has_no_duplicate_adr_links(self) -> None: - """Each ADR target should have one index entry per section, not duplicate drift.""" - docs_index = (DOCS_ROOT / "README.md").read_text(encoding="utf-8") - targets = re.findall(r"\(adr/(\d{4}[-\w]*\.md)\)", docs_index) - self.assertEqual(len(targets), len(set(targets))) - if __name__ == "__main__": unittest.main() From c3e28e97f93d3f0207883af683d53da4418e2f06 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:04:04 +0900 Subject: [PATCH 010/130] docs: align ADR 0109 title with decision record --- docs/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/README.md b/docs/README.md index c26e957e..3c3b82b8 100644 --- a/docs/README.md +++ b/docs/README.md @@ -70,6 +70,6 @@ Proposed ADRs are reviewable architecture memory, not shipped behavior and not a - [ADR 0106: Provenance evidence model](adr/0106-provenance-evidence-model.md) - [ADR 0107: Browser protocol adapter strategy](adr/0107-browser-protocol-adapter-strategy.md) - [ADR 0108: Crawler policy](adr/0108-crawler-policy.md) -- [ADR 0109: Hourly automation operational closure](adr/0109-hourly-automation-operational-closure.md) +- [ADR 0109: Hourly automation secret ordering and operational closure](adr/0109-hourly-automation-operational-closure.md) See the [ADR index](adr/README.md) for status rules, required decision structure, supersession rules, and active feature ADRs. The index and each ADR's own status metadata must agree; a PR body, chat transcript, automation prompt, or stale issue reference cannot change ADR status. \ No newline at end of file From 703c9dede3c3a3a8d8fe9ad629c10addb2573c26 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:04:38 +0900 Subject: [PATCH 011/130] docs: align ADR 0109 index title --- docs/adr/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/adr/README.md b/docs/adr/README.md index 209ab165..1a1f5be1 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -44,7 +44,7 @@ Proposed ADR files can live on protected `main` as reviewable target architectur | [0106](0106-provenance-evidence-model.md) | Provenance-native evidence model | Proposed | WARC/PROV-style evidence identities, integrity and disclosure | | [0107](0107-browser-protocol-adapter-strategy.md) | Versioned browser and agent protocol adapters | Proposed | WebDriver BiDi, CDP, WebMCP, MCP and OriginWeave Protocol boundaries | | [0108](0108-crawler-policy.md) | Policy-bound crawler mode | Proposed | robots, rate/resource policy, read-only collection and no-evasion behavior | -| [0109](0109-hourly-automation-operational-closure.md) | Hourly automation operational closure | Proposed | deterministic gates, model secret boundary, retries and protected-main proof | +| [0109](0109-hourly-automation-operational-closure.md) | Hourly automation secret ordering and operational closure | Proposed | deterministic gates, model secret boundary, retries and protected-main proof | Active feature PRs may contain additional Proposed ADRs. They are not indexed here as protected-main decisions until their files reach protected `main`. Historical PR checks, stale branch state, or chat decisions never transfer ADR acceptance across a changed head. From 71d7554d4246aa9062eb9dcf9fe3848a8ec1d8b5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:06:59 +0900 Subject: [PATCH 012/130] docs: ground browser and agent protocol boundaries --- docs/doctoring/browser-agent-protocols.md | 79 +++++++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 docs/doctoring/browser-agent-protocols.md diff --git a/docs/doctoring/browser-agent-protocols.md b/docs/doctoring/browser-agent-protocols.md new file mode 100644 index 00000000..57c3d54f --- /dev/null +++ b/docs/doctoring/browser-agent-protocols.md @@ -0,0 +1,79 @@ +# Browser and Agent Protocol Standards Evidence + +- **Reviewed:** 2026-08-10 +- **Purpose:** primary-source evidence for OriginWeave browser compatibility and adapter boundaries +- **Canonical research index:** [`../doctoring.md`](../doctoring.md) + +This addendum complements the main doctoring record. The main record already carries the WebDriver BiDi, WARC/ISO 28500 and W3C PROV-O evidence. This addendum records the current primary sources for Manifest V3, Chrome DevTools Protocol, WebMCP and Model Context Protocol so product documentation does not rely on uncited protocol names. + +## WebDriver BiDi + +The W3C publication reviewed for this baseline is the 1 June 2026 **Working Draft**, not a Recommendation. OriginWeave therefore treats BiDi as a versioned browser-automation adapter rather than product-internal authority. Raw BiDi session/context/node identifiers do not become durable OriginWeave identities. + +Primary source: World Wide Web Consortium, *WebDriver BiDi*. + +## Chrome Manifest V3 + +Chrome's current manifest documentation identifies Manifest V3 as the current extension manifest format and the supported `manifest_version` value. OriginWeave therefore tests its declared extension compatibility against a pinned real Chromium/Chrome-for-Testing build and publishes evidence by exact capability. This is a compatibility target, not a claim of universal Chrome/Web Store/Google-service/codec/DRM equivalence. + +A Chrome extension permission remains separate from an OriginWeave Agent capability. Passing MV3 compatibility tests does not prove Agent-authority isolation, and a correct extension-grant kernel does not prove a real Chrome extension API works. + +Primary source: Chrome for Developers, *Manifest file format* and *Manifest Version*. + +## Chrome DevTools Protocol + +The official CDP documentation states that tip-of-tree changes frequently and provides no backward-compatibility guarantee for capabilities it introduces. OriginWeave therefore pins the Chromium/protocol evidence used by a release and keeps CDP behind an adapter. CDP is useful for Chromium-specific Network, Accessibility, DOMSnapshot, tracing and diagnostic surfaces; it is not the durable OriginWeave authority model. + +Primary source: Chrome DevTools Protocol, *Chrome DevTools Protocol—Latest (tip-of-tree)*. + +## WebMCP + +Chrome's 2026 WebMCP documentation describes WebMCP as an experimental/proposed structured-tool surface and its security guidance explicitly discusses indirect prompt injection and `untrustedContentHint`. The reviewed Chrome material is associated with an origin-trial / intent-to-experiment path. OriginWeave may prefer a valid structured WebMCP tool over lower-level scraping when present, but WebMCP remains optional and adapter-bound. + +WebMCP tool definitions, extension-produced content and tool outputs are untrusted observations. They cannot mint OriginWeave capabilities, alter the trusted task goal, resolve secrets, or approve high-risk actions. + +Primary sources: Chrome for Developers, *WebMCP*; *WebMCP tool security*; *Agent security considerations for WebMCP*. + +## Model Context Protocol + +The Model Context Protocol project released specification version `2026-07-28` on 28 July 2026. That release moved the protocol core toward stateless request/response operation and removed the earlier protocol-session assumptions described by previous releases. OriginWeave therefore keeps durable browser state in explicit OriginWeave application handles and exposes MCP only as a high-level adapter to the Rust runtime. MCP clients or servers do not connect models directly to Chromium/CDP authority. + +Primary sources: Model Context Protocol, *2026-07-28 Specification* and the maintainers' official release announcement. + +## Provenance standards + +The main [`docs/doctoring.md`](../doctoring.md) records the stable W3C PROV-O Recommendation and ISO 28500:2017 WARC format. OriginWeave treats both as interoperability/persistence adapters around its typed evidence identities. A WARC record, PROV statement, model judgement, check result or action log is evidence of its own class; none becomes authorization merely because it is captured in a provenance format. + +## Product consequences + +1. Version adapter contracts independently from OriginWeave session/context/action/evidence types. +2. Pin exact Chromium/CDP compatibility evidence at release time. +3. Keep WebDriver BiDi's Working Draft status visible in compatibility claims. +4. Keep WebMCP experimental/optional and propagate untrusted-content semantics. +5. Keep MCP browser state application-level rather than equating protocol transport/session metadata with browser authority. +6. Test Manifest V3 compatibility and extension-to-Agent authority isolation as separate evidence classes. +7. Treat WARC/PROV as provenance representations, not policy or truth escalation. + +## References — APA 7th + +Chrome DevTools Protocol. (2026). *Chrome DevTools Protocol—Latest (tip-of-tree)*. https://chromedevtools.github.io/devtools-protocol/tot/ + +Google Chrome Developers. (n.d.). *Manifest file format*. Chrome for Developers. Retrieved August 10, 2026, from https://developer.chrome.com/docs/extensions/reference/manifest + +Google Chrome Developers. (n.d.). *Manifest Version*. Chrome for Developers. Retrieved August 10, 2026, from https://developer.chrome.com/docs/extensions/reference/manifest/manifest-version + +Google Chrome Developers. (2026). *WebMCP*. Chrome for Developers. https://developer.chrome.com/docs/ai/webmcp + +Pagnucco, J., & Klepper, A. (2026, June 9). *Agent security considerations for WebMCP*. Chrome for Developers. https://developer.chrome.com/docs/agents/security + +Pagnucco, J., & Klepper, A. (2026, June 9). *WebMCP tool security*. Chrome for Developers. https://developer.chrome.com/docs/ai/webmcp/secure-tools + +Soria Parra, D., & Delimarsky, D. (2026, July 28). *The 2026-07-28 specification*. Model Context Protocol. https://blog.modelcontextprotocol.io/posts/2026-07-28/ + +Model Context Protocol. (2026). *Model Context Protocol specification (2026-07-28)*. https://modelcontextprotocol.io/specification/2026-07-28 + +World Wide Web Consortium. (2013). *PROV-O: The PROV ontology*. https://www.w3.org/TR/prov-o/ + +World Wide Web Consortium. (2026, June 1). *WebDriver BiDi* (W3C Working Draft). https://www.w3.org/TR/2026/WD-webdriver-bidi-20260601/ + +International Organization for Standardization. (2017). *Information and documentation—WARC file format* (ISO Standard No. 28500:2017). https://www.iso.org/standard/68004.html From 6019fd57354d8493ff07d43d175985f2dc38b33d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:07:28 +0900 Subject: [PATCH 013/130] docs: expose browser protocol standards evidence --- docs/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/README.md b/docs/README.md index 3c3b82b8..ad7df926 100644 --- a/docs/README.md +++ b/docs/README.md @@ -19,6 +19,7 @@ - [Release and rollback contract](RELEASE_AND_ROLLBACK.md) - [Product roadmap](product-roadmap.md) - [Research and standards](doctoring.md) + - [Browser and Agent protocol standards evidence](doctoring/browser-agent-protocols.md) - [Current product-baseline standards addendum](doctoring/product-documentation-baseline.md) - [Quality gates](quality-gates.md) - [Security policy](../SECURITY.md) From be969675d2c1acb03c70bba08b9ffbd2e8bab944 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 11:08:32 +0900 Subject: [PATCH 014/130] docs: link documentation fitness claims to primary standards --- docs/DOCUMENTATION_FITNESS.md | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index a4b67c01..487924c6 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -31,7 +31,23 @@ File existence alone is never sufficient. A document can be present and still be | API / protocol contract | **PRESENT-CURRENT as target contract** | The typed OriginWeave Protocol boundary is documented but much of the browser adapter implementation remains Planned. Keep adapter identifiers non-authoritative and versioned. | | Release / rollback / provenance | **PRESENT-CURRENT** | Correctly prevents feature-level green checks from becoming release readiness. Formal release remains blocked by missing full browser/runtime product evidence. | | Data governance / PII | **PRESENT-CURRENT as architecture; PARTIAL implementation** | Correctly rejects blanket masking and ambient raw propagation in favor of purpose-bound authorization, opaque handles, encryption, retention and audit. Trusted broker/storage/lifecycle completion remains open work. | -| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary standards and APA 7 doctoring exist. Experimental/draft browser interfaces must remain explicitly separated from final normative standards. | +| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary standards and APA 7 doctoring exist in [`doctoring.md`](doctoring.md) and the browser/agent protocol addendum [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md). Experimental/draft browser interfaces remain explicitly separated from final normative standards. | + +### 2.1 Primary-source standards evidence used by this assessment + +The protocol names in this assessment are not free-floating design jargon. Their normative or official status is grounded in the repository doctoring and these primary sources: + +| Boundary | Primary evidence | Repository evidence rule | +|---|---|---| +| WebDriver BiDi | [W3C WebDriver BiDi, 1 June 2026 Working Draft](https://www.w3.org/TR/2026/WD-webdriver-bidi-20260601/) | [`doctoring.md`](doctoring.md) and [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md) record that it is a Working Draft and therefore remains adapter-bound. | +| Manifest V3 | [Chrome manifest format](https://developer.chrome.com/docs/extensions/reference/manifest) and [Manifest Version](https://developer.chrome.com/docs/extensions/reference/manifest/manifest-version) | The browser-protocol addendum records MV3 as the current Chrome extension baseline without claiming universal Chrome/Web Store/Google-service compatibility. | +| Chrome DevTools Protocol | [Official CDP tip-of-tree documentation](https://chromedevtools.github.io/devtools-protocol/tot/) | The official documentation says tip-of-tree changes frequently and has no backwards-compatibility guarantee; OriginWeave pins and versions the adapter. | +| WebMCP | [Chrome WebMCP](https://developer.chrome.com/docs/ai/webmcp), [WebMCP tool security](https://developer.chrome.com/docs/ai/webmcp/secure-tools), and [agent security considerations](https://developer.chrome.com/docs/agents/security) | The addendum records the origin-trial/experimental status and the untrusted-content/prompt-injection boundary. | +| Model Context Protocol | [MCP 2026-07-28 specification](https://modelcontextprotocol.io/specification/2026-07-28) and [official release announcement](https://blog.modelcontextprotocol.io/posts/2026-07-28/) | OriginWeave keeps durable browser state in application-level handles and treats MCP as a high-level adapter, not Chromium authority. | +| W3C PROV-O | [PROV-O Recommendation](https://www.w3.org/TR/prov-o/) | [`doctoring.md`](doctoring.md) records PROV as a provenance interoperability adapter, not authorization. | +| WARC | [ISO 28500:2017](https://www.iso.org/standard/68004.html) | [`doctoring.md`](doctoring.md) records WARC as evidence/payload preservation format, not a truth or permission escalation mechanism. | + +APA 7th references for all rows are recorded in the doctoring documents rather than duplicated into every architecture assessment. ## 3. Concrete stale/current discrepancies discovered @@ -139,6 +155,7 @@ isolated profile/context - Reconcile the ADR index with every protected-main ADR and its own status. - Add machine-checkable documentation fitness contracts so ADR discoverability/status drift is caught automatically. - Add the missing extension-permission-to-Agent-authority UML without duplicating already-present resource/automation views. +- Keep browser/protocol claims linked to primary evidence and APA 7 doctoring. - Continue the existing HTTP replacement, browser-registry and MV3 compatibility work without using documentation as a reason to stop. ### Defer to stable implementation state From 7b738462eee0bec5b766366bfeb7d99df8cf3e40 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:42:14 +0900 Subject: [PATCH 015/130] docs(adr): define MV3 compatibility authority boundary --- .../0011-manifest-v3-extension-authority.md | 135 ++++++++++++++++++ 1 file changed, 135 insertions(+) create mode 100644 docs/adr/0011-manifest-v3-extension-authority.md diff --git a/docs/adr/0011-manifest-v3-extension-authority.md b/docs/adr/0011-manifest-v3-extension-authority.md new file mode 100644 index 00000000..35d842f5 --- /dev/null +++ b/docs/adr/0011-manifest-v3-extension-authority.md @@ -0,0 +1,135 @@ +# ADR 0011: Manifest V3 compatibility and extension-to-Agent authority + +- **Status:** Proposed +- **Date:** 2026-08-10 +- **Supersedes:** None +- **Superseded by:** None + +## Context + +OriginWeave deliberately retains Chromium as its compatibility kernel rather than reimplementing Blink, V8, graphics, or Chrome's extension runtime. That architecture creates two distinct questions that must not be collapsed: + +1. whether a declared Manifest V3 extension capability actually works on the pinned Chromium baseline; and +2. whether an extension can influence an OriginWeave Agent Task only through explicit OriginWeave authority. + +Issue #27 requires executable compatibility evidence for declared Manifest V3 surfaces and explicit isolation between Chromium extension permissions and OriginWeave Agent capabilities. Protected main already contains partial pinned-Chromium compatibility evidence and extension-to-Agent authority foundations, while the full capability matrix, managed/native-messaging boundaries, release integration, and complete isolation acceptance remain open. + +This ADR makes the target decision reviewable without claiming that issue #27 is complete. Until this ADR is Accepted through protected-main governance, it is Proposed design authority only. + +## Decision drivers + +- Preserve Chromium extension compatibility without creating a second OriginWeave plugin ecosystem. +- Prevent Chrome extension permissions from becoming ambient Agent Task authority. +- Keep Human Mode and delegated Agent Task profile semantics distinct. +- Make compatibility claims falsifiable and bound to an exact Chromium revision and capability matrix. +- Keep extension-produced content, messages, and tool output in the untrusted-observation domain. +- Keep protected secrets and sensitive values behind their own purpose-bound broker authority. +- Support enterprise-managed extensions without granting arbitrary native-process or cross-origin capability. +- Permit safe rollback when a Chromium revision regresses a declared extension surface. + +## Assumptions and authority boundaries + +- Chromium owns Manifest V3 parsing, service workers, extension APIs, isolated worlds, enterprise extension policy, and the compatibility behavior of `//extensions`. +- OriginWeave owns Agent Task session/profile isolation, extension-to-Agent grants, task/origin/action authority, secret/sensitive-data disclosure, approval, evidence, and release claims. +- A Chromium extension permission authorizes the extension inside Chromium; it does not mint an OriginWeave capability. +- An OriginWeave `extension_grant` authorizes only the explicitly bound OriginWeave interaction. It does not change or emulate Chrome manifest permissions. +- Extension content, page mutations, messages, native-host output, and structured tool output are untrusted observations unless independently authenticated as a separate trusted administrative channel. +- Compatibility evidence and Agent-authority-isolation evidence are independent evidence classes. Neither implies the other. + +## Options considered + +### Option A — Reimplement Chrome extensions as a Rust plugin system + +Rejected. This would create a second extension ecosystem, multiply compatibility work, and move differentiation away from OriginWeave's authority/provenance control plane. + +### Option B — Let extensions inherit Agent Task authority from their Chrome permissions + +Rejected. Chrome permissions were not designed as OriginWeave task/origin/action/approval grants. Ambient inheritance would create confused-deputy, secret-disclosure, prompt-injection, and cross-origin escalation paths. + +### Option C — Disable all extensions in every OriginWeave mode + +Rejected as a product-wide rule. Agent Task Mode should default to no extensions or a managed allow-list, but Human Mode must remain compatible with ordinary Chromium extension use and enterprises may require managed extensions. + +### Option D — Retain Chromium's extension plane and add explicit OriginWeave grants + +Selected. Chromium remains the compatibility implementation while OriginWeave separately controls whether an extension may interact with Agent authority. + +## Decision + +1. **Retain Chromium Manifest V3 as the compatibility plane.** OriginWeave does not create a competing Rust extension API for product compatibility. +2. **Separate execution modes.** Human Mode may use the person's compatible extension set subject to browser/enterprise policy. Agent Task Mode defaults to no extensions or an explicit managed allow-list. Attached human-tab execution, when later supported, is labelled reduced-assurance because pre-existing extensions can influence page state. +3. **Require explicit OriginWeave extension authority.** Any extension-to-Agent interaction that can affect an Agent Task requires an `extension_grant` or equivalent typed policy decision bound at minimum to extension identity/version policy, browser session, browsing context where applicable, capability, allowed origin/resource scope, expiry, and current task. +4. **Never translate Chrome permission into Agent capability.** `tabs`, `scripting`, `downloads`, `declarativeNetRequest`, native messaging, host permissions, or managed policy do not grant OriginWeave navigation, action, approval, secret, or sensitive-data authority. +5. **Keep extension output untrusted.** Extension messages and content enter the same bounded observation/provenance path as page-controlled data. They cannot alter the trusted task goal, add tools, mint capabilities, approve high-risk actions, or weaken deterministic policy. +6. **Keep protected values brokered.** An extension never obtains raw credential or sensitive values merely because it can observe or modify a page. Any value use must pass the independent secret/sensitive-data authority immediately before trusted browser dispatch. +7. **Bound native messaging separately.** Native messaging is permitted only behind an explicit host-managed allow-list, exact extension/host identity policy, process boundary, bounded I/O, and auditable lifecycle. It is not part of the minimum compatibility claim until that executable boundary exists. +8. **Publish exact capability evidence.** Every public compatibility claim is bound to an exact Chromium revision/build and an explicit Manifest V3 capability matrix. OriginWeave does not claim universal or `100% Chrome extension compatibility`. +9. **Separate Chrome-only service claims.** Web Store distribution, Google-account services, proprietary codecs/DRM, licensing, and other Chrome-only services are not implied by Manifest V3 compatibility. +10. **Make compatibility a release gate only for declared capabilities.** A declared supported capability that regresses on the pinned release baseline blocks that release or must be removed from the published supported matrix before release. Compatibility success never substitutes for Agent-authority-isolation evidence. + +## Consequences + +### Positive + +- Buyers can distinguish a real Chromium compatibility claim from an OriginWeave security claim. +- OriginWeave can preserve mature Chromium extension behavior while keeping its differentiating authority logic in reusable Rust control-plane modules. +- Enterprise extension policy can be integrated without granting extensions ambient task authority. +- Capability regressions can be isolated to exact Chromium revisions and exact declared surfaces. + +### Costs and trade-offs + +- Release acceptance needs both browser compatibility fixtures and OriginWeave authority-isolation tests. +- Managed extension identity, update, migration, and native-host lifecycle require explicit adapters and evidence. +- Attached human-profile automation cannot offer the same assurance as an isolated Agent Task profile when arbitrary user extensions are active. + +## Failure and degraded behavior + +- If a declared MV3 fixture fails on the pinned Chromium revision, the affected capability is unsupported for that release until fixed or explicitly removed from the supported matrix. +- If extension identity, grant scope, session/context binding, origin, expiry, or task cannot be verified, the OriginWeave interaction fails closed. +- If an extension attempts to widen task origin/action authority, provide a trusted instruction, resolve a secret, or synthesize approval, the request is denied and recorded as bounded credential-free evidence. +- If native-host policy or process isolation is unavailable, native messaging remains unsupported rather than falling back to ambient process execution. +- If an Agent Task must attach to a human tab with unknown extensions, the session is marked reduced-assurance and must not silently inherit isolated-task release claims. + +## Security / privacy / governance impact + +The decision reduces confused-deputy and prompt-injection risk by preventing Chromium extension permissions from being interpreted as OriginWeave policy. Secret and sensitive-data disclosure remain purpose-bound and separate. Extension observations and compatibility diagnostics must not expose raw credentials, arbitrary local filesystem paths, unrestricted native-process output, or protected values in logs/evidence. Enterprise-managed extension policy is an input to OriginWeave policy, not a replacement for task-specific authorization. + +## Tests and acceptance evidence + +Acceptance of the complete issue #27 boundary requires realistic pinned-Chromium evidence for the declared supported matrix and separate production authority tests. At minimum the evolving suite must cover: + +- install/enable/update/restart and extension service-worker lifecycle; +- content scripts and isolated-world behavior; +- declared APIs such as storage, scripting, downloads, bookmarks, history, commands, side panel, DNR, tabs/windows, and managed policy where supported; +- restart/update persistence; +- Agent Task isolation when an extension is not granted; +- explicit managed grant success; +- denial of extension attempts to widen task origin/action authority; +- extension-produced prompt-injection/untrusted-message treatment; +- secret/sensitive-data non-disclosure; +- exact Chromium/OriginWeave build binding and repeated-run evidence; +- native messaging denial until its explicit host boundary is implemented; and +- release failure when a publicly declared capability regresses. + +Current active compatibility PRs are implementation evidence only for their unchanged exact heads; they do not make this Proposed ADR Accepted or close issue #27. + +## Migration and rollback + +No persistent database migration is introduced by this ADR. A release can roll back an affected Chromium baseline, disable a managed extension, revoke an `extension_grant`, or remove an unproven capability from the published compatibility matrix without widening authority. Rollback must preserve evidence of which exact Chromium/build/capability set was tested. + +## Open follow-ups + +- Complete issue #27's declared compatibility matrix and production extension-isolation acceptance. +- Define and test managed-extension identity/update semantics. +- Implement the native-messaging host allow-list/process boundary before claiming support. +- Integrate the first complete Agent Task browser vertical slice under issue #28. +- Reconcile PRD/TRD/traceability from protected-main evidence as each active compatibility slice integrates. +- Promote this ADR from Proposed only through explicit protected-main governance; file presence or green compatibility checks are insufficient. + +## Supersession / reversal conditions + +Supersede this ADR if Chromium replaces Manifest V3 with a materially different extension authority model, if OriginWeave intentionally drops Chromium extension compatibility, or if an accepted architecture proves a safer compatibility mechanism that preserves equivalent buyer-visible extension behavior without ambient Agent authority. Any replacement must retain explicit compatibility evidence and task-authority separation. + +## References + +Primary browser/extension/protocol evidence and APA 7 references are maintained in [`../doctoring/browser-agent-protocols.md`](../doctoring/browser-agent-protocols.md) and [`../doctoring.md`](../doctoring.md). Related governing decisions include ADR 0001 (Chromium compatibility kernel), ADR 0002 (Agent safety kernel), ADR 0007 (purpose-bound sensitive-data authority), ADR 0010 (session/context-bound node authority), ADR 0101 (isolated execution/profile modes), ADR 0104 (prompt-injection and secret authority separation), and ADR 0107 (browser protocol adapter strategy). \ No newline at end of file From cb57387d6285534793a29c19cadef05aa118fa88 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:43:03 +0900 Subject: [PATCH 016/130] docs(adr): record architecture decision governance --- .../0012-architecture-decision-governance.md | 121 ++++++++++++++++++ 1 file changed, 121 insertions(+) create mode 100644 docs/adr/0012-architecture-decision-governance.md diff --git a/docs/adr/0012-architecture-decision-governance.md b/docs/adr/0012-architecture-decision-governance.md new file mode 100644 index 00000000..4dbdaf6e --- /dev/null +++ b/docs/adr/0012-architecture-decision-governance.md @@ -0,0 +1,121 @@ +# ADR 0012: Architecture decision acceptance governance + +- **Status:** Proposed +- **Date:** 2026-08-10 +- **Supersedes:** None +- **Superseded by:** None + +## Context + +OriginWeave separates several authorities that are easy to conflate: protected-main source, executable checks, formal review, documentation, release evidence, and runtime policy. Architecture Decision Records need the same discipline. A Markdown file, issue, chat statement, automation prompt, model verdict, or PR body can propose a decision but cannot independently make it an Accepted governing decision. + +The repository's authoritative contributor contract is `AGENTS.md`, together with live GitHub rules and any explicit operationally satisfiable CWL/OriginWeave governance rule. The current contract also documents a solo-maintainer condition: an otherwise impossible independent non-author approval rule is not manufactured when fewer than two eligible independent maintainers exist, while exact-head technical/security/coverage/rustdoc/findings/live-base/branch-protection gates remain mandatory. + +A previous documentation-index revision repeated those binding governance details directly in `docs/adr/README.md`. That makes an index file appear to create governance rather than discover it. This ADR proposes a durable architecture decision for ADR acceptance and reversal semantics while keeping live `AGENTS.md` and GitHub policy authoritative until this ADR itself becomes Accepted. + +## Decision drivers + +- Prevent documentation indexes, chat, model output, or stale PR evidence from silently changing architecture authority. +- Never synthesize, impersonate, self-submit, or otherwise fabricate an approval that current policy actually requires. +- Avoid permanently blocking a solo-maintainer repository on an independent approval route that cannot operationally exist when GitHub does not require it. +- Keep exact-head technical evidence mandatory regardless of review topology. +- Make reviewer-provisioning gaps explicit and reversible when maintainer topology changes. +- Keep ADR status discoverable and machine-checkable without turning README prose into a hidden policy engine. + +## Assumptions and authority boundaries + +- Current protected-main `AGENTS.md` and live GitHub rules are authoritative for contributor actions. +- This ADR is **Proposed** until protected-main governance accepts it. It therefore documents the proposed durable rule and rationale; it does not override current `AGENTS.md` or live GitHub policy while unaccepted. +- Formal review and technical checks are separate evidence classes. Neither substitutes for the other. +- A review counts only if the governing policy at that exact time recognizes the reviewer identity and review state. +- A status or review attached to a predecessor head does not transfer to a changed exact head unless GitHub policy explicitly defines such behavior. + +## Options considered + +### Option A — Define ADR acceptance only in the ADR index README + +Rejected. An index should discover and summarize decisions, not silently create the binding governance that decides whether its own entries are Accepted. + +### Option B — Require a non-author approval unconditionally, even when no eligible reviewer exists + +Rejected. This creates a permanent governance deadlock in a genuine solo-maintainer topology and encourages unsafe pressure to invent reviewer identities or weaken the rule. + +### Option C — Let the author or automation synthesize the missing approval + +Rejected. Self-approval, impersonation, fake identities, model verdicts, reactions, status checks, or synthetic reviews cannot provide independent review evidence. + +### Option D — Bind acceptance to live protected-branch governance with an explicit solo-maintainer hold + +Selected. Live GitHub rules and current authoritative repository governance determine which review evidence is actually required. A governance rule that requires an independent reviewer must have an operationally valid reviewer path; otherwise the independent-review portion is held rather than fabricated, while all technical and safety gates remain intact. + +## Decision + +If this ADR is Accepted, OriginWeave uses the following durable architecture-decision governance: + +1. **Protected-main transition defines architecture acceptance.** An ADR is not a governing protected-main decision merely because the file exists on a feature branch, appears in an issue, is described as accepted in chat, or receives a model/check verdict. Its status metadata and the protected-main transition must agree. +2. **Live policy determines required review evidence.** When current GitHub branch/ruleset policy requires a counted approval, acceptance requires a formal `APPROVED` review from an eligible identity recognized by that policy on the unchanged head to which the rule applies. +3. **Explicit repository governance may add review requirements only when operationally satisfiable.** A stricter OriginWeave/CWL rule may require an eligible non-author reviewer, but automation must verify that a legitimate reviewer route exists before treating it as executable. +4. **No synthetic approval.** Author approval, COMMENTED reviews, reactions, model verdicts, commit statuses, predecessor-head approvals, impersonated identities, or fabricated reviewer accounts never substitute for a counted independent approval when one is required. +5. **Solo-maintainer hold is narrow.** When fewer than two eligible independent maintainers exist and live GitHub policy does not independently require a counted non-author approval, an otherwise impossible repository-level independent-review requirement is placed on hold. This does not waive exact-head CI, security, SAST, exact owned-code coverage, rustdoc, unresolved finding/thread, live-base, mergeability, branch-protection, release, or operational-evidence gates. +6. **Reviewer provisioning is a first-class governance state.** If live policy requires independent approval but no eligible reviewer route exists, the PR is blocked by a reviewer-provisioning gap. The correct remedy is legitimate reviewer/team/App provisioning or governance change by an authorized human/organization control plane, not self-approval or gate weakening. +7. **The hold reverses automatically.** Independent-review enforcement is re-enabled when two or more eligible independent maintainers exist, when live GitHub policy requires it, or when an accepted superseding governance decision establishes another legitimate counted reviewer route. +8. **Indexes discover; they do not grant status.** `docs/README.md` and `docs/adr/README.md` must reflect each ADR's explicit lifecycle status and protected-main location. Their role is discoverability and consistency checking, not status creation. +9. **Implementation truth remains separate.** Even an Accepted ADR is design authority, not proof that every described capability is implemented or released. Protected-main source, executable tests, artifacts/configuration, and claim-appropriate operational/release evidence establish implementation truth. + +## Consequences + +### Positive + +- Review governance remains realistic without weakening technical gates. +- The repository has a durable explanation for why impossible independent approval is held rather than faked in a solo-maintainer condition. +- ADR indexes can be machine-checked as inventories instead of becoming hidden policy documents. +- Maintainer-topology changes have a clear re-enablement condition. + +### Costs and trade-offs + +- The repository must periodically evaluate reviewer eligibility and live GitHub rules instead of relying on a timeless prose assumption. +- A future maintainer-topology change can legitimately make previously non-required independent review mandatory. +- Some changes may remain blocked on reviewer provisioning even when every technical check is green. + +## Failure and degraded behavior + +- If live review requirements cannot be determined, do not infer permission to accept or merge; treat review authority as unresolved and continue non-conflicting safe work. +- If a required eligible reviewer cannot be provisioned under current authority, classify the exact PR/head as reviewer-provisioning-blocked rather than weakening the rule. +- If an ADR index and ADR file disagree, the documentation contract fails and the mismatch must be repaired before using the index as architecture discovery. +- If an Accepted ADR describes behavior absent from protected-main implementation evidence, product documentation must label the capability partial/planned rather than upgrading it to shipped truth. + +## Security / privacy / governance impact + +This decision is governance-hardening. It prevents automation from manufacturing social proof, preserves branch/ruleset authority, and keeps model/check output non-authoritative for approval. It introduces no new secret or personal-data flow. Reviewer identity/eligibility evidence should be limited to repository/organization metadata required to establish governance and should not be copied into long-lived product telemetry. + +## Tests and acceptance evidence + +The documentation contract should prove at minimum that: + +- every ADR file is indexed exactly once in both canonical documentation indexes; +- each indexed lifecycle status agrees with the ADR metadata; +- Accepted and Proposed entries are not silently interchanged; +- a Superseded ADR identifies a discoverable successor where applicable; +- active-PR ADRs are not presented as protected-main implementation evidence; and +- README prose points to the authoritative governance sources and this ADR rather than independently redefining the acceptance algorithm. + +Operational acceptance additionally requires a current-authority probe of GitHub rules/reviewer eligibility when an actual change depends on counted approval. A documentation test cannot prove that a reviewer is eligible at runtime. + +## Migration and rollback + +This decision introduces no database or runtime migration. On acceptance, remove duplicate binding acceptance logic from ADR index prose and retain a concise reference to `AGENTS.md`, live GitHub policy, and this ADR. If the decision is later superseded, update both indexes and `AGENTS.md`/governance documentation coherently so no stale approval algorithm remains discoverable as current authority. + +## Open follow-ups + +- Keep the machine-checkable ADR-index/status contract aligned with new lifecycle states and supersession links. +- Re-evaluate reviewer topology whenever maintainers/teams/Apps or branch rules change. +- Keep scheduler prompts subordinate to protected-main `AGENTS.md` and live GitHub policy. +- If an organization-wide reviewer authority is introduced, record its eligibility and trust boundary in a superseding or amended Accepted ADR before relying on it as an OriginWeave-specific governance rule. + +## Supersession / reversal conditions + +Supersede this ADR if GitHub repository governance changes to a different mandatory review model, the organization adopts a formally managed independent-review service/team with explicit eligibility semantics, or OriginWeave changes its ADR lifecycle model. Any successor must retain the prohibitions on synthetic approval and on treating technical/model evidence as formal review authority. + +## References + +Current contributor and maintenance authority is defined by [`../../AGENTS.md`](../../AGENTS.md), live GitHub repository policy, and the ADR lifecycle index [`README.md`](README.md). This ADR deliberately does not freeze mutable GitHub product semantics into timeless prose; runtime enforcement must always be checked against the live repository policy. \ No newline at end of file From 223e94302b61c819aeeec2f3a306f198e18943b4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:43:44 +0900 Subject: [PATCH 017/130] docs: index proposed MV3 and ADR governance decisions --- docs/README.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/README.md b/docs/README.md index ad7df926..48fe9012 100644 --- a/docs/README.md +++ b/docs/README.md @@ -62,6 +62,8 @@ The PRD/TRD/Architecture/ADR/UML/ERD/data-governance/traceability/security/opera Proposed ADRs are reviewable architecture memory, not shipped behavior and not automatically Accepted merely because their files live on protected `main`. - [ADR 0009: Hourly agent credential boundary](adr/0009-hourly-agent-credential-boundary.md) +- [ADR 0011: Manifest V3 compatibility and extension-to-Agent authority](adr/0011-manifest-v3-extension-authority.md) +- [ADR 0012: Architecture decision acceptance governance](adr/0012-architecture-decision-governance.md) - [ADR 0100: Rust control-plane boundary](adr/0100-rust-control-plane-boundary.md) - [ADR 0101: Isolated execution/profile modes](adr/0101-isolated-execution-profile-modes.md) - [ADR 0102: Typed actions over arbitrary JavaScript](adr/0102-typed-actions-and-arbitrary-js.md) From 6093fcc4b97a1141f088960da9eed830318f735a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:44:13 +0900 Subject: [PATCH 018/130] docs(adr): index new authority and governance decisions --- docs/adr/README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/adr/README.md b/docs/adr/README.md index 1a1f5be1..5e222724 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -10,7 +10,7 @@ This directory contains durable architecture decisions for OriginWeave. A pull-r - **Deprecated** — still discoverable but no longer recommended for new work. - **Rejected** — evaluated and intentionally not adopted. -An ADR becomes Accepted only through the repository's actual protected-branch governance at the time of the change. Where live GitHub policy or an explicit operationally satisfiable CWL/OriginWeave rule requires independent non-author approval, that approval is part of acceptance. When the repository is operating under its documented solo-maintainer exception and GitHub does not require a counted approval, automation must not invent an impossible approval gate. COMMENTED reviews, check/status results, model verdicts, reactions, author approval, predecessor-head approval, or dismissed reviews never substitute for a review that policy actually requires. +Current contributor/review authority is defined by protected-main [`../../AGENTS.md`](../../AGENTS.md) together with live GitHub repository policy. [ADR 0012](0012-architecture-decision-governance.md) records the proposed durable ADR-acceptance model, including reviewer eligibility, the solo-maintainer hold, re-enablement conditions, and the prohibition on synthetic approval. While ADR 0012 is Proposed, it does not override those live authorities. COMMENTED reviews, check/status results, model verdicts, reactions, author approval, predecessor-head approval, or dismissed reviews never substitute for a review that current policy actually requires. An Accepted ADR is **design authority, not implementation evidence**. Protected-main source, executable tests, built/released artifacts, migrations/configuration, and protected-main operational evidence appropriate to the claim establish current implemented behavior. An ADR may intentionally describe an accepted target that is only partially implemented; product documents must label implementation status separately. @@ -35,6 +35,8 @@ Proposed ADR files can live on protected `main` as reviewable target architectur | ADR | Decision | Status | Governs | |---|---|---|---| | [0009](0009-hourly-agent-credential-boundary.md) | Hourly agent credential boundary | Proposed | deterministic gates, NVIDIA credential materialization, local broker and publication separation | +| [0011](0011-manifest-v3-extension-authority.md) | Manifest V3 compatibility and extension-to-Agent authority | Proposed | Chromium extension compatibility evidence, profile separation, extension grants, native-messaging boundary and release claims | +| [0012](0012-architecture-decision-governance.md) | Architecture decision acceptance governance | Proposed | ADR lifecycle authority, reviewer eligibility, solo-maintainer hold and re-enablement conditions | | [0100](0100-rust-control-plane-boundary.md) | Rust control-plane boundary | Proposed | Rust-owned product authority versus Chromium compatibility kernel | | [0101](0101-isolated-execution-profile-modes.md) | Isolated execution/profile modes | Proposed | Human, Assist, Agent Task and Crawler session/profile isolation | | [0102](0102-typed-actions-and-arbitrary-js.md) | Typed actions over arbitrary JavaScript authority | Proposed | action API, script escape hatches, risk/policy semantics | From f6bd30023f2a5f030abecad6a8b99ee9cd76d167 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:45:39 +0900 Subject: [PATCH 019/130] docs(adr): reserve MV3 authority decision after HTTP ADRs --- .../0013-manifest-v3-extension-authority.md | 108 ++++++++++++++++++ 1 file changed, 108 insertions(+) create mode 100644 docs/adr/0013-manifest-v3-extension-authority.md diff --git a/docs/adr/0013-manifest-v3-extension-authority.md b/docs/adr/0013-manifest-v3-extension-authority.md new file mode 100644 index 00000000..e620edf9 --- /dev/null +++ b/docs/adr/0013-manifest-v3-extension-authority.md @@ -0,0 +1,108 @@ +# ADR 0013: Manifest V3 compatibility and extension-to-Agent authority + +- **Status:** Proposed +- **Date:** 2026-08-10 +- **Supersedes:** None +- **Superseded by:** None + +## Context + +OriginWeave retains Chromium as its compatibility kernel rather than reimplementing Chrome's extension runtime. That creates two independent product questions: whether a declared Manifest V3 capability works on the pinned Chromium baseline, and whether an extension can influence an OriginWeave Agent Task only through explicit OriginWeave authority. + +Issue #27 requires both executable Manifest V3 compatibility evidence and explicit separation between Chromium extension permissions and OriginWeave Agent capabilities. Protected main contains partial pinned-Chromium compatibility evidence and extension-to-Agent authority foundations, but the full capability matrix, managed/native-messaging boundaries, release integration, and complete isolation acceptance remain open. + +This ADR makes that target architecture reviewable without claiming issue #27 is complete. Until protected-main governance accepts it, this ADR is Proposed design authority only. + +## Decision drivers + +- Preserve Chromium extension compatibility without creating a second OriginWeave plugin ecosystem. +- Prevent Chrome extension permissions from becoming ambient Agent Task authority. +- Keep Human Mode and delegated Agent Task profile semantics distinct. +- Bind compatibility claims to an exact Chromium revision and declared capability matrix. +- Keep extension-produced content and messages in the untrusted-observation domain. +- Keep protected secrets and sensitive values behind independent purpose-bound authority. +- Support managed extensions without granting arbitrary native-process or cross-origin capability. +- Allow safe rollback when a Chromium revision regresses a declared extension surface. + +## Assumptions and authority boundaries + +- Chromium owns Manifest V3 parsing, service workers, extension APIs, isolated worlds, and browser-managed extension policy. +- OriginWeave owns Agent Task isolation, extension-to-Agent grants, task/origin/action authority, secret/sensitive disclosure, approvals, evidence, and release claims. +- A Chromium extension permission authorizes the extension inside Chromium; it does not mint an OriginWeave capability. +- An OriginWeave `extension_grant` authorizes only the explicitly bound OriginWeave interaction; it does not emulate Chrome manifest permissions. +- Extension content, page mutations, messages, native-host output, and structured tool output remain untrusted observations unless independently authenticated through a separate trusted administrative channel. +- Compatibility evidence and Agent-authority-isolation evidence are separate evidence classes. Neither implies the other. + +## Options considered + +### Reimplement Chrome extensions as a Rust plugin system + +Rejected. It would create a second extension ecosystem and duplicate mature Chromium behavior. + +### Let extensions inherit Agent Task authority from Chrome permissions + +Rejected. Chrome permissions are not OriginWeave task/origin/action/approval grants and ambient inheritance creates confused-deputy, secret-disclosure, prompt-injection, and cross-origin escalation risk. + +### Disable extensions in every mode + +Rejected as a product-wide rule. Agent Task Mode defaults to no extensions or a managed allow-list, but Human Mode must retain normal compatible extension use and enterprises may require managed extensions. + +### Retain Chromium's extension plane and add explicit OriginWeave grants + +Selected. + +## Decision + +1. **Retain Chromium Manifest V3 as the compatibility plane.** OriginWeave does not create a competing Rust extension API for browser compatibility. +2. **Separate execution modes.** Human Mode may use the person's compatible extension set under browser/enterprise policy. Agent Task Mode defaults to no extensions or an explicit managed allow-list. Later attached-human-tab execution is labelled reduced-assurance when pre-existing extensions can influence page state. +3. **Require explicit OriginWeave extension authority.** Any extension-to-Agent interaction that can affect an Agent Task requires an `extension_grant` or equivalent typed decision bound at minimum to extension identity/version policy, session, applicable browsing context, capability, origin/resource scope, expiry, and task. +4. **Never translate Chrome permission into Agent capability.** `tabs`, `scripting`, `downloads`, `declarativeNetRequest`, host permissions, native messaging, or managed policy do not grant OriginWeave navigation, action, approval, secret, or sensitive-data authority. +5. **Keep extension output untrusted.** Extension messages and content enter the bounded observation/provenance path. They cannot alter the trusted goal, add tools, mint capabilities, approve high-risk actions, or weaken deterministic policy. +6. **Keep protected values brokered.** An extension does not receive raw credentials or sensitive values merely because it can inspect or modify a page. Independent secret/sensitive-data authority is rechecked immediately before trusted browser dispatch. +7. **Bound native messaging separately.** Native messaging is supported only behind an explicit host-managed allow-list, exact extension/host identity policy, process boundary, bounded I/O, and auditable lifecycle. It remains unsupported until that executable boundary exists. +8. **Publish exact compatibility evidence.** Public extension claims are bound to an exact Chromium revision/build and explicit Manifest V3 capability matrix. OriginWeave does not claim universal or `100% Chrome extension compatibility`. +9. **Separate Chrome-only services.** Web Store distribution, Google-account services, proprietary codecs/DRM, licensing, and other Chrome-only services are not implied by Manifest V3 compatibility. +10. **Gate releases by declared surfaces.** A declared supported capability that regresses blocks release or must be removed from the published matrix before release. Compatibility success never substitutes for Agent-authority-isolation evidence. + +## Consequences + +OriginWeave can preserve mature Chromium extension behavior while keeping its differentiating authority logic in reusable Rust modules. Buyers receive exact, falsifiable compatibility claims and separately reviewable security evidence. The cost is maintaining both a real-browser compatibility suite and independent authority-isolation tests, plus explicit managed-extension/native-host lifecycle work. + +## Failure and degraded behavior + +- A failed declared MV3 fixture makes that capability unsupported for the affected pinned release until fixed or removed from the published matrix. +- Invalid extension identity, grant scope, session/context binding, origin, expiry, or task fails closed. +- Attempts to widen task authority, inject a trusted instruction, resolve a secret, or synthesize approval are denied and recorded as bounded credential-free evidence. +- Missing native-host policy/process isolation keeps native messaging unsupported rather than falling back to ambient process execution. +- Attached human-tab sessions with unknown extensions are reduced-assurance and cannot inherit isolated-task release claims. + +## Security / privacy / governance impact + +The decision reduces confused-deputy and prompt-injection risk by keeping Chrome extension permissions outside OriginWeave policy. Secret and sensitive-data disclosure remain independently purpose-bound. Extension observations and compatibility diagnostics must not expose raw credentials, arbitrary local filesystem paths, unrestricted native-process output, or protected values in logs/evidence. Enterprise-managed extension policy is policy input, not a replacement for task authorization. + +## Tests and acceptance evidence + +Issue #27 acceptance requires pinned-Chromium evidence for the declared matrix and separate production authority tests, including service-worker/content-script lifecycle, declared APIs, restart/update persistence, Agent Task isolation without a grant, managed-grant success, denial of origin/action widening, untrusted-message handling, secret non-disclosure, exact build binding, repeated-run evidence, native-messaging denial until implemented, and release failure when a public capability regresses. + +Current active compatibility PRs are evidence only for their unchanged exact heads. They do not make this Proposed ADR Accepted or close issue #27. + +## Migration and rollback + +No persistent database migration is introduced. A release can roll back the Chromium baseline, disable a managed extension, revoke an `extension_grant`, or remove an unproven capability from the published matrix without widening authority. Rollback evidence must retain the exact Chromium/build/capability set that was tested. + +## Open follow-ups + +- Complete issue #27's compatibility matrix and production isolation acceptance. +- Define managed-extension identity/update semantics. +- Implement the native-messaging allow-list/process boundary before claiming support. +- Integrate the complete Agent Task browser vertical slice under issue #28. +- Reconcile PRD/TRD/traceability from protected-main evidence as compatibility slices integrate. +- Promote this ADR only through explicit protected-main governance. + +## Supersession / reversal conditions + +Supersede this ADR if Chromium adopts a materially different extension authority model, OriginWeave intentionally drops Chromium extension compatibility, or an accepted architecture provides safer equivalent compatibility without ambient Agent authority. A successor must retain explicit compatibility evidence and task-authority separation. + +## References + +Primary browser/extension/protocol evidence and APA 7 references are maintained in [`../doctoring/browser-agent-protocols.md`](../doctoring/browser-agent-protocols.md) and [`../doctoring.md`](../doctoring.md). Related decisions include ADR 0001, ADR 0002, ADR 0007, ADR 0010, ADR 0101, ADR 0104, and ADR 0107. \ No newline at end of file From 83af7393438c0725cb26a0816f967302d6ed3bf5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:46:07 +0900 Subject: [PATCH 020/130] docs(adr): reserve governance ADR after HTTP decisions --- .../0014-architecture-decision-governance.md | 103 ++++++++++++++++++ 1 file changed, 103 insertions(+) create mode 100644 docs/adr/0014-architecture-decision-governance.md diff --git a/docs/adr/0014-architecture-decision-governance.md b/docs/adr/0014-architecture-decision-governance.md new file mode 100644 index 00000000..bbbdd1c0 --- /dev/null +++ b/docs/adr/0014-architecture-decision-governance.md @@ -0,0 +1,103 @@ +# ADR 0014: Architecture decision acceptance governance + +- **Status:** Proposed +- **Date:** 2026-08-10 +- **Supersedes:** None +- **Superseded by:** None + +## Context + +OriginWeave separates protected-main source, executable checks, formal review, documentation, release evidence, and runtime policy as distinct authorities. Architecture Decision Records need the same discipline: a Markdown file, issue, chat statement, automation prompt, model verdict, or PR body can propose a decision but cannot independently make it an Accepted governing decision. + +Current contributor authority comes from protected-main `AGENTS.md`, live GitHub policy, and any explicit operationally satisfiable CWL/OriginWeave governance rule. The current contract also describes a solo-maintainer condition: an otherwise impossible independent non-author approval rule is not manufactured when fewer than two eligible independent maintainers exist, while technical/security/coverage/rustdoc/findings/live-base/branch-protection gates remain mandatory. + +The ADR index previously repeated these binding details directly. An index should discover governance rather than create it. This ADR therefore records the proposed durable acceptance model and its reversal conditions. While Proposed, it does not override `AGENTS.md` or live GitHub policy. + +## Decision drivers + +- Prevent indexes, chat, model output, or stale PR evidence from silently changing architecture authority. +- Never synthesize, impersonate, self-submit, or fabricate approval that current policy requires. +- Avoid permanent solo-maintainer deadlock when an independent reviewer route does not operationally exist and GitHub does not require one. +- Keep exact-head technical evidence mandatory regardless of review topology. +- Make reviewer-provisioning gaps explicit and reversible. +- Keep ADR status machine-checkable without turning README prose into a hidden policy engine. + +## Assumptions and authority boundaries + +- Protected-main `AGENTS.md` and live GitHub rules are authoritative for contributor actions. +- This ADR is Proposed until protected-main governance accepts it. +- Formal review and technical checks are separate evidence classes. +- A review counts only if the governing policy recognizes that reviewer identity and review state for the relevant exact head. +- Predecessor-head approval does not transfer across a changed head unless live policy explicitly defines that behavior. + +## Options considered + +### Define ADR acceptance only in the index README + +Rejected. The index should summarize and discover decisions, not define the binding algorithm that grants its own statuses. + +### Require non-author approval unconditionally + +Rejected. In a genuine solo-maintainer topology this creates an unsatisfiable governance deadlock and pressure to invent reviewer identities or weaken the rule. + +### Let the author or automation synthesize approval + +Rejected. Self-approval, impersonation, model verdicts, reactions, status checks, or fabricated identities cannot provide independent review evidence. + +### Bind acceptance to live protected-branch governance with a narrow solo-maintainer hold + +Selected. + +## Decision + +If Accepted, OriginWeave applies these durable ADR-governance rules: + +1. **Protected-main transition defines architecture acceptance.** A branch file, issue, chat statement, prompt, PR body, check, or model verdict does not independently create a governing Accepted ADR. +2. **Live policy defines mandatory review evidence.** When current GitHub rules require counted approval, acceptance requires a formal `APPROVED` review from an eligible identity recognized by that policy on the applicable unchanged head. +3. **Repository-specific review requirements must be operationally satisfiable.** A stricter CWL/OriginWeave rule may require an eligible non-author reviewer only when a legitimate reviewer route exists. +4. **No synthetic approval.** Author approval, COMMENTED reviews, reactions, model verdicts, statuses, predecessor-head approvals, impersonated identities, and fabricated accounts never substitute for required counted approval. +5. **The solo-maintainer hold is narrow.** When fewer than two eligible independent maintainers exist and live GitHub policy does not independently require counted non-author approval, an otherwise impossible repository-level independent-review requirement is held. CI, security, SAST, exact owned-code coverage, rustdoc, unresolved findings/threads, live-base, mergeability, branch protection, release, and operational evidence remain mandatory. +6. **Reviewer provisioning is a first-class state.** If live policy requires independent approval but no eligible reviewer route exists, the PR is reviewer-provisioning-blocked. The remedy is legitimate reviewer/team/App provisioning or an authorized governance change, never self-approval or gate weakening. +7. **The hold reverses automatically.** Independent-review enforcement returns when two or more eligible independent maintainers exist, live GitHub policy requires it, or an Accepted successor defines another legitimate counted-review route. +8. **Indexes discover; they do not grant status.** `docs/README.md` and `docs/adr/README.md` must mirror each ADR's explicit lifecycle metadata and protected-main location. +9. **Design authority is not implementation evidence.** Even an Accepted ADR does not prove described behavior is implemented or released; protected-main code/tests/artifacts/configuration and claim-appropriate operational evidence establish that truth. + +## Consequences + +The repository can remain review-realistic without weakening technical gates, and maintainer-topology changes have explicit re-enablement semantics. The trade-off is that reviewer eligibility and live policy must be re-evaluated when governance changes; some otherwise-green work may legitimately remain blocked on reviewer provisioning. + +## Failure and degraded behavior + +- If live review requirements cannot be determined, do not infer permission to accept or merge; treat review authority as unresolved and continue non-conflicting work. +- If a required reviewer cannot be provisioned under current authority, classify the exact PR/head as reviewer-provisioning-blocked. +- If an ADR index and file disagree, the documentation contract fails until repaired. +- If an Accepted ADR describes behavior absent from protected-main implementation evidence, product docs must label that capability partial/planned rather than shipped. + +## Security / privacy / governance impact + +This is governance hardening. It prevents automation from manufacturing social proof, preserves branch/ruleset authority, and keeps model/check output non-authoritative for approval. It introduces no new secret or personal-data path. + +## Tests and acceptance evidence + +The documentation contract must prove that every ADR file is indexed exactly once in both canonical indexes, index status matches file metadata, Accepted and Proposed entries are not silently interchanged, superseded decisions retain discoverable successors where applicable, and active-PR ADRs are not presented as protected-main implementation evidence. README prose should point to `AGENTS.md`, live GitHub policy, and this ADR instead of independently redefining the acceptance algorithm. + +Operational acceptance for an actual merge additionally requires a current-authority probe of GitHub rules and reviewer eligibility whenever counted review matters; a documentation test cannot prove runtime reviewer eligibility. + +## Migration and rollback + +No database or runtime migration is introduced. On acceptance, duplicate binding review logic should be removed from ADR-index prose and replaced by concise references to `AGENTS.md`, live GitHub policy, and this ADR. A superseding governance change must update both indexes and contributor-governance documentation coherently. + +## Open follow-ups + +- Keep the machine-checkable ADR-index/status contract aligned with lifecycle and supersession states. +- Re-evaluate reviewer topology whenever maintainers, teams, Apps, or branch rules change. +- Keep scheduler prompts subordinate to protected-main `AGENTS.md` and live GitHub policy. +- Record any future organization-wide reviewer authority and its eligibility boundary in an Accepted successor before relying on it as repository-specific governance. + +## Supersession / reversal conditions + +Supersede this ADR if GitHub governance changes to a materially different review model, the organization adopts a managed independent-review service/team with explicit eligibility semantics, or OriginWeave changes its ADR lifecycle. A successor must retain the prohibitions on synthetic approval and on treating technical/model evidence as formal review authority. + +## References + +Current contributor authority is defined by [`../../AGENTS.md`](../../AGENTS.md), live GitHub repository policy, and the ADR lifecycle index [`README.md`](README.md). This ADR deliberately does not freeze mutable GitHub product semantics into timeless prose. \ No newline at end of file From 2b07467778cc261cc5fa1e16cedfd821ccc03406 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:46:19 +0900 Subject: [PATCH 021/130] docs(adr): release HTTP-owned ADR 0011 number --- .../0011-manifest-v3-extension-authority.md | 135 ------------------ 1 file changed, 135 deletions(-) delete mode 100644 docs/adr/0011-manifest-v3-extension-authority.md diff --git a/docs/adr/0011-manifest-v3-extension-authority.md b/docs/adr/0011-manifest-v3-extension-authority.md deleted file mode 100644 index 35d842f5..00000000 --- a/docs/adr/0011-manifest-v3-extension-authority.md +++ /dev/null @@ -1,135 +0,0 @@ -# ADR 0011: Manifest V3 compatibility and extension-to-Agent authority - -- **Status:** Proposed -- **Date:** 2026-08-10 -- **Supersedes:** None -- **Superseded by:** None - -## Context - -OriginWeave deliberately retains Chromium as its compatibility kernel rather than reimplementing Blink, V8, graphics, or Chrome's extension runtime. That architecture creates two distinct questions that must not be collapsed: - -1. whether a declared Manifest V3 extension capability actually works on the pinned Chromium baseline; and -2. whether an extension can influence an OriginWeave Agent Task only through explicit OriginWeave authority. - -Issue #27 requires executable compatibility evidence for declared Manifest V3 surfaces and explicit isolation between Chromium extension permissions and OriginWeave Agent capabilities. Protected main already contains partial pinned-Chromium compatibility evidence and extension-to-Agent authority foundations, while the full capability matrix, managed/native-messaging boundaries, release integration, and complete isolation acceptance remain open. - -This ADR makes the target decision reviewable without claiming that issue #27 is complete. Until this ADR is Accepted through protected-main governance, it is Proposed design authority only. - -## Decision drivers - -- Preserve Chromium extension compatibility without creating a second OriginWeave plugin ecosystem. -- Prevent Chrome extension permissions from becoming ambient Agent Task authority. -- Keep Human Mode and delegated Agent Task profile semantics distinct. -- Make compatibility claims falsifiable and bound to an exact Chromium revision and capability matrix. -- Keep extension-produced content, messages, and tool output in the untrusted-observation domain. -- Keep protected secrets and sensitive values behind their own purpose-bound broker authority. -- Support enterprise-managed extensions without granting arbitrary native-process or cross-origin capability. -- Permit safe rollback when a Chromium revision regresses a declared extension surface. - -## Assumptions and authority boundaries - -- Chromium owns Manifest V3 parsing, service workers, extension APIs, isolated worlds, enterprise extension policy, and the compatibility behavior of `//extensions`. -- OriginWeave owns Agent Task session/profile isolation, extension-to-Agent grants, task/origin/action authority, secret/sensitive-data disclosure, approval, evidence, and release claims. -- A Chromium extension permission authorizes the extension inside Chromium; it does not mint an OriginWeave capability. -- An OriginWeave `extension_grant` authorizes only the explicitly bound OriginWeave interaction. It does not change or emulate Chrome manifest permissions. -- Extension content, page mutations, messages, native-host output, and structured tool output are untrusted observations unless independently authenticated as a separate trusted administrative channel. -- Compatibility evidence and Agent-authority-isolation evidence are independent evidence classes. Neither implies the other. - -## Options considered - -### Option A — Reimplement Chrome extensions as a Rust plugin system - -Rejected. This would create a second extension ecosystem, multiply compatibility work, and move differentiation away from OriginWeave's authority/provenance control plane. - -### Option B — Let extensions inherit Agent Task authority from their Chrome permissions - -Rejected. Chrome permissions were not designed as OriginWeave task/origin/action/approval grants. Ambient inheritance would create confused-deputy, secret-disclosure, prompt-injection, and cross-origin escalation paths. - -### Option C — Disable all extensions in every OriginWeave mode - -Rejected as a product-wide rule. Agent Task Mode should default to no extensions or a managed allow-list, but Human Mode must remain compatible with ordinary Chromium extension use and enterprises may require managed extensions. - -### Option D — Retain Chromium's extension plane and add explicit OriginWeave grants - -Selected. Chromium remains the compatibility implementation while OriginWeave separately controls whether an extension may interact with Agent authority. - -## Decision - -1. **Retain Chromium Manifest V3 as the compatibility plane.** OriginWeave does not create a competing Rust extension API for product compatibility. -2. **Separate execution modes.** Human Mode may use the person's compatible extension set subject to browser/enterprise policy. Agent Task Mode defaults to no extensions or an explicit managed allow-list. Attached human-tab execution, when later supported, is labelled reduced-assurance because pre-existing extensions can influence page state. -3. **Require explicit OriginWeave extension authority.** Any extension-to-Agent interaction that can affect an Agent Task requires an `extension_grant` or equivalent typed policy decision bound at minimum to extension identity/version policy, browser session, browsing context where applicable, capability, allowed origin/resource scope, expiry, and current task. -4. **Never translate Chrome permission into Agent capability.** `tabs`, `scripting`, `downloads`, `declarativeNetRequest`, native messaging, host permissions, or managed policy do not grant OriginWeave navigation, action, approval, secret, or sensitive-data authority. -5. **Keep extension output untrusted.** Extension messages and content enter the same bounded observation/provenance path as page-controlled data. They cannot alter the trusted task goal, add tools, mint capabilities, approve high-risk actions, or weaken deterministic policy. -6. **Keep protected values brokered.** An extension never obtains raw credential or sensitive values merely because it can observe or modify a page. Any value use must pass the independent secret/sensitive-data authority immediately before trusted browser dispatch. -7. **Bound native messaging separately.** Native messaging is permitted only behind an explicit host-managed allow-list, exact extension/host identity policy, process boundary, bounded I/O, and auditable lifecycle. It is not part of the minimum compatibility claim until that executable boundary exists. -8. **Publish exact capability evidence.** Every public compatibility claim is bound to an exact Chromium revision/build and an explicit Manifest V3 capability matrix. OriginWeave does not claim universal or `100% Chrome extension compatibility`. -9. **Separate Chrome-only service claims.** Web Store distribution, Google-account services, proprietary codecs/DRM, licensing, and other Chrome-only services are not implied by Manifest V3 compatibility. -10. **Make compatibility a release gate only for declared capabilities.** A declared supported capability that regresses on the pinned release baseline blocks that release or must be removed from the published supported matrix before release. Compatibility success never substitutes for Agent-authority-isolation evidence. - -## Consequences - -### Positive - -- Buyers can distinguish a real Chromium compatibility claim from an OriginWeave security claim. -- OriginWeave can preserve mature Chromium extension behavior while keeping its differentiating authority logic in reusable Rust control-plane modules. -- Enterprise extension policy can be integrated without granting extensions ambient task authority. -- Capability regressions can be isolated to exact Chromium revisions and exact declared surfaces. - -### Costs and trade-offs - -- Release acceptance needs both browser compatibility fixtures and OriginWeave authority-isolation tests. -- Managed extension identity, update, migration, and native-host lifecycle require explicit adapters and evidence. -- Attached human-profile automation cannot offer the same assurance as an isolated Agent Task profile when arbitrary user extensions are active. - -## Failure and degraded behavior - -- If a declared MV3 fixture fails on the pinned Chromium revision, the affected capability is unsupported for that release until fixed or explicitly removed from the supported matrix. -- If extension identity, grant scope, session/context binding, origin, expiry, or task cannot be verified, the OriginWeave interaction fails closed. -- If an extension attempts to widen task origin/action authority, provide a trusted instruction, resolve a secret, or synthesize approval, the request is denied and recorded as bounded credential-free evidence. -- If native-host policy or process isolation is unavailable, native messaging remains unsupported rather than falling back to ambient process execution. -- If an Agent Task must attach to a human tab with unknown extensions, the session is marked reduced-assurance and must not silently inherit isolated-task release claims. - -## Security / privacy / governance impact - -The decision reduces confused-deputy and prompt-injection risk by preventing Chromium extension permissions from being interpreted as OriginWeave policy. Secret and sensitive-data disclosure remain purpose-bound and separate. Extension observations and compatibility diagnostics must not expose raw credentials, arbitrary local filesystem paths, unrestricted native-process output, or protected values in logs/evidence. Enterprise-managed extension policy is an input to OriginWeave policy, not a replacement for task-specific authorization. - -## Tests and acceptance evidence - -Acceptance of the complete issue #27 boundary requires realistic pinned-Chromium evidence for the declared supported matrix and separate production authority tests. At minimum the evolving suite must cover: - -- install/enable/update/restart and extension service-worker lifecycle; -- content scripts and isolated-world behavior; -- declared APIs such as storage, scripting, downloads, bookmarks, history, commands, side panel, DNR, tabs/windows, and managed policy where supported; -- restart/update persistence; -- Agent Task isolation when an extension is not granted; -- explicit managed grant success; -- denial of extension attempts to widen task origin/action authority; -- extension-produced prompt-injection/untrusted-message treatment; -- secret/sensitive-data non-disclosure; -- exact Chromium/OriginWeave build binding and repeated-run evidence; -- native messaging denial until its explicit host boundary is implemented; and -- release failure when a publicly declared capability regresses. - -Current active compatibility PRs are implementation evidence only for their unchanged exact heads; they do not make this Proposed ADR Accepted or close issue #27. - -## Migration and rollback - -No persistent database migration is introduced by this ADR. A release can roll back an affected Chromium baseline, disable a managed extension, revoke an `extension_grant`, or remove an unproven capability from the published compatibility matrix without widening authority. Rollback must preserve evidence of which exact Chromium/build/capability set was tested. - -## Open follow-ups - -- Complete issue #27's declared compatibility matrix and production extension-isolation acceptance. -- Define and test managed-extension identity/update semantics. -- Implement the native-messaging host allow-list/process boundary before claiming support. -- Integrate the first complete Agent Task browser vertical slice under issue #28. -- Reconcile PRD/TRD/traceability from protected-main evidence as each active compatibility slice integrates. -- Promote this ADR from Proposed only through explicit protected-main governance; file presence or green compatibility checks are insufficient. - -## Supersession / reversal conditions - -Supersede this ADR if Chromium replaces Manifest V3 with a materially different extension authority model, if OriginWeave intentionally drops Chromium extension compatibility, or if an accepted architecture proves a safer compatibility mechanism that preserves equivalent buyer-visible extension behavior without ambient Agent authority. Any replacement must retain explicit compatibility evidence and task-authority separation. - -## References - -Primary browser/extension/protocol evidence and APA 7 references are maintained in [`../doctoring/browser-agent-protocols.md`](../doctoring/browser-agent-protocols.md) and [`../doctoring.md`](../doctoring.md). Related governing decisions include ADR 0001 (Chromium compatibility kernel), ADR 0002 (Agent safety kernel), ADR 0007 (purpose-bound sensitive-data authority), ADR 0010 (session/context-bound node authority), ADR 0101 (isolated execution/profile modes), ADR 0104 (prompt-injection and secret authority separation), and ADR 0107 (browser protocol adapter strategy). \ No newline at end of file From 4dee0f7e23561c14f825c68610125244df79f382 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:46:29 +0900 Subject: [PATCH 022/130] docs(adr): release HTTP-owned ADR 0012 number --- .../0012-architecture-decision-governance.md | 121 ------------------ 1 file changed, 121 deletions(-) delete mode 100644 docs/adr/0012-architecture-decision-governance.md diff --git a/docs/adr/0012-architecture-decision-governance.md b/docs/adr/0012-architecture-decision-governance.md deleted file mode 100644 index 4dbdaf6e..00000000 --- a/docs/adr/0012-architecture-decision-governance.md +++ /dev/null @@ -1,121 +0,0 @@ -# ADR 0012: Architecture decision acceptance governance - -- **Status:** Proposed -- **Date:** 2026-08-10 -- **Supersedes:** None -- **Superseded by:** None - -## Context - -OriginWeave separates several authorities that are easy to conflate: protected-main source, executable checks, formal review, documentation, release evidence, and runtime policy. Architecture Decision Records need the same discipline. A Markdown file, issue, chat statement, automation prompt, model verdict, or PR body can propose a decision but cannot independently make it an Accepted governing decision. - -The repository's authoritative contributor contract is `AGENTS.md`, together with live GitHub rules and any explicit operationally satisfiable CWL/OriginWeave governance rule. The current contract also documents a solo-maintainer condition: an otherwise impossible independent non-author approval rule is not manufactured when fewer than two eligible independent maintainers exist, while exact-head technical/security/coverage/rustdoc/findings/live-base/branch-protection gates remain mandatory. - -A previous documentation-index revision repeated those binding governance details directly in `docs/adr/README.md`. That makes an index file appear to create governance rather than discover it. This ADR proposes a durable architecture decision for ADR acceptance and reversal semantics while keeping live `AGENTS.md` and GitHub policy authoritative until this ADR itself becomes Accepted. - -## Decision drivers - -- Prevent documentation indexes, chat, model output, or stale PR evidence from silently changing architecture authority. -- Never synthesize, impersonate, self-submit, or otherwise fabricate an approval that current policy actually requires. -- Avoid permanently blocking a solo-maintainer repository on an independent approval route that cannot operationally exist when GitHub does not require it. -- Keep exact-head technical evidence mandatory regardless of review topology. -- Make reviewer-provisioning gaps explicit and reversible when maintainer topology changes. -- Keep ADR status discoverable and machine-checkable without turning README prose into a hidden policy engine. - -## Assumptions and authority boundaries - -- Current protected-main `AGENTS.md` and live GitHub rules are authoritative for contributor actions. -- This ADR is **Proposed** until protected-main governance accepts it. It therefore documents the proposed durable rule and rationale; it does not override current `AGENTS.md` or live GitHub policy while unaccepted. -- Formal review and technical checks are separate evidence classes. Neither substitutes for the other. -- A review counts only if the governing policy at that exact time recognizes the reviewer identity and review state. -- A status or review attached to a predecessor head does not transfer to a changed exact head unless GitHub policy explicitly defines such behavior. - -## Options considered - -### Option A — Define ADR acceptance only in the ADR index README - -Rejected. An index should discover and summarize decisions, not silently create the binding governance that decides whether its own entries are Accepted. - -### Option B — Require a non-author approval unconditionally, even when no eligible reviewer exists - -Rejected. This creates a permanent governance deadlock in a genuine solo-maintainer topology and encourages unsafe pressure to invent reviewer identities or weaken the rule. - -### Option C — Let the author or automation synthesize the missing approval - -Rejected. Self-approval, impersonation, fake identities, model verdicts, reactions, status checks, or synthetic reviews cannot provide independent review evidence. - -### Option D — Bind acceptance to live protected-branch governance with an explicit solo-maintainer hold - -Selected. Live GitHub rules and current authoritative repository governance determine which review evidence is actually required. A governance rule that requires an independent reviewer must have an operationally valid reviewer path; otherwise the independent-review portion is held rather than fabricated, while all technical and safety gates remain intact. - -## Decision - -If this ADR is Accepted, OriginWeave uses the following durable architecture-decision governance: - -1. **Protected-main transition defines architecture acceptance.** An ADR is not a governing protected-main decision merely because the file exists on a feature branch, appears in an issue, is described as accepted in chat, or receives a model/check verdict. Its status metadata and the protected-main transition must agree. -2. **Live policy determines required review evidence.** When current GitHub branch/ruleset policy requires a counted approval, acceptance requires a formal `APPROVED` review from an eligible identity recognized by that policy on the unchanged head to which the rule applies. -3. **Explicit repository governance may add review requirements only when operationally satisfiable.** A stricter OriginWeave/CWL rule may require an eligible non-author reviewer, but automation must verify that a legitimate reviewer route exists before treating it as executable. -4. **No synthetic approval.** Author approval, COMMENTED reviews, reactions, model verdicts, commit statuses, predecessor-head approvals, impersonated identities, or fabricated reviewer accounts never substitute for a counted independent approval when one is required. -5. **Solo-maintainer hold is narrow.** When fewer than two eligible independent maintainers exist and live GitHub policy does not independently require a counted non-author approval, an otherwise impossible repository-level independent-review requirement is placed on hold. This does not waive exact-head CI, security, SAST, exact owned-code coverage, rustdoc, unresolved finding/thread, live-base, mergeability, branch-protection, release, or operational-evidence gates. -6. **Reviewer provisioning is a first-class governance state.** If live policy requires independent approval but no eligible reviewer route exists, the PR is blocked by a reviewer-provisioning gap. The correct remedy is legitimate reviewer/team/App provisioning or governance change by an authorized human/organization control plane, not self-approval or gate weakening. -7. **The hold reverses automatically.** Independent-review enforcement is re-enabled when two or more eligible independent maintainers exist, when live GitHub policy requires it, or when an accepted superseding governance decision establishes another legitimate counted reviewer route. -8. **Indexes discover; they do not grant status.** `docs/README.md` and `docs/adr/README.md` must reflect each ADR's explicit lifecycle status and protected-main location. Their role is discoverability and consistency checking, not status creation. -9. **Implementation truth remains separate.** Even an Accepted ADR is design authority, not proof that every described capability is implemented or released. Protected-main source, executable tests, artifacts/configuration, and claim-appropriate operational/release evidence establish implementation truth. - -## Consequences - -### Positive - -- Review governance remains realistic without weakening technical gates. -- The repository has a durable explanation for why impossible independent approval is held rather than faked in a solo-maintainer condition. -- ADR indexes can be machine-checked as inventories instead of becoming hidden policy documents. -- Maintainer-topology changes have a clear re-enablement condition. - -### Costs and trade-offs - -- The repository must periodically evaluate reviewer eligibility and live GitHub rules instead of relying on a timeless prose assumption. -- A future maintainer-topology change can legitimately make previously non-required independent review mandatory. -- Some changes may remain blocked on reviewer provisioning even when every technical check is green. - -## Failure and degraded behavior - -- If live review requirements cannot be determined, do not infer permission to accept or merge; treat review authority as unresolved and continue non-conflicting safe work. -- If a required eligible reviewer cannot be provisioned under current authority, classify the exact PR/head as reviewer-provisioning-blocked rather than weakening the rule. -- If an ADR index and ADR file disagree, the documentation contract fails and the mismatch must be repaired before using the index as architecture discovery. -- If an Accepted ADR describes behavior absent from protected-main implementation evidence, product documentation must label the capability partial/planned rather than upgrading it to shipped truth. - -## Security / privacy / governance impact - -This decision is governance-hardening. It prevents automation from manufacturing social proof, preserves branch/ruleset authority, and keeps model/check output non-authoritative for approval. It introduces no new secret or personal-data flow. Reviewer identity/eligibility evidence should be limited to repository/organization metadata required to establish governance and should not be copied into long-lived product telemetry. - -## Tests and acceptance evidence - -The documentation contract should prove at minimum that: - -- every ADR file is indexed exactly once in both canonical documentation indexes; -- each indexed lifecycle status agrees with the ADR metadata; -- Accepted and Proposed entries are not silently interchanged; -- a Superseded ADR identifies a discoverable successor where applicable; -- active-PR ADRs are not presented as protected-main implementation evidence; and -- README prose points to the authoritative governance sources and this ADR rather than independently redefining the acceptance algorithm. - -Operational acceptance additionally requires a current-authority probe of GitHub rules/reviewer eligibility when an actual change depends on counted approval. A documentation test cannot prove that a reviewer is eligible at runtime. - -## Migration and rollback - -This decision introduces no database or runtime migration. On acceptance, remove duplicate binding acceptance logic from ADR index prose and retain a concise reference to `AGENTS.md`, live GitHub policy, and this ADR. If the decision is later superseded, update both indexes and `AGENTS.md`/governance documentation coherently so no stale approval algorithm remains discoverable as current authority. - -## Open follow-ups - -- Keep the machine-checkable ADR-index/status contract aligned with new lifecycle states and supersession links. -- Re-evaluate reviewer topology whenever maintainers/teams/Apps or branch rules change. -- Keep scheduler prompts subordinate to protected-main `AGENTS.md` and live GitHub policy. -- If an organization-wide reviewer authority is introduced, record its eligibility and trust boundary in a superseding or amended Accepted ADR before relying on it as an OriginWeave-specific governance rule. - -## Supersession / reversal conditions - -Supersede this ADR if GitHub repository governance changes to a different mandatory review model, the organization adopts a formally managed independent-review service/team with explicit eligibility semantics, or OriginWeave changes its ADR lifecycle model. Any successor must retain the prohibitions on synthetic approval and on treating technical/model evidence as formal review authority. - -## References - -Current contributor and maintenance authority is defined by [`../../AGENTS.md`](../../AGENTS.md), live GitHub repository policy, and the ADR lifecycle index [`README.md`](README.md). This ADR deliberately does not freeze mutable GitHub product semantics into timeless prose; runtime enforcement must always be checked against the live repository policy. \ No newline at end of file From e545457b4b7daa4a9cd34ee2bfa3b3cb0cacc4a3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:46:57 +0900 Subject: [PATCH 023/130] docs: align ADR index with active HTTP numbering --- docs/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/README.md b/docs/README.md index 48fe9012..8d0fb549 100644 --- a/docs/README.md +++ b/docs/README.md @@ -62,8 +62,8 @@ The PRD/TRD/Architecture/ADR/UML/ERD/data-governance/traceability/security/opera Proposed ADRs are reviewable architecture memory, not shipped behavior and not automatically Accepted merely because their files live on protected `main`. - [ADR 0009: Hourly agent credential boundary](adr/0009-hourly-agent-credential-boundary.md) -- [ADR 0011: Manifest V3 compatibility and extension-to-Agent authority](adr/0011-manifest-v3-extension-authority.md) -- [ADR 0012: Architecture decision acceptance governance](adr/0012-architecture-decision-governance.md) +- [ADR 0013: Manifest V3 compatibility and extension-to-Agent authority](adr/0013-manifest-v3-extension-authority.md) +- [ADR 0014: Architecture decision acceptance governance](adr/0014-architecture-decision-governance.md) - [ADR 0100: Rust control-plane boundary](adr/0100-rust-control-plane-boundary.md) - [ADR 0101: Isolated execution/profile modes](adr/0101-isolated-execution-profile-modes.md) - [ADR 0102: Typed actions over arbitrary JavaScript](adr/0102-typed-actions-and-arbitrary-js.md) From 90e355e9f2f2a93e50ddb2e235704de94293ed5f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:47:29 +0900 Subject: [PATCH 024/130] docs(adr): align reserved decision numbers with HTTP lineage --- docs/adr/README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/adr/README.md b/docs/adr/README.md index 5e222724..b3fc1cc7 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -10,7 +10,7 @@ This directory contains durable architecture decisions for OriginWeave. A pull-r - **Deprecated** — still discoverable but no longer recommended for new work. - **Rejected** — evaluated and intentionally not adopted. -Current contributor/review authority is defined by protected-main [`../../AGENTS.md`](../../AGENTS.md) together with live GitHub repository policy. [ADR 0012](0012-architecture-decision-governance.md) records the proposed durable ADR-acceptance model, including reviewer eligibility, the solo-maintainer hold, re-enablement conditions, and the prohibition on synthetic approval. While ADR 0012 is Proposed, it does not override those live authorities. COMMENTED reviews, check/status results, model verdicts, reactions, author approval, predecessor-head approval, or dismissed reviews never substitute for a review that current policy actually requires. +Current contributor/review authority is defined by protected-main [`../../AGENTS.md`](../../AGENTS.md) together with live GitHub repository policy. [ADR 0014](0014-architecture-decision-governance.md) records the proposed durable ADR-acceptance model, including reviewer eligibility, the solo-maintainer hold, re-enablement conditions, and the prohibition on synthetic approval. While ADR 0014 is Proposed, it does not override those live authorities. COMMENTED reviews, check/status results, model verdicts, reactions, author approval, predecessor-head approval, or dismissed reviews never substitute for a review that current policy actually requires. An Accepted ADR is **design authority, not implementation evidence**. Protected-main source, executable tests, built/released artifacts, migrations/configuration, and protected-main operational evidence appropriate to the claim establish current implemented behavior. An ADR may intentionally describe an accepted target that is only partially implemented; product documents must label implementation status separately. @@ -35,8 +35,8 @@ Proposed ADR files can live on protected `main` as reviewable target architectur | ADR | Decision | Status | Governs | |---|---|---|---| | [0009](0009-hourly-agent-credential-boundary.md) | Hourly agent credential boundary | Proposed | deterministic gates, NVIDIA credential materialization, local broker and publication separation | -| [0011](0011-manifest-v3-extension-authority.md) | Manifest V3 compatibility and extension-to-Agent authority | Proposed | Chromium extension compatibility evidence, profile separation, extension grants, native-messaging boundary and release claims | -| [0012](0012-architecture-decision-governance.md) | Architecture decision acceptance governance | Proposed | ADR lifecycle authority, reviewer eligibility, solo-maintainer hold and re-enablement conditions | +| [0013](0013-manifest-v3-extension-authority.md) | Manifest V3 compatibility and extension-to-Agent authority | Proposed | Chromium extension compatibility evidence, profile separation, extension grants, native-messaging boundary and release claims | +| [0014](0014-architecture-decision-governance.md) | Architecture decision acceptance governance | Proposed | ADR lifecycle authority, reviewer eligibility, solo-maintainer hold and re-enablement conditions | | [0100](0100-rust-control-plane-boundary.md) | Rust control-plane boundary | Proposed | Rust-owned product authority versus Chromium compatibility kernel | | [0101](0101-isolated-execution-profile-modes.md) | Isolated execution/profile modes | Proposed | Human, Assist, Agent Task and Crawler session/profile isolation | | [0102](0102-typed-actions-and-arbitrary-js.md) | Typed actions over arbitrary JavaScript authority | Proposed | action API, script escape hatches, risk/policy semantics | From 39ecb33130db33320ace5d347b7b66633dbeb514 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 12:51:15 +0900 Subject: [PATCH 025/130] test(docs): parse repository ADR status metadata forms --- tests/test_documentation_fitness_contract.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index a55a4b92..2485c084 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -25,7 +25,10 @@ def _adr_files() -> set[str]: def _adr_file_status(path: Path) -> str: """Read one ADR's explicit lifecycle status from its metadata header.""" text = path.read_text(encoding="utf-8") - match = re.search(r"(?im)^-\s+(?:\*\*)?Status(?:\*\*)?:\s*(\w+)\s*$", text) + match = re.search( + r"(?im)^-\s+(?:\*\*Status:\*\*|\*\*Status\*\*:|Status:)\s*(\w+)\s*$", + text, + ) if match is None: raise AssertionError(f"ADR has no parseable status: {path.name}") status = match.group(1) From 63f96299edcc3c8c6bbcfeff18f5ad66a794e674 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 13:22:01 +0900 Subject: [PATCH 026/130] test(docs): accept descriptive ADR lifecycle metadata --- tests/test_documentation_fitness_contract.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index 2485c084..1579fdca 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -26,7 +26,7 @@ def _adr_file_status(path: Path) -> str: """Read one ADR's explicit lifecycle status from its metadata header.""" text = path.read_text(encoding="utf-8") match = re.search( - r"(?im)^-\s+(?:\*\*Status:\*\*|\*\*Status\*\*:|Status:)\s*(\w+)\s*$", + r"(?im)^-\s+(?:\*\*Status:\*\*|\*\*Status\*\*:|Status:)\s*(\w+)(?:\s+.+)?$", text, ) if match is None: From 936f178daac085a5b1ae6ff71210fe9df7793a9c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 13:24:52 +0900 Subject: [PATCH 027/130] docs: reconcile protected-main and active-PR traceability --- docs/traceability/README.md | 160 ++++++++++++++++++++---------------- 1 file changed, 89 insertions(+), 71 deletions(-) diff --git a/docs/traceability/README.md b/docs/traceability/README.md index 3d5a298e..f2c7f2c6 100644 --- a/docs/traceability/README.md +++ b/docs/traceability/README.md @@ -1,12 +1,12 @@ # OriginWeave Product and Decision Traceability - **Status:** Proposed authoritative traceability baseline -- **Scope:** Product requirements, Accepted architecture, implemented kernels, planned adapters, conversation-derived decisions, standards, and verification evidence +- **Scope:** Product requirements, Accepted architecture, protected-main implementation, active-PR implementation, planned adapters, conversation-derived decisions, standards, and verification evidence This file prevents two opposite errors: 1. an implemented safety boundary becoming undiscoverable because it exists only in code/tests; and -2. a product-design conversation or pull-request proposal being presented as if it already shipped. +2. a product-design conversation, issue, or active pull request being presented as if it already shipped. ## 1. Evidence precedence @@ -15,81 +15,95 @@ For current behavior, use this precedence order: 1. exact protected-main code and executable tests; 2. Accepted ADRs governing that code; 3. current root `ARCHITECTURE.md` and authoritative PRD/TRD aligned to protected main; -4. roadmap and issue/PR plans; -5. conversation-derived product decisions and research notes. +4. active-PR code/tests as explicitly labeled non-shipped evidence; +5. roadmap and issue plans; +6. conversation-derived product decisions and research notes. -Lower layers may define future direction but cannot override current protected implementation or an Accepted ADR. +Lower layers may define future direction but cannot override current protected implementation or an Accepted ADR. Active-PR behavior is never protected-main truth. -## 2. Status vocabulary +## 2. Capability maturity vocabulary -- **Implemented** — present on protected `main` with executable evidence. -- **Accepted architecture** — governing reviewed direction, though the complete runtime path may be unfinished. -- **Proposed** — candidate product/design decision requiring reviewed adoption. -- **Open** — intentionally unresolved. +Capability maturity uses exactly one of these values: -A change can move from Proposed -> Accepted architecture -> Implemented, but never skips evidence merely because the idea is compelling. +- **IMPLEMENTED_ON_PROTECTED_MAIN** — present on protected `main` with executable evidence. +- **IMPLEMENTED_ON_ACTIVE_PR** — implemented and testable on an active PR, but not shipped/protected-main truth. +- **PARTIAL** — material foundations are implemented, while a named runtime, lifecycle, integration, or acceptance boundary remains incomplete. +- **ACCEPTED_ARCHITECTURE** — governing reviewed direction; implementation may be incomplete. +- **PLANNED** — accepted product backlog or target architecture without current implementation evidence. +- **RESEARCH_ONLY** — exploratory evidence that does not define a product commitment. +- **SUPERSEDED** — replaced by later implementation or architecture authority. +- **OUT_OF_SCOPE** — intentionally excluded from the current product boundary. + +ADR lifecycle is separate and remains `Proposed`, `Accepted`, `Superseded`, `Deprecated`, or `Rejected`. An Accepted ADR is design authority, not implementation proof. ## 3. Product-level decision trace -| Product decision | Origin/status | Authoritative artifact | Protected implementation/evidence | +| Product decision | Capability maturity | Authoritative artifact | Protected-main / active-PR evidence boundary | |---|---|---|---| -| Chromium remains the compatibility kernel rather than rewriting Blink/V8 | Accepted architecture | ADR 0001; `ARCHITECTURE.md`; PRD-COMP-001 | Architecture/repository contract tests; Chromium adapter itself remains Planned | -| `Browse. Act. Prove.` provenance-native product identity | Accepted product framing | `README.md`; `docs/PRD.md`; roadmap | Evidence/provenance foundation implemented; full buyer Evidence Trail Planned | -| Human / Assist / Agent Task / Crawler execution modes | Accepted architecture | `ARCHITECTURE.md`; `docs/PRD.md`; ADR 0002 | Core mode/purpose and policy foundation implemented; browser-session integration Planned | -| Page content is data, never instruction authority | Implemented foundation | ADR 0002; `ARCHITECTURE.md`; `docs/TRD.md` | `originweave-core` + `originweave-policy` tests | -| Typed actions instead of default arbitrary JavaScript | Accepted architecture | PRD-ACT-001..004; ADR 0002 | Typed core/policy foundation implemented; full browser action adapter Planned | -| logical origin != resolved destination | Implemented | ADR 0004; TRD-INV-002 | `originweave-destination`; destination governance tests | -| resolved destination != TCP peer | Implemented | ADR 0005; TRD Section 6 | `originweave-network`; loopback/peer tests | -| TCP peer != TLS service identity | Implemented | ADR 0006; TRD Section 6 | `originweave-tls`; rustls integration tests | -| Proxy/PAC route authority must be explicit | Accepted architecture / active development | PRD-NET-005; TRD Section 6.3 | Protected-main direct-only boundary exists; complete proxy execution not yet shipped | -| HTTP semantics require an authenticated governed connection and resource bounds | Accepted architecture / active development | PRD-NET-006; TRD Section 6.6 | Not yet a protected-main product capability in this baseline | -| Node handles bind session/context/origin/document lifetime | Proposed/active development | PRD-OBS-001/002; TRD Section 5 | Not treated as shipped until protected integration | -| Raw secrets never enter model context | Accepted architecture / implemented policy foundation | PRD-DATA-001; ADR 0002; TRD Section 9 | Core secret-delivery policy implemented; trusted broker runtime Planned | -| Sensitive disclosure is purpose-bound and classification-bound | Proposed/active development | PRD-DATA-002; TRD Section 9 | Do not claim complete broker/service until protected integration | -| Evidence/provenance are product outputs, not debug leftovers | Accepted / foundation implemented | ADR 0003; PRD Section 9.6 | `originweave-evidence`; evidence governance tests | -| Human interaction outranks inference/background collection | Accepted architecture / foundation implemented | `ARCHITECTURE.md`; PRD-RES-002 | Deterministic resource mitigation foundation implemented; platform telemetry Planned | -| Structured observation precedes raw HTML/screenshot fallback | Accepted architecture | PRD-OBS-003; TRD Section 7 | Observation adapter Planned | -| WebDriver BiDi / CDP / WebMCP / MCP are adapters, not internal authority | Accepted architecture | PRD Section 9.8; TRD Section 12 | Adapter implementations Planned | -| Manifest V3 compatibility is preserved upstream where practical | Accepted architecture | ADR 0001; PRD Section 9.9 | Chromium compatibility program Planned | -| WARC/PROV-oriented durable evidence adapters | Accepted architecture / Planned | ADR 0003; PRD-EVD-005 | Source/provenance kernel foundation exists; persistence adapters Planned | -| Origin Map visualizes value/action provenance | **conversation-derived Proposed** product UX | PRD-EVD-004; this traceability record | No shipped UI claim | -| Browser / Runtime / Observe / Capture / Governor / Policy / Evidence / Protocol / SDK product surfaces | **conversation-derived Proposed product taxonomy**, aligned to existing architecture | PRD Section 6 | Some foundations exist under crates; named commercial surfaces are not all shipped artifacts | -| Constrained GPU phase scheduling for browser rendering vs local inference | **conversation-derived Accepted architecture direction**, implementation Planned | PRD-RES-005; TRD Section 10 | Deterministic resource plan exists; real GPU scheduler/telemetry Planned | -| Enterprise SSO/SCIM/residency/audit/procurement package | Planned | PRD Section 9.11; roadmap Phase 5 | Not shipped in pre-alpha baseline | +| Chromium remains the compatibility kernel rather than rewriting Blink/V8 | ACCEPTED_ARCHITECTURE | ADR 0001; `ARCHITECTURE.md`; PRD-COMP-001 | Architecture/repository contracts exist; complete branded browser distribution remains Planned | +| `Browse. Act. Prove.` provenance-native product identity | ACCEPTED_ARCHITECTURE | `README.md`; `docs/PRD.md`; roadmap | Evidence/provenance foundations exist; complete buyer Evidence Trail remains Planned | +| Human / Assist / Agent Task / Crawler execution modes | PARTIAL | `ARCHITECTURE.md`; `docs/PRD.md`; ADR 0002 | Core mode/purpose/policy foundations exist; browser-session/profile integration remains incomplete | +| Page content is data, never instruction authority | IMPLEMENTED_ON_PROTECTED_MAIN | ADR 0002; `ARCHITECTURE.md`; `docs/TRD.md` | `originweave-core` + `originweave-policy` tests | +| Typed actions instead of default arbitrary JavaScript | PARTIAL | PRD-ACT-001..004; ADR 0002 | Typed core/policy foundations are on main; complete browser action adapter remains Planned | +| logical origin != resolved destination | IMPLEMENTED_ON_PROTECTED_MAIN | ADR 0004; TRD-INV-002 | `originweave-destination`; destination governance tests | +| resolved destination != TCP peer | IMPLEMENTED_ON_PROTECTED_MAIN | ADR 0005; TRD Section 6 | `originweave-network`; loopback/peer tests | +| TCP peer != TLS service identity | IMPLEMENTED_ON_PROTECTED_MAIN | ADR 0006; TRD Section 6 | `originweave-tls`; rustls integration tests | +| Proxy/PAC route authority must be explicit | PARTIAL | PRD-NET-005; TRD Section 6.3 | Protected-main direct-route authority exists; PAC evaluation/proxy transport/CONNECT remain incomplete | +| Bounded HTTP semantics require an authenticated governed connection and resource bounds | IMPLEMENTED_ON_ACTIVE_PR | PRD-NET-006; issue #9; active PR #37 | `originweave-http` replacement exists on active PR #37; historical PR #11 is SUPERSEDED implementation lineage and is not current evidence; no protected-main HTTP claim yet | +| Node handles bind session/context/origin/document lifetime | PARTIAL | ADR 0010; PRD-OBS-001/002; TRD Section 5 | Core opaque session/context/document/node authority is on protected main; active PR #40 owns the protocol-ID registry and remains non-shipped evidence | +| Raw secrets never enter model context | PARTIAL | PRD-DATA-001; ADR 0002; TRD Section 9 | Core secret-delivery policy exists; trusted broker/runtime completion remains Planned | +| Sensitive disclosure is purpose- and classification-bound | PARTIAL | ADR 0007; PRD-DATA-002; issue #10 | Purpose-bound policy kernel and sensitive-access evidence foundations are on protected main; trusted broker/storage/revocation/lifecycle/model-disclosure boundary remains open | +| Evidence/provenance are product outputs, not debug leftovers | PARTIAL | ADR 0003; PRD Section 9.6 | `originweave-evidence` foundations exist; complete durable Evidence Trail/WARC/PROV adapters remain Planned | +| Human interaction outranks inference/background collection | PARTIAL | `ARCHITECTURE.md`; PRD-RES-002 | Deterministic resource mitigation/CPU-worker admission foundations exist; platform telemetry/actuation remain Planned | +| Structured observation precedes raw HTML/screenshot fallback | ACCEPTED_ARCHITECTURE | PRD-OBS-003; TRD Section 7 | Real semantic observation adapter remains Planned | +| WebDriver BiDi / CDP / WebMCP / MCP are adapters, not internal authority | ACCEPTED_ARCHITECTURE | PRD Section 9.8; TRD Section 12 | Protocol adapter implementation remains Planned/active under issue #28; active PR #40 may not be called shipped | +| Manifest V3 compatibility is preserved upstream where practical | PARTIAL | ADR 0001; issue #27; Proposed ADR 0013 | Protected main has pinned real-Chromium compatibility evidence for service worker/content script/storage/DNR/tabs/windows/scripting/commands/side panel/bookmarks/history/restart/repeatability; active PR #43 adds real bounded downloads evidence; full issue #27 matrix remains incomplete | +| Extension permission does not imply OriginWeave Agent capability | PARTIAL | protected-main extension authority kernel; Proposed ADR 0013 | Core extension-to-Agent authority isolation exists on protected main; complete managed-extension/native-messaging/enterprise release policy remains incomplete | +| WARC/PROV-oriented durable evidence adapters | PLANNED | ADR 0003; PRD-EVD-005 | Source/provenance kernel foundation exists; persistence/export adapters remain Planned | +| Origin Map visualizes value/action provenance | PLANNED | PRD-EVD-004; this traceability record | No shipped UI claim | +| Browser / Runtime / Observe / Capture / Governor / Policy / Evidence / Protocol / SDK product surfaces | PARTIAL | PRD Section 6 | Some foundations exist under crates; named commercial surfaces are not all shipped artifacts | +| Constrained GPU phase scheduling for browser rendering vs local inference | PARTIAL | PRD-RES-005; TRD Section 10 | Deterministic resource plan exists; real GPU scheduler/telemetry remains Planned | +| Enterprise SSO/SCIM/residency/audit/procurement package | PLANNED | PRD Section 9.11; roadmap Phase 5 | Not shipped in pre-alpha baseline | ## 4. Requirement-to-module trace -| Requirement family | Current module(s) | Primary tests/docs | Implementation status | +| Requirement family | Current module(s) / lane | Primary tests/docs | Capability maturity | |---|---|---|---| -| Canonical origin / action / approval | `originweave-core` | crate tests; ADR 0002 | Implemented | -| Deterministic action policy | `originweave-policy` | policy/security-review tests | Implemented | -| Destination/rebinding/redirect | `originweave-destination` | destination tests; ADR 0004 | Implemented | -| Exact direct socket/peer | `originweave-network` | real loopback + error tests; ADR 0005 | Implemented | -| TLS identity | `originweave-tls` | real rustls integration; ADR 0006 | Implemented | -| Resource budgets/mitigations | `originweave-resource` | crate tests | Implemented foundation | -| Redacted evidence/provenance | `originweave-evidence` | crate tests; ADR 0003 | Implemented foundation | -| HTTP | future/active `originweave-http` work | dedicated design/tests/PR evidence | Planned until protected merge | -| Proxy/PAC | destination foundation + future adapter | roadmap/TRD | Planned/active | -| Session/observation/action | future crates/adapters | roadmap/TRD/UML | Planned/active | -| Secret broker | future bounded service/crate | PRD/TRD | Planned/active | -| BiDi/CDP/WebMCP/MCP | adapter crates | protocol compatibility tests required | Planned | -| WARC/PROV persistence | persistence adapters | doctoring + future conformance tests | Planned | +| Canonical origin / action / approval | `originweave-core` | crate tests; ADR 0002 | IMPLEMENTED_ON_PROTECTED_MAIN | +| Deterministic action policy | `originweave-policy` | policy/security-review tests | IMPLEMENTED_ON_PROTECTED_MAIN | +| Destination/rebinding/redirect | `originweave-destination` | destination tests; ADR 0004 | IMPLEMENTED_ON_PROTECTED_MAIN | +| Exact direct socket/peer | `originweave-network` | real loopback + error tests; ADR 0005 | IMPLEMENTED_ON_PROTECTED_MAIN | +| TLS identity | `originweave-tls` | real rustls integration; ADR 0006 | IMPLEMENTED_ON_PROTECTED_MAIN | +| Resource budgets/mitigations | `originweave-resource` | crate tests | PARTIAL | +| Redacted evidence/provenance | `originweave-evidence` | crate tests; ADR 0003 | PARTIAL | +| Bounded HTTP/1.1 | active `originweave-http` replacement in PR #37 | issue #9; active-PR unit/integration/coverage evidence | IMPLEMENTED_ON_ACTIVE_PR | +| Proxy/PAC | destination/route foundation + future adapter | roadmap/TRD | PARTIAL | +| Session/context/document/node authority | `originweave-core` authority values; active registry work in PR #40 | ADR 0010; roadmap/TRD/UML | PARTIAL | +| Manifest V3 compatibility evidence | `scripts/ci/run_mv3_compatibility.py` + controlled MV3 fixture; active downloads lane #43 | issue #27; real-browser contracts | PARTIAL | +| Extension-to-Agent authority | protected-main core authority kernel + Proposed ADR 0013 | issue #27; extension authority UML | PARTIAL | +| Purpose-bound sensitive-data policy/evidence | `originweave-policy` + evidence foundations | ADR 0007; issue #10 | PARTIAL | +| Trusted sensitive-data broker/storage/lifecycle | future bounded service/crate | issue #10; PRD/TRD/data governance | PLANNED | +| BiDi/CDP/WebMCP/MCP | future/versioned adapter crates; registry prerequisite active in #40 | protocol compatibility tests required | PLANNED | +| WARC/PROV persistence | persistence/export adapters | doctoring + future conformance tests | PLANNED | ## 5. Requirement-to-ADR trace -| Requirement | Governing ADR | +| Requirement | Governing ADR / current decision boundary | |---|---| -| PRD-COMP-001, PRD-COMP-003 | ADR 0001 | -| PRD-ACT-001, PRD-ACT-005, PRD-CRAWL-001, trust-source boundary | ADR 0002 | -| PRD-EVD-001, PRD-EVD-002, PRD-EVD-005 | ADR 0003 | -| PRD-NET-001, PRD-NET-002, redirect/rebinding boundary | ADR 0004 | -| PRD-NET-003 | ADR 0005 | -| PRD-NET-004 | ADR 0006 | -| Session/context/document node binding | Proposed/active decision; index only after dedicated ADR reaches protected main | -| Proxy/PAC route execution | Proposed/active decision; protected-main index updates after merge | -| HTTP semantics | Proposed/active decision; protected-main index updates after merge | -| Sensitive-data broker lifecycle | Proposed/active decision; policy/evidence slices do not equal full broker acceptance | -| Enterprise deployment/privacy | Open ADR family before production release | +| PRD-COMP-001, Chromium compatibility kernel | ADR 0001 (Accepted) | +| PRD-ACT-001, PRD-ACT-005, PRD-CRAWL-001, trust-source boundary | ADR 0002 (Accepted) | +| PRD-EVD-001, PRD-EVD-002, PRD-EVD-005 | ADR 0003 (Accepted) | +| PRD-NET-001, PRD-NET-002, redirect/rebinding boundary | ADR 0004 (Accepted) | +| PRD-NET-003 | ADR 0005 (Accepted) | +| PRD-NET-004 | ADR 0006 (Accepted) | +| Purpose-bound sensitive-data authority | ADR 0007 (Accepted); trusted broker/storage/lifecycle still issue #10 | +| TLS delegated-task leaf-validity horizon | ADR 0008 (Accepted) | +| Session/context/document/node binding | ADR 0010 (Accepted); active registry implementation #40 remains non-shipped | +| Manifest V3 compatibility + extension-to-Agent authority | ADR 0013 is Proposed on documentation PR #44; protected-main extension authority code does not auto-Accept the ADR | +| Architecture-decision acceptance governance | ADR 0014 is Proposed on documentation PR #44; protected-main AGENTS + live policy remain authoritative | +| HTTP semantics | active PR #37 contains its feature ADR lineage; it is active-PR evidence until protected merge and index reconciliation | +| Proxy/PAC route execution | current protected-main route authority + future dedicated execution decision as needed | +| Enterprise deployment/privacy | open ADR family before production release | ## 6. Standards-to-decision trace @@ -101,7 +115,7 @@ The canonical APA 7th bibliography is [`../doctoring.md`](../doctoring.md). This | IANA special-purpose registries / RFC 6890 / RFC 8190 / RFC 9637 | Destination classification and fail-closed public-web policy | | RFC 9293 | Exact TCP endpoint/peer model | | RFC 5280 / RFC 9525 / current TLS guidance | Certificate path and HTTPS service identity | -| RFC 9110 and related HTTP specifications | Redirect and bounded HTTP semantics | +| RFC 9110 / RFC 9112 / RFC 9530 | Bounded HTTP semantics, framing, redirect evidence and digest fields | | RFC 9309 | Crawler robots evidence, explicitly not access authorization | | W3C WebDriver BiDi | Versioned browser automation adapter, not core authority | | Chrome DevTools Protocol | Chromium-specific observation/diagnostic adapter | @@ -114,15 +128,17 @@ Material claims should update `docs/doctoring.md` with current primary evidence ## 7. Diagram-to-requirement trace -| Diagram | Requirements represented | +| Diagram | Requirements represented / maturity | |---|---| | UML component/bounded-context view | Product family, Chromium/Rust ownership, adapter boundaries | -| Network authority sequence | PRD-NET-001..007; TRD-INV-002 | +| Network authority sequence | PRD-NET-001..007; TRD-INV-002; HTTP remains active-PR until #37 integrates | | Observation/action sequence | PRD-OBS, PRD-ACT, PRD-DATA, trust separation | | Delegated-task state machine | session lifecycle, approval, resource pause, cancellation/recovery, post-condition truth | | Deployment topology | renderer trust, orchestrator/model/store boundaries | -| Evidence authority flow | PRD-EVD; separation of proposal/policy/approval/execution/outcome | -| Conceptual ERD | durable session/action/network/sensitive/resource/provenance identity | +| Evidence authority flow | PRD-EVD; proposal/policy/approval/execution/outcome separation | +| Extension authority sequence | MV3 compatibility plane vs explicit OriginWeave extension grant and Agent capability separation | +| Conceptual ERD | session/action/network/sensitive/resource/provenance identity; conceptual model does not imply physical persistence | +| Real Chromium vertical-slice sequence | PLANNED until issue #28 implementation stabilizes; do not encode temporary adapter fields as shipped architecture | ## 8. Conversation-to-repository capture rule @@ -130,23 +146,25 @@ A **conversation-derived** decision is not binding merely because it was repeate If material and absent from GitHub: -1. record it as `Proposed` or `Open` in PRD/TRD/traceability; -2. create/supersede an ADR when it changes a governing architecture decision; +1. record it with explicit capability maturity in PRD/TRD/traceability; +2. create or supersede an ADR when it changes a governing architecture decision; 3. update UML/ERD when relationships or lifecycles change; 4. add standards/research to `docs/doctoring.md` when evidence is material; -5. add executable tests before calling production behavior Implemented; +5. add executable tests before calling production behavior `IMPLEMENTED_ON_PROTECTED_MAIN`; 6. update the protected-main ADR index only after review and merge. This rule intentionally prevents chat history from becoming a shadow architecture database. ## 9. Documentation drift checks -Repository contracts should fail when the canonical PRD/TRD/ADR index/UML/ERD/traceability files disappear or when core status/authority vocabulary is removed. More semantic checks should be added when a specific drift has caused a real defect; avoid brittle tests that duplicate prose without protecting a contract. +Repository contracts should fail when canonical PRD/TRD/ADR/UML/ERD/traceability artifacts disappear, lifecycle/index status diverges, an active PR is promoted to protected-main truth, or core maturity/authority vocabulary is removed. More semantic checks should be added when a specific drift has caused a real defect; avoid brittle tests that merely duplicate prose. ## 10. Open traceability work +- **Open:** reconcile PRD/TRD implementation notes that still name historical PR #11 or already-integrated sensitive-data work; active PR #37 is current HTTP implementation evidence but remains non-shipped until merge. +- **Open:** after #43 integrates, move bounded MV3 downloads from `IMPLEMENTED_ON_ACTIVE_PR` into the protected-main compatibility evidence inventory while issue #27 remains open for the complete matrix. +- **Open:** after #40 stabilizes/integrates, map its registry API and tests without presenting raw BiDi/CDP identifiers as durable authority. - **Open:** attach concrete release profiles and quantitative benchmark thresholds after reproducible benchmark evidence exists. - **Open:** map every future public OriginWeave Protocol operation to risk/capability/authority and conformance tests. - **Open:** map enterprise controls to exact SOC 2/CSAP-oriented control evidence without claiming certification. - **Open:** add data-retention and residency lifecycle diagrams when persistence/tenant adapters become concrete. -- **Open:** after active feature PRs merge, update this matrix from `Proposed/active development` to the exact protected implementation and Accepted ADRs. From 9409cc58837bda6172a3dd5321121169a070c890 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 13:30:19 +0900 Subject: [PATCH 028/130] docs: refresh fitness after traceability reconciliation --- docs/DOCUMENTATION_FITNESS.md | 144 +++++++++++++++++++--------------- 1 file changed, 79 insertions(+), 65 deletions(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index 487924c6..6f1a8bf8 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -7,9 +7,9 @@ ## 1. Meaning of the verdict -**DESIGN-SUFFICIENT** means the repository now contains enough coherent product, technical, architecture, decision, diagram, data-model, security, testing, operability, protocol and release material to implement and review OriginWeave without reconstructing the original design from conversation history. +**DESIGN-SUFFICIENT** means the repository contains enough coherent product, technical, architecture, decision, diagram, data-model, security, testing, operability, protocol and release material to implement and review OriginWeave without reconstructing the original design from conversation history. -**PROTECTED-MAIN-PARTIAL** means the canonical graph still contains stale implementation-status references and incomplete current-state reconciliation. The documentation set is broad enough, but several documents lag protected-main code and active replacement work. Therefore documentation is not yet a release-quality source of current implementation truth. +**PROTECTED-MAIN-PARTIAL** means the canonical graph still contains stale implementation-status references and incomplete current-state reconciliation. The documentation set is broad enough, but PRD/TRD and some implementation-facing views lag protected-main code or current active replacement work. Therefore documentation is not yet a release-quality source of current implementation truth. File existence alone is never sufficient. A document can be present and still be stale, contradictory, overclaiming, underclaiming, or disconnected from code and evidence. @@ -17,71 +17,77 @@ File existence alone is never sufficient. A document can be present and still be | Documentation family | Fitness | Evidence / current gap | |---|---|---| -| PRD | **PARTIAL** | Strong whole-product requirements, modes, product family and buyer outcomes. Some implementation notes are stale: HTTP still points at historical PR #11 rather than the current replacement line; sensitive-data policy text still refers to work that has since integrated on protected main; recent real MV3 compatibility evidence is underrepresented. | -| TRD | **PARTIAL** | Strong authority stack, lifecycle, action, observation, network, secret and resource contracts. Current implementation inventory lags protected-main additions and uses composite phrases such as `Planned / active development` even though the document defines a single controlled status vocabulary. | -| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium-compatibility-kernel + Rust-control-plane direction and explicit authority layers. Must continue to be reconciled when the browser registry, HTTP replacement and Chromium vertical slice integrate. | -| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Previous index omitted Accepted ADRs 0007, 0008 and 0010, omitted Proposed ADR 0009, and described 0100-series ADRs as being `in this change` even after the documentation baseline reached protected main. This branch reconciles discoverability and status categories without promoting Proposed ADRs. | -| Individual ADRs | **PARTIAL** | Core Accepted decisions 0001-0008 and 0010 are durable. Proposed 0009 and 0100-0109 remain explicitly Proposed. HTTP feature ADRs remain active-PR evidence until the replacement merges. A dedicated accepted extension/MV3 authority decision is still required before closing the extension compatibility issue. | -| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | The product-wide pack already contains component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly deterministic-gate/model/publication flows. This branch adds [`uml/extension-authority.md`](uml/extension-authority.md) so Chromium MV3 permission and OriginWeave Agent capability cannot be visually conflated. The real Chromium vertical-slice sequence remains incomplete until issue #28 stabilizes. | -| Conceptual ERD/domain model | **PRESENT-CURRENT with follow-up** | Correctly distinguishes conceptual persistence and includes session/context, action/policy/approval, network/TLS/HTTP, sensitive authority, resources, provenance, downloads and extension grants. Must be updated only when persistence ownership or new durable entities actually change; do not invent a database merely to increase diagram count. | -| Traceability | **PARTIAL** | Requirement/decision/standard/module/test mapping exists but must be reconciled with protected-main MV3 evidence, the HTTP replacement, browser registry work and issue-driven buyer gaps. Active PRs must remain visibly distinct from protected-main implementation. | +| PRD | **PARTIAL** | Strong whole-product requirements, modes, product family and buyer outcomes. Some implementation notes are stale: HTTP still names historical PR #11 rather than current replacement PR #37; sensitive-data policy text still references already-integrated work; real pinned-Chromium MV3 evidence is underrepresented. | +| TRD | **PARTIAL** | Strong authority stack, lifecycle, action, observation, network, secret and resource contracts. Current implementation inventory lags protected-main additions and still uses composite implementation language in places where protected-main, active-PR and planned maturity should be separated. | +| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium-compatibility-kernel + Rust-control-plane direction and explicit authority layers. Reconcile again when the browser registry, HTTP replacement and Chromium vertical slice integrate. | +| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | The previous index omitted Accepted ADRs 0007, 0008 and 0010, omitted Proposed ADR 0009, and retained change-local wording. This branch repairs discoverability/status categories and adds Proposed ADRs 0013/0014 without promoting them to Accepted. | +| Individual ADRs | **PARTIAL** | Accepted decisions 0001-0008 and 0010 remain design authority. Proposed 0009, 0013, 0014 and 0100-0109 remain explicitly non-binding. HTTP feature ADRs remain active-PR evidence until PR #37 integrates. Extension/MV3 authority now has Proposed ADR 0013; issue #27 cannot close merely because the proposal exists. | +| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Product-wide component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. This branch adds [`uml/extension-authority.md`](uml/extension-authority.md), separating Chromium MV3 permission from OriginWeave Agent capability. The real Chromium vertical-slice sequence remains incomplete until issue #28 stabilizes. | +| Conceptual ERD/domain model | **PRESENT-CURRENT with follow-up** | Correctly distinguishes conceptual persistence and includes session/context, action/policy/approval, network/TLS/HTTP, sensitive authority, resources, provenance, downloads and extension grants. Update only when persistence ownership or durable entities actually change; do not invent a database to increase diagram count. | +| Traceability | **REPAIRED IN THIS CHANGE / PARTIAL BY DESIGN** | This branch now separates `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, accepted architecture and planned work. It records #37 as active HTTP evidence, protected-main node authority plus #40 registry work, partial protected-main MV3 evidence plus #43 downloads, and protected-main sensitive-data foundations plus issue #10 broker lifecycle. PRD/TRD still need the same reconciliation. | | Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, secret, network, provenance and extension risks. Continue adding executable mitigations when HTTP/browser/runtime boundaries integrate. | -| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code coverage, rustdoc and realistic boundary testing are explicit. Real Chromium and MV3 compatibility evidence is now growing and must remain release-bound to pinned browser evidence. | -| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. Protected-main evidence for the hourly model-backed development path remains an operational closure requirement rather than a documentation-only claim. | -| API / protocol contract | **PRESENT-CURRENT as target contract** | The typed OriginWeave Protocol boundary is documented but much of the browser adapter implementation remains Planned. Keep adapter identifiers non-authoritative and versioned. | +| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code coverage, rustdoc and realistic boundary testing are explicit. Real Chromium/MV3 evidence must remain release-bound to pinned browser evidence rather than source-text assertions. | +| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. Protected-main evidence for model-backed hourly development remains an operational-closure requirement rather than a documentation-only claim. | +| API / protocol contract | **PRESENT-CURRENT as target contract** | Typed OriginWeave Protocol boundaries are documented but much browser adapter implementation remains Planned. Keep adapter identifiers non-authoritative and versioned. | | Release / rollback / provenance | **PRESENT-CURRENT** | Correctly prevents feature-level green checks from becoming release readiness. Formal release remains blocked by missing full browser/runtime product evidence. | -| Data governance / PII | **PRESENT-CURRENT as architecture; PARTIAL implementation** | Correctly rejects blanket masking and ambient raw propagation in favor of purpose-bound authorization, opaque handles, encryption, retention and audit. Trusted broker/storage/lifecycle completion remains open work. | -| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary standards and APA 7 doctoring exist in [`doctoring.md`](doctoring.md) and the browser/agent protocol addendum [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md). Experimental/draft browser interfaces remain explicitly separated from final normative standards. | +| Data governance / PII | **PRESENT-CURRENT as architecture; PARTIAL implementation** | Correctly rejects blanket masking and ambient raw propagation in favor of purpose-bound authorization, opaque handles, encryption, retention and audit. Trusted broker/storage/revocation/lifecycle completion remains open under issue #10. | +| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary standards and APA 7 doctoring exist in [`doctoring.md`](doctoring.md) and [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md). Experimental/draft browser interfaces remain explicitly separated from final normative standards. | ### 2.1 Primary-source standards evidence used by this assessment -The protocol names in this assessment are not free-floating design jargon. Their normative or official status is grounded in the repository doctoring and these primary sources: +The protocol names in this assessment are grounded in repository doctoring and primary sources: | Boundary | Primary evidence | Repository evidence rule | |---|---|---| -| WebDriver BiDi | [W3C WebDriver BiDi, 1 June 2026 Working Draft](https://www.w3.org/TR/2026/WD-webdriver-bidi-20260601/) | [`doctoring.md`](doctoring.md) and [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md) record that it is a Working Draft and therefore remains adapter-bound. | -| Manifest V3 | [Chrome manifest format](https://developer.chrome.com/docs/extensions/reference/manifest) and [Manifest Version](https://developer.chrome.com/docs/extensions/reference/manifest/manifest-version) | The browser-protocol addendum records MV3 as the current Chrome extension baseline without claiming universal Chrome/Web Store/Google-service compatibility. | -| Chrome DevTools Protocol | [Official CDP tip-of-tree documentation](https://chromedevtools.github.io/devtools-protocol/tot/) | The official documentation says tip-of-tree changes frequently and has no backwards-compatibility guarantee; OriginWeave pins and versions the adapter. | -| WebMCP | [Chrome WebMCP](https://developer.chrome.com/docs/ai/webmcp), [WebMCP tool security](https://developer.chrome.com/docs/ai/webmcp/secure-tools), and [agent security considerations](https://developer.chrome.com/docs/agents/security) | The addendum records the origin-trial/experimental status and the untrusted-content/prompt-injection boundary. | -| Model Context Protocol | [MCP 2026-07-28 specification](https://modelcontextprotocol.io/specification/2026-07-28) and [official release announcement](https://blog.modelcontextprotocol.io/posts/2026-07-28/) | OriginWeave keeps durable browser state in application-level handles and treats MCP as a high-level adapter, not Chromium authority. | -| W3C PROV-O | [PROV-O Recommendation](https://www.w3.org/TR/prov-o/) | [`doctoring.md`](doctoring.md) records PROV as a provenance interoperability adapter, not authorization. | -| WARC | [ISO 28500:2017](https://www.iso.org/standard/68004.html) | [`doctoring.md`](doctoring.md) records WARC as evidence/payload preservation format, not a truth or permission escalation mechanism. | +| WebDriver BiDi | [W3C WebDriver BiDi, 1 June 2026 Working Draft](https://www.w3.org/TR/2026/WD-webdriver-bidi-20260601/) | Doctoring records Working Draft status, so it remains adapter-bound. | +| Manifest V3 | [Chrome manifest format](https://developer.chrome.com/docs/extensions/reference/manifest) and [Manifest Version](https://developer.chrome.com/docs/extensions/reference/manifest/manifest-version) | MV3 is the current Chrome extension baseline without a claim of universal Chrome/Web Store/Google-service compatibility. | +| Chrome DevTools Protocol | [Official CDP tip-of-tree documentation](https://chromedevtools.github.io/devtools-protocol/tot/) | Tip-of-tree changes frequently and lacks backwards-compatibility guarantee; OriginWeave pins/versions adapters. | +| WebMCP | [Chrome WebMCP](https://developer.chrome.com/docs/ai/webmcp), [WebMCP tool security](https://developer.chrome.com/docs/ai/webmcp/secure-tools), and [agent security considerations](https://developer.chrome.com/docs/agents/security) | Doctoring records experimental/origin-trial status and untrusted-content/prompt-injection boundaries. | +| Model Context Protocol | [MCP 2026-07-28 specification](https://modelcontextprotocol.io/specification/2026-07-28) and [official release announcement](https://blog.modelcontextprotocol.io/posts/2026-07-28/) | Durable browser state remains in OriginWeave-level handles; MCP is a high-level adapter, not Chromium authority. | +| W3C PROV-O | [PROV-O Recommendation](https://www.w3.org/TR/prov-o/) | Provenance interoperability adapter, not authorization. | +| WARC | [ISO 28500:2017](https://www.iso.org/standard/68004.html) | Evidence/payload preservation format, not a truth or permission escalation mechanism. | -APA 7th references for all rows are recorded in the doctoring documents rather than duplicated into every architecture assessment. +APA 7th references are recorded in doctoring documents rather than duplicated into every architecture assessment. -## 3. Concrete stale/current discrepancies discovered +## 3. Concrete stale/current discrepancies -### 3.1 Historical HTTP PR is still named as active product evidence +### 3.1 Historical HTTP PR still appears as active PRD evidence -Protected-main PRD currently describes bounded HTTP semantics as Planned with `Active PR #11`. PR #11 is historical and intentionally non-integration-ready; current executable replacement work is PR #37. Canonical requirements must not use the historical PR as current implementation evidence after replacement lineage is established. +Protected-main PRD describes bounded HTTP semantics as Planned with `Active PR #11`. PR #11 is historical predecessor lineage; current executable replacement work is PR #37. Active PR #37 itself is not protected-main implementation truth. -**Required repair:** after the current HTTP replacement reaches a stable exact head or protected main, update PRD/TRD/traceability to point to the current lineage and then to protected-main implementation. Never transfer predecessor checks or reviews. +**Current reconciliation:** traceability now records HTTP as `IMPLEMENTED_ON_ACTIVE_PR` under #37 and treats #11 as predecessor/superseded implementation lineage. PRD/TRD still require the equivalent protected-main-vs-active-PR wording repair. Never transfer predecessor checks or reviews. ### 3.2 Sensitive-data implementation status lags protected main -Protected main has integrated purpose-bound sensitive disclosure foundations, while PRD/TRD still contain `active PR` language for the policy slice. The broader trusted broker, storage, selective model disclosure, revocation and lifecycle issue remains open, so the correct representation is **implemented policy foundation + planned broker/runtime**, not either `all shipped` or `all planned`. +Protected main has purpose-bound sensitive-disclosure policy/evidence foundations, while PRD/TRD retain stale active-PR language. The trusted broker, storage, selective model disclosure, revocation and lifecycle remain open. -### 3.3 MV3 compatibility evidence has moved beyond the original roadmap language +**Current reconciliation:** traceability now records **PARTIAL**: protected-main policy/evidence foundation + planned broker/runtime under issue #10. PRD/TRD remain to reconcile. -Protected main now has executable pinned-Chromium MV3 evidence covering restart persistence and additional core extension APIs, including bookmarks and history. Issue #27 remains open because the complete declared compatibility matrix, downloads/native-messaging/enterprise-policy boundaries and release integration are not finished. +### 3.3 MV3 compatibility evidence moved beyond original roadmap wording -**Required repair:** PRD/TRD/traceability should say **partial protected-main compatibility evidence**, while keeping the full product-surface requirement Planned/Open until the issue acceptance criteria are met. +Protected main has executable pinned-Chromium MV3 evidence for service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart and repeatability. Active PR #43 adds real bounded downloads evidence and now preserves only allowlisted download-stage diagnostics in runner failure evidence. Issue #27 remains open because the complete compatibility matrix, native-messaging/enterprise-policy boundaries and release integration are unfinished. -### 3.4 Browser authority is transitioning from value types to an adapter registry +**Current reconciliation:** traceability records protected-main compatibility as **PARTIAL** and #43 as active-PR evidence. PRD/TRD must adopt the same distinction. -Protected main already contains session/context/document/node authority foundations. PR #40 is adding the bounded session-scoped registry that prevents raw BiDi/CDP identifiers from becoming durable OriginWeave authority. The architecture and ERD are directionally correct, but PRD/TRD/UML must be reconciled after that branch reaches a stable integration state. +### 3.4 Browser authority is transitioning from protected-main value types to an adapter registry -### 3.5 ADR lifecycle discoverability had drifted +Protected main contains session/context/document/node authority foundations governed by Accepted ADR 0010. PR #40 is adding a bounded session-scoped registry so raw BiDi/CDP identifiers do not become durable OriginWeave authority. -The previous ADR index listed only 0001-0006 as current protected-main decisions even though Accepted ADRs 0007, 0008 and 0010 were present on protected main. Proposed ADR 0009 was also absent from both accepted and proposed tables. This created an architecture-discovery defect. The current documentation branch repairs the index while preserving each ADR's own Accepted/Proposed status. +**Current reconciliation:** traceability records the foundation as protected-main and #40 as active non-shipped evidence. Architecture/ERD remain directionally correct; detailed adapter UML should wait for stable protocol contracts rather than encode temporary field names. -### 3.6 UML assessment itself was initially stale +### 3.5 ADR lifecycle discoverability drifted -The first pass of this assessment incorrectly called resource-pressure and hourly automation flows missing. A direct re-read of protected-main `docs/uml/README.md` showed both already exist. This branch corrects the matrix instead of preserving the mistaken audit claim, and adds only the genuinely missing extension-permission-to-Agent-authority view. +The prior ADR index omitted Accepted ADRs 0007, 0008 and 0010 and Proposed ADR 0009. This branch repairs the index, adds Proposed ADR 0013 for MV3/extension authority and Proposed ADR 0014 for ADR acceptance governance, and preserves their non-Accepted status. -## 4. Durable conversation decisions that must remain represented +### 3.6 Documentation-contract parser overfit one metadata spelling + +The first documentation-fitness contract accepted only bare lifecycle tokens, but existing Accepted ADR 0007 legitimately uses `- Status: Accepted for the first authority kernel`. CI correctly exposed the mismatch. This branch now parses the leading lifecycle token while retaining exact supported lifecycle validation. -The following product decisions are durable architecture input and may not live only in chat, scheduler prompts, PR bodies, or implementation plans: +### 3.7 UML assessment itself was initially stale + +The first audit called resource-pressure and hourly automation flows missing. Protected-main `docs/uml/README.md` already contains both. The branch corrects the audit and adds only the genuinely missing extension-permission-to-Agent-authority view. + +## 4. Durable conversation decisions that must remain represented 1. **OriginWeave — Browse. Act. Prove.** is an enterprise agentic web runtime/provenance-native browser platform, not merely a Selenium-style automation library. 2. Chromium remains the compatibility kernel; OriginWeave does not reimplement Blink or V8 for product differentiation. @@ -103,12 +109,13 @@ The following product decisions are durable architecture input and may not live 18. Autonomous development uses NVIDIA NIM/OpenCode with deterministic gates and reviewer/publication authority separation; it does not use `COPILOT_GITHUB_TOKEN` as the development-model credential. 19. Documentation, checks, reviews and operational evidence are separate authorities. A green sub-check, model verdict, active PR, chat decision or ADR never silently upgrades missing implementation to shipped behavior. 20. Work-conserving autonomous maintenance continues to another safe lane instead of ending on one merge, one document, one RCA, one queued check or one external approval gap. +21. Repository-scoped collision-sensitive identifiers such as ADR numbers must be reserved across protected main **and active PRs**, not allocated from protected main alone. ## 5. Architecture views requiring follow-through ### 5.1 Extension authority and compatibility sequence — added in this branch -[`uml/extension-authority.md`](uml/extension-authority.md) now separates: +[`uml/extension-authority.md`](uml/extension-authority.md) separates: ```text Chromium MV3 permission @@ -124,15 +131,15 @@ It also separates **compatibility evidence** from **Agent-authority isolation ev ### 5.2 Resource-pressure state/sequence — already present -Protected-main `docs/uml/README.md` already models browser/model resource pressure and fallback. Future edits should refine it only when the platform telemetry/admission implementation changes, rather than creating a duplicate diagram merely to satisfy a checklist. +Protected-main `docs/uml/README.md` already models browser/model resource pressure and fallback. Refine it only when platform telemetry/admission implementation changes. ### 5.3 Hourly autonomous-development authority flow — already present -Protected-main `docs/uml/README.md` already models deterministic early gates, conditional model-credential use, pristine attempts, bounded validation, publication authority, protected merge and protected-main operational acceptance. Its implementation/evidence status must continue to be reconciled against the actual workflow rather than inferred from the diagram. +Protected-main `docs/uml/README.md` models deterministic early gates, conditional model-credential use, pristine attempts, bounded validation, publication authority, protected merge and protected-main operational acceptance. Its implementation/evidence status must be reconciled against actual workflows rather than inferred from the diagram. ### 5.4 Real Chromium vertical slice — incomplete until issue #28 stabilizes -Once issue #28 begins integrating, diagram and trace: +Once issue #28 contracts stabilize, diagram and trace: ```text isolated profile/context @@ -149,33 +156,40 @@ isolated profile/context ## 6. Immediate repository actions -### Execute now +### Completed or materially advanced in this documentation line + +- documentation fitness is discoverable from `docs/README.md`; +- ADR indexes are reconciled with protected-main lifecycle status; +- machine-checkable documentation fitness contracts exist and now tolerate repository-valid descriptive status suffixes; +- extension-permission-to-Agent-authority UML exists without duplicating resource/automation diagrams; +- Proposed ADRs 0013 and 0014 make MV3/extension authority and architecture-decision governance explicit without claiming Acceptance; +- traceability distinguishes protected-main, active-PR, partial and planned capability maturity; +- current active lanes #37, #40 and #43 are represented without promoting them to shipped truth. + +### Execute next when the relevant file/branch lease is clear -- Keep this fitness assessment discoverable from `docs/README.md`. -- Reconcile the ADR index with every protected-main ADR and its own status. -- Add machine-checkable documentation fitness contracts so ADR discoverability/status drift is caught automatically. -- Add the missing extension-permission-to-Agent-authority UML without duplicating already-present resource/automation views. -- Keep browser/protocol claims linked to primary evidence and APA 7 doctoring. -- Continue the existing HTTP replacement, browser-registry and MV3 compatibility work without using documentation as a reason to stop. +- reconcile PRD HTTP, sensitive-data and MV3 implementation notes to the same maturity model without encoding unstable exact heads; +- reconcile TRD implementation inventory/status language to protected-main vs active-PR vs planned truth; +- after #43 reaches a stable exact head, resolve its addressed diagnostic review finding only after exact-head checks validate the fix; +- after #37/#40 stop moving, re-read their exact contracts before mutating overlapping documentation or source. -### Defer to stable implementation state +### Defer until executable contracts stabilize -- Replace historical/current PR references in PRD/TRD/traceability immediately after the relevant active branch reaches a stable exact head or protected merge, so documentation does not race source writers. -- Add the detailed real-Chromium vertical-slice UML when its executable contracts are stable enough that the diagram will not encode temporary protocol/field names. -- Promote Proposed ADRs only through an explicit reviewed status change; do not infer Acceptance from file presence on `main`. +- add detailed real-Chromium vertical-slice UML only when issue #28 adapter contracts are stable enough that the diagram will not encode temporary protocol/field names; +- promote Proposed ADRs only through explicit reviewed status changes; file presence or matching code never implies Acceptance. ## 7. Completion criteria for documentation fitness -The whole documentation graph becomes **PROTECTED-MAIN-SUFFICIENT** only when: +The whole graph becomes **PROTECTED-MAIN-SUFFICIENT** only when: -1. PRD and TRD implementation inventories agree with current protected-main crates, APIs and executable browser/extension evidence; -2. no canonical document identifies a superseded/historical PR as current active implementation evidence; -3. the ADR index discovers every ADR and its status agrees with the file metadata; -4. UML covers all current material authority flows, including extension/Agent isolation and the real Chromium vertical slice once implemented; -5. ERD/domain models accurately distinguish conceptual, in-memory, persisted, adapter-owned and external entities; -6. traceability maps every material requirement and Accepted decision to current implementation/test/evidence or an explicit open issue; -7. machine-checkable documentation tests catch stale status/index/link/ownership terminology; +1. PRD and TRD implementation inventories agree with current protected-main crates/APIs and executable browser/extension evidence; +2. no canonical document identifies a historical/superseded PR as current implementation evidence; +3. ADR indexes discover every protected-main ADR and status agrees with file metadata; +4. UML covers every current material authority flow, including extension/Agent isolation and the real Chromium vertical slice once implemented; +5. ERD/domain models distinguish conceptual, in-memory, persisted, adapter-owned and external entities accurately; +6. traceability maps every material requirement and Accepted decision to protected-main implementation/test/evidence, explicitly active-PR evidence, or an open issue; +7. machine-checkable documentation tests catch stale status/index/link/ownership/identifier terminology; 8. security, test, operability, data-governance and release docs agree with the same shipped-vs-planned boundary; and -9. protected-main checks/review/governance for the documentation reconciliation itself pass. +9. exact-head checks/review/governance for this documentation reconciliation pass. -Until then, OriginWeave is **design-documented but not documentation-closed**. That is a product-quality finding, not a release blocker that prevents unrelated safe implementation work. \ No newline at end of file +Until then, OriginWeave is **design-documented but not documentation-closed**. This is a product-quality finding, not a reason to stop unrelated safe implementation work. From bebc7cd5dc6dc9b32a09e4e1b4770d9e65708a29 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 13:33:12 +0900 Subject: [PATCH 029/130] docs: reconcile PRD implementation evidence --- docs/PRD.md | 34 +++++++++++++++++----------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/docs/PRD.md b/docs/PRD.md index 12e5b7f0..64a0948a 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -44,7 +44,7 @@ Every requirement uses **exactly one** status from this table. Implementation ev | **Proposed** | Product direction still requiring a dedicated reviewed decision or sufficient implementation evidence. | | **Open** | A decision or acceptance criterion is intentionally unresolved. | -Only `Implemented` may describe shipped behavior. An Accepted ADR is design authority, not implementation proof. +Only `Implemented` may describe shipped behavior. An Accepted ADR is design authority, not implementation proof. Active PR implementation evidence may be named in the evidence column, but it does not change a requirement to `Implemented` until the applicable behavior reaches protected `main`. ## 4. Problem statement @@ -85,9 +85,9 @@ The status applies to the **whole named product surface**, not to every implemen | **OriginWeave Browser** | Chromium-compatible interactive distribution with governed agent entry points | Planned | No protected-main branded browser distribution yet | | **OriginWeave Runtime** | Headless/embedded governed web-task runtime | Planned | Rust authority kernels exist; browser integration remains incomplete | | **OriginWeave Observe** | Structured observation from tools, structured data, network, accessibility, DOM/layout and visual fallback | Planned | Session/context/node-authority foundations are on protected main; semantic browser observation adapter is incomplete | -| **OriginWeave Capture** | Schema-bound extraction, crawler controls, downloads and WARC/PROV-oriented capture | Planned | Evidence foundations exist; complete capture runtime not shipped | +| **OriginWeave Capture** | Schema-bound extraction, crawler controls, downloads and WARC/PROV-oriented capture | Planned | Evidence foundations and partial real-Chromium extension compatibility evidence exist; complete capture runtime is not shipped | | **OriginWeave Governor** | CPU, RAM, GPU, VRAM, admission and model/browser priority governance | Accepted architecture | Deterministic resource-budget and CPU-worker admission foundations are implemented; platform telemetry/scheduling adapters remain incomplete | -| **OriginWeave Policy** | Capability, origin, purpose, risk, crawler, approval and sensitive-data authority | Accepted architecture | Capability/origin/purpose/risk/crawler/approval foundations are implemented; purpose-bound sensitive-data policy is active work in PR #33 and the trusted broker remains planned | +| **OriginWeave Policy** | Capability, origin, purpose, risk, crawler, approval and sensitive-data authority | Accepted architecture | Capability/origin/purpose/risk/crawler/approval and purpose-bound sensitive-data policy foundations are implemented on protected main; trusted sensitive-data broker/storage/lifecycle remain planned under issue #10 | | **OriginWeave Evidence** | Credential-free evidence, provenance and task-trail contracts | Accepted architecture | Credential-free network evidence and purpose-bound sensitive-access receipts are implemented; complete Evidence Trail, WARC/PROV adapters and durable enterprise storage remain planned | | **OriginWeave Protocol** | Stable browser-agent protocol independent of one upstream automation standard | Planned | Contract documented; implementation pending | | **OriginWeave SDK** | Typed client libraries and adapters | Planned | Not a shipped product surface | @@ -163,7 +163,7 @@ planner identifies field + purpose + destination -> disclosure receipt records metadata without protected value ``` -The full journey is target architecture until the sensitive policy, trusted broker, browser-fill path, and post-condition/evidence path are all protected-main integrated. Implemented subcomponents do not make this whole sequence shipped. +The full journey is target architecture until the trusted broker, browser-fill path, and post-condition/evidence path are all protected-main integrated. The purpose-bound sensitive-data policy foundation and access-evidence primitives are already on protected main; those implemented subcomponents do not make the complete broker journey shipped. ### 8.4 Enterprise crawler @@ -183,7 +183,7 @@ public-crawl purpose | ID | Requirement | Status | Implementation evidence / note | |---|---|---|---| | PRD-COMP-001 | Chromium is the compatibility kernel; OriginWeave does not reimplement Blink or V8 | Accepted architecture | ADR 0001 | -| PRD-COMP-002 | Maintain a Manifest V3 compatibility matrix and representative extension test farm | Planned | Issue #27 / release-specific evidence required | +| PRD-COMP-002 | Maintain a Manifest V3 compatibility matrix and representative extension test farm | Planned | Partial protected-main pinned-Chromium evidence covers service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart and repeatability; active PR #43 adds bounded real downloads evidence; issue #27 still owns the complete matrix/release acceptance | | PRD-COMP-003 | Chromium-specific integrations remain behind versioned adapters | Planned | Adapter strategy ADR 0107 | | PRD-COMP-004 | Headless runtime remains independently usable without the interactive browser UI | Planned | Modular architecture target | @@ -191,8 +191,8 @@ public-crawl purpose | ID | Requirement | Status | Implementation evidence / note | |---|---|---|---| -| PRD-OBS-001 | Autonomous observations can carry explicit browser-session, browsing-context, canonical-origin and document-epoch authority | Implemented | `ObservedNodeHandle`, `BrowserSessionId`, `BrowsingContextId` and `DocumentEpoch` on protected main via #17; real browser adapter remains planned | -| PRD-OBS-002 | Actionable semantic-node handles are invalidated by relevant document-epoch changes at the action linearization boundary | Accepted architecture | Core exact-authority validation exists; adapter lifecycle/mutation invalidation and atomic dispatch evidence remain planned | +| PRD-OBS-001 | Autonomous observations can carry explicit browser-session, browsing-context, canonical-origin and document-epoch authority | Implemented | `ObservedNodeHandle`, `BrowserSessionId`, `BrowsingContextId` and `DocumentEpoch` are on protected main under Accepted ADR 0010; real browser adapter remains planned | +| PRD-OBS-002 | Actionable semantic-node handles are invalidated by relevant document-epoch changes at the action linearization boundary | Accepted architecture | Core exact-authority validation exists; adapter lifecycle/mutation invalidation and atomic dispatch evidence remain planned; active PR #40 owns the bounded protocol-ID registry and remains non-shipped evidence | | PRD-OBS-003 | Observation prefers typed/structured evidence before accessibility/DOM/layout and bounded visual fallback | Accepted architecture | ADR 0103 | | PRD-OBS-004 | Observation can use bounded incremental updates rather than full repeated snapshots | Planned | Adapter-specific design needed | | PRD-OBS-005 | Source channel and trust/provenance remain explicit | Accepted architecture | Evidence model foundations exist | @@ -215,8 +215,8 @@ public-crawl purpose | PRD-NET-002 | Resolution snapshots are bounded, origin-bound and fail closed on unapproved expansion | Implemented | `originweave-destination` | | PRD-NET-003 | Direct transport connects only to approved canonical sockets and verifies `peer_addr` | Implemented | `originweave-network` | | PRD-NET-004 | TLS authenticates service identity over the exact governed transport with explicit roots/time | Implemented | `originweave-tls` | -| PRD-NET-005 | Proxy/PAC route authority is explicit and never ambient | Implemented | Protected-main route-authority foundation from #20; PAC evaluation, proxy transport and CONNECT remain planned | -| PRD-NET-006 | Bounded HTTP semantics operate over authenticated governed transport | Planned | Active PR #11 is not shipped evidence | +| PRD-NET-005 | Proxy/PAC route authority is explicit and never ambient | Implemented | Protected-main route-authority foundation; PAC evaluation, proxy transport and CONNECT remain planned | +| PRD-NET-006 | Bounded HTTP semantics operate over authenticated governed transport | Planned | Current implementation evidence is active replacement PR #37; it is not protected-main truth. Historical PR #11 is predecessor lineage and must not be used as current implementation evidence | | PRD-NET-007 | Real Chromium navigation proves end-to-end consumption of every shipped authority layer | Planned | Issue #28 / release acceptance requirement | ### 9.5 Secret and sensitive-data authority @@ -224,8 +224,8 @@ public-crawl purpose | ID | Requirement | Status | Implementation evidence / note | |---|---|---|---| | PRD-DATA-001 | Raw secret values never enter model-visible context | Accepted architecture | ADR 0104; trusted browser/broker runtime path not fully shipped | -| PRD-DATA-002 | Sensitive disclosure binds tenant/task/field/purpose/destination/classification | Planned | Active replacement PR #33; no active-PR evidence counts as protected-main implementation | -| PRD-DATA-003 | Trusted broker owns expiry, revocation, atomic use reservation and resolution | Planned | Broker implementation pending under issue #10 | +| PRD-DATA-002 | Sensitive disclosure binds tenant/task/field/purpose/destination/classification | Implemented | Protected-main purpose-bound sensitive-data policy kernel governed by Accepted ADR 0007; this status does not claim broker/storage/value resolution | +| PRD-DATA-003 | Trusted broker owns expiry, revocation, atomic use reservation and resolution | Planned | Broker/storage/lifecycle implementation pending under issue #10 | | PRD-DATA-004 | Privacy controls use purpose-bound authorization, encryption, retention and audit rather than blanket masking | Accepted architecture | `DATA_GOVERNANCE.md` | | PRD-DATA-005 | Model disclosure additionally binds provider/model/region/retention policy | Planned | Requires orchestrator/provider integration | @@ -238,7 +238,7 @@ public-crawl purpose | PRD-EVD-003 | Evidence Trail links source, model judgement, policy, approval, action and verified outcome as distinct authorities | Planned | Conceptual ERD/provenance ADR; complete trail is not shipped | | PRD-EVD-004 | **Origin Map** provides buyer-visible provenance exploration | Proposed | UX/product-design work still required | | PRD-EVD-005 | WARC and PROV are separate interoperability/export adapters | Accepted architecture | ADR 0106 | -| PRD-EVD-006 | Sensitive-access evidence records authority without protected value | Implemented | Protected-main purpose-bound sensitive-access receipts via #31 | +| PRD-EVD-006 | Sensitive-access evidence records authority without protected value | Implemented | Protected-main purpose-bound sensitive-access receipts | ### 9.7 Resource governance @@ -246,7 +246,7 @@ public-crawl purpose |---|---|---|---| | PRD-RES-001 | Deterministic resource budgets produce cumulative mitigations | Implemented | `originweave-resource` foundations | | PRD-RES-002 | Browser/human correctness outranks optional model throughput | Accepted architecture | ADR 0105 | -| PRD-RES-003 | CPU worker saturation participates in deterministic new-work admission | Implemented | Protected-main `ResourceSnapshot`/`ResourceGovernor` CPU-worker admission via #30; platform worker telemetry/actuation remains adapter work | +| PRD-RES-003 | CPU worker saturation participates in deterministic new-work admission | Implemented | Protected-main `ResourceSnapshot`/`ResourceGovernor` CPU-worker admission; platform worker telemetry/actuation remains adapter work | | PRD-RES-004 | Platform adapters report bounded CPU/RAM/GPU/VRAM/network/storage telemetry | Planned | Platform integration required | | PRD-RES-005 | Constrained GPU systems shrink/offload/pause model work before sacrificing governed browser correctness | Accepted architecture | ADR 0105 | @@ -264,10 +264,10 @@ public-crawl purpose | ID | Requirement | Status | Implementation evidence / note | |---|---|---|---| -| PRD-EXT-001 | Manifest V3 remains the extension compatibility baseline | Accepted architecture | Official Chrome platform baseline | -| PRD-EXT-002 | Upstream extension APIs are preserved where possible | Accepted architecture | Chromium-kernel strategy | -| PRD-EXT-003 | Extension access to agent authority requires separate signed policy grant | Planned | Issue #27 / enterprise-runtime integration | -| PRD-EXT-004 | Compatibility tests cover install/update, worker lifecycle, scripts, storage, DNR, messaging, download, side panel and isolation | Planned | Issue #27 / release-specific suite | +| PRD-EXT-001 | Manifest V3 remains the extension compatibility baseline | Accepted architecture | Official Chrome platform baseline; real pinned-Chromium evidence exists on protected main | +| PRD-EXT-002 | Upstream extension APIs are preserved where possible | Accepted architecture | Chromium-kernel strategy; current protected-main compatibility lane exercises multiple real MV3 APIs | +| PRD-EXT-003 | Extension access to agent authority requires separate signed policy grant | Planned | Protected-main extension authority foundation exists, but the complete managed-extension/native-messaging/enterprise runtime contract remains open under issue #27; Proposed ADR 0013 does not itself make this shipped | +| PRD-EXT-004 | Compatibility tests cover install/update, worker lifecycle, scripts, storage, DNR, messaging, download, side panel and isolation | Planned | Protected-main suite already covers worker/content/storage/DNR/tabs/windows/scripting/commands/side panel/bookmarks/history/restart/repeatability; active PR #43 adds downloads; install/update/native messaging/enterprise isolation and release-wide matrix remain open under issue #27 | ### 9.10 Crawler and capture policy From 88355b468d20182fd757011b33e11d87024ea42b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 13:34:46 +0900 Subject: [PATCH 030/130] docs: reconcile TRD protected-main maturity --- docs/TRD.md | 88 ++++++++++++++++++++++++++++++----------------------- 1 file changed, 50 insertions(+), 38 deletions(-) diff --git a/docs/TRD.md b/docs/TRD.md index 7330fec9..3e803001 100644 --- a/docs/TRD.md +++ b/docs/TRD.md @@ -17,25 +17,28 @@ This TRD defines technical invariants for OriginWeave without describing planned - **Proposed** — a candidate design that still needs a dedicated reviewed decision or implementation proof. - **Open** — deliberately unresolved. -Pull-request code is not treated as Implemented until it reaches protected `main` and required acceptance evidence is re-established there. +Pull-request code is not treated as Implemented until it reaches protected `main` and required acceptance evidence is re-established there. Active-PR implementation may be recorded in a separate evidence note, but it never creates a composite implementation status. ## 2. Current protected-main implementation inventory -The current reusable Rust control plane is intentionally smaller than the final browser product. - -| Module | Current responsibility | Status | -|---|---|---| -| `originweave-core` | Canonical origin, typed actions, purpose/mode, capabilities, risk, secret-delivery and approval contracts. | **Implemented** | -| `originweave-policy` | Pure fail-closed action-policy evaluation. | **Implemented** | -| `originweave-destination` | Resolved-address classification, origin-bound snapshots, connection pinning, rebinding and redirect authority. | **Implemented** | -| `originweave-network` | Direct single-address TCP connection plan and exact operating-system peer verification. | **Implemented** | -| `originweave-tls` | WebPKI service identity over the already verified TCP stream. | **Implemented** | -| `originweave-resource` | Deterministic resource budgets and cumulative mitigation plans. | **Implemented** | -| `originweave-evidence` | Value-redacted network evidence and provenance foundations. | **Implemented** | -| Browser/session/observation/action adapters | Chromium/BiDi/CDP integration and node-lifetime enforcement. | **Planned / active development** | -| HTTP/proxy/PAC execution | Bounded HTTP and explicit route execution beyond pure foundations. | **Planned / active development** | -| Secret broker persistence/runtime | Atomic opaque-handle lifecycle and trusted fill. | **Planned / active development** | -| WARC/PROV persistence | Durable capture and provenance serialization. | **Planned** | +The current reusable Rust control plane is intentionally smaller than the final browser product. The status column describes protected `main` only; active PR evidence is kept in the final column. + +| Module / boundary | Current responsibility | Protected-main status | Active/non-shipped evidence | +|---|---|---|---| +| `originweave-core` | Canonical origin, typed actions, purpose/mode, capabilities, risk, secret-delivery, approval, session/context/document/node authority values. | **Implemented** | PR #40 builds a protocol-ID registry on top of these values; it is not protected-main truth | +| `originweave-policy` | Pure fail-closed action policy including purpose-bound sensitive-data authority. | **Implemented** | Trusted broker/runtime lifecycle remains separate planned work under issue #10 | +| `originweave-destination` | Resolved-address classification, origin-bound snapshots, route authority, connection pinning, rebinding and redirect authority. | **Implemented** | PAC evaluation/proxy transport/CONNECT are still Planned | +| `originweave-network` | Direct single-address TCP connection plan and exact operating-system peer verification. | **Implemented** | — | +| `originweave-tls` | WebPKI service identity over the already verified TCP stream. | **Implemented** | — | +| `originweave-resource` | Deterministic resource budgets, CPU-worker admission and cumulative mitigation plans. | **Implemented** | Platform telemetry/actuation remains Planned | +| `originweave-evidence` | Value-redacted network evidence, provenance foundations and sensitive-access evidence primitives. | **Implemented** | Complete durable Evidence Trail/WARC/PROV persistence remains Planned | +| Browser/session protocol registry | Bind raw BiDi/CDP identifiers to OriginWeave session/context/document authority. | **Planned** | Active PR #40; core lifetime value contracts are already Implemented under ADR 0010 | +| Semantic observation/action browser adapters | Chromium/BiDi/CDP observation, node lifecycle, typed input and post-condition verification. | **Planned** | Issue #28 | +| Bounded HTTP execution | HTTP/1.1 semantics over authenticated governed transport. | **Planned** | Active replacement PR #37; historical PR #11 is predecessor lineage, not current evidence | +| Proxy/PAC execution | Evaluate authorized route selection and perform governed proxy/CONNECT transport. | **Planned** | Protected-main route-authority value foundation already exists | +| Sensitive-data broker persistence/runtime | Atomic opaque-handle lifecycle, revocation/reservation, value resolution and trusted fill. | **Planned** | Protected-main policy/evidence foundations exist; issue #10 owns complete runtime lifecycle | +| Manifest V3 compatibility program | Real pinned-Chromium extension compatibility and release matrix. | **Planned** | Protected main already contains partial real-browser evidence; active PR #43 adds downloads evidence | +| WARC/PROV persistence | Durable capture and provenance serialization. | **Planned** | — | ## 3. Architectural invariants @@ -69,7 +72,7 @@ A **logical origin** is not a **resolved destination** decision. A resolved addr ### TRD-INV-003 — Untrusted page content -Browser content, rendered text, hidden text, comments, ads, WebMCP output, network bodies, downloads, and model-produced summaries are data. They cannot mutate system policy, expand capabilities, authorize destinations, reveal secrets, or redefine the user's goal. +Browser content, rendered text, hidden text, comments, ads, WebMCP output, network bodies, downloads, extension messages, and model-produced summaries are data. They cannot mutate system policy, expand capabilities, authorize destinations, reveal secrets, or redefine the user's goal. ### TRD-INV-004 — Secret separation @@ -87,23 +90,23 @@ A typed action may be attempted only after exact current authority is validated. ### Assist Mode -**Accepted architecture; Planned adapter path.** Reversible/read behavior may be automated. Irreversible or externally visible state changes re-enter the risk/approval pipeline. +**Accepted architecture.** Reversible/read behavior may be automated. Irreversible or externally visible state changes re-enter the risk/approval pipeline. The browser adapter path remains Planned. ### Agent Task Mode -**Accepted architecture; Planned adapter path.** Each delegated task receives an isolated or explicitly attached browser context, scoped capabilities, origins, secrets, policy and resource budgets. The unrestricted default human profile is not ambient task authority. +**Accepted architecture.** Each delegated task receives an isolated or explicitly attached browser context, scoped capabilities, origins, secrets, policy and resource budgets. The unrestricted default human profile is not ambient task authority. Complete browser adapter/session integration remains Planned. ### Crawler Mode -**Accepted architecture; policy foundation Implemented.** Crawler actions are read-only. Robots evidence, rate controls, purpose, privacy, retention and legal/contract policy are distinct checks. +**Accepted architecture.** The read-only crawler policy foundation is Implemented, while the complete crawler runtime is Planned. Robots evidence, rate controls, purpose, privacy, retention and legal/contract policy are distinct checks. ## 5. Identifier and lifetime contracts ### 5.1 Core identifiers -Durable identifiers introduced by adapters must be opaque and nonzero/nonempty. External browser identifiers are translated through scoped registries instead of becoming the core authority value directly. +Protected-main core contracts already define opaque browser-session, browsing-context, document-epoch and observed-node authority values governed by Accepted ADR 0010. External browser identifiers must be translated through scoped registries instead of becoming core authority directly. The protocol-ID registry is active PR #40 evidence until protected integration. -Planned browser-lifetime tuple: +Required browser-lifetime tuple: ```text browser_session_id @@ -117,7 +120,7 @@ An actionable node reference is valid only when every component matches the live ### 5.2 Document epochs -Navigation, document replacement, or another adapter-defined actionable-document lifetime change rotates `document_epoch`. A stale node reference must fail deterministically before input dispatch. +Navigation, document replacement, or another adapter-defined actionable-document lifetime change rotates `document_epoch`. A stale node reference must fail deterministically before input dispatch. Core exact-authority validation is Implemented; real browser lifecycle invalidation/linearized dispatch remains adapter work. ### 5.3 Idempotency @@ -145,7 +148,7 @@ The pure destination crate itself does no DNS lookup. ### 6.3 Route/proxy authority -**Accepted architecture; active development.** Direct routing is the default. Proxy and PAC-selected routes require explicit authority. A proxy is an intermediate authority and never replaces final-target authorization. Ambient environment proxy variables cannot silently change the governed route. +**Protected-main status: Implemented for route-authority foundations. Proxy/PAC execution: Planned.** Direct routing is the default. Proxy and PAC-selected routes require explicit authority. A proxy is an intermediate authority and never replaces final-target authorization. Ambient environment proxy variables cannot silently change the governed route. PAC evaluation, proxy transport and CONNECT require separate execution evidence before release claims. ### 6.4 Direct transport @@ -157,7 +160,9 @@ The pure destination crate itself does no DNS lookup. ### 6.6 HTTP semantics -**Accepted architecture; active development.** HTTP processing must consume an authenticated governed connection and define: +**Protected-main status: Planned.** Active replacement PR #37 implements bounded HTTP/1.1 semantics but remains non-shipped evidence until protected integration. Historical PR #11 is predecessor lineage and is not current implementation evidence. + +HTTP processing must consume an authenticated governed connection and define: - supported methods and caller-controlled fields; - syntax/framing rules; @@ -200,7 +205,7 @@ Raw HTML is not the default model payload. ## 8. Action architecture -Standard action vocabulary is **Accepted architecture / Planned runtime integration**: +The standard action vocabulary is **Accepted architecture**; complete real-browser runtime integration remains Planned: ```text navigate @@ -241,7 +246,7 @@ The adapter declares an observable post-condition contract, such as URL change, ### 9.1 Purpose-bound authority -**Active development.** Protected disclosure authority is represented as one value object/scoped record containing tenant, task, field, business purpose, canonical destination and data classification. Reclassification requires newly valid authority. +**Implemented policy foundation.** Protected disclosure authority binds tenant, task, field, business purpose, canonical destination and data classification under Accepted ADR 0007. This implementation does not imply that trusted value storage, opaque-handle resolution, revocation or browser fill are complete. ### 9.2 Opaque handle broker @@ -256,15 +261,17 @@ The adapter declares an observable post-condition contract, such as URL change, - value resolution/fill; - compensation/recovery after reserved-but-failed use. +Issue #10 owns the broader broker/storage/lifecycle completion. + ### 9.3 Evidence -Access/disclosure evidence records identifiers, scope, decision, approval reference, policy version and lifecycle times without carrying the protected value. +Protected-main evidence primitives can record purpose-bound sensitive-access authority without carrying the protected value. Complete broker-use receipts must remain aligned with the runtime lifecycle once that broker exists. ## 10. Resource-governor requirements ### 10.1 Deterministic kernel -**Implemented foundation.** `originweave-resource` validates budgets and produces a cumulative mitigation plan. It does not sample the operating system or directly schedule processes. +**Implemented.** `originweave-resource` validates budgets, includes CPU-worker admission state, and produces a cumulative mitigation plan. It does not sample the operating system or directly schedule processes. ### 10.2 Adapter telemetry @@ -276,7 +283,7 @@ Access/disclosure evidence records identifiers, scope, decision, approval refere ### 10.4 Constrained GPU -**Accepted architecture / Planned implementation.** Rendering and local model inference use phase scheduling where necessary. The mitigation ladder can shrink model batches, release inference caches, offload to CPU, pause the task and reject admission before foreground rendering is sacrificed. +**Accepted architecture.** Rendering and local model inference use phase scheduling where necessary. The implementation of platform GPU telemetry/scheduling remains Planned. The mitigation ladder can shrink model batches, release inference caches, offload to CPU, pause the task and reject admission before foreground rendering is sacrificed. ## 11. Evidence and provenance requirements @@ -310,7 +317,7 @@ Generic network evidence retains bounded names and canonical locators while valu ### WebDriver BiDi -**Planned.** WebDriver BiDi is an evolving W3C adapter contract. Its session/user-context/browsing-context identifiers are translated into OriginWeave-scoped internal identities. Protocol evolution is isolated behind versioned adapter tests. +**Planned.** WebDriver BiDi is an evolving W3C adapter contract. Its session/user-context/browsing-context identifiers are translated into OriginWeave-scoped internal identities. Core lifetime authority is already Implemented; active PR #40 is non-shipped registry implementation evidence. ### Chrome DevTools Protocol @@ -318,7 +325,7 @@ Generic network evidence retains bounded names and canonical locators while valu ### WebMCP -**Planned / experimental external dependency.** **WebMCP** can provide typed page tools. Tool schemas and outputs remain untrusted page-originated data and cannot grant OriginWeave authority. +**Planned.** **WebMCP** is an experimental external dependency that can provide typed page tools. Tool schemas and outputs remain untrusted page-originated data and cannot grant OriginWeave authority. ### Model Context Protocol @@ -330,9 +337,9 @@ Generic network evidence retains bounded names and canonical locators while valu ## 13. Manifest V3 extension requirements -**Accepted architecture / Planned compatibility program.** OriginWeave preserves Chromium's extension implementation rather than rebuilding Chrome APIs in Rust. Agent authority remains separate from ordinary extension permissions. A future signed policy registry controls which extensions may observe or propose agent actions. +The complete compatibility program is **Planned** under issue #27, while partial real-browser evidence exists on protected main. OriginWeave preserves Chromium's extension implementation rather than rebuilding Chrome APIs in Rust. Agent authority remains separate from ordinary extension permissions. Proposed ADR 0013 documents this separation but is not Accepted design authority until reviewed/integrated accordingly. -Compatibility acceptance includes installation/update, extension service-worker lifecycle, content scripts, storage, scripting, DNR, native messaging, downloads, side panel, restart persistence and explicit task-mode isolation. +Protected-main pinned-Chromium evidence currently exercises service-worker lifecycle, content scripts, storage, declarativeNetRequest, tabs, windows, scripting, commands, side panel, bookmarks, history, restart persistence and repeatability. Active PR #43 adds a bounded real `chrome.downloads` path and allowlisted download-stage failure evidence. Installation/update, native messaging, managed-extension/enterprise policy, broader isolation, Web Store and release-wide compatibility remain outside the current protected-main claim. ## 14. Prompt-injection and model boundary @@ -386,6 +393,7 @@ Long-running tasks and external model calls require cancellation semantics that - Node/action validation occurs immediately before execution to close stale-state races. - Sensitive-handle use becomes atomic in the trusted broker. - Migration/release/automation writer leases prevent competing repository writers. +- Repository-scoped collision-sensitive identifiers such as ADR numbers, migration IDs and protocol/schema versions are reserved across protected main plus active work before allocation. - Platform compute pools avoid avoidable oversubscription between Chromium, Rust and model runtimes. ## 17. Persistence and data naming @@ -407,7 +415,7 @@ network_exchange download_artifact ``` -The conceptual model is defined in [`erd/README.md`](erd/README.md). Adapters may use WARC/object storage/relational stores independently; cross-service application database access is not an integration contract. +The conceptual model is defined in [`erd/README.md`](erd/README.md). Adapters may use WARC/object storage/relational stores independently; cross-service application database access is not an integration contract. Conceptual ERD entities are not evidence that a physical relational schema exists. ## 18. Security and enterprise controls @@ -423,11 +431,15 @@ Product UI targets WCAG 2.2 AA / ISO/IEC 40500:2025-aligned evidence. Approval, ### Implemented kernels -Require deterministic unit/property/integration tests for canonicalization, classification, rebinding, redirects, direct peers, TLS identity, policy, resources and evidence. +Require deterministic unit/property/integration tests for canonicalization, classification, rebinding, redirects, route authority, direct peers, TLS identity, policy, session/node authority values, resources and evidence. ### Browser vertical slice -Requires real browser integration tests covering isolated contexts, stale nodes, iframes/shadow DOM where supported, origin changes, typed actions, post-conditions, crashes, cancellations and governed real network composition. +Requires real browser integration tests covering isolated contexts, protocol-ID registry binding, stale nodes, iframes/shadow DOM where supported, origin changes, typed actions, post-conditions, crashes, cancellations and governed real network composition. + +### Manifest V3 compatibility + +Maintain pinned real-Chromium evidence for every claimed extension surface, with restart/repeatability and bounded failure diagnostics. Compatibility evidence and Agent-authority evidence are independent: neither can substitute for the other. ### Security @@ -482,4 +494,4 @@ A material change to any of the following must update the authoritative document - enterprise privacy/security/tenancy contract; - release acceptance or rollback semantics. -If a decision is not implemented, the documentation must retain `Planned`, `Proposed`, or `Open` status rather than silently describe it as shipped. +If a decision is not implemented, the documentation must retain `Planned`, `Proposed`, or `Open` status rather than silently describe it as shipped. Active PR evidence remains explicitly non-shipped until protected integration and exact acceptance evidence exist. From dce4e6b28d93ae24d586c5e654f1f783702c0bbf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 13:37:53 +0900 Subject: [PATCH 031/130] docs: align fitness with reconciled PRD and TRD --- docs/DOCUMENTATION_FITNESS.md | 227 ++++++++++++++++------------------ 1 file changed, 106 insertions(+), 121 deletions(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index 6f1a8bf8..15267666 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -1,121 +1,112 @@ # OriginWeave Documentation Fitness Assessment - **Assessment date:** 2026-08-10 -- **Assessment scope:** protected `main`, current open OriginWeave work, and durable product decisions that must be reconstructable without chat history +- **Assessment scope:** protected `main`, every current OriginWeave implementation lane relevant to canonical product truth, and durable product decisions that must be reconstructable without chat history - **Assessment type:** semantic fitness, not file-presence inventory - **Current verdict:** **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL** -## 1. Meaning of the verdict +## 1. Verdict -**DESIGN-SUFFICIENT** means the repository contains enough coherent product, technical, architecture, decision, diagram, data-model, security, testing, operability, protocol and release material to implement and review OriginWeave without reconstructing the original design from conversation history. +**DESIGN-SUFFICIENT** means the repository has a coherent product, technical, architecture, decision, diagram, data-model, security, testing, operability, protocol and release graph sufficient to implement and review OriginWeave without reconstructing product intent from chat history. -**PROTECTED-MAIN-PARTIAL** means the canonical graph still contains stale implementation-status references and incomplete current-state reconciliation. The documentation set is broad enough, but PRD/TRD and some implementation-facing views lag protected-main code or current active replacement work. Therefore documentation is not yet a release-quality source of current implementation truth. +**PROTECTED-MAIN-PARTIAL** now means something narrower than it did at the beginning of this reconciliation: this PR has repaired the known PRD/TRD/traceability/index semantic drift on its own branch, but protected `main` does not receive those repairs until this documentation line passes exact-head governance and integrates. Active feature PRs also remain non-shipped evidence. The branch therefore must not relabel protected main as documentation-closed before integration. -File existence alone is never sufficient. A document can be present and still be stale, contradictory, overclaiming, underclaiming, or disconnected from code and evidence. +File existence alone is never sufficient. An artifact can exist and still be stale, contradictory, overclaiming, underclaiming, or disconnected from executable evidence. ## 2. Fitness matrix -| Documentation family | Fitness | Evidence / current gap | +| Documentation family | Fitness | Current evidence / remaining boundary | |---|---|---| -| PRD | **PARTIAL** | Strong whole-product requirements, modes, product family and buyer outcomes. Some implementation notes are stale: HTTP still names historical PR #11 rather than current replacement PR #37; sensitive-data policy text still references already-integrated work; real pinned-Chromium MV3 evidence is underrepresented. | -| TRD | **PARTIAL** | Strong authority stack, lifecycle, action, observation, network, secret and resource contracts. Current implementation inventory lags protected-main additions and still uses composite implementation language in places where protected-main, active-PR and planned maturity should be separated. | -| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium-compatibility-kernel + Rust-control-plane direction and explicit authority layers. Reconcile again when the browser registry, HTTP replacement and Chromium vertical slice integrate. | -| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | The previous index omitted Accepted ADRs 0007, 0008 and 0010, omitted Proposed ADR 0009, and retained change-local wording. This branch repairs discoverability/status categories and adds Proposed ADRs 0013/0014 without promoting them to Accepted. | -| Individual ADRs | **PARTIAL** | Accepted decisions 0001-0008 and 0010 remain design authority. Proposed 0009, 0013, 0014 and 0100-0109 remain explicitly non-binding. HTTP feature ADRs remain active-PR evidence until PR #37 integrates. Extension/MV3 authority now has Proposed ADR 0013; issue #27 cannot close merely because the proposal exists. | -| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Product-wide component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. This branch adds [`uml/extension-authority.md`](uml/extension-authority.md), separating Chromium MV3 permission from OriginWeave Agent capability. The real Chromium vertical-slice sequence remains incomplete until issue #28 stabilizes. | -| Conceptual ERD/domain model | **PRESENT-CURRENT with follow-up** | Correctly distinguishes conceptual persistence and includes session/context, action/policy/approval, network/TLS/HTTP, sensitive authority, resources, provenance, downloads and extension grants. Update only when persistence ownership or durable entities actually change; do not invent a database to increase diagram count. | -| Traceability | **REPAIRED IN THIS CHANGE / PARTIAL BY DESIGN** | This branch now separates `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, accepted architecture and planned work. It records #37 as active HTTP evidence, protected-main node authority plus #40 registry work, partial protected-main MV3 evidence plus #43 downloads, and protected-main sensitive-data foundations plus issue #10 broker lifecycle. PRD/TRD still need the same reconciliation. | -| Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, secret, network, provenance and extension risks. Continue adding executable mitigations when HTTP/browser/runtime boundaries integrate. | -| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code coverage, rustdoc and realistic boundary testing are explicit. Real Chromium/MV3 evidence must remain release-bound to pinned browser evidence rather than source-text assertions. | -| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. Protected-main evidence for model-backed hourly development remains an operational-closure requirement rather than a documentation-only claim. | -| API / protocol contract | **PRESENT-CURRENT as target contract** | Typed OriginWeave Protocol boundaries are documented but much browser adapter implementation remains Planned. Keep adapter identifiers non-authoritative and versioned. | -| Release / rollback / provenance | **PRESENT-CURRENT** | Correctly prevents feature-level green checks from becoming release readiness. Formal release remains blocked by missing full browser/runtime product evidence. | -| Data governance / PII | **PRESENT-CURRENT as architecture; PARTIAL implementation** | Correctly rejects blanket masking and ambient raw propagation in favor of purpose-bound authorization, opaque handles, encryption, retention and audit. Trusted broker/storage/revocation/lifecycle completion remains open under issue #10. | -| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary standards and APA 7 doctoring exist in [`doctoring.md`](doctoring.md) and [`doctoring/browser-agent-protocols.md`](doctoring/browser-agent-protocols.md). Experimental/draft browser interfaces remain explicitly separated from final normative standards. | - -### 2.1 Primary-source standards evidence used by this assessment - -The protocol names in this assessment are grounded in repository doctoring and primary sources: - -| Boundary | Primary evidence | Repository evidence rule | -|---|---|---| -| WebDriver BiDi | [W3C WebDriver BiDi, 1 June 2026 Working Draft](https://www.w3.org/TR/2026/WD-webdriver-bidi-20260601/) | Doctoring records Working Draft status, so it remains adapter-bound. | -| Manifest V3 | [Chrome manifest format](https://developer.chrome.com/docs/extensions/reference/manifest) and [Manifest Version](https://developer.chrome.com/docs/extensions/reference/manifest/manifest-version) | MV3 is the current Chrome extension baseline without a claim of universal Chrome/Web Store/Google-service compatibility. | -| Chrome DevTools Protocol | [Official CDP tip-of-tree documentation](https://chromedevtools.github.io/devtools-protocol/tot/) | Tip-of-tree changes frequently and lacks backwards-compatibility guarantee; OriginWeave pins/versions adapters. | -| WebMCP | [Chrome WebMCP](https://developer.chrome.com/docs/ai/webmcp), [WebMCP tool security](https://developer.chrome.com/docs/ai/webmcp/secure-tools), and [agent security considerations](https://developer.chrome.com/docs/agents/security) | Doctoring records experimental/origin-trial status and untrusted-content/prompt-injection boundaries. | -| Model Context Protocol | [MCP 2026-07-28 specification](https://modelcontextprotocol.io/specification/2026-07-28) and [official release announcement](https://blog.modelcontextprotocol.io/posts/2026-07-28/) | Durable browser state remains in OriginWeave-level handles; MCP is a high-level adapter, not Chromium authority. | -| W3C PROV-O | [PROV-O Recommendation](https://www.w3.org/TR/prov-o/) | Provenance interoperability adapter, not authorization. | -| WARC | [ISO 28500:2017](https://www.iso.org/standard/68004.html) | Evidence/payload preservation format, not a truth or permission escalation mechanism. | +| PRD | **REPAIRED IN THIS CHANGE** | HTTP now names active replacement PR #37 while retaining `Planned` protected-main status; historical PR #11 is predecessor lineage. Purpose-bound sensitive disclosure is recorded as an Implemented policy kernel while broker/storage/lifecycle remain Planned under issue #10. MV3 remains a Planned complete compatibility program while protected-main and active-PR evidence are separately identified. | +| TRD | **REPAIRED IN THIS CHANGE** | Implementation inventory now separates protected-main status from active/non-shipped evidence instead of composite labels such as `Planned / active development`. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries are reconciled to current evidence. | +| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium compatibility-kernel + Rust control-plane direction, explicit authority stack and protected-main truth rule. Reconcile implementation-facing details after #37/#40 or the real Chromium vertical slice integrate. | +| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Indexes now discover Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 without promoting Proposed decisions. Identifier allocation is treated as a cross-main-and-active-work reservation problem. | +| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 covers MV3 compatibility vs extension-to-Agent authority; Proposed ADR 0014 covers ADR acceptance governance. Their presence does not imply Acceptance. HTTP ADRs in PR #37 remain active-PR evidence. | +| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. This PR adds `uml/extension-authority.md`. A detailed real-Chromium vertical-slice sequence is deferred until issue #28 contracts stabilize. | +| Conceptual ERD/domain model | **PRESENT-CURRENT** | Explicitly conceptual unless an adapter/schema is separately implemented; distinguishes current value/evidence concepts from planned durable records and adapter-owned representations. No physical database is invented merely to satisfy an ERD checklist. | +| Traceability | **REPAIRED IN THIS CHANGE** | Separates `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`; records #37/#40/#43 without promoting them to shipped truth. | +| Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, network, secret, provenance and extension risks. Update when new real browser/HTTP/runtime attack surfaces integrate. | +| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code coverage, rustdoc and realistic boundary testing are explicit. Real browser and MV3 evidence remain pinned-browser executable evidence rather than source-text claims. | +| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. Protected-main runtime/scheduled evidence remains required for operational closure where applicable. | +| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented; much browser adapter implementation remains Planned. External protocol identifiers are never durable authority by themselves. | +| Release / rollback / provenance | **PRESENT-CURRENT** | Feature-branch green checks cannot become release readiness. Release remains bound to one exact integrated protected head and applicable CI/security/coverage/package/provenance/recovery/compatibility/review evidence. | +| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist; trusted broker/storage/revocation/model-disclosure lifecycle remains open under issue #10. | +| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references are kept in doctoring documents with draft/experimental status distinguished from final normative standards. | + +## 3. Reconciliation findings and resolution state + +### 3.1 HTTP lineage -APA 7th references are recorded in doctoring documents rather than duplicated into every architecture assessment. +Protected-main PRD previously named historical PR #11 as active HTTP evidence. Current executable replacement work is PR #37, while protected main still does not ship bounded HTTP semantics. -## 3. Concrete stale/current discrepancies +**Resolved on this documentation branch:** PRD, TRD and traceability now name #37 only as active/non-shipped evidence, retain protected-main `Planned`, and treat #11 as predecessor lineage. Old-head checks/reviews do not transfer. -### 3.1 Historical HTTP PR still appears as active PRD evidence +### 3.2 Sensitive-data authority -Protected-main PRD describes bounded HTTP semantics as Planned with `Active PR #11`. PR #11 is historical predecessor lineage; current executable replacement work is PR #37. Active PR #37 itself is not protected-main implementation truth. +Protected main contains a purpose-bound sensitive-data policy/evidence foundation, while the trusted broker, durable value lifecycle, revocation/reservation, trusted fill and provider/model disclosure controls remain incomplete. -**Current reconciliation:** traceability now records HTTP as `IMPLEMENTED_ON_ACTIVE_PR` under #37 and treats #11 as predecessor/superseded implementation lineage. PRD/TRD still require the equivalent protected-main-vs-active-PR wording repair. Never transfer predecessor checks or reviews. +**Resolved on this documentation branch:** PRD/TRD/traceability distinguish the Implemented policy foundation from the Planned broker/runtime under issue #10 instead of calling the entire concern active or shipped. -### 3.2 Sensitive-data implementation status lags protected main +### 3.3 Manifest V3 compatibility -Protected main has purpose-bound sensitive-disclosure policy/evidence foundations, while PRD/TRD retain stale active-PR language. The trusted broker, storage, selective model disclosure, revocation and lifecycle remain open. +Protected main has executable pinned-Chromium evidence for service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart persistence and repeatability. Active PR #43 adds real bounded downloads evidence. Issue #27 remains open for the complete compatibility/release matrix and additional managed/native-messaging boundaries. -**Current reconciliation:** traceability now records **PARTIAL**: protected-main policy/evidence foundation + planned broker/runtime under issue #10. PRD/TRD remain to reconcile. +**Resolved on this documentation branch:** PRD/TRD/traceability represent complete compatibility as Planned while separately naming partial protected-main evidence and active-PR downloads evidence. Proposed ADR 0013 separates compatibility evidence from Agent-authority evidence. -### 3.3 MV3 compatibility evidence moved beyond original roadmap wording +### 3.4 Browser identifier authority -Protected main has executable pinned-Chromium MV3 evidence for service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart and repeatability. Active PR #43 adds real bounded downloads evidence and now preserves only allowlisted download-stage diagnostics in runner failure evidence. Issue #27 remains open because the complete compatibility matrix, native-messaging/enterprise-policy boundaries and release integration are unfinished. +Protected main contains session/context/document/node authority foundations under Accepted ADR 0010. Active PR #40 owns a bounded registry mapping protocol-local identifiers into that authority model. -**Current reconciliation:** traceability records protected-main compatibility as **PARTIAL** and #43 as active-PR evidence. PRD/TRD must adopt the same distinction. +**Resolved on this documentation branch:** PRD/TRD/traceability identify the protected-main core foundation separately from #40 active/non-shipped registry evidence. Detailed adapter-sequence UML is deliberately deferred until its executable contracts stabilize. -### 3.4 Browser authority is transitioning from protected-main value types to an adapter registry +### 3.5 ADR discoverability and identifier allocation -Protected main contains session/context/document/node authority foundations governed by Accepted ADR 0010. PR #40 is adding a bounded session-scoped registry so raw BiDi/CDP identifiers do not become durable OriginWeave authority. +The prior index omitted Accepted ADRs 0007, 0008 and 0010 and Proposed ADR 0009. During this reconciliation, candidate ADR numbers 0011/0012 were also found to be reserved by active PR #37. -**Current reconciliation:** traceability records the foundation as protected-main and #40 as active non-shipped evidence. Architecture/ERD remain directionally correct; detailed adapter UML should wait for stable protocol contracts rather than encode temporary field names. +**Resolved on this documentation branch:** lifecycle indexes are complete for the branch, extension/governance decisions use non-colliding 0013/0014, and repository-scoped collision-sensitive identifiers are reserved across protected main plus active work rather than allocated from main alone. -### 3.5 ADR lifecycle discoverability drifted +### 3.6 Documentation contract parser -The prior ADR index omitted Accepted ADRs 0007, 0008 and 0010 and Proposed ADR 0009. This branch repairs the index, adds Proposed ADR 0013 for MV3/extension authority and Proposed ADR 0014 for ADR acceptance governance, and preserves their non-Accepted status. +The first fitness contract accepted only bare lifecycle metadata, while Accepted ADR 0007 legitimately contains a descriptive suffix after `Accepted`. -### 3.6 Documentation-contract parser overfit one metadata spelling +**Resolved on this documentation branch:** the parser reads the leading supported lifecycle token and accepts repository-valid descriptive suffixes without accepting unknown lifecycle states. -The first documentation-fitness contract accepted only bare lifecycle tokens, but existing Accepted ADR 0007 legitimately uses `- Status: Accepted for the first authority kernel`. CI correctly exposed the mismatch. This branch now parses the leading lifecycle token while retaining exact supported lifecycle validation. +### 3.7 Initial UML audit false positive -### 3.7 UML assessment itself was initially stale +The first audit incorrectly called resource-pressure and hourly automation views missing. Protected-main UML already contained them. -The first audit called resource-pressure and hourly automation flows missing. Protected-main `docs/uml/README.md` already contains both. The branch corrects the audit and adds only the genuinely missing extension-permission-to-Agent-authority view. +**Resolved on this documentation branch:** the assessment recognizes those views and adds only the genuinely missing extension-permission-to-Agent-authority diagram. -## 4. Durable conversation decisions that must remain represented +## 4. Durable conversation decisions captured in GitHub -1. **OriginWeave — Browse. Act. Prove.** is an enterprise agentic web runtime/provenance-native browser platform, not merely a Selenium-style automation library. -2. Chromium remains the compatibility kernel; OriginWeave does not reimplement Blink or V8 for product differentiation. -3. Rust owns new authority-bearing control-plane semantics and remains independently reusable in headless/MSA composition. -4. Human, Assist, Agent Task and Crawler modes have distinct profile/authority semantics. -5. Agent Task Mode must not ambiently inherit a normal human browser profile. -6. Page, extension and WebMCP content are untrusted observations, never policy or goal authority. -7. Structured observation precedes raw HTML and screenshot-only interpretation. -8. Typed actions and observed post-conditions replace arbitrary JavaScript and command-return-as-success. -9. Logical origin, destination, route/proxy, TCP peer, TLS identity and HTTP semantics are separate authorities. -10. Session/context/document epoch/node identity is separate from raw BiDi/CDP identifiers. -11. Extension permissions are not Agent capabilities; Manifest V3 compatibility and Agent authority isolation are tested separately. -12. Raw secrets stay out of model-visible context; sensitive values use purpose-bound disclosure and opaque handles wherever possible. -13. Browser correctness and human interaction outrank optional local-model throughput under resource pressure. -14. Provenance separates source observation, model judgement, policy decision, approval, action and verified outcome; WARC/PROV remain adapters, not collapsed truth. -15. WebDriver BiDi, CDP, WebMCP and MCP remain versioned adapters; no experimental protocol becomes OriginWeave authority by itself. -16. The first product proof is a pinned-stock-Chromium vertical slice before a large Chromium fork. -17. High-risk actions remain approval-bound; Crawler Mode is read-only and does not include CAPTCHA/block-evasion features. -18. Autonomous development uses NVIDIA NIM/OpenCode with deterministic gates and reviewer/publication authority separation; it does not use `COPILOT_GITHUB_TOKEN` as the development-model credential. -19. Documentation, checks, reviews and operational evidence are separate authorities. A green sub-check, model verdict, active PR, chat decision or ADR never silently upgrades missing implementation to shipped behavior. -20. Work-conserving autonomous maintenance continues to another safe lane instead of ending on one merge, one document, one RCA, one queued check or one external approval gap. -21. Repository-scoped collision-sensitive identifiers such as ADR numbers must be reserved across protected main **and active PRs**, not allocated from protected main alone. +The canonical graph must continue to preserve these durable decisions: -## 5. Architecture views requiring follow-through +1. OriginWeave is **Browse. Act. Prove.** — an enterprise agentic web runtime and provenance-native browser platform, not merely Selenium-style automation. +2. Chromium remains the compatibility kernel; Blink/V8 are not rewritten for product differentiation. +3. Rust owns new authority-bearing control-plane semantics and remains usable independently in headless/MSA composition. +4. Human, Assist, Agent Task and Crawler modes have distinct authority/profile semantics; Agent Task does not ambiently inherit Human Mode authority. +5. Page, extension, WebMCP and model content are untrusted observations, not goal/policy authority. +6. Structured observation precedes raw HTML or screenshot-only interpretation. +7. Typed actions and observed post-conditions replace arbitrary script execution and command-return-as-success. +8. Logical origin, destination, route/proxy, TCP peer, TLS identity and HTTP semantics are separate authorities. +9. Session/context/document epoch/node identity is separate from raw BiDi/CDP identifiers. +10. Manifest V3 permission is not an OriginWeave Agent capability; compatibility evidence and Agent-authority evidence are independent. +11. Raw secrets stay outside model-visible context; sensitive values use purpose-bound authority, opaque handles and trusted fill paths. +12. Browser correctness/human interaction outrank optional local-model throughput under resource pressure. +13. Provenance distinguishes source observation, model judgement, policy, approval, action and verified outcome; WARC/PROV are adapters rather than collapsed truth. +14. WebDriver BiDi, CDP, WebMCP and MCP are versioned adapters, never the product's authority model by themselves. +15. The first browser proof is a pinned-stock-Chromium vertical slice before any broad Chromium fork. +16. High-risk actions remain approval-bound; Crawler Mode remains read-only and excludes CAPTCHA/block-evasion features. +17. Autonomous development uses OpenCode/NVIDIA NIM under deterministic gates and separate review/publication authority, never `COPILOT_GITHUB_TOKEN` as the development-model credential. +18. Documentation, checks, reviews, model judgements and operational evidence are separate evidence authorities. +19. Work-conserving maintenance continues to another safe lane rather than stopping on one merge, document, RCA, queued check or external approval gap. +20. ADR numbers, migrations, schema/API/protocol versions and other collision-sensitive repository identifiers are reserved across protected main **and active work** before allocation. -### 5.1 Extension authority and compatibility sequence — added in this branch +## 5. Architecture views still legitimately deferred -[`uml/extension-authority.md`](uml/extension-authority.md) separates: +### 5.1 Extension authority — present in this branch + +`uml/extension-authority.md` shows: ```text Chromium MV3 permission @@ -127,19 +118,11 @@ Chromium MV3 permission -> deterministic policy ``` -It also separates **compatibility evidence** from **Agent-authority isolation evidence**: neither evidence class proves the other. - -### 5.2 Resource-pressure state/sequence — already present +Compatibility evidence cannot substitute for Agent-authority isolation evidence, and vice versa. -Protected-main `docs/uml/README.md` already models browser/model resource pressure and fallback. Refine it only when platform telemetry/admission implementation changes. +### 5.2 Real Chromium vertical slice — deferred until issue #28 stabilizes -### 5.3 Hourly autonomous-development authority flow — already present - -Protected-main `docs/uml/README.md` models deterministic early gates, conditional model-credential use, pristine attempts, bounded validation, publication authority, protected merge and protected-main operational acceptance. Its implementation/evidence status must be reconciled against actual workflows rather than inferred from the diagram. - -### 5.4 Real Chromium vertical slice — incomplete until issue #28 stabilizes - -Once issue #28 contracts stabilize, diagram and trace: +The eventual sequence must cover: ```text isolated profile/context @@ -154,42 +137,44 @@ isolated profile/context -> teardown/recovery ``` -## 6. Immediate repository actions - -### Completed or materially advanced in this documentation line +Do not freeze temporary protocol/field names into authoritative UML before the executable contracts stabilize. -- documentation fitness is discoverable from `docs/README.md`; -- ADR indexes are reconciled with protected-main lifecycle status; -- machine-checkable documentation fitness contracts exist and now tolerate repository-valid descriptive status suffixes; -- extension-permission-to-Agent-authority UML exists without duplicating resource/automation diagrams; -- Proposed ADRs 0013 and 0014 make MV3/extension authority and architecture-decision governance explicit without claiming Acceptance; -- traceability distinguishes protected-main, active-PR, partial and planned capability maturity; -- current active lanes #37, #40 and #43 are represented without promoting them to shipped truth. +## 6. What remains before documentation closure -### Execute next when the relevant file/branch lease is clear +### Completed or materially advanced on this branch -- reconcile PRD HTTP, sensitive-data and MV3 implementation notes to the same maturity model without encoding unstable exact heads; -- reconcile TRD implementation inventory/status language to protected-main vs active-PR vs planned truth; -- after #43 reaches a stable exact head, resolve its addressed diagnostic review finding only after exact-head checks validate the fix; -- after #37/#40 stop moving, re-read their exact contracts before mutating overlapping documentation or source. +- PRD current-state reconciliation; +- TRD current-state reconciliation; +- requirement/decision/module/evidence traceability reconciliation; +- ADR lifecycle/index repair; +- Proposed ADR 0013 for MV3/extension authority separation; +- Proposed ADR 0014 for architecture-decision acceptance governance; +- extension authority UML; +- conceptual ERD truth discipline; +- documentation fitness and regression contracts; +- current browser/protocol standards doctoring. -### Defer until executable contracts stabilize +### Still required -- add detailed real-Chromium vertical-slice UML only when issue #28 adapter contracts are stable enough that the diagram will not encode temporary protocol/field names; -- promote Proposed ADRs only through explicit reviewed status changes; file presence or matching code never implies Acceptance. +- exact-head CI/security/review acceptance of this documentation PR; +- integration before any of these branch repairs become protected-main truth; +- re-reconciliation after active PR #37 or #40 integrates, because active-PR status must then move to protected-main evidence; +- detailed real-Chromium vertical-slice UML when issue #28 implementation contracts are stable; +- future ERD changes only when persistence ownership/entities actually change; +- ongoing security/operability/release reconciliation as real browser/runtime boundaries integrate. -## 7. Completion criteria for documentation fitness +## 7. Completion criteria -The whole graph becomes **PROTECTED-MAIN-SUFFICIENT** only when: +The documentation graph becomes **PROTECTED-MAIN-SUFFICIENT** only when: -1. PRD and TRD implementation inventories agree with current protected-main crates/APIs and executable browser/extension evidence; -2. no canonical document identifies a historical/superseded PR as current implementation evidence; -3. ADR indexes discover every protected-main ADR and status agrees with file metadata; -4. UML covers every current material authority flow, including extension/Agent isolation and the real Chromium vertical slice once implemented; -5. ERD/domain models distinguish conceptual, in-memory, persisted, adapter-owned and external entities accurately; -6. traceability maps every material requirement and Accepted decision to protected-main implementation/test/evidence, explicitly active-PR evidence, or an open issue; -7. machine-checkable documentation tests catch stale status/index/link/ownership/identifier terminology; -8. security, test, operability, data-governance and release docs agree with the same shipped-vs-planned boundary; and -9. exact-head checks/review/governance for this documentation reconciliation pass. +1. PRD/TRD implementation inventories agree with protected-main crates/APIs/executable browser evidence; +2. no canonical document identifies historical/superseded PR lineage as current implementation evidence; +3. ADR indexes discover every protected-main ADR and match its lifecycle metadata; +4. UML covers every currently implemented material authority flow, with planned diagrams clearly marked; +5. ERD/domain models accurately distinguish conceptual, in-memory, persisted, adapter-owned and external entities; +6. traceability maps every material requirement/Accepted decision to protected-main evidence, explicitly active-PR evidence, or an open issue; +7. documentation tests catch stale status/index/link/ownership/identifier terminology; +8. security, test, operability, data-governance and release docs agree on shipped-vs-planned boundaries; and +9. this documentation reconciliation itself reaches protected main through live repository governance. -Until then, OriginWeave is **design-documented but not documentation-closed**. This is a product-quality finding, not a reason to stop unrelated safe implementation work. +Until then, OriginWeave is **design-documented but not protected-main documentation-closed**. That finding must never be used as an excuse to stop unrelated safe implementation work. From 20e11ad7ca99ba922d8ac1c5858da976929889a5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 13:38:25 +0900 Subject: [PATCH 032/130] test(docs): lock current implementation maturity boundaries --- tests/test_documentation_fitness_contract.py | 46 +++++++++++++++----- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index 1579fdca..2ac6cba0 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -79,7 +79,7 @@ def _parse_adr_index(text: str) -> dict[str, str]: class DocumentationFitnessContractTests(unittest.TestCase): - """Keep architecture discovery and ADR lifecycle metadata coherent.""" + """Keep architecture discovery and implementation-maturity metadata coherent.""" def test_documentation_index_links_fitness_assessment(self) -> None: """The semantic fitness audit must remain discoverable from the docs index.""" @@ -88,14 +88,15 @@ def test_documentation_index_links_fitness_assessment(self) -> None: self.assertTrue((DOCS_ROOT / "DOCUMENTATION_FITNESS.md").is_file()) def test_documentation_fitness_distinguishes_design_from_protected_main(self) -> None: - """A broad design pack must not be mislabeled as code-current closure.""" + """A broad design pack must not be mislabeled as protected-main closure.""" assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") self.assertIn("DESIGN-SUFFICIENT", assessment) self.assertIn("PROTECTED-MAIN-PARTIAL", assessment) self.assertIn("File existence alone is never sufficient", assessment) - self.assertIn("Historical HTTP PR", assessment) - self.assertIn("MV3 compatibility evidence", assessment) - self.assertIn("Browser authority", assessment) + self.assertIn("HTTP lineage", assessment) + self.assertIn("Manifest V3 compatibility", assessment) + self.assertIn("Browser identifier authority", assessment) + self.assertIn("integration before any of these branch repairs become protected-main truth", assessment) def test_every_adr_is_indexed_once_with_its_file_status(self) -> None: """Both canonical indexes must exactly cover ADR files and their lifecycle status.""" @@ -118,12 +119,35 @@ def test_adr_index_does_not_use_change_local_language_as_timeless_authority(self self.assertNotIn("Proposed target-architecture decisions in this change", adr_index) self.assertIn("Index completeness rule", adr_index) - def test_fitness_audit_tracks_current_replacement_and_buyer_gap_lanes(self) -> None: - """The dated audit must identify the current implementation lanes it evaluated.""" + def test_current_replacement_lanes_are_not_promoted_to_protected_main(self) -> None: + """Canonical docs must distinguish active implementation from shipped implementation.""" assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") - for marker in ("PR #37", "PR #40", "Issue #27", "issue #28"): + traceability = (DOCS_ROOT / "traceability" / "README.md").read_text(encoding="utf-8") + for marker in ("PR #37", "PR #40", "PR #43", "issue #10", "issue #27", "issue #28"): with self.subTest(marker=marker): - self.assertIn(marker, assessment) + self.assertTrue(marker in assessment or marker in traceability) + self.assertIn("IMPLEMENTED_ON_ACTIVE_PR", traceability) + self.assertIn("IMPLEMENTED_ON_PROTECTED_MAIN", traceability) + self.assertIn("Active-PR behavior is never protected-main truth", traceability) + + def test_prd_does_not_restore_superseded_active_pr_claims(self) -> None: + """Historical feature branches must not reappear as the current implementation lane.""" + prd = (DOCS_ROOT / "PRD.md").read_text(encoding="utf-8") + self.assertNotIn("Active PR #11", prd) + self.assertNotIn("Active replacement PR #33", prd) + self.assertIn("active replacement PR #37", prd) + self.assertIn("Protected-main purpose-bound sensitive-data policy kernel", prd) + self.assertIn("active PR #43 adds", prd) + + def test_trd_uses_single_status_with_separate_active_pr_evidence(self) -> None: + """Implementation status must not be collapsed with active-development annotations.""" + trd = (DOCS_ROOT / "TRD.md").read_text(encoding="utf-8") + self.assertNotIn("**Planned / active development**", trd) + self.assertNotIn("**Accepted architecture; active development.**", trd) + self.assertIn("Protected-main status", trd) + self.assertIn("Active/non-shipped evidence", trd) + self.assertIn("Active replacement PR #37", trd) + self.assertIn("purpose-bound sensitive-data policy kernel", trd) def test_extension_authority_uml_separates_compatibility_from_agent_authority(self) -> None: """A Chrome permission must never be documented as an Agent capability.""" @@ -139,8 +163,8 @@ def test_fitness_audit_does_not_duplicate_existing_resource_or_hourly_uml(self) """The audit must recognize existing product-wide resource and automation diagrams.""" assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") uml_index = (UML_ROOT / "README.md").read_text(encoding="utf-8") - self.assertIn("Resource-pressure state/sequence — already present", assessment) - self.assertIn("Hourly autonomous-development authority flow — already present", assessment) + self.assertIn("resource-pressure/GPU fallback", assessment) + self.assertIn("hourly automation flows", assessment) self.assertIn("## 9. Resource-pressure and fallback flow", uml_index) self.assertIn("## 10. Hourly product-development gate-to-model flow", uml_index) From 7371bee7eba40597674ca5b8da43a42a28b82381 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 13:42:37 +0900 Subject: [PATCH 033/130] test(docs): accept status punctuation and semantic TRD wording --- tests/test_documentation_fitness_contract.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index 2ac6cba0..e456141b 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -26,7 +26,7 @@ def _adr_file_status(path: Path) -> str: """Read one ADR's explicit lifecycle status from its metadata header.""" text = path.read_text(encoding="utf-8") match = re.search( - r"(?im)^-\s+(?:\*\*Status:\*\*|\*\*Status\*\*:|Status:)\s*(\w+)(?:\s+.+)?$", + r"(?im)^-\s+(?:\*\*Status:\*\*|\*\*Status\*\*:|Status:)\s*(\w+)(?:[;\s].*)?$", text, ) if match is None: @@ -147,7 +147,7 @@ def test_trd_uses_single_status_with_separate_active_pr_evidence(self) -> None: self.assertIn("Protected-main status", trd) self.assertIn("Active/non-shipped evidence", trd) self.assertIn("Active replacement PR #37", trd) - self.assertIn("purpose-bound sensitive-data policy kernel", trd) + self.assertIn("purpose-bound sensitive-data authority", trd) def test_extension_authority_uml_separates_compatibility_from_agent_authority(self) -> None: """A Chrome permission must never be documented as an Agent capability.""" From e29fc3445214ffc23301fa389e8a0a860ef5fc31 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 13:43:11 +0900 Subject: [PATCH 034/130] test(docs): require canonical traceability maturity vocabulary --- tests/test_product_documentation_contract.py | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/tests/test_product_documentation_contract.py b/tests/test_product_documentation_contract.py index 66a67d52..08e6f706 100644 --- a/tests/test_product_documentation_contract.py +++ b/tests/test_product_documentation_contract.py @@ -125,10 +125,19 @@ def test_release_contract_never_bypasses_evidence_or_reproducibility(self) -> No self.assertNotIn("residual unrun evidence", release) def test_traceability_labels_conversation_derived_future_work(self) -> None: - """Conversation decisions must preserve implementation status instead of becoming claims.""" + """Conversation decisions must preserve canonical maturity instead of becoming shipped claims.""" traceability = (ROOT / "docs/traceability/README.md").read_text(encoding="utf-8") - for phrase in ("Implemented", "Accepted architecture", "Proposed", "Open", "conversation-derived", "docs/doctoring.md"): + for phrase in ( + "IMPLEMENTED_ON_PROTECTED_MAIN", + "IMPLEMENTED_ON_ACTIVE_PR", + "PARTIAL", + "ACCEPTED_ARCHITECTURE", + "PLANNED", + "conversation-derived", + "docs/doctoring.md", + "Active-PR behavior is never protected-main truth", + ): with self.subTest(phrase=phrase): self.assertIn(phrase, traceability) -if __name__ == "__main__": unittest.main() +if __name__ == "__main__": unittest.main() \ No newline at end of file From e8c8ce4faac8bd5c56f054d5aed02a7c70c276ef Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 14:53:47 +0900 Subject: [PATCH 035/130] docs: distinguish proposed ADR provenance from protected main --- docs/README.md | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/docs/README.md b/docs/README.md index 8d0fb549..1f8c9d2c 100644 --- a/docs/README.md +++ b/docs/README.md @@ -57,13 +57,13 @@ The PRD/TRD/Architecture/ADR/UML/ERD/data-governance/traceability/security/opera - [ADR 0008: Delegated-task TLS leaf-validity horizon](adr/0008-leaf-validity-horizon.md) - [ADR 0010: Session/context-bound node authority](adr/0010-session-context-bound-node-authority.md) -## Proposed decisions retained on protected main +## Proposed architecture decisions -Proposed ADRs are reviewable architecture memory, not shipped behavior and not automatically Accepted merely because their files live on protected `main`. +Proposed ADRs are reviewable architecture memory, not shipped behavior and not automatically Accepted because their files are present in a branch or later reach protected `main`. The provenance headings below distinguish the protected-main baseline from decisions introduced by this documentation reconciliation without changing either decision's lifecycle status. + +### Protected-main baseline proposed decisions - [ADR 0009: Hourly agent credential boundary](adr/0009-hourly-agent-credential-boundary.md) -- [ADR 0013: Manifest V3 compatibility and extension-to-Agent authority](adr/0013-manifest-v3-extension-authority.md) -- [ADR 0014: Architecture decision acceptance governance](adr/0014-architecture-decision-governance.md) - [ADR 0100: Rust control-plane boundary](adr/0100-rust-control-plane-boundary.md) - [ADR 0101: Isolated execution/profile modes](adr/0101-isolated-execution-profile-modes.md) - [ADR 0102: Typed actions over arbitrary JavaScript](adr/0102-typed-actions-and-arbitrary-js.md) @@ -75,4 +75,11 @@ Proposed ADRs are reviewable architecture memory, not shipped behavior and not a - [ADR 0108: Crawler policy](adr/0108-crawler-policy.md) - [ADR 0109: Hourly automation secret ordering and operational closure](adr/0109-hourly-automation-operational-closure.md) +### Proposed decisions introduced by this documentation reconciliation + +- [ADR 0013: Manifest V3 compatibility and extension-to-Agent authority](adr/0013-manifest-v3-extension-authority.md) +- [ADR 0014: Architecture decision acceptance governance](adr/0014-architecture-decision-governance.md) + +The second group exists only on this documentation branch until the branch integrates. After integration, the heading remains useful historical provenance; it does not promote either ADR from Proposed to Accepted and it does not claim that the described runtime capability is implemented. + See the [ADR index](adr/README.md) for status rules, required decision structure, supersession rules, and active feature ADRs. The index and each ADR's own status metadata must agree; a PR body, chat transcript, automation prompt, or stale issue reference cannot change ADR status. \ No newline at end of file From ef3dc0baf4ccd321d0f9ce4246b52a12597a8005 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 14:54:32 +0900 Subject: [PATCH 036/130] docs: separate ADR lifecycle from branch provenance --- docs/adr/README.md | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/docs/adr/README.md b/docs/adr/README.md index b3fc1cc7..416231b1 100644 --- a/docs/adr/README.md +++ b/docs/adr/README.md @@ -28,15 +28,15 @@ An Accepted ADR is **design authority, not implementation evidence**. Protected- | [0008](0008-leaf-validity-horizon.md) | Delegated-task TLS leaf-validity horizon | Accepted | minimum certificate-validity horizon for bounded delegated tasks | | [0010](0010-session-context-bound-node-authority.md) | Session/context-bound node authority | Accepted | browser-session, browsing-context, origin, document-epoch and stale-node authority | -## Proposed decisions retained on protected main +## Proposed architecture decisions -Proposed ADR files can live on protected `main` as reviewable target architecture without becoming Accepted or shipped behavior. Their own status metadata remains authoritative until a later reviewed change accepts, supersedes, rejects, or deprecates them. +Proposed ADR files are reviewable target architecture without becoming Accepted or shipped behavior. The provenance subsections distinguish files already present in the protected-main baseline from decisions introduced by this documentation reconciliation. Provenance never changes lifecycle: file presence on an active branch is not protected-main truth, and later integration does not itself promote a Proposed ADR to Accepted. + +### Protected-main baseline proposed decisions | ADR | Decision | Status | Governs | |---|---|---|---| | [0009](0009-hourly-agent-credential-boundary.md) | Hourly agent credential boundary | Proposed | deterministic gates, NVIDIA credential materialization, local broker and publication separation | -| [0013](0013-manifest-v3-extension-authority.md) | Manifest V3 compatibility and extension-to-Agent authority | Proposed | Chromium extension compatibility evidence, profile separation, extension grants, native-messaging boundary and release claims | -| [0014](0014-architecture-decision-governance.md) | Architecture decision acceptance governance | Proposed | ADR lifecycle authority, reviewer eligibility, solo-maintainer hold and re-enablement conditions | | [0100](0100-rust-control-plane-boundary.md) | Rust control-plane boundary | Proposed | Rust-owned product authority versus Chromium compatibility kernel | | [0101](0101-isolated-execution-profile-modes.md) | Isolated execution/profile modes | Proposed | Human, Assist, Agent Task and Crawler session/profile isolation | | [0102](0102-typed-actions-and-arbitrary-js.md) | Typed actions over arbitrary JavaScript authority | Proposed | action API, script escape hatches, risk/policy semantics | @@ -48,17 +48,27 @@ Proposed ADR files can live on protected `main` as reviewable target architectur | [0108](0108-crawler-policy.md) | Policy-bound crawler mode | Proposed | robots, rate/resource policy, read-only collection and no-evasion behavior | | [0109](0109-hourly-automation-operational-closure.md) | Hourly automation secret ordering and operational closure | Proposed | deterministic gates, model secret boundary, retries and protected-main proof | -Active feature PRs may contain additional Proposed ADRs. They are not indexed here as protected-main decisions until their files reach protected `main`. Historical PR checks, stale branch state, or chat decisions never transfer ADR acceptance across a changed head. +### Proposed decisions introduced by documentation reconciliation + +| ADR | Decision | Status | Governs | +|---|---|---|---| +| [0013](0013-manifest-v3-extension-authority.md) | Manifest V3 compatibility and extension-to-Agent authority | Proposed | Chromium extension compatibility evidence, profile separation, extension grants, native-messaging boundary and release claims | +| [0014](0014-architecture-decision-governance.md) | Architecture decision acceptance governance | Proposed | ADR lifecycle authority, reviewer eligibility, solo-maintainer hold and re-enablement conditions | + +ADR 0013 and ADR 0014 exist only on this documentation branch until it integrates. After integration, this subsection remains historical provenance rather than an active-PR claim; both decisions remain Proposed until a later policy-compliant change explicitly changes their lifecycle. + +Other active feature PRs may contain additional Proposed ADRs. Those files are not part of this canonical documentation line until integrated or deliberately reconciled here. Historical PR checks, stale branch state, or chat decisions never transfer ADR acceptance across a changed head. ## Index completeness rule -Every ADR file on protected `main` must be discoverable from this index with a status that agrees with the ADR's own status metadata. A feature ADR in an active PR belongs in that PR's traceability until merge. When an ADR is added, accepted, superseded, deprecated, or rejected, update this index in the same protected change or an immediately coupled documentation reconciliation. +Every numbered ADR file in the canonical documentation tree under review must be discoverable from this index with a status that agrees with the ADR's own lifecycle metadata. The protected-main subset must remain exact, while feature ADRs outside this canonical line belong in their owning PR's traceability until integration. When an ADR is added, accepted, superseded, deprecated, or rejected, update this index in the same protected change or an immediately coupled documentation reconciliation. The machine-checkable documentation contract should fail when: -- an ADR file on protected `main` is absent from this index; +- a numbered ADR file in the canonical documentation tree is absent from this index; - this index claims `Accepted` while the ADR metadata says `Proposed`, or the reverse; - a superseded ADR lacks a discoverable successor; +- branch provenance is presented as lifecycle status or protected-main implementation evidence; - an active-PR ADR is presented as protected-main implementation evidence; or - a stale PR number, SHA, run ID, automation prompt, or conversation statement is used as timeless architecture authority. From 484f40fed2bce9bea1b352ab29d06df1e1995e03 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 14:56:14 +0900 Subject: [PATCH 037/130] test(docs): separate branch provenance from protected-main truth --- tests/test_documentation_fitness_contract.py | 26 ++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index e456141b..3d60b3ca 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -119,6 +119,32 @@ def test_adr_index_does_not_use_change_local_language_as_timeless_authority(self self.assertNotIn("Proposed target-architecture decisions in this change", adr_index) self.assertIn("Index completeness rule", adr_index) + def test_proposed_adr_provenance_does_not_promote_branch_to_protected_main(self) -> None: + """Branch-only ADR presence must remain distinct from lifecycle and protected-main truth.""" + docs_index = (DOCS_ROOT / "README.md").read_text(encoding="utf-8") + adr_index = (ADR_ROOT / "README.md").read_text(encoding="utf-8") + + for text in (docs_index, adr_index): + with self.subTest(index="docs" if text is docs_index else "adr"): + self.assertIn("## Proposed architecture decisions", text) + self.assertIn("Protected-main baseline proposed decisions", text) + self.assertNotIn("## Proposed decisions retained on protected main", text) + + docs_branch = docs_index.split( + "### Proposed decisions introduced by this documentation reconciliation", 1 + )[1].split("\n## ", 1)[0] + adr_branch = adr_index.split( + "### Proposed decisions introduced by documentation reconciliation", 1 + )[1].split("\n## ", 1)[0] + for adr_path in ( + "0013-manifest-v3-extension-authority.md", + "0014-architecture-decision-governance.md", + ): + with self.subTest(adr=adr_path): + self.assertIn(adr_path, docs_branch) + self.assertIn(adr_path, adr_branch) + self.assertIn("exist only on this documentation branch until it integrates", adr_index) + def test_current_replacement_lanes_are_not_promoted_to_protected_main(self) -> None: """Canonical docs must distinguish active implementation from shipped implementation.""" assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") From d00aea11474056cebfa61aafd013790192b23621 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 16:01:47 +0900 Subject: [PATCH 038/130] docs: reconcile active sensitive-data lifecycle evidence --- docs/DOCUMENTATION_FITNESS.md | 52 ++++++++++++++++++++++------------- 1 file changed, 33 insertions(+), 19 deletions(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index 15267666..0e06b521 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -17,20 +17,20 @@ File existence alone is never sufficient. An artifact can exist and still be sta | Documentation family | Fitness | Current evidence / remaining boundary | |---|---|---| -| PRD | **REPAIRED IN THIS CHANGE** | HTTP now names active replacement PR #37 while retaining `Planned` protected-main status; historical PR #11 is predecessor lineage. Purpose-bound sensitive disclosure is recorded as an Implemented policy kernel while broker/storage/lifecycle remain Planned under issue #10. MV3 remains a Planned complete compatibility program while protected-main and active-PR evidence are separately identified. | -| TRD | **REPAIRED IN THIS CHANGE** | Implementation inventory now separates protected-main status from active/non-shipped evidence instead of composite labels such as `Planned / active development`. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries are reconciled to current evidence. | -| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium compatibility-kernel + Rust control-plane direction, explicit authority stack and protected-main truth rule. Reconcile implementation-facing details after #37/#40 or the real Chromium vertical slice integrate. | -| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Indexes now discover Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 without promoting Proposed decisions. Identifier allocation is treated as a cross-main-and-active-work reservation problem. | -| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 covers MV3 compatibility vs extension-to-Agent authority; Proposed ADR 0014 covers ADR acceptance governance. Their presence does not imply Acceptance. HTTP ADRs in PR #37 remain active-PR evidence. | -| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. This PR adds `uml/extension-authority.md`. A detailed real-Chromium vertical-slice sequence is deferred until issue #28 contracts stabilize. | -| Conceptual ERD/domain model | **PRESENT-CURRENT** | Explicitly conceptual unless an adapter/schema is separately implemented; distinguishes current value/evidence concepts from planned durable records and adapter-owned representations. No physical database is invented merely to satisfy an ERD checklist. | -| Traceability | **REPAIRED IN THIS CHANGE** | Separates `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`; records #37/#40/#43 without promoting them to shipped truth. | -| Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, network, secret, provenance and extension risks. Update when new real browser/HTTP/runtime attack surfaces integrate. | -| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code coverage, rustdoc and realistic boundary testing are explicit. Real browser and MV3 evidence remain pinned-browser executable evidence rather than source-text claims. | -| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. Protected-main runtime/scheduled evidence remains required for operational closure where applicable. | -| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented; much browser adapter implementation remains Planned. External protocol identifiers are never durable authority by themselves. | +| PRD | **REPAIRED IN THIS CHANGE** | HTTP names active replacement PR #37 while retaining `Planned` protected-main status; historical PR #11 is predecessor lineage. Purpose-bound sensitive disclosure is an Implemented protected-main policy kernel while broker/storage/lifecycle remain Planned under issue #10; active PR #45 adds credential-free lifecycle evidence and active PR #46 adds bounded in-process authoritative use reservation without turning the broker runtime into shipped behavior. MV3 remains a Planned complete compatibility program while protected-main and active-PR evidence are separately identified. | +| TRD | **REPAIRED IN THIS CHANGE** | Implementation inventory separates protected-main status from active/non-shipped evidence instead of composite labels. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth; #45/#46 are active partial broker-lifecycle evidence only. | +| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium compatibility-kernel + Rust control-plane direction, explicit authority stack and protected-main truth rule. No topology change is required for #45/#46 because they implement already-governed ADR 0007 evidence/policy primitives rather than introducing broker persistence or a new service boundary. Reconcile implementation-facing details after #37/#40 or the real Chromium vertical slice integrate. | +| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Indexes Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 without promoting Proposed decisions. Identifier allocation is treated as a cross-main-and-active-work reservation problem. No new ADR is required for #45/#46 because both stay within Accepted ADR 0007's existing sensitive-data authority/broker-lifecycle direction. | +| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 covers MV3 compatibility vs extension-to-Agent authority; Proposed ADR 0014 covers ADR acceptance governance. Their presence does not imply Acceptance. HTTP ADRs in PR #37 remain active-PR evidence. ADR 0007 already specifies caller-unforgeable state and atomic broker reservation; #45/#46 are partial implementation evidence, not a new architecture decision. | +| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. This PR adds `uml/extension-authority.md`. No new UML is justified for #45/#46 until a real trusted broker/storage/fill runtime changes the deployed component or transaction boundary. A detailed real-Chromium vertical-slice sequence is deferred until issue #28 contracts stabilize. | +| Conceptual ERD/domain model | **PRESENT-CURRENT** | Explicitly conceptual unless an adapter/schema is separately implemented; distinguishes current value/evidence concepts from planned durable records and adapter-owned representations. #45/#46 introduce no physical persistence, so adding tables merely to represent active in-memory primitives would be false architecture. | +| Traceability | **REPAIRED IN THIS CHANGE** | Separates `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`; #37/#40/#43/#45/#46 are active evidence only and cannot be promoted to protected-main truth. | +| Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, network, secret, provenance and extension risks. ADR 0007 already identifies stale caller-count/concurrent replay risk; #46 narrows that risk only within one in-process mutable state object and does not claim cross-process atomicity/revocation. Update when a real broker/storage/runtime attack surface integrates. | +| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code coverage, rustdoc and realistic boundary testing are explicit. #46 follows real RED at the unresolved production API, then exact-head workspace/test/Clippy/rustdoc and 100% function/line/region/branch coverage. Real browser and MV3 evidence remain pinned-browser executable evidence rather than source-text claims. | +| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. #45/#46 intentionally add no durable broker operation, so no new runbook/SLO/RPO/RTO is fabricated. Protected-main runtime/scheduled evidence remains required for operational closure where applicable. | +| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented; much browser adapter implementation remains Planned. External protocol identifiers are never durable authority by themselves. #46's Rust policy API is internal reusable control-plane state, not a new external wire/schema contract. | | Release / rollback / provenance | **PRESENT-CURRENT** | Feature-branch green checks cannot become release readiness. Release remains bound to one exact integrated protected head and applicable CI/security/coverage/package/provenance/recovery/compatibility/review evidence. | -| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist; trusted broker/storage/revocation/model-disclosure lifecycle remains open under issue #10. | +| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. Active PR #45 adds credential-free handle lifecycle evidence; active PR #46 adds a bounded in-process reservation counter that removes caller-supplied prior-use state from the reservation operation. Trusted broker storage, cross-process transactionality, revocation, protected-value resolution/fill, compensation, encryption/KMS and model-disclosure lifecycle remain open under issue #10. | | Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references are kept in doctoring documents with draft/experimental status distinguished from final normative standards. | ## 3. Reconciliation findings and resolution state @@ -39,13 +39,20 @@ File existence alone is never sufficient. An artifact can exist and still be sta Protected-main PRD previously named historical PR #11 as active HTTP evidence. Current executable replacement work is PR #37, while protected main still does not ship bounded HTTP semantics. -**Resolved on this documentation branch:** PRD, TRD and traceability now name #37 only as active/non-shipped evidence, retain protected-main `Planned`, and treat #11 as predecessor lineage. Old-head checks/reviews do not transfer. +**Resolved on this documentation branch:** PRD, TRD and traceability name #37 only as active/non-shipped evidence, retain protected-main `Planned`, and treat #11 as predecessor lineage. Old-head checks/reviews do not transfer. -### 3.2 Sensitive-data authority +### 3.2 Sensitive-data authority and broker lifecycle -Protected main contains a purpose-bound sensitive-data policy/evidence foundation, while the trusted broker, durable value lifecycle, revocation/reservation, trusted fill and provider/model disclosure controls remain incomplete. +Protected main contains a purpose-bound sensitive-data policy/evidence foundation governed by Accepted ADR 0007, while the complete trusted broker remains unimplemented. -**Resolved on this documentation branch:** PRD/TRD/traceability distinguish the Implemented policy foundation from the Planned broker/runtime under issue #10 instead of calling the entire concern active or shipped. +Two newer active lanes provide narrower non-shipped evidence: + +- PR #45 records credential-free handle lifecycle evidence in `originweave-evidence` without storing protected values; and +- PR #46 adds `SensitiveHandleUseState`, an in-process authoritative reservation count in `originweave-policy` that increments only after existing exact-scope/classification/expiry/use-limit admission and does not trust a reservation caller to supply the prior-use count. + +PR #46's mutable-borrow serialization is deliberately **not** described as durable or cross-process atomic broker enforcement. It stores neither the opaque token nor protected data and does not implement revocation, transactionally durable reservation, value resolution/fill, compensation, encryption/KMS, retention, or model/provider/region disclosure policy. + +**Resolved on this documentation branch:** the design verdict remains unchanged. PRD/TRD/traceability may identify #45/#46 as `IMPLEMENTED_ON_ACTIVE_PR`/partial evidence while the complete broker/runtime stays `Planned` under issue #10. Root Architecture, UML and ERD do not gain fictitious service/database boundaries before those boundaries actually exist. ### 3.3 Manifest V3 compatibility @@ -101,6 +108,7 @@ The canonical graph must continue to preserve these durable decisions: 18. Documentation, checks, reviews, model judgements and operational evidence are separate evidence authorities. 19. Work-conserving maintenance continues to another safe lane rather than stopping on one merge, document, RCA, queued check or external approval gap. 20. ADR numbers, migrations, schema/API/protocol versions and other collision-sensitive repository identifiers are reserved across protected main **and active work** before allocation. +21. A policy primitive may narrow stale-count/replay risk without claiming the durable trusted broker exists; in-memory serialization, cross-process transactionality, lifecycle evidence and protected-value release remain separate maturity claims. ## 5. Architecture views still legitimately deferred @@ -139,6 +147,10 @@ isolated profile/context Do not freeze temporary protocol/field names into authoritative UML before the executable contracts stabilize. +### 5.3 Trusted sensitive-data broker — deferred until issue #10 owns a real runtime boundary + +Current protected-main policy/evidence plus active #45/#46 primitives do not justify inventing a broker process, database table, transaction manager, KMS path or browser-fill adapter in timeless Architecture/UML/ERD. When a real broker slice exists, the documentation graph must add the actual component/transaction/data-lifecycle views and mark persisted versus in-memory versus external state from executable evidence. + ## 6. What remains before documentation closure ### Completed or materially advanced on this branch @@ -152,14 +164,16 @@ Do not freeze temporary protocol/field names into authoritative UML before the e - extension authority UML; - conceptual ERD truth discipline; - documentation fitness and regression contracts; -- current browser/protocol standards doctoring. +- current browser/protocol standards doctoring; +- active-sensitive-data evidence reconciliation without promoting #45/#46 to shipped or inventing broker persistence. ### Still required - exact-head CI/security/review acceptance of this documentation PR; - integration before any of these branch repairs become protected-main truth; -- re-reconciliation after active PR #37 or #40 integrates, because active-PR status must then move to protected-main evidence; +- re-reconciliation after active PR #37, #40, #43, #45 or #46 integrates, because active-PR status must then move to protected-main evidence; - detailed real-Chromium vertical-slice UML when issue #28 implementation contracts are stable; +- trusted-broker UML/ERD/operability additions only when issue #10 establishes real runtime/persistence ownership; - future ERD changes only when persistence ownership/entities actually change; - ongoing security/operability/release reconciliation as real browser/runtime boundaries integrate. From 113298e5f659644fc6565da8329dd2ebc6917e60 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 18:47:26 +0900 Subject: [PATCH 039/130] docs(traceability): track bounded resolution freshness authority --- .../resolution-freshness-authority.md | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 docs/traceability/resolution-freshness-authority.md diff --git a/docs/traceability/resolution-freshness-authority.md b/docs/traceability/resolution-freshness-authority.md new file mode 100644 index 00000000..13994f16 --- /dev/null +++ b/docs/traceability/resolution-freshness-authority.md @@ -0,0 +1,51 @@ +# Resolution Freshness Authority Trace + +- **Documentation status:** Active-PR traceability +- **Protected-main capability status:** **PARTIAL** +- **Active implementation lane:** PR #47, `feat/resolution-freshness-authority-main` +- **Governing existing decision boundary:** ADR 0004 and the protected-main destination/rebinding authority model +- **Buyer-visible gap:** bound the interval between a validated resolution answer and use of that authority so DNS-rebinding/TOCTOU exposure is explicit and fail-closed + +## Truth boundary + +Protected `main` at `67af7c87589edc2039545af335c95064d9b8391c` already classifies, approves, pins, and non-expansively revalidates resolved destination addresses. It does **not** yet encode a resolution approval timestamp, bounded validity interval, or expiry decision in the destination authority consumed by the socket path. + +PR #47 is therefore **IMPLEMENTED_ON_ACTIVE_PR only after its production change exists and exact-head tests pass**. Its initial test-only head is intentionally RED and must never be cited as shipped implementation evidence. + +The complete DNS-rebinding/TOCTOU path is not closed merely by introducing a deterministic freshness primitive. First-party direct socket planning must subsequently require the fresh authority at the action linearization boundary, and that consumer must use one trusted monotonic clock domain. Until that integration is protected-main evidence, the capability remains **PARTIAL**. + +## Required deterministic authority + +The active slice is expected to prove a reusable destination-policy primitive with all of the following properties: + +1. approval time is explicit and supplied from one trusted monotonic clock domain; +2. validity is non-zero and capped by a repository-owned product safety budget; +3. the usable interval is half-open: `approved_at <= now < valid_until`; +4. use before approval, use at/after expiry, arithmetic overflow, and unapproved addresses fail closed with typed errors; +5. credential-free connection evidence records approval, expiry, and authorization times without introducing hostnames, credentials, resolver internals, or raw protected values beyond the existing origin/address evidence contract; +6. non-expanding revalidation may renew the bounded interval only while rerunning the existing destination-policy validation against the newly supplied answer; and +7. the primitive performs no DNS lookup, socket I/O, wall-clock read, proxy selection, TLS, HTTP, browser control, persistence, or model call. + +## Architecture and ADR assessment + +This bounded primitive does not by itself introduce a new component, persistence owner, wire protocol, browser adapter, or trust domain. It tightens the already Accepted destination/rebinding authority governed by ADR 0004. Therefore a new ADR, UML deployment view, or physical ERD object would be false precision at this stage. + +A new or superseding ADR becomes appropriate only if integration changes the governing boundary—for example, if resolution freshness becomes durable cross-process state, is delegated to a separate resolver service, changes trusted-clock ownership, or introduces a new externally versioned protocol. + +## Evidence progression + +| Evidence state | Allowed maturity claim | +|---|---| +| Test-only PR head with unresolved production API | `PLANNED` test contract / intentional RED only | +| Active PR production primitive + exact-head tests/coverage | `IMPLEMENTED_ON_ACTIVE_PR` for the primitive; overall path remains `PARTIAL` | +| Protected-main primitive, but direct socket consumer can still bypass freshness | `PARTIAL` | +| Protected-main direct socket path requires exact fresh authority and exact-head integration tests prove expiry/rebinding behavior | `IMPLEMENTED_ON_PROTECTED_MAIN` for the bounded resolution-to-socket interval | +| Browser/network adapter proves the same clock and authority chain under real navigation | additional integration/release evidence; not implied by the lower-layer primitive | + +## Required follow-through + +- keep PRD/TRD/network-authority traceability from calling the TOCTOU boundary closed while PR #47 is active or while the socket consumer can bypass freshness; +- integrate freshness into the first-party `originweave-network` connection-plan boundary test-first after the destination primitive stabilizes; +- require exact 100% owned production function/line/region/branch coverage and complete rustdoc on each changed head; +- update the network authority UML only if the executable consumer changes the current sequence semantics materially; and +- retain the existing conceptual ERD unless a real persistence owner is introduced. From 34b976588f74f3dee14d682cea083ddaf68e4469 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 20:09:54 +0900 Subject: [PATCH 040/130] docs(traceability): bound revocation freshness maturity --- .../tls-revocation-freshness-authority.md | 52 +++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 docs/traceability/tls-revocation-freshness-authority.md diff --git a/docs/traceability/tls-revocation-freshness-authority.md b/docs/traceability/tls-revocation-freshness-authority.md new file mode 100644 index 00000000..7ae35d28 --- /dev/null +++ b/docs/traceability/tls-revocation-freshness-authority.md @@ -0,0 +1,52 @@ +# TLS Revocation-Material Freshness Authority Trace + +- **Documentation status:** Active-PR traceability +- **Protected-main capability status:** **PARTIAL** +- **Active implementation lane:** PR #48, `feat/tls-revocation-freshness-main` +- **Governing existing boundary:** protected-main TLS service-identity authority, ADR 0006, ADR 0008, and the revocation-distribution/freshness roadmap gap +- **Buyer-visible gap:** prevent stale independently verified revocation material from being treated as current authority while preserving the fact that OriginWeave does not yet make an unrevoked-certificate claim + +## Truth boundary + +Protected `main` authenticates the requested HTTPS service over the already verified TCP stream, but its TLS evidence records revocation as `NotConfigured`. It does not fetch, parse, validate, cache, or enforce OCSP/CRL material and it does not claim that a certificate is unrevoked. + +PR #48 adds a reusable **freshness primitive** for revocation material only. The primitive can classify independently verified material as usable inside its signed `thisUpdate` to `nextUpdate` interval. That active-PR implementation is not protected-main truth, and passing the freshness check does not prove signature validity, path validity, responder authority, non-revocation, successful distribution, or complete TLS authentication policy. + +The complete revocation path therefore remains **PARTIAL** until a separately reviewed adapter acquires and cryptographically verifies revocation material, composes freshness into the authentication decision, defines failure/cache/recovery semantics, and proves the resulting behavior on protected main. + +## Required deterministic authority + +The bounded primitive is expected to preserve these properties: + +1. `thisUpdate` and `nextUpdate` are supplied only after independent cryptographic verification by a higher-layer adapter; +2. the signed interval is non-empty and ordered; +3. the usable interval is half-open: `thisUpdate <= trusted_time < nextUpdate`; +4. trusted time before `thisUpdate` and at/after `nextUpdate` fails closed with typed bounded errors; +5. the primitive performs no OCSP/CRL fetch, DNS, socket connection, TLS handshake mutation, parsing, signature verification, cache operation, browser control, persistence, or model call; and +6. no evidence or documentation converts freshness into an `unrevoked` claim. + +## Architecture and ADR assessment + +The active primitive tightens an existing TLS evidence/policy concern without introducing a new deployed component, persistence owner, wire protocol, network path, or secret boundary. A new ADR is therefore not required merely because the helper type exists. + +A new or superseding ADR becomes appropriate if OriginWeave later chooses a concrete revocation architecture that changes trust ownership—for example, stapled OCSP versus independently fetched OCSP/CRL, cache authority and freshness policy, hard-fail versus explicitly bounded degraded behavior, responder/path validation ownership, or a separate revocation service. + +No new physical ERD object is justified by this active in-memory primitive. UML should change only when the executable TLS/revocation data or control path changes materially. + +## Evidence progression + +| Evidence state | Allowed maturity claim | +|---|---| +| Protected main records `RevocationStatus::NotConfigured` | `PARTIAL`; no revocation enforcement or unrevoked claim | +| Active PR freshness primitive with exact-head tests/coverage | `IMPLEMENTED_ON_ACTIVE_PR` for freshness classification only | +| Protected-main freshness primitive without verified material acquisition/composition | `PARTIAL` | +| Protected-main adapter verifies responder/material authenticity, freshness, cache/failure policy, and binds the result into TLS authentication | implementation evidence for the chosen bounded revocation policy | +| Protected-main integration/recovery/operational tests prove the complete path | required additional release evidence; not implied by the helper primitive | + +## Required follow-through + +- keep PRD/TRD/TLS evidence from implying revocation enforcement while protected main remains `NotConfigured`; +- define revocation-material acquisition, authenticity, cache, freshness, failure, privacy, and recovery semantics before calling the TLS revocation boundary implemented; +- require exact 100% owned production function/line/region/branch coverage and complete rustdoc on every changed head; +- add or supersede an ADR only when the concrete revocation architecture changes a durable trust or deployment decision; and +- retain the conceptual ERD unless executable persistence ownership actually appears. From 14bc318b3ed985aade3a3b4e9be245a1a13a093c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 20:10:37 +0900 Subject: [PATCH 041/130] docs(traceability): reconcile resolution freshness coverage RCA --- .../resolution-freshness-authority.md | 28 +++++++++++++------ 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/docs/traceability/resolution-freshness-authority.md b/docs/traceability/resolution-freshness-authority.md index 13994f16..ce44d693 100644 --- a/docs/traceability/resolution-freshness-authority.md +++ b/docs/traceability/resolution-freshness-authority.md @@ -4,25 +4,33 @@ - **Protected-main capability status:** **PARTIAL** - **Active implementation lane:** PR #47, `feat/resolution-freshness-authority-main` - **Governing existing decision boundary:** ADR 0004 and the protected-main destination/rebinding authority model -- **Buyer-visible gap:** bound the interval between a validated resolution answer and use of that authority so DNS-rebinding/TOCTOU exposure is explicit and fail-closed +- **Buyer-visible gap:** bind the interval between a validated resolution answer and use of that authority so DNS-rebinding/TOCTOU exposure is explicit and fail-closed ## Truth boundary -Protected `main` at `67af7c87589edc2039545af335c95064d9b8391c` already classifies, approves, pins, and non-expansively revalidates resolved destination addresses. It does **not** yet encode a resolution approval timestamp, bounded validity interval, or expiry decision in the destination authority consumed by the socket path. +Protected `main` already classifies, approves, pins, and non-expansively revalidates resolved destination addresses. It does **not** yet encode a resolution approval timestamp, bounded validity interval, or expiry decision in the destination authority consumed by the socket path. -PR #47 is therefore **IMPLEMENTED_ON_ACTIVE_PR only after its production change exists and exact-head tests pass**. Its initial test-only head is intentionally RED and must never be cited as shipped implementation evidence. +PR #47 now contains the reusable production `FreshResolutionSnapshot` primitive and realistic tests, so the primitive is **IMPLEMENTED_ON_ACTIVE_PR** evidence. It is still non-shipped evidence. The complete DNS-rebinding/TOCTOU path is not closed merely by introducing a deterministic freshness primitive: first-party direct socket planning must subsequently require the fresh authority at the action linearization boundary and that consumer must use one trusted monotonic clock domain. Until that integration reaches protected main, the overall capability remains **PARTIAL**. -The complete DNS-rebinding/TOCTOU path is not closed merely by introducing a deterministic freshness primitive. First-party direct socket planning must subsequently require the fresh authority at the action linearization boundary, and that consumer must use one trusted monotonic clock domain. Until that integration is protected-main evidence, the capability remains **PARTIAL**. +The initial test-only head is historical RED evidence only and must never be cited as shipped implementation evidence. -## Required deterministic authority +## Current exact-head RCA -The active slice is expected to prove a reusable destination-policy primitive with all of the following properties: +The first production-complete head reached all ordinary Rust contracts and security scans, but exact coverage failed at one compiler region while functions, lines, and branches were already complete. The uploaded coverage evidence localized the only missing region to the generic `FreshResolutionSnapshot::revalidate` instantiation used with a one-address resolver answer: the success path for a one-address contraction was exercised, while the same monomorphized helper's error propagation for a one-address expansion had not been executed. + +That is a realistic DNS-rebinding case rather than an impossible instrumentation artifact. The current branch therefore adds a focused regression in which a fresh resolver answer contains exactly one new public address and must fail closed with `ResolutionSetExpanded`. The existing two-address expansion test is retained because answer cardinality is part of the generic call shape and both are realistic resolver behaviors. + +Fresh exact-head CI for that new test must be terminally successful before the branch can be called coverage-clean or moved out of Draft. Predecessor-head security/check results do not transfer to the new head. + +## Deterministic authority contract + +The active slice proves a reusable destination-policy primitive with all of the following properties: 1. approval time is explicit and supplied from one trusted monotonic clock domain; 2. validity is non-zero and capped by a repository-owned product safety budget; 3. the usable interval is half-open: `approved_at <= now < valid_until`; 4. use before approval, use at/after expiry, arithmetic overflow, and unapproved addresses fail closed with typed errors; -5. credential-free connection evidence records approval, expiry, and authorization times without introducing hostnames, credentials, resolver internals, or raw protected values beyond the existing origin/address evidence contract; +5. credential-free connection evidence records approval, expiry, and authorization times without introducing credentials, resolver internals, or raw protected values beyond the existing origin/address evidence contract; 6. non-expanding revalidation may renew the bounded interval only while rerunning the existing destination-policy validation against the newly supplied answer; and 7. the primitive performs no DNS lookup, socket I/O, wall-clock read, proxy selection, TLS, HTTP, browser control, persistence, or model call. @@ -37,13 +45,15 @@ A new or superseding ADR becomes appropriate only if integration changes the gov | Evidence state | Allowed maturity claim | |---|---| | Test-only PR head with unresolved production API | `PLANNED` test contract / intentional RED only | -| Active PR production primitive + exact-head tests/coverage | `IMPLEMENTED_ON_ACTIVE_PR` for the primitive; overall path remains `PARTIAL` | +| Active PR production primitive with ordinary tests but a non-passing exact coverage gate | `IMPLEMENTED_ON_ACTIVE_PR` for the primitive, but not gate-clean; overall path remains `PARTIAL` | +| Active PR production primitive + unchanged exact-head CI/security/100% coverage | gate-clean active-PR evidence only; overall path remains `PARTIAL` | | Protected-main primitive, but direct socket consumer can still bypass freshness | `PARTIAL` | -| Protected-main direct socket path requires exact fresh authority and exact-head integration tests prove expiry/rebinding behavior | `IMPLEMENTED_ON_PROTECTED_MAIN` for the bounded resolution-to-socket interval | +| Protected-main direct socket path requires exact fresh authority and integration tests prove expiry/rebinding behavior | `IMPLEMENTED_ON_PROTECTED_MAIN` for the bounded resolution-to-socket interval | | Browser/network adapter proves the same clock and authority chain under real navigation | additional integration/release evidence; not implied by the lower-layer primitive | ## Required follow-through +- require terminal success on the current exact PR #47 head before changing Draft/review readiness; - keep PRD/TRD/network-authority traceability from calling the TOCTOU boundary closed while PR #47 is active or while the socket consumer can bypass freshness; - integrate freshness into the first-party `originweave-network` connection-plan boundary test-first after the destination primitive stabilizes; - require exact 100% owned production function/line/region/branch coverage and complete rustdoc on each changed head; From a3efb627883de51030d53647b05ee1fc8bd8233f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 20:11:10 +0900 Subject: [PATCH 042/130] test(docs): require freshness traceability discovery --- tests/test_freshness_traceability_contract.py | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 tests/test_freshness_traceability_contract.py diff --git a/tests/test_freshness_traceability_contract.py b/tests/test_freshness_traceability_contract.py new file mode 100644 index 00000000..30aa9f90 --- /dev/null +++ b/tests/test_freshness_traceability_contract.py @@ -0,0 +1,41 @@ +"""Regression contracts for bounded freshness-authority documentation.""" + +from __future__ import annotations + +import pathlib +import unittest + +ROOT = pathlib.Path(__file__).resolve().parents[1] +TRACEABILITY = ROOT / "docs" / "traceability" + + +class FreshnessTraceabilityContractTests(unittest.TestCase): + """Keep active freshness primitives discoverable without promoting them to shipped truth.""" + + def test_traceability_index_discovers_each_active_freshness_authority(self) -> None: + """Resolution and TLS freshness traces must be linked from the canonical index.""" + index = (TRACEABILITY / "README.md").read_text(encoding="utf-8") + for filename in ( + "resolution-freshness-authority.md", + "tls-revocation-freshness-authority.md", + ): + with self.subTest(filename=filename): + self.assertTrue((TRACEABILITY / filename).is_file()) + self.assertIn(filename, index) + + def test_active_freshness_traces_preserve_protected_main_maturity(self) -> None: + """Active implementation evidence must remain explicitly non-shipped and partial overall.""" + for filename in ( + "resolution-freshness-authority.md", + "tls-revocation-freshness-authority.md", + ): + text = (TRACEABILITY / filename).read_text(encoding="utf-8") + with self.subTest(filename=filename): + self.assertIn("Active-PR traceability", text) + self.assertIn("Protected-main capability status:** **PARTIAL", text) + self.assertIn("IMPLEMENTED_ON_ACTIVE_PR", text) + self.assertIn("not protected-main truth", text) + + +if __name__ == "__main__": + unittest.main() From 1487f4ade5eb2f6409a223261c270d24a8b95884 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 20:12:07 +0900 Subject: [PATCH 043/130] docs(traceability): index active freshness authorities --- docs/traceability/README.md | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/docs/traceability/README.md b/docs/traceability/README.md index f2c7f2c6..eb8778d9 100644 --- a/docs/traceability/README.md +++ b/docs/traceability/README.md @@ -21,6 +21,15 @@ For current behavior, use this precedence order: Lower layers may define future direction but cannot override current protected implementation or an Accepted ADR. Active-PR behavior is never protected-main truth. +### 1.1 Active freshness-authority dossiers + +Transient implementation evidence that materially tightens an existing authority boundary is kept in explicit active-PR traceability rather than silently changing protected-main maturity: + +- [`resolution-freshness-authority.md`](resolution-freshness-authority.md) — PR #47 bounds the lifetime of validated destination-resolution authority; the direct socket consumer still must require that fresh authority before the overall DNS-rebinding/TOCTOU interval can be called implemented on protected main. +- [`tls-revocation-freshness-authority.md`](tls-revocation-freshness-authority.md) — PR #48 classifies independently verified revocation material for freshness only; it does not fetch or authenticate OCSP/CRL material and does not create an unrevoked-certificate claim. + +These dossiers are evidence indexes, not substitute ADRs. A new ADR is required only when a durable architecture/trust/deployment decision changes. + ## 2. Capability maturity vocabulary Capability maturity uses exactly one of these values: @@ -46,13 +55,15 @@ ADR lifecycle is separate and remains `Proposed`, `Accepted`, `Superseded`, `Dep | Page content is data, never instruction authority | IMPLEMENTED_ON_PROTECTED_MAIN | ADR 0002; `ARCHITECTURE.md`; `docs/TRD.md` | `originweave-core` + `originweave-policy` tests | | Typed actions instead of default arbitrary JavaScript | PARTIAL | PRD-ACT-001..004; ADR 0002 | Typed core/policy foundations are on main; complete browser action adapter remains Planned | | logical origin != resolved destination | IMPLEMENTED_ON_PROTECTED_MAIN | ADR 0004; TRD-INV-002 | `originweave-destination`; destination governance tests | +| Bounded resolution freshness is explicit before destination authority is consumed | IMPLEMENTED_ON_ACTIVE_PR | ADR 0004; [`resolution-freshness-authority.md`](resolution-freshness-authority.md) | PR #47 implements the deterministic freshness primitive; protected-main socket planning can still bypass it, so the overall resolution-to-socket TOCTOU boundary remains PARTIAL | | resolved destination != TCP peer | IMPLEMENTED_ON_PROTECTED_MAIN | ADR 0005; TRD Section 6 | `originweave-network`; loopback/peer tests | | TCP peer != TLS service identity | IMPLEMENTED_ON_PROTECTED_MAIN | ADR 0006; TRD Section 6 | `originweave-tls`; rustls integration tests | +| Revocation-material freshness is separate from revocation authenticity/non-revocation | IMPLEMENTED_ON_ACTIVE_PR | ADR 0006/0008 boundary; [`tls-revocation-freshness-authority.md`](tls-revocation-freshness-authority.md) | PR #48 adds a freshness classifier only; protected main still records revocation as NotConfigured and makes no unrevoked claim | | Proxy/PAC route authority must be explicit | PARTIAL | PRD-NET-005; TRD Section 6.3 | Protected-main direct-route authority exists; PAC evaluation/proxy transport/CONNECT remain incomplete | | Bounded HTTP semantics require an authenticated governed connection and resource bounds | IMPLEMENTED_ON_ACTIVE_PR | PRD-NET-006; issue #9; active PR #37 | `originweave-http` replacement exists on active PR #37; historical PR #11 is SUPERSEDED implementation lineage and is not current evidence; no protected-main HTTP claim yet | | Node handles bind session/context/origin/document lifetime | PARTIAL | ADR 0010; PRD-OBS-001/002; TRD Section 5 | Core opaque session/context/document/node authority is on protected main; active PR #40 owns the protocol-ID registry and remains non-shipped evidence | | Raw secrets never enter model context | PARTIAL | PRD-DATA-001; ADR 0002; TRD Section 9 | Core secret-delivery policy exists; trusted broker/runtime completion remains Planned | -| Sensitive disclosure is purpose- and classification-bound | PARTIAL | ADR 0007; PRD-DATA-002; issue #10 | Purpose-bound policy kernel and sensitive-access evidence foundations are on protected main; trusted broker/storage/revocation/lifecycle/model-disclosure boundary remains open | +| Sensitive disclosure is purpose- and classification-bound | PARTIAL | ADR 0007; PRD-DATA-002; issue #10 | Purpose-bound policy/evidence foundations are on protected main; active PR #45 adds credential-free handle-lifecycle evidence and #46 adds bounded in-process authoritative use reservation, while trusted storage/revocation/value resolution/cross-process lifecycle/model-disclosure remain open | | Evidence/provenance are product outputs, not debug leftovers | PARTIAL | ADR 0003; PRD Section 9.6 | `originweave-evidence` foundations exist; complete durable Evidence Trail/WARC/PROV adapters remain Planned | | Human interaction outranks inference/background collection | PARTIAL | `ARCHITECTURE.md`; PRD-RES-002 | Deterministic resource mitigation/CPU-worker admission foundations exist; platform telemetry/actuation remain Planned | | Structured observation precedes raw HTML/screenshot fallback | ACCEPTED_ARCHITECTURE | PRD-OBS-003; TRD Section 7 | Real semantic observation adapter remains Planned | @@ -72,8 +83,10 @@ ADR lifecycle is separate and remains `Proposed`, `Accepted`, `Superseded`, `Dep | Canonical origin / action / approval | `originweave-core` | crate tests; ADR 0002 | IMPLEMENTED_ON_PROTECTED_MAIN | | Deterministic action policy | `originweave-policy` | policy/security-review tests | IMPLEMENTED_ON_PROTECTED_MAIN | | Destination/rebinding/redirect | `originweave-destination` | destination tests; ADR 0004 | IMPLEMENTED_ON_PROTECTED_MAIN | +| Resolution freshness authority | active `originweave-destination` work in PR #47 | [`resolution-freshness-authority.md`](resolution-freshness-authority.md); active exact-head tests/coverage | IMPLEMENTED_ON_ACTIVE_PR | | Exact direct socket/peer | `originweave-network` | real loopback + error tests; ADR 0005 | IMPLEMENTED_ON_PROTECTED_MAIN | | TLS identity | `originweave-tls` | real rustls integration; ADR 0006 | IMPLEMENTED_ON_PROTECTED_MAIN | +| TLS revocation-material freshness | active `originweave-tls` work in PR #48 | [`tls-revocation-freshness-authority.md`](tls-revocation-freshness-authority.md); active exact-head tests/coverage | IMPLEMENTED_ON_ACTIVE_PR | | Resource budgets/mitigations | `originweave-resource` | crate tests | PARTIAL | | Redacted evidence/provenance | `originweave-evidence` | crate tests; ADR 0003 | PARTIAL | | Bounded HTTP/1.1 | active `originweave-http` replacement in PR #37 | issue #9; active-PR unit/integration/coverage evidence | IMPLEMENTED_ON_ACTIVE_PR | @@ -81,7 +94,7 @@ ADR lifecycle is separate and remains `Proposed`, `Accepted`, `Superseded`, `Dep | Session/context/document/node authority | `originweave-core` authority values; active registry work in PR #40 | ADR 0010; roadmap/TRD/UML | PARTIAL | | Manifest V3 compatibility evidence | `scripts/ci/run_mv3_compatibility.py` + controlled MV3 fixture; active downloads lane #43 | issue #27; real-browser contracts | PARTIAL | | Extension-to-Agent authority | protected-main core authority kernel + Proposed ADR 0013 | issue #27; extension authority UML | PARTIAL | -| Purpose-bound sensitive-data policy/evidence | `originweave-policy` + evidence foundations | ADR 0007; issue #10 | PARTIAL | +| Purpose-bound sensitive-data policy/evidence | `originweave-policy` + evidence foundations; active lifecycle/reservation work #45/#46 | ADR 0007; issue #10 | PARTIAL | | Trusted sensitive-data broker/storage/lifecycle | future bounded service/crate | issue #10; PRD/TRD/data governance | PLANNED | | BiDi/CDP/WebMCP/MCP | future/versioned adapter crates; registry prerequisite active in #40 | protocol compatibility tests required | PLANNED | | WARC/PROV persistence | persistence/export adapters | doctoring + future conformance tests | PLANNED | @@ -93,9 +106,9 @@ ADR lifecycle is separate and remains `Proposed`, `Accepted`, `Superseded`, `Dep | PRD-COMP-001, Chromium compatibility kernel | ADR 0001 (Accepted) | | PRD-ACT-001, PRD-ACT-005, PRD-CRAWL-001, trust-source boundary | ADR 0002 (Accepted) | | PRD-EVD-001, PRD-EVD-002, PRD-EVD-005 | ADR 0003 (Accepted) | -| PRD-NET-001, PRD-NET-002, redirect/rebinding boundary | ADR 0004 (Accepted) | +| PRD-NET-001, PRD-NET-002, redirect/rebinding/freshness boundary | ADR 0004 (Accepted); active PR #47 tightens the existing boundary without creating a new deployed component or trust owner | | PRD-NET-003 | ADR 0005 (Accepted) | -| PRD-NET-004 | ADR 0006 (Accepted) | +| PRD-NET-004 | ADR 0006 (Accepted); active PR #48 adds revocation-material freshness only and does not define a complete revocation architecture | | Purpose-bound sensitive-data authority | ADR 0007 (Accepted); trusted broker/storage/lifecycle still issue #10 | | TLS delegated-task leaf-validity horizon | ADR 0008 (Accepted) | | Session/context/document/node binding | ADR 0010 (Accepted); active registry implementation #40 remains non-shipped | @@ -114,7 +127,7 @@ The canonical APA 7th bibliography is [`../doctoring.md`](../doctoring.md). This | WHATWG URL + Chromium canonicalizer | Browser-compatible origin identity and numeric-host rejection | | IANA special-purpose registries / RFC 6890 / RFC 8190 / RFC 9637 | Destination classification and fail-closed public-web policy | | RFC 9293 | Exact TCP endpoint/peer model | -| RFC 5280 / RFC 9525 / current TLS guidance | Certificate path and HTTPS service identity | +| RFC 5280 / RFC 9525 / current TLS guidance | Certificate path, HTTPS service identity, and the separation between certificate validity and any future revocation policy | | RFC 9110 / RFC 9112 / RFC 9530 | Bounded HTTP semantics, framing, redirect evidence and digest fields | | RFC 9309 | Crawler robots evidence, explicitly not access authorization | | W3C WebDriver BiDi | Versioned browser automation adapter, not core authority | @@ -131,13 +144,13 @@ Material claims should update `docs/doctoring.md` with current primary evidence | Diagram | Requirements represented / maturity | |---|---| | UML component/bounded-context view | Product family, Chromium/Rust ownership, adapter boundaries | -| Network authority sequence | PRD-NET-001..007; TRD-INV-002; HTTP remains active-PR until #37 integrates | +| Network authority sequence | PRD-NET-001..007; TRD-INV-002; HTTP remains active-PR until #37 integrates; resolution freshness remains an active lower-layer primitive until the socket consumer requires it | | Observation/action sequence | PRD-OBS, PRD-ACT, PRD-DATA, trust separation | | Delegated-task state machine | session lifecycle, approval, resource pause, cancellation/recovery, post-condition truth | | Deployment topology | renderer trust, orchestrator/model/store boundaries | | Evidence authority flow | PRD-EVD; proposal/policy/approval/execution/outcome separation | | Extension authority sequence | MV3 compatibility plane vs explicit OriginWeave extension grant and Agent capability separation | -| Conceptual ERD | session/action/network/sensitive/resource/provenance identity; conceptual model does not imply physical persistence | +| Conceptual ERD | session/action/network/sensitive/resource/provenance identity; active freshness primitives introduce no physical persistence | | Real Chromium vertical-slice sequence | PLANNED until issue #28 implementation stabilizes; do not encode temporary adapter fields as shipped architecture | ## 8. Conversation-to-repository capture rule @@ -157,13 +170,16 @@ This rule intentionally prevents chat history from becoming a shadow architectur ## 9. Documentation drift checks -Repository contracts should fail when canonical PRD/TRD/ADR/UML/ERD/traceability artifacts disappear, lifecycle/index status diverges, an active PR is promoted to protected-main truth, or core maturity/authority vocabulary is removed. More semantic checks should be added when a specific drift has caused a real defect; avoid brittle tests that merely duplicate prose. +Repository contracts should fail when canonical PRD/TRD/ADR/UML/ERD/traceability artifacts disappear, lifecycle/index status diverges, an active PR is promoted to protected-main truth, or core maturity/authority vocabulary is removed. Active freshness dossiers must remain discoverable from this index so lower-layer primitives cannot silently become over-broad shipped claims. More semantic checks should be added when a specific drift has caused a real defect; avoid brittle tests that merely duplicate prose. ## 10. Open traceability work -- **Open:** reconcile PRD/TRD implementation notes that still name historical PR #11 or already-integrated sensitive-data work; active PR #37 is current HTTP implementation evidence but remains non-shipped until merge. +- **Open:** active PR #47 must reach unchanged exact-head CI/security/100% coverage, then the first-party socket consumer must require the fresh resolution authority before the resolution-to-socket TOCTOU interval can become protected-main implemented evidence. +- **Open:** active PR #48 remains freshness classification only; define and review revocation-material acquisition/authenticity/cache/failure/composition before any protected-main revocation-enforcement or unrevoked claim. +- **Open:** after #37 integrates, move bounded HTTP from `IMPLEMENTED_ON_ACTIVE_PR` into protected-main evidence and close historical PR #11 only after unique-work preservation and protected-main verification are proven. - **Open:** after #43 integrates, move bounded MV3 downloads from `IMPLEMENTED_ON_ACTIVE_PR` into the protected-main compatibility evidence inventory while issue #27 remains open for the complete matrix. - **Open:** after #40 stabilizes/integrates, map its registry API and tests without presenting raw BiDi/CDP identifiers as durable authority. +- **Open:** after #45/#46 integrate, reclassify their narrow lifecycle/reservation primitives while keeping durable trusted-broker storage/revocation/value-resolution/model-disclosure boundaries under issue #10 until implemented. - **Open:** attach concrete release profiles and quantitative benchmark thresholds after reproducible benchmark evidence exists. - **Open:** map every future public OriginWeave Protocol operation to risk/capability/authority and conformance tests. - **Open:** map enterprise controls to exact SOC 2/CSAP-oriented control evidence without claiming certification. From e65a48427d81848d296453f0827d7fafe4a63177 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 20:18:14 +0900 Subject: [PATCH 044/130] docs(traceability): state freshness as non-protected-main truth --- docs/traceability/resolution-freshness-authority.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/traceability/resolution-freshness-authority.md b/docs/traceability/resolution-freshness-authority.md index ce44d693..b84efb0e 100644 --- a/docs/traceability/resolution-freshness-authority.md +++ b/docs/traceability/resolution-freshness-authority.md @@ -10,7 +10,7 @@ Protected `main` already classifies, approves, pins, and non-expansively revalidates resolved destination addresses. It does **not** yet encode a resolution approval timestamp, bounded validity interval, or expiry decision in the destination authority consumed by the socket path. -PR #47 now contains the reusable production `FreshResolutionSnapshot` primitive and realistic tests, so the primitive is **IMPLEMENTED_ON_ACTIVE_PR** evidence. It is still non-shipped evidence. The complete DNS-rebinding/TOCTOU path is not closed merely by introducing a deterministic freshness primitive: first-party direct socket planning must subsequently require the fresh authority at the action linearization boundary and that consumer must use one trusted monotonic clock domain. Until that integration reaches protected main, the overall capability remains **PARTIAL**. +PR #47 now contains the reusable production `FreshResolutionSnapshot` primitive and realistic tests, so the primitive is **IMPLEMENTED_ON_ACTIVE_PR** evidence. It is not protected-main truth. It is still non-shipped evidence. The complete DNS-rebinding/TOCTOU path is not closed merely by introducing a deterministic freshness primitive: first-party direct socket planning must subsequently require the fresh authority at the action linearization boundary and that consumer must use one trusted monotonic clock domain. Until that integration reaches protected main, the overall capability remains **PARTIAL**. The initial test-only head is historical RED evidence only and must never be cited as shipped implementation evidence. From 1c94b63688152cb99baa70107ccd895742a0ef01 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 20:21:58 +0900 Subject: [PATCH 045/130] docs(adr): make acceptance transition explicit --- docs/adr/0014-architecture-decision-governance.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/docs/adr/0014-architecture-decision-governance.md b/docs/adr/0014-architecture-decision-governance.md index bbbdd1c0..d550f846 100644 --- a/docs/adr/0014-architecture-decision-governance.md +++ b/docs/adr/0014-architecture-decision-governance.md @@ -25,7 +25,8 @@ The ADR index previously repeated these binding details directly. An index shoul ## Assumptions and authority boundaries - Protected-main `AGENTS.md` and live GitHub rules are authoritative for contributor actions. -- This ADR is Proposed until protected-main governance accepts it. +- This ADR remains Proposed until a protected-main revision explicitly records an Accepted lifecycle transition in this ADR's metadata and both canonical indexes. +- Merely merging a file that still says `Proposed` does not Accept it. - Formal review and technical checks are separate evidence classes. - A review counts only if the governing policy recognizes that reviewer identity and review state for the relevant exact head. - Predecessor-head approval does not transfer across a changed head unless live policy explicitly defines that behavior. @@ -52,7 +53,7 @@ Selected. If Accepted, OriginWeave applies these durable ADR-governance rules: -1. **Protected-main transition defines architecture acceptance.** A branch file, issue, chat statement, prompt, PR body, check, or model verdict does not independently create a governing Accepted ADR. +1. **Explicit protected-main lifecycle transition defines architecture acceptance.** A branch file, issue, chat statement, prompt, PR body, check, model verdict, or merge by itself does not create a governing Accepted ADR. An ADR becomes Accepted only when a protected-main revision explicitly changes that ADR's lifecycle metadata to `Accepted` and both `docs/README.md` and `docs/adr/README.md` mirror the same status. A Proposed ADR that merely reaches protected main remains Proposed. 2. **Live policy defines mandatory review evidence.** When current GitHub rules require counted approval, acceptance requires a formal `APPROVED` review from an eligible identity recognized by that policy on the applicable unchanged head. 3. **Repository-specific review requirements must be operationally satisfiable.** A stricter CWL/OriginWeave rule may require an eligible non-author reviewer only when a legitimate reviewer route exists. 4. **No synthetic approval.** Author approval, COMMENTED reviews, reactions, model verdicts, statuses, predecessor-head approvals, impersonated identities, and fabricated accounts never substitute for required counted approval. @@ -100,4 +101,12 @@ Supersede this ADR if GitHub governance changes to a materially different review ## References -Current contributor authority is defined by [`../../AGENTS.md`](../../AGENTS.md), live GitHub repository policy, and the ADR lifecycle index [`README.md`](README.md). This ADR deliberately does not freeze mutable GitHub product semantics into timeless prose. \ No newline at end of file +ContextualWisdomLab. (2026). *Agent development contract* [Repository specification]. *OriginWeave*. [`../../AGENTS.md`](../../AGENTS.md) + +ContextualWisdomLab. (2026). *OriginWeave architecture decision records* [Repository specification]. *OriginWeave*. [`README.md`](README.md) + +GitHub. (n.d.). *Approving a pull request with required reviews*. GitHub Docs. Retrieved August 10, 2026, from https://docs.github.com/en/pull-requests/how-tos/review-pull-requests/approving-a-pull-request-with-required-reviews + +GitHub. (n.d.). *About protected branches*. GitHub Docs. Retrieved August 10, 2026, from https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches + +Current repository settings remain mutable runtime policy and must be probed live; these references document GitHub review/protection semantics rather than freezing the repository's current configuration into this ADR. From e77ab74ce8b81831117d037d30a73540c55588a3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 20:22:24 +0900 Subject: [PATCH 046/130] docs(doctoring): cite mutable CDP tip-of-tree correctly --- docs/doctoring/browser-agent-protocols.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/doctoring/browser-agent-protocols.md b/docs/doctoring/browser-agent-protocols.md index 57c3d54f..5173a32e 100644 --- a/docs/doctoring/browser-agent-protocols.md +++ b/docs/doctoring/browser-agent-protocols.md @@ -56,7 +56,7 @@ The main [`docs/doctoring.md`](../doctoring.md) records the stable W3C PROV-O Re ## References — APA 7th -Chrome DevTools Protocol. (2026). *Chrome DevTools Protocol—Latest (tip-of-tree)*. https://chromedevtools.github.io/devtools-protocol/tot/ +Chrome DevTools Protocol. (n.d.). *Chrome DevTools Protocol—Latest (tip-of-tree)*. Retrieved August 10, 2026, from https://chromedevtools.github.io/devtools-protocol/tot/ Google Chrome Developers. (n.d.). *Manifest file format*. Chrome for Developers. Retrieved August 10, 2026, from https://developer.chrome.com/docs/extensions/reference/manifest From c463145757614631da3f6bcb5445384efc17e501 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 20:22:59 +0900 Subject: [PATCH 047/130] test(docs): accept descriptive ADR index status suffixes --- tests/test_documentation_fitness_contract.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index 3d60b3ca..1168c286 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -70,7 +70,7 @@ def _parse_adr_index(text: str) -> dict[str, str]: mapping: dict[str, str] = {} pattern = re.compile( r"^\|\s*\[\d{4}\]\((\d{4}[-\w]*\.md)\)\s*\|[^|]*\|\s*" - r"(Proposed|Accepted|Superseded|Deprecated|Rejected)\s*\|", + r"(Proposed|Accepted|Superseded|Deprecated|Rejected)(?:[;\s][^|\r\n]*)?\s*\|", re.MULTILINE, ) for path, status in pattern.findall(text): From c32a051a6cd180f3df4f05f78f2fe3cbcb256e50 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 20:23:37 +0900 Subject: [PATCH 048/130] test(docs): remove compound-line lint hazards --- tests/test_product_documentation_contract.py | 281 +++++++++++++++---- 1 file changed, 233 insertions(+), 48 deletions(-) diff --git a/tests/test_product_documentation_contract.py b/tests/test_product_documentation_contract.py index 08e6f706..a22ccdbb 100644 --- a/tests/test_product_documentation_contract.py +++ b/tests/test_product_documentation_contract.py @@ -14,9 +14,16 @@ class ProductDocumentationContractTests(unittest.TestCase): def test_authoritative_product_documentation_graph_exists(self) -> None: """Major product decisions must not require reconstructing chat or PR history.""" required_paths = { - "docs/PRD.md", "docs/TRD.md", "docs/adr/README.md", "docs/uml/README.md", - "docs/erd/README.md", "docs/traceability/README.md", "docs/THREAT_MODEL.md", - "docs/TEST_STRATEGY.md", "docs/OPERABILITY.md", "docs/API_CONTRACT.md", + "docs/PRD.md", + "docs/TRD.md", + "docs/adr/README.md", + "docs/uml/README.md", + "docs/erd/README.md", + "docs/traceability/README.md", + "docs/THREAT_MODEL.md", + "docs/TEST_STRATEGY.md", + "docs/OPERABILITY.md", + "docs/API_CONTRACT.md", "docs/RELEASE_AND_ROLLBACK.md", } missing = sorted(path for path in required_paths if not (ROOT / path).is_file()) @@ -25,103 +32,279 @@ def test_authoritative_product_documentation_graph_exists(self) -> None: def test_root_architecture_links_the_authoritative_product_graph(self) -> None: """Architecture readers must be able to reach requirements, decisions, diagrams, and data.""" architecture = (ROOT / "ARCHITECTURE.md").read_text(encoding="utf-8") - for link in ("docs/PRD.md", "docs/TRD.md", "docs/adr/README.md", "docs/uml/README.md", "docs/erd/README.md", "docs/traceability/README.md"): - with self.subTest(link=link): self.assertIn(link, architecture) + for link in ( + "docs/PRD.md", + "docs/TRD.md", + "docs/adr/README.md", + "docs/uml/README.md", + "docs/erd/README.md", + "docs/traceability/README.md", + ): + with self.subTest(link=link): + self.assertIn(link, architecture) def test_security_policy_links_the_product_threat_model(self) -> None: """Vulnerability reporters and operators must be able to find modeled trust boundaries.""" - self.assertIn("docs/THREAT_MODEL.md", (ROOT / "SECURITY.md").read_text(encoding="utf-8")) + self.assertIn( + "docs/THREAT_MODEL.md", + (ROOT / "SECURITY.md").read_text(encoding="utf-8"), + ) def test_agent_contract_is_work_conserving_instead_of_one_action_per_run(self) -> None: """Finishing one bounded slice must return maintenance to the live queue.""" contract = (ROOT / "AGENTS.md").read_text(encoding="utf-8") - for phrase in ("A completed action is an intermediate state", "one write-active slice at a time", "Mandatory exit sweep", "termination is prohibited", "blocks only that item"): - with self.subTest(phrase=phrase): self.assertIn(phrase, contract) + for phrase in ( + "A completed action is an intermediate state", + "one write-active slice at a time", + "Mandatory exit sweep", + "termination is prohibited", + "blocks only that item", + ): + with self.subTest(phrase=phrase): + self.assertIn(phrase, contract) def test_prd_covers_product_family_modes_and_buyer_acceptance(self) -> None: """The PRD must describe the actual product family rather than one kernel slice.""" prd = (ROOT / "docs/PRD.md").read_text(encoding="utf-8") - for phrase in ("Browse. Act. Prove.", "Human Mode", "Assist Mode", "Agent Task Mode", "Crawler Mode", "OriginWeave Browser", "OriginWeave Runtime", "OriginWeave Observe", "OriginWeave Capture", "OriginWeave Governor", "OriginWeave Policy", "OriginWeave Evidence", "OriginWeave Protocol", "Non-goals", "Buyer-visible acceptance"): - with self.subTest(phrase=phrase): self.assertIn(phrase, prd) + for phrase in ( + "Browse. Act. Prove.", + "Human Mode", + "Assist Mode", + "Agent Task Mode", + "Crawler Mode", + "OriginWeave Browser", + "OriginWeave Runtime", + "OriginWeave Observe", + "OriginWeave Capture", + "OriginWeave Governor", + "OriginWeave Policy", + "OriginWeave Evidence", + "OriginWeave Protocol", + "Non-goals", + "Buyer-visible acceptance", + ): + with self.subTest(phrase=phrase): + self.assertIn(phrase, prd) def test_trd_distinguishes_shipped_architecture_from_future_work(self) -> None: """Technical documentation must not silently describe planned work as shipped.""" trd = (ROOT / "docs/TRD.md").read_text(encoding="utf-8") - for phrase in ("Implemented", "Accepted architecture", "Planned", "logical origin", "resolved destination", "TCP peer", "TLS service identity", "WebDriver BiDi", "Chrome DevTools Protocol", "WebMCP", "Model Context Protocol", "NVIDIA_NIM_API_KEY", "COPILOT_GITHUB_TOKEN"): - with self.subTest(phrase=phrase): self.assertIn(phrase, trd) + for phrase in ( + "Implemented", + "Accepted architecture", + "Planned", + "logical origin", + "resolved destination", + "TCP peer", + "TLS service identity", + "WebDriver BiDi", + "Chrome DevTools Protocol", + "WebMCP", + "Model Context Protocol", + "NVIDIA_NIM_API_KEY", + "COPILOT_GITHUB_TOKEN", + ): + with self.subTest(phrase=phrase): + self.assertIn(phrase, trd) def test_target_architecture_adr_set_is_detailed(self) -> None: """Product direction must be reconstructable from durable, reviewable decisions.""" required_adrs = { - "docs/adr/0001-chromium-compatibility-kernel.md": ("Chromium", "browser-engine rewrite"), - "docs/adr/0100-rust-control-plane-boundary.md": ("Rust control plane", "Chromium compatibility kernel"), - "docs/adr/0101-isolated-execution-profile-modes.md": ("Human", "Assist", "Agent Task", "Crawler"), - "docs/adr/0102-typed-actions-and-arbitrary-js.md": ("typed action", "arbitrary JavaScript"), - "docs/adr/0103-semantic-observation-and-stale-node-identity.md": ("WebMCP", "accessibility", "document epoch", "stale"), - "docs/adr/0104-prompt-injection-and-secret-authority.md": ("prompt injection", "opaque", "secret"), - "docs/adr/0105-resource-governor-priority.md": ("resource governor", "GPU", "browser", "model"), - "docs/adr/0106-provenance-evidence-model.md": ("WARC", "PROV", "evidence"), - "docs/adr/0107-browser-protocol-adapter-strategy.md": ("WebDriver BiDi", "Chrome DevTools Protocol", "WebMCP", "Model Context Protocol"), + "docs/adr/0001-chromium-compatibility-kernel.md": ( + "Chromium", + "browser-engine rewrite", + ), + "docs/adr/0100-rust-control-plane-boundary.md": ( + "Rust control plane", + "Chromium compatibility kernel", + ), + "docs/adr/0101-isolated-execution-profile-modes.md": ( + "Human", + "Assist", + "Agent Task", + "Crawler", + ), + "docs/adr/0102-typed-actions-and-arbitrary-js.md": ( + "typed action", + "arbitrary JavaScript", + ), + "docs/adr/0103-semantic-observation-and-stale-node-identity.md": ( + "WebMCP", + "accessibility", + "document epoch", + "stale", + ), + "docs/adr/0104-prompt-injection-and-secret-authority.md": ( + "prompt injection", + "opaque", + "secret", + ), + "docs/adr/0105-resource-governor-priority.md": ( + "resource governor", + "GPU", + "browser", + "model", + ), + "docs/adr/0106-provenance-evidence-model.md": ( + "WARC", + "PROV", + "evidence", + ), + "docs/adr/0107-browser-protocol-adapter-strategy.md": ( + "WebDriver BiDi", + "Chrome DevTools Protocol", + "WebMCP", + "Model Context Protocol", + ), "docs/adr/0108-crawler-policy.md": ("robots", "rate", "CAPTCHA"), - "docs/adr/0109-hourly-automation-operational-closure.md": ("NVIDIA_NIM_API_KEY", "protected-main", "open_pull_request"), + "docs/adr/0109-hourly-automation-operational-closure.md": ( + "NVIDIA_NIM_API_KEY", + "protected-main", + "open_pull_request", + ), } - sections = ("## Context", "## Options considered", "## Decision", "## Consequences", "## Failure and degraded behavior", "## Security / privacy / governance impact", "## Tests and acceptance evidence", "## Migration and rollback", "## Supersession / reversal conditions") + sections = ( + "## Context", + "## Options considered", + "## Decision", + "## Consequences", + "## Failure and degraded behavior", + "## Security / privacy / governance impact", + "## Tests and acceptance evidence", + "## Migration and rollback", + "## Supersession / reversal conditions", + ) fields = ("- Status:", "- Date:", "- Supersedes:", "- Superseded by:") for path, phrases in required_adrs.items(): with self.subTest(path=path): text = (ROOT / path).read_text(encoding="utf-8") - for field in fields: self.assertIn(field, text) - for section in sections: self.assertIn(section, text) - for phrase in phrases: self.assertIn(phrase, text) + for field in fields: + self.assertIn(field, text) + for section in sections: + self.assertIn(section, text) + for phrase in phrases: + self.assertIn(phrase, text) def test_stale_node_adr_defines_action_linearization_race(self) -> None: """A mutation between handle validation and dispatch must never produce a stale side effect.""" - adr = (ROOT / "docs/adr/0103-semantic-observation-and-stale-node-identity.md").read_text(encoding="utf-8") - for phrase in ("action linearization point", "side effect", "competing mutation", "re-observation"): - with self.subTest(phrase=phrase): self.assertIn(phrase, adr) + adr = ( + ROOT / "docs/adr/0103-semantic-observation-and-stale-node-identity.md" + ).read_text(encoding="utf-8") + for phrase in ( + "action linearization point", + "side effect", + "competing mutation", + "re-observation", + ): + with self.subTest(phrase=phrase): + self.assertIn(phrase, adr) def test_hourly_automation_adr_requires_exit_sweep(self) -> None: """Automation closure must re-sweep all actionable lanes instead of stopping after one result.""" - adr = (ROOT / "docs/adr/0109-hourly-automation-operational-closure.md").read_text(encoding="utf-8") - for phrase in ("mandatory exit sweep", "open OriginWeave PRs and issues", "release state", "documentation", "product gaps", "safe actionable work remains"): - with self.subTest(phrase=phrase): self.assertIn(phrase, adr) + adr = ( + ROOT / "docs/adr/0109-hourly-automation-operational-closure.md" + ).read_text(encoding="utf-8") + for phrase in ( + "mandatory exit sweep", + "open OriginWeave PRs and issues", + "release state", + "documentation", + "product gaps", + "safe actionable work remains", + ): + with self.subTest(phrase=phrase): + self.assertIn(phrase, adr) def test_uml_and_erd_are_diagram_as_code(self) -> None: """Architecture flows and the conceptual domain model must be reviewable in Git.""" uml = (ROOT / "docs/uml/README.md").read_text(encoding="utf-8") erd = (ROOT / "docs/erd/README.md").read_text(encoding="utf-8") - self.assertGreaterEqual(uml.count("```mermaid"), 8); self.assertIn("sequenceDiagram", uml); self.assertIn("stateDiagram-v2", uml) - for heading in ("Secret-fill sequence", "Read/write risk approval flow", "Resource-pressure and fallback flow", "Hourly product-development gate-to-model flow"): - with self.subTest(heading=heading): self.assertIn(heading, uml) + self.assertGreaterEqual(uml.count("```mermaid"), 8) + self.assertIn("sequenceDiagram", uml) + self.assertIn("stateDiagram-v2", uml) + for heading in ( + "Secret-fill sequence", + "Read/write risk approval flow", + "Resource-pressure and fallback flow", + "Hourly product-development gate-to-model flow", + ): + with self.subTest(heading=heading): + self.assertIn(heading, uml) self.assertIn("erDiagram", erd) - for entity in ("agent_session", "browser_profile", "page_snapshot", "semantic_node", "action_event", "policy_decision", "provenance_record", "resource_budget"): - with self.subTest(entity=entity): self.assertIn(entity, erd) + for entity in ( + "agent_session", + "browser_profile", + "page_snapshot", + "semantic_node", + "action_event", + "policy_decision", + "provenance_record", + "resource_budget", + ): + with self.subTest(entity=entity): + self.assertIn(entity, erd) def test_hourly_uml_fails_closed_before_secret_or_publication(self) -> None: """Denied credentials and failed validation must terminate before secret use or publication.""" uml = (ROOT / "docs/uml/README.md").read_text(encoding="utf-8") - for phrase in ("credential denied or broker unavailable", "stop without secret materialization", "validation failed", "fail closed without publication", "validation passed"): - with self.subTest(phrase=phrase): self.assertIn(phrase, uml) + for phrase in ( + "credential denied or broker unavailable", + "stop without secret materialization", + "validation failed", + "fail closed without publication", + "validation passed", + ): + with self.subTest(phrase=phrase): + self.assertIn(phrase, uml) def test_operational_documents_preserve_fail_closed_product_boundaries(self) -> None: """Security, operations, APIs, tests, and rollback must agree on core authority boundaries.""" documents = { - "docs/THREAT_MODEL.md": ("renderer compromise", "prompt injection", "confused deputy", "cross-tenant"), - "docs/TEST_STRATEGY.md": ("true production boundary", "100%", "hostile", "protected-main"), + "docs/THREAT_MODEL.md": ( + "renderer compromise", + "prompt injection", + "confused deputy", + "cross-tenant", + ), + "docs/TEST_STRATEGY.md": ( + "true production boundary", + "100%", + "hostile", + "protected-main", + ), "docs/OPERABILITY.md": ("SLI", "SLO", "quarantine", "break-glass"), - "docs/API_CONTRACT.md": ("OriginWeave Protocol", "idempotency", "post-condition", "opaque"), - "docs/RELEASE_AND_ROLLBACK.md": ("SBOM", "provenance", "rollback", "protected main"), + "docs/API_CONTRACT.md": ( + "OriginWeave Protocol", + "idempotency", + "post-condition", + "opaque", + ), + "docs/RELEASE_AND_ROLLBACK.md": ( + "SBOM", + "provenance", + "rollback", + "protected main", + ), } for path, phrases in documents.items(): text = (ROOT / path).read_text(encoding="utf-8") for phrase in phrases: - with self.subTest(path=path, phrase=phrase): self.assertIn(phrase, text) + with self.subTest(path=path, phrase=phrase): + self.assertIn(phrase, text) def test_release_contract_never_bypasses_evidence_or_reproducibility(self) -> None: """Emergency release handling must preserve exact-head gates and reproducible artifacts.""" release = (ROOT / "docs/RELEASE_AND_ROLLBACK.md").read_text(encoding="utf-8") - for phrase in ("Emergency releases do not bypass required gates", "current-head checks", "complete coverage", "branch protection", "reproducible artifact", "nondeterministic signing"): - with self.subTest(phrase=phrase): self.assertIn(phrase, release) + for phrase in ( + "Emergency releases do not bypass required gates", + "current-head checks", + "complete coverage", + "branch protection", + "reproducible artifact", + "nondeterministic signing", + ): + with self.subTest(phrase=phrase): + self.assertIn(phrase, release) self.assertNotIn("residual unrun evidence", release) def test_traceability_labels_conversation_derived_future_work(self) -> None: @@ -137,7 +320,9 @@ def test_traceability_labels_conversation_derived_future_work(self) -> None: "docs/doctoring.md", "Active-PR behavior is never protected-main truth", ): - with self.subTest(phrase=phrase): self.assertIn(phrase, traceability) + with self.subTest(phrase=phrase): + self.assertIn(phrase, traceability) -if __name__ == "__main__": unittest.main() \ No newline at end of file +if __name__ == "__main__": + unittest.main() From 75fc2e29a67aa2522aeb583832cc736213c257ad Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 23:21:54 +0900 Subject: [PATCH 049/130] docs(traceability): track fresh-resolution socket consumer lane --- .../resolution-freshness-authority.md | 63 +++++++++++-------- 1 file changed, 37 insertions(+), 26 deletions(-) diff --git a/docs/traceability/resolution-freshness-authority.md b/docs/traceability/resolution-freshness-authority.md index b84efb0e..b1e699f0 100644 --- a/docs/traceability/resolution-freshness-authority.md +++ b/docs/traceability/resolution-freshness-authority.md @@ -2,60 +2,71 @@ - **Documentation status:** Active-PR traceability - **Protected-main capability status:** **PARTIAL** -- **Active implementation lane:** PR #47, `feat/resolution-freshness-authority-main` +- **Primitive implementation lane:** PR #47, `feat/resolution-freshness-authority-main` +- **First-party consumer lane:** PR #50, `feat/network-consume-resolution-freshness` - **Governing existing decision boundary:** ADR 0004 and the protected-main destination/rebinding authority model -- **Buyer-visible gap:** bind the interval between a validated resolution answer and use of that authority so DNS-rebinding/TOCTOU exposure is explicit and fail-closed +- **Buyer-visible gap:** bind the interval between a validated resolution answer and socket use so DNS-rebinding/TOCTOU exposure is explicit and fail-closed ## Truth boundary -Protected `main` already classifies, approves, pins, and non-expansively revalidates resolved destination addresses. It does **not** yet encode a resolution approval timestamp, bounded validity interval, or expiry decision in the destination authority consumed by the socket path. +Protected `main` already classifies, approves, pins, and non-expansively revalidates resolved destination addresses. It does **not** yet require a time-bounded resolution authority at the first-party direct-socket planning boundary. -PR #47 now contains the reusable production `FreshResolutionSnapshot` primitive and realistic tests, so the primitive is **IMPLEMENTED_ON_ACTIVE_PR** evidence. It is not protected-main truth. It is still non-shipped evidence. The complete DNS-rebinding/TOCTOU path is not closed merely by introducing a deterministic freshness primitive: first-party direct socket planning must subsequently require the fresh authority at the action linearization boundary and that consumer must use one trusted monotonic clock domain. Until that integration reaches protected main, the overall capability remains **PARTIAL**. +PR #47 exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` contains the reusable production `FreshResolutionSnapshot` primitive and has terminal successful CI/security/SAST/exact-coverage evidence. That primitive is therefore **IMPLEMENTED_ON_ACTIVE_PR** evidence only; it is not protected-main truth. -The initial test-only head is historical RED evidence only and must never be cited as shipped implementation evidence. +PR #50 is the dependent consumer lane. Its contract requires `originweave-network::ConnectionPlan` to consume the fresh snapshot together with one caller-supplied trusted monotonic current time, reject expired authority before socket I/O, and retain only credential-free freshness timestamps needed to prove the planning decision. PR #50 remains Draft and non-shipped. Its current production implementation is not yet gate-clean, so the complete resolution-to-socket interval remains **PARTIAL**. + +Neither an active primitive nor a test contract may be cited as shipped implementation evidence. The overall DNS-rebinding/TOCTOU boundary becomes protected-main implemented only after the primitive and the first-party consumer integrate under one exact trusted clock/authority chain with current protected-main evidence. ## Current exact-head RCA -The first production-complete head reached all ordinary Rust contracts and security scans, but exact coverage failed at one compiler region while functions, lines, and branches were already complete. The uploaded coverage evidence localized the only missing region to the generic `FreshResolutionSnapshot::revalidate` instantiation used with a one-address resolver answer: the success path for a one-address contraction was exercised, while the same monomorphized helper's error propagation for a one-address expansion had not been executed. +### PR #47 primitive + +The first production-complete PR #47 head reached all ordinary Rust contracts and security scans, but exact coverage failed at one compiler region while functions, lines, and branches were already complete. Coverage evidence localized the missing region to the generic `FreshResolutionSnapshot::revalidate` instantiation used with a one-address resolver answer: the success path for a one-address contraction was exercised, while the same monomorphized helper's error propagation for a one-address expansion had not been executed. + +That was a realistic DNS-rebinding case rather than an impossible instrumentation artifact. The branch added a focused one-address expansion regression requiring `ResolutionSetExpanded`, retained the two-address expansion case, and exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` subsequently passed CI including exact production function/line/region/branch coverage, Security Scan, and SAST Semgrep. + +### PR #50 consumer -That is a realistic DNS-rebinding case rather than an impossible instrumentation artifact. The current branch therefore adds a focused regression in which a fresh resolver answer contains exactly one new public address and must fail closed with `ResolutionSetExpanded`. The existing two-address expansion test is retained because answer cardinality is part of the generic call shape and both are realistic resolver behaviors. +PR #50 began from exact PR #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` with a test contract that intentionally does not compile against the old `ConnectionPlan::new(&ResolutionSnapshot, ...)` API. CI on predecessor head `1fcc3b39c5c4f420ed85d5084afe2e68896ef7a3` proved the intended production mismatch, but it also exposed an unrelated setup defect: the test attempted to format `OriginError` with `Display`, which that type intentionally does not implement. -Fresh exact-head CI for that new test must be terminally successful before the branch can be called coverage-clean or moved out of Draft. Predecessor-head security/check results do not transfer to the new head. +The consumer lane was corrected at head `a8da35a156d62c5da17e4ea3f248d5d90b339af3` to use debug formatting for that setup-only diagnostic. That correction does **not** satisfy the product contract; it only removes the accidental test-harness failure so the remaining compile failure is attributable to the missing fresh-authority `ConnectionPlan` API and evidence accessors. Fresh exact-head CI after this correction is required before using the head as canonical RED evidence, and production implementation plus complete exact-head gates are still required before the consumer can be called implemented on an active PR. ## Deterministic authority contract -The active slice proves a reusable destination-policy primitive with all of the following properties: +The active work is intended to prove one continuous destination-to-socket authority chain with all of the following properties: 1. approval time is explicit and supplied from one trusted monotonic clock domain; 2. validity is non-zero and capped by a repository-owned product safety budget; 3. the usable interval is half-open: `approved_at <= now < valid_until`; -4. use before approval, use at/after expiry, arithmetic overflow, and unapproved addresses fail closed with typed errors; -5. credential-free connection evidence records approval, expiry, and authorization times without introducing credentials, resolver internals, or raw protected values beyond the existing origin/address evidence contract; -6. non-expanding revalidation may renew the bounded interval only while rerunning the existing destination-policy validation against the newly supplied answer; and -7. the primitive performs no DNS lookup, socket I/O, wall-clock read, proxy selection, TLS, HTTP, browser control, persistence, or model call. +4. use before approval, use at/after expiry, arithmetic overflow, unapproved addresses, and set expansion fail closed with typed errors; +5. the first-party socket planner cannot accept an untimed `ResolutionSnapshot` as sufficient authority once the consumer integration is complete; +6. credential-free planning evidence records approval, expiry, and authorization times without introducing credentials, resolver internals, or protected values; +7. non-expanding revalidation may renew the bounded interval only while rerunning existing destination-policy validation against the newly supplied answer; and +8. the primitive and planning boundary perform no DNS lookup, wall-clock read, ambient proxy selection, TLS, HTTP, browser control, persistence, secret, or model call. ## Architecture and ADR assessment -This bounded primitive does not by itself introduce a new component, persistence owner, wire protocol, browser adapter, or trust domain. It tightens the already Accepted destination/rebinding authority governed by ADR 0004. Therefore a new ADR, UML deployment view, or physical ERD object would be false precision at this stage. +The primitive and its first-party consumer tighten the already Accepted destination/rebinding authority governed by ADR 0004. They do not introduce a new component, persistence owner, wire protocol, browser adapter, or trust domain. Therefore a new ADR, deployment component, or physical ERD object would be false precision at this stage. -A new or superseding ADR becomes appropriate only if integration changes the governing boundary—for example, if resolution freshness becomes durable cross-process state, is delegated to a separate resolver service, changes trusted-clock ownership, or introduces a new externally versioned protocol. +The network-authority UML should be reconciled when the PR #50 consumer stabilizes because the executable sequence changes materially from `resolution snapshot -> socket plan` to `fresh resolution authority + trusted monotonic use time -> socket plan`. A new or superseding ADR becomes appropriate only if integration changes the governing ownership boundary—for example, durable cross-process freshness state, a separate resolver service, a different trusted-clock owner, or a new externally versioned protocol. ## Evidence progression | Evidence state | Allowed maturity claim | |---|---| -| Test-only PR head with unresolved production API | `PLANNED` test contract / intentional RED only | -| Active PR production primitive with ordinary tests but a non-passing exact coverage gate | `IMPLEMENTED_ON_ACTIVE_PR` for the primitive, but not gate-clean; overall path remains `PARTIAL` | -| Active PR production primitive + unchanged exact-head CI/security/100% coverage | gate-clean active-PR evidence only; overall path remains `PARTIAL` | +| Test-only consumer head with unresolved production API | intentional RED contract only; not implementation evidence | +| Active PR #47 production primitive + unchanged exact-head CI/security/100% coverage | `IMPLEMENTED_ON_ACTIVE_PR` for the primitive; overall path remains `PARTIAL` | +| Active PR #50 production consumer requires fresh authority but has non-passing gates | `IMPLEMENTED_ON_ACTIVE_PR` only for code already present and testable; overall path remains `PARTIAL` | +| PR #47 + #50 exact heads are individually gate-clean but neither is on protected main | active-PR evidence only; no shipped claim | | Protected-main primitive, but direct socket consumer can still bypass freshness | `PARTIAL` | -| Protected-main direct socket path requires exact fresh authority and integration tests prove expiry/rebinding behavior | `IMPLEMENTED_ON_PROTECTED_MAIN` for the bounded resolution-to-socket interval | -| Browser/network adapter proves the same clock and authority chain under real navigation | additional integration/release evidence; not implied by the lower-layer primitive | +| Protected-main direct socket path requires exact fresh authority and tests prove pre-approval/expiry/rebinding behavior | `IMPLEMENTED_ON_PROTECTED_MAIN` for the bounded resolution-to-socket interval | +| Browser/network adapter proves the same clock and authority chain under real navigation | additional integration/release evidence; not implied by lower-layer primitives | ## Required follow-through -- require terminal success on the current exact PR #47 head before changing Draft/review readiness; -- keep PRD/TRD/network-authority traceability from calling the TOCTOU boundary closed while PR #47 is active or while the socket consumer can bypass freshness; -- integrate freshness into the first-party `originweave-network` connection-plan boundary test-first after the destination primitive stabilizes; -- require exact 100% owned production function/line/region/branch coverage and complete rustdoc on each changed head; -- update the network authority UML only if the executable consumer changes the current sequence semantics materially; and -- retain the existing conceptual ERD unless a real persistence owner is introduced. +- keep PR #47 as active/non-shipped evidence until repository governance integrates it; +- on PR #50, preserve valid RED at the production API, implement the smallest fresh-authority consumer boundary, and require terminal exact-head workspace/tests/Clippy/rustdoc/100% function-line-region-branch coverage plus security evidence; +- keep PRD/TRD/traceability from calling the DNS-rebinding/TOCTOU interval closed while either prerequisite is active or the socket path can bypass freshness; +- update network-authority sequence documentation after the executable consumer signature/evidence contract stabilizes, without encoding temporary branch-only details as protected-main truth; +- retain the existing conceptual ERD unless a real persistence owner is introduced; and +- after both layers integrate, rerun protected-main operational/release acceptance before promoting the capability maturity. From 927d1d715ff237aef7f4996f5ae69f60c4efcacf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Mon, 10 Aug 2026 23:56:09 +0900 Subject: [PATCH 050/130] docs(traceability): record fresh socket consumer RCA --- .../resolution-freshness-authority.md | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/docs/traceability/resolution-freshness-authority.md b/docs/traceability/resolution-freshness-authority.md index b1e699f0..075468fd 100644 --- a/docs/traceability/resolution-freshness-authority.md +++ b/docs/traceability/resolution-freshness-authority.md @@ -13,9 +13,9 @@ Protected `main` already classifies, approves, pins, and non-expansively revalid PR #47 exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` contains the reusable production `FreshResolutionSnapshot` primitive and has terminal successful CI/security/SAST/exact-coverage evidence. That primitive is therefore **IMPLEMENTED_ON_ACTIVE_PR** evidence only; it is not protected-main truth. -PR #50 is the dependent consumer lane. Its contract requires `originweave-network::ConnectionPlan` to consume the fresh snapshot together with one caller-supplied trusted monotonic current time, reject expired authority before socket I/O, and retain only credential-free freshness timestamps needed to prove the planning decision. PR #50 remains Draft and non-shipped. Its current production implementation is not yet gate-clean, so the complete resolution-to-socket interval remains **PARTIAL**. +PR #50 is the dependent consumer lane. Its intended contract requires the first-party direct-socket planning boundary to consume the fresh snapshot together with one caller-supplied trusted monotonic current time, reject expired authority before socket I/O, and retain only credential-free freshness timestamps needed to prove the planning decision. PR #50 remains Draft and non-shipped. Current exact head `18d3b19523de61f59dd47a11c2c82d6451512272` adds a production `FreshConnectionPlan`, but leaves the original public `ConnectionPlan::new(&ResolutionSnapshot, ...)` bypass available and leaves the acceptance test intentionally calling that old path. Exact-head CI therefore fails at the intended policy boundary rather than proving the consumer complete. The complete resolution-to-socket interval remains **PARTIAL**. -Neither an active primitive nor a test contract may be cited as shipped implementation evidence. The overall DNS-rebinding/TOCTOU boundary becomes protected-main implemented only after the primitive and the first-party consumer integrate under one exact trusted clock/authority chain with current protected-main evidence. +Neither an active primitive nor an alternative wrapper may be cited as shipped implementation evidence while the first-party untimed planning path remains callable. The overall DNS-rebinding/TOCTOU boundary becomes protected-main implemented only after the primitive and the first-party consumer integrate under one exact trusted clock/authority chain and no ordinary first-party socket plan can bypass freshness. ## Current exact-head RCA @@ -27,9 +27,13 @@ That was a realistic DNS-rebinding case rather than an impossible instrumentatio ### PR #50 consumer -PR #50 began from exact PR #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` with a test contract that intentionally does not compile against the old `ConnectionPlan::new(&ResolutionSnapshot, ...)` API. CI on predecessor head `1fcc3b39c5c4f420ed85d5084afe2e68896ef7a3` proved the intended production mismatch, but it also exposed an unrelated setup defect: the test attempted to format `OriginError` with `Display`, which that type intentionally does not implement. +PR #50 began from exact PR #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` with a test contract that intentionally does not compile against the old `ConnectionPlan::new(&ResolutionSnapshot, ...)` API. Predecessor CI also exposed and removed a setup-only `OriginError` formatting defect, leaving the production API mismatch as the valid RED boundary. -The consumer lane was corrected at head `a8da35a156d62c5da17e4ea3f248d5d90b339af3` to use debug formatting for that setup-only diagnostic. That correction does **not** satisfy the product contract; it only removes the accidental test-harness failure so the remaining compile failure is attributable to the missing fresh-authority `ConnectionPlan` API and evidence accessors. Fresh exact-head CI after this correction is required before using the head as canonical RED evidence, and production implementation plus complete exact-head gates are still required before the consumer can be called implemented on an active PR. +Current exact head `18d3b19523de61f59dd47a11c2c82d6451512272` implements a separate `FreshConnectionPlan`. That wrapper first calls `FreshResolutionSnapshot::authorize_connection`, then delegates to the existing untimed `ConnectionPlan`, and stores approval/expiry/authorization timestamps. This is useful implementation progress, but it does **not** yet satisfy the accepted consumer contract because the existing public `ConnectionPlan::new(&ResolutionSnapshot, ...)` remains a first-party route that can bypass freshness entirely. + +CI run `31400013559` checked out exactly `18d3b19523de61f59dd47a11c2c82d6451512272`; repository contracts and rustfmt passed, then `cargo check --locked --workspace --all-targets` failed in `crates/originweave-network/tests/fresh_resolution_plan.rs`. The test still supplies a `FreshResolutionSnapshot` plus trusted current time to `ConnectionPlan::new` and requires freshness evidence accessors. Rust correctly reports the old four-argument untimed signature and missing freshness accessors. Production coverage also fails because the workspace does not compile. + +The root cause is therefore **not** a formatting, runner, dependency, or coverage-instrumentation defect, and the smallest correct remedy is **not** to weaken the acceptance test to call `FreshConnectionPlan` while leaving an ordinary untimed `ConnectionPlan` public. The product boundary requires eliminating or structurally constraining the bypass: for example, make the externally consumable direct planner itself require `FreshResolutionSnapshot` + trusted time, or make the untimed planner an internal implementation detail reachable only after freshness authorization. Any chosen remedy must preserve current socket-validation semantics, use the same trusted monotonic clock domain, and reacquire exact-head CI/security/coverage evidence. ## Deterministic authority contract @@ -56,7 +60,8 @@ The network-authority UML should be reconciled when the PR #50 consumer stabiliz |---|---| | Test-only consumer head with unresolved production API | intentional RED contract only; not implementation evidence | | Active PR #47 production primitive + unchanged exact-head CI/security/100% coverage | `IMPLEMENTED_ON_ACTIVE_PR` for the primitive; overall path remains `PARTIAL` | -| Active PR #50 production consumer requires fresh authority but has non-passing gates | `IMPLEMENTED_ON_ACTIVE_PR` only for code already present and testable; overall path remains `PARTIAL` | +| Active PR #50 adds a freshness wrapper while an ordinary untimed planner remains public | implementation progress only; bypass still makes the overall path `PARTIAL` | +| Active PR #50 production consumer structurally requires fresh authority but has non-passing gates | `IMPLEMENTED_ON_ACTIVE_PR` only for code already present and testable; overall path remains `PARTIAL` | | PR #47 + #50 exact heads are individually gate-clean but neither is on protected main | active-PR evidence only; no shipped claim | | Protected-main primitive, but direct socket consumer can still bypass freshness | `PARTIAL` | | Protected-main direct socket path requires exact fresh authority and tests prove pre-approval/expiry/rebinding behavior | `IMPLEMENTED_ON_PROTECTED_MAIN` for the bounded resolution-to-socket interval | @@ -65,8 +70,9 @@ The network-authority UML should be reconciled when the PR #50 consumer stabiliz ## Required follow-through - keep PR #47 as active/non-shipped evidence until repository governance integrates it; -- on PR #50, preserve valid RED at the production API, implement the smallest fresh-authority consumer boundary, and require terminal exact-head workspace/tests/Clippy/rustdoc/100% function-line-region-branch coverage plus security evidence; -- keep PRD/TRD/traceability from calling the DNS-rebinding/TOCTOU interval closed while either prerequisite is active or the socket path can bypass freshness; +- on PR #50, preserve the valid RED at the public first-party planning API and remove or structurally constrain the untimed `ResolutionSnapshot` bypass rather than weakening the test to accept a parallel wrapper; +- require terminal exact-head workspace/tests/Clippy/rustdoc/100% function-line-region-branch coverage plus security evidence after that production boundary changes; +- keep PRD/TRD/traceability from calling the DNS-rebinding/TOCTOU interval closed while either prerequisite is active or any ordinary socket path can bypass freshness; - update network-authority sequence documentation after the executable consumer signature/evidence contract stabilizes, without encoding temporary branch-only details as protected-main truth; - retain the existing conceptual ERD unless a real persistence owner is introduced; and - after both layers integrate, rerun protected-main operational/release acceptance before promoting the capability maturity. From c2bbb9f85ce4d9e4b5d6de678d093a4b907b9eed Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 00:09:15 +0900 Subject: [PATCH 051/130] docs(traceability): pin resolution freshness budget evidence --- docs/traceability/resolution-freshness-authority.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/docs/traceability/resolution-freshness-authority.md b/docs/traceability/resolution-freshness-authority.md index 075468fd..f8bade0a 100644 --- a/docs/traceability/resolution-freshness-authority.md +++ b/docs/traceability/resolution-freshness-authority.md @@ -25,6 +25,8 @@ The first production-complete PR #47 head reached all ordinary Rust contracts an That was a realistic DNS-rebinding case rather than an impossible instrumentation artifact. The branch added a focused one-address expansion regression requiring `ResolutionSetExpanded`, retained the two-address expansion case, and exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` subsequently passed CI including exact production function/line/region/branch coverage, Security Scan, and SAST Semgrep. +The freshness ceiling is also executable active-PR evidence rather than an aspirational requirement. `crates/originweave-destination/src/resolution.rs` owns `MAX_RESOLUTION_VALIDITY: Duration = Duration::from_secs(30)`. `FreshResolutionSnapshot::approve` rejects `Duration::ZERO` and any interval above that constant with `DestinationError::InvalidResolutionValidity`; `crates/originweave-destination/tests/resolution_freshness.rs::fresh_resolution_rejects_invalid_or_overflowing_validity` verifies both the zero and greater-than-30-second boundaries plus approval-time overflow. This evidence remains active-PR-only until PR #47 integrates. + ### PR #50 consumer PR #50 began from exact PR #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` with a test contract that intentionally does not compile against the old `ConnectionPlan::new(&ResolutionSnapshot, ...)` API. Predecessor CI also exposed and removed a setup-only `OriginError` formatting defect, leaving the production API mismatch as the valid RED boundary. @@ -40,7 +42,7 @@ The root cause is therefore **not** a formatting, runner, dependency, or coverag The active work is intended to prove one continuous destination-to-socket authority chain with all of the following properties: 1. approval time is explicit and supplied from one trusted monotonic clock domain; -2. validity is non-zero and capped by a repository-owned product safety budget; +2. validity is non-zero and capped by the active implementation's repository-owned `MAX_RESOLUTION_VALIDITY` safety budget (30 seconds on PR #47 exact head), with shorter caller-selected intervals permitted; 3. the usable interval is half-open: `approved_at <= now < valid_until`; 4. use before approval, use at/after expiry, arithmetic overflow, unapproved addresses, and set expansion fail closed with typed errors; 5. the first-party socket planner cannot accept an untimed `ResolutionSnapshot` as sufficient authority once the consumer integration is complete; From 14c57a6a24f6a92bb2fb80000d9847da129d2f73 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 00:11:28 +0900 Subject: [PATCH 052/130] docs(traceability): fail closed on missing revocation nextUpdate --- .../tls-revocation-freshness-authority.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/docs/traceability/tls-revocation-freshness-authority.md b/docs/traceability/tls-revocation-freshness-authority.md index 7ae35d28..a5bfb98c 100644 --- a/docs/traceability/tls-revocation-freshness-authority.md +++ b/docs/traceability/tls-revocation-freshness-authority.md @@ -18,12 +18,13 @@ The complete revocation path therefore remains **PARTIAL** until a separately re The bounded primitive is expected to preserve these properties: -1. `thisUpdate` and `nextUpdate` are supplied only after independent cryptographic verification by a higher-layer adapter; -2. the signed interval is non-empty and ordered; -3. the usable interval is half-open: `thisUpdate <= trusted_time < nextUpdate`; -4. trusted time before `thisUpdate` and at/after `nextUpdate` fails closed with typed bounded errors; -5. the primitive performs no OCSP/CRL fetch, DNS, socket connection, TLS handshake mutation, parsing, signature verification, cache operation, browser control, persistence, or model call; and -6. no evidence or documentation converts freshness into an `unrevoked` claim. +1. a higher-layer adapter may construct `RevocationMaterialFreshness` only after independent cryptographic verification has supplied both signed `thisUpdate` and `nextUpdate`; because RFC 6960 permits an OCSP `SingleResponse` to omit `nextUpdate`, absence must fail closed in that adapter before construction and must never be converted into an invented timestamp; +2. the active PR #48 primitive deliberately accepts mandatory `u64` `this_update_unix_seconds` and `next_update_unix_seconds`, so a missing `nextUpdate` has no representable successful state in the primitive; any future parser/adapter must expose a typed missing-`nextUpdate` error or a separately reviewed bounded fallback contract before calling freshness approved; +3. the signed interval is non-empty and ordered; +4. the usable interval is half-open: `thisUpdate <= trusted_time < nextUpdate`; +5. trusted time before `thisUpdate` and at/after `nextUpdate` fails closed with typed bounded errors; +6. the primitive performs no OCSP/CRL fetch, DNS, socket connection, TLS handshake mutation, parsing, signature verification, cache operation, browser control, persistence, or model call; and +7. no evidence or documentation converts freshness into an `unrevoked` claim. ## Architecture and ADR assessment @@ -40,13 +41,13 @@ No new physical ERD object is justified by this active in-memory primitive. UML | Protected main records `RevocationStatus::NotConfigured` | `PARTIAL`; no revocation enforcement or unrevoked claim | | Active PR freshness primitive with exact-head tests/coverage | `IMPLEMENTED_ON_ACTIVE_PR` for freshness classification only | | Protected-main freshness primitive without verified material acquisition/composition | `PARTIAL` | -| Protected-main adapter verifies responder/material authenticity, freshness, cache/failure policy, and binds the result into TLS authentication | implementation evidence for the chosen bounded revocation policy | +| Protected-main adapter verifies responder/material authenticity, requires or safely bounds missing `nextUpdate`, enforces freshness, cache/failure policy, and binds the result into TLS authentication | implementation evidence for the chosen bounded revocation policy | | Protected-main integration/recovery/operational tests prove the complete path | required additional release evidence; not implied by the helper primitive | ## Required follow-through - keep PRD/TRD/TLS evidence from implying revocation enforcement while protected main remains `NotConfigured`; -- define revocation-material acquisition, authenticity, cache, freshness, failure, privacy, and recovery semantics before calling the TLS revocation boundary implemented; +- define revocation-material acquisition, authenticity, missing-`nextUpdate`, cache, freshness, failure, privacy, and recovery semantics before calling the TLS revocation boundary implemented; - require exact 100% owned production function/line/region/branch coverage and complete rustdoc on every changed head; - add or supersede an ADR only when the concrete revocation architecture changes a durable trust or deployment decision; and - retain the conceptual ERD unless executable persistence ownership actually appears. From 057a4c597314679ec7b38309ebb6b1eeac6fb73c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 00:11:59 +0900 Subject: [PATCH 053/130] test(docs): require freshness trace links --- tests/test_freshness_traceability_contract.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_freshness_traceability_contract.py b/tests/test_freshness_traceability_contract.py index 30aa9f90..d12fb9e6 100644 --- a/tests/test_freshness_traceability_contract.py +++ b/tests/test_freshness_traceability_contract.py @@ -21,7 +21,7 @@ def test_traceability_index_discovers_each_active_freshness_authority(self) -> N ): with self.subTest(filename=filename): self.assertTrue((TRACEABILITY / filename).is_file()) - self.assertIn(filename, index) + self.assertIn(f"]({filename})", index) def test_active_freshness_traces_preserve_protected_main_maturity(self) -> None: """Active implementation evidence must remain explicitly non-shipped and partial overall.""" From 02f8f8b82211955ed83f37a502c6f74b0d218d14 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 00:16:33 +0900 Subject: [PATCH 054/130] docs(traceability): cite RFC 9325 TLS guidance --- docs/traceability/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/traceability/README.md b/docs/traceability/README.md index eb8778d9..42ff1de4 100644 --- a/docs/traceability/README.md +++ b/docs/traceability/README.md @@ -127,7 +127,7 @@ The canonical APA 7th bibliography is [`../doctoring.md`](../doctoring.md). This | WHATWG URL + Chromium canonicalizer | Browser-compatible origin identity and numeric-host rejection | | IANA special-purpose registries / RFC 6890 / RFC 8190 / RFC 9637 | Destination classification and fail-closed public-web policy | | RFC 9293 | Exact TCP endpoint/peer model | -| RFC 5280 / RFC 9525 / current TLS guidance | Certificate path, HTTPS service identity, and the separation between certificate validity and any future revocation policy | +| RFC 5280 / RFC 9525 / RFC 9325 | Certificate path, HTTPS service identity, and the separation between certificate validity and any future revocation policy | | RFC 9110 / RFC 9112 / RFC 9530 | Bounded HTTP semantics, framing, redirect evidence and digest fields | | RFC 9309 | Crawler robots evidence, explicitly not access authorization | | W3C WebDriver BiDi | Versioned browser automation adapter, not core authority | @@ -183,4 +183,4 @@ Repository contracts should fail when canonical PRD/TRD/ADR/UML/ERD/traceability - **Open:** attach concrete release profiles and quantitative benchmark thresholds after reproducible benchmark evidence exists. - **Open:** map every future public OriginWeave Protocol operation to risk/capability/authority and conformance tests. - **Open:** map enterprise controls to exact SOC 2/CSAP-oriented control evidence without claiming certification. -- **Open:** add data-retention and residency lifecycle diagrams when persistence/tenant adapters become concrete. +- **Open:** add data-retention and residency lifecycle diagrams when persistence/tenant adapters become concrete. \ No newline at end of file From c818ef5c595a25002612aaac58c0dabf427455ac Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 00:16:49 +0900 Subject: [PATCH 055/130] test(docs): lock UML and maturity discoverability --- ..._documentation_discoverability_followup.py | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 tests/test_documentation_discoverability_followup.py diff --git a/tests/test_documentation_discoverability_followup.py b/tests/test_documentation_discoverability_followup.py new file mode 100644 index 00000000..67801c1c --- /dev/null +++ b/tests/test_documentation_discoverability_followup.py @@ -0,0 +1,43 @@ +"""Focused regression contracts for reviewed documentation discoverability gaps.""" + +from __future__ import annotations + +import pathlib +import unittest + +ROOT = pathlib.Path(__file__).resolve().parents[1] + + +class DocumentationDiscoverabilityFollowupTests(unittest.TestCase): + """Keep canonical diagrams and maturity vocabulary machine-discoverable.""" + + def test_extension_authority_view_is_indexed_mermaid(self) -> None: + """The extension authority view must exist, be indexed, and remain diagram-as-code.""" + uml_index = (ROOT / "docs" / "uml" / "README.md").read_text(encoding="utf-8") + authority_view = ROOT / "docs" / "uml" / "extension-authority.md" + + self.assertTrue(authority_view.is_file()) + self.assertIn("](extension-authority.md)", uml_index) + self.assertIn("```mermaid", authority_view.read_text(encoding="utf-8")) + + def test_traceability_keeps_complete_maturity_vocabulary(self) -> None: + """Every canonical capability maturity label must remain explicit.""" + traceability = (ROOT / "docs" / "traceability" / "README.md").read_text( + encoding="utf-8" + ) + for label in ( + "IMPLEMENTED_ON_PROTECTED_MAIN", + "IMPLEMENTED_ON_ACTIVE_PR", + "PARTIAL", + "ACCEPTED_ARCHITECTURE", + "PLANNED", + "RESEARCH_ONLY", + "SUPERSEDED", + "OUT_OF_SCOPE", + ): + with self.subTest(label=label): + self.assertIn(label, traceability) + + +if __name__ == "__main__": + unittest.main() From 893e5210e042ff3716abe10daa3753e19eefc244 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 00:38:44 +0900 Subject: [PATCH 056/130] docs: record dated active PR maturity evidence --- .../evidence/2026-08-10-active-pr-maturity.md | 37 +++++++++++++++++++ 1 file changed, 37 insertions(+) create mode 100644 docs/evidence/2026-08-10-active-pr-maturity.md diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md new file mode 100644 index 00000000..d3f7e3c0 --- /dev/null +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -0,0 +1,37 @@ +# Active pull-request maturity evidence — 2026-08-10 + +This dated appendix records volatile implementation evidence that must not be embedded as timeless architecture truth. Protected `main` remains the only shipped-code authority. Active pull requests are implementation evidence only until they integrate and protected-main acceptance is re-established. + +## Protected-main anchor + +- Protected `main`: `67af7c87589edc2039545af335c95064d9b8391c` +- Product status: pre-alpha +- Documentation verdict: **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL** + +## Active implementation evidence + +| PR | Scope | Maturity on 2026-08-10 | Dependency / evidence boundary | +|---|---|---|---| +| #37 | Bounded HTTP/1.1 over authenticated governed transport | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `a38980683f073c8df8bebb8d674efaca4cf3e66d` is gate-clean and mergeable; protected main still reports HTTP as Planned. Historical #11 remains predecessor lineage until protected integration. | +| #40 | Browser protocol identifier → OriginWeave authority registry | **IMPLEMENTED_ON_ACTIVE_PR** | Current exact head `c30c76ecc217497fb23b188e095ad486fd612498` is gate-clean across CI, Security Scan, SAST, Manifest V3 Compatibility and CodeRabbit; the real browser adapter remains Planned under #28. | +| #43 | Real pinned-Chromium Manifest V3 downloads compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `27ce89066ed1473dcd66eb26a2f91becf9df5424` is gate-clean; this proves one declared compatibility surface, not full extension compatibility or Agent authority. | +| #44 | Canonical documentation reconciliation | **IMPLEMENTED_ON_ACTIVE_PR** | This branch owns the documentation repair itself; its content does not become protected-main truth until integration. | +| #45 | Credential-free sensitive-handle lifecycle evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0f07fea031090c72a448fd9501b49d4dd7568419` is gate-clean; trusted broker/storage/value resolution remain Planned under #10. | +| #46 | In-process authoritative sensitive-handle use reservation | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `5f212cdfbf3c453472069973138fd9563cf7bff8` is gate-clean; no cross-process/database transactionality or protected-value resolution is claimed. | +| #47 | Bounded resolution freshness authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` is gate-clean; first-party socket planning must still consume this authority immediately before I/O. | +| #48 | TLS revocation-material freshness primitive | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `9bbe12860436027a3b7cd5786775f1dacfbc835d` is gate-clean; no OCSP/CRL acquisition, signature validation, cache, or unrevoked claim is implemented. | +| #49 | Ephemeral Agent Task profile-isolation regression | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43 at exact head `96a4e949d96b5794ef473ccf813987b8e69ea566`; CI is green but dependency-gated and not independently integrable before #43. | +| #50 | First-party network consumption of resolution freshness | **PARTIAL** | Draft stacked on #47. The prior exact head `18d3b19523de61f59dd47a11c2c82d6451512272` established a real compile-boundary RED because tests required fresh authority while the exported network API still exposed the untimed planner. Production/export/test repair is active; no protected-main claim is permitted. | +| #51 | Browser-task runtime telemetry value object | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `1c85b966087191f52b4a709a2822b2a53fb0e2fa` is CI/Security/SAST/CodeRabbit clean and Ready for review; it carries validated measurements but performs no OS/Chromium sampling itself. | + +## Historical lineage + +PR #11 is a historical HTTP predecessor, not current implementation authority. It may close as superseded only after #37 reaches protected main and unique-work preservation plus protected-main acceptance are revalidated. + +## Interpretation rules + +1. `IMPLEMENTED_ON_ACTIVE_PR` never means shipped. +2. A green active PR does not authorize release or change an ADR lifecycle state. +3. A Draft or stacked PR remains dependency-gated even if its own checks pass. +4. Exact heads and workflow run identifiers are volatile evidence and belong in dated appendices such as this one, not in timeless Architecture/PRD/TRD claims. +5. After an active PR integrates, canonical PRD/TRD/Architecture/UML/ERD/traceability must be re-evaluated from the new protected-main head before reclassifying the capability. From c8a6822833c36cfa00997eafb5f5bcc9d462f96f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 00:39:15 +0900 Subject: [PATCH 057/130] docs: index volatile active PR evidence separately --- docs/README.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/README.md b/docs/README.md index 1f8c9d2c..95da4b18 100644 --- a/docs/README.md +++ b/docs/README.md @@ -12,6 +12,7 @@ - [Data governance and privacy boundary](DATA_GOVERNANCE.md) - [Product and decision traceability](traceability/README.md) - [Documentation fitness assessment](DOCUMENTATION_FITNESS.md) +- [Dated active-PR maturity evidence (2026-08-10)](evidence/2026-08-10-active-pr-maturity.md) - [Threat model](THREAT_MODEL.md) - [Product-wide test strategy](TEST_STRATEGY.md) - [Operability and incident-response baseline](OPERABILITY.md) @@ -24,7 +25,7 @@ - [Quality gates](quality-gates.md) - [Security policy](../SECURITY.md) -The PRD/TRD/Architecture/ADR/UML/ERD/data-governance/traceability/security/operations/API/release set is the product-wide documentation graph. The documentation-fitness assessment records where that graph is current, stale, partial, or intentionally proposed. Feature-specific design specifications and plans below provide detailed implementation history but do not substitute for the product-wide baseline. Planned or conversation-derived capabilities must remain labelled Planned, Proposed, or Open until reviewed implementation evidence reaches protected `main`. +The PRD/TRD/Architecture/ADR/UML/ERD/data-governance/traceability/security/operations/API/release set is the product-wide documentation graph. The documentation-fitness assessment records where that graph is current, stale, partial, or intentionally proposed. Volatile exact heads, workflow results, stack state, and active-PR maturity belong in dated evidence appendices rather than timeless architecture claims. Feature-specific design specifications and plans below provide detailed implementation history but do not substitute for the product-wide baseline. Planned or conversation-derived capabilities must remain labelled Planned, Proposed, or Open until reviewed implementation evidence reaches protected `main`. ## Governance and maintenance @@ -82,4 +83,4 @@ Proposed ADRs are reviewable architecture memory, not shipped behavior and not a The second group exists only on this documentation branch until the branch integrates. After integration, the heading remains useful historical provenance; it does not promote either ADR from Proposed to Accepted and it does not claim that the described runtime capability is implemented. -See the [ADR index](adr/README.md) for status rules, required decision structure, supersession rules, and active feature ADRs. The index and each ADR's own status metadata must agree; a PR body, chat transcript, automation prompt, or stale issue reference cannot change ADR status. \ No newline at end of file +See the [ADR index](adr/README.md) for status rules, required decision structure, supersession rules, and active feature ADRs. The index and each ADR's own status metadata must agree; a PR body, chat transcript, automation prompt, or stale issue reference cannot change ADR status. From c3bcdaeaac9506b4edaa29f96f6354fbdf5fc9ba Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 00:46:59 +0900 Subject: [PATCH 058/130] docs: index extension authority UML --- docs/uml/README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/docs/uml/README.md b/docs/uml/README.md index 1d04ab00..1a985e25 100644 --- a/docs/uml/README.md +++ b/docs/uml/README.md @@ -6,6 +6,10 @@ These diagrams visualize governing boundaries; they do not imply that every planned adapter is already shipped. Labels use `implemented`, `active`, or `planned` where implementation status matters. +## Focused authority views + +- [Manifest V3 extension compatibility and Agent authority](extension-authority.md) + ## 1. Component and bounded-context view ```mermaid @@ -404,4 +408,4 @@ Update this pack when a protected change materially alters: - deployment boundaries; - evidence/provenance relationships. -A feature-specific ADR may include a more detailed sequence diagram, but this pack remains the product-wide view and must not require maintainers to reconstruct the complete system from scattered ADR diagrams. +A feature-specific ADR may include a more detailed sequence diagram, but this pack remains the product-wide view and must not require maintainers to reconstruct the complete system from scattered ADR diagrams. \ No newline at end of file From ce1b7188e30f5d9e7673a8c713417540f042ec54 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 01:23:19 +0900 Subject: [PATCH 059/130] docs: refresh whole-graph fitness against active authority lanes --- docs/DOCUMENTATION_FITNESS.md | 87 ++++++++++++++++++++++++++--------- 1 file changed, 64 insertions(+), 23 deletions(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index 0e06b521..6cd61200 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -1,6 +1,6 @@ # OriginWeave Documentation Fitness Assessment -- **Assessment date:** 2026-08-10 +- **Assessment date:** 2026-08-11 - **Assessment scope:** protected `main`, every current OriginWeave implementation lane relevant to canonical product truth, and durable product decisions that must be reconstructable without chat history - **Assessment type:** semantic fitness, not file-presence inventory - **Current verdict:** **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL** @@ -17,20 +17,20 @@ File existence alone is never sufficient. An artifact can exist and still be sta | Documentation family | Fitness | Current evidence / remaining boundary | |---|---|---| -| PRD | **REPAIRED IN THIS CHANGE** | HTTP names active replacement PR #37 while retaining `Planned` protected-main status; historical PR #11 is predecessor lineage. Purpose-bound sensitive disclosure is an Implemented protected-main policy kernel while broker/storage/lifecycle remain Planned under issue #10; active PR #45 adds credential-free lifecycle evidence and active PR #46 adds bounded in-process authoritative use reservation without turning the broker runtime into shipped behavior. MV3 remains a Planned complete compatibility program while protected-main and active-PR evidence are separately identified. | -| TRD | **REPAIRED IN THIS CHANGE** | Implementation inventory separates protected-main status from active/non-shipped evidence instead of composite labels. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth; #45/#46 are active partial broker-lifecycle evidence only. | -| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium compatibility-kernel + Rust control-plane direction, explicit authority stack and protected-main truth rule. No topology change is required for #45/#46 because they implement already-governed ADR 0007 evidence/policy primitives rather than introducing broker persistence or a new service boundary. Reconcile implementation-facing details after #37/#40 or the real Chromium vertical slice integrate. | -| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Indexes Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 without promoting Proposed decisions. Identifier allocation is treated as a cross-main-and-active-work reservation problem. No new ADR is required for #45/#46 because both stay within Accepted ADR 0007's existing sensitive-data authority/broker-lifecycle direction. | -| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 covers MV3 compatibility vs extension-to-Agent authority; Proposed ADR 0014 covers ADR acceptance governance. Their presence does not imply Acceptance. HTTP ADRs in PR #37 remain active-PR evidence. ADR 0007 already specifies caller-unforgeable state and atomic broker reservation; #45/#46 are partial implementation evidence, not a new architecture decision. | -| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. This PR adds `uml/extension-authority.md`. No new UML is justified for #45/#46 until a real trusted broker/storage/fill runtime changes the deployed component or transaction boundary. A detailed real-Chromium vertical-slice sequence is deferred until issue #28 contracts stabilize. | -| Conceptual ERD/domain model | **PRESENT-CURRENT** | Explicitly conceptual unless an adapter/schema is separately implemented; distinguishes current value/evidence concepts from planned durable records and adapter-owned representations. #45/#46 introduce no physical persistence, so adding tables merely to represent active in-memory primitives would be false architecture. | -| Traceability | **REPAIRED IN THIS CHANGE** | Separates `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`; #37/#40/#43/#45/#46 are active evidence only and cannot be promoted to protected-main truth. | -| Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, network, secret, provenance and extension risks. ADR 0007 already identifies stale caller-count/concurrent replay risk; #46 narrows that risk only within one in-process mutable state object and does not claim cross-process atomicity/revocation. Update when a real broker/storage/runtime attack surface integrates. | -| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code coverage, rustdoc and realistic boundary testing are explicit. #46 follows real RED at the unresolved production API, then exact-head workspace/test/Clippy/rustdoc and 100% function/line/region/branch coverage. Real browser and MV3 evidence remain pinned-browser executable evidence rather than source-text claims. | -| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. #45/#46 intentionally add no durable broker operation, so no new runbook/SLO/RPO/RTO is fabricated. Protected-main runtime/scheduled evidence remains required for operational closure where applicable. | -| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented; much browser adapter implementation remains Planned. External protocol identifiers are never durable authority by themselves. #46's Rust policy API is internal reusable control-plane state, not a new external wire/schema contract. | -| Release / rollback / provenance | **PRESENT-CURRENT** | Feature-branch green checks cannot become release readiness. Release remains bound to one exact integrated protected head and applicable CI/security/coverage/package/provenance/recovery/compatibility/review evidence. | -| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. Active PR #45 adds credential-free handle lifecycle evidence; active PR #46 adds a bounded in-process reservation counter that removes caller-supplied prior-use state from the reservation operation. Trusted broker storage, cross-process transactionality, revocation, protected-value resolution/fill, compensation, encryption/KMS and model-disclosure lifecycle remain open under issue #10. | +| PRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | HTTP names active replacement PR #37 while retaining `Planned` protected-main status; historical PR #11 is predecessor lineage. Purpose-bound sensitive disclosure is an Implemented protected-main policy kernel while broker/storage/lifecycle remain Planned under issue #10; active PRs #45/#46 add bounded non-shipped lifecycle/use-state evidence. Resolution freshness is active in #47 with first-party network consumption stacked in #50; neither is protected-main truth. Browser task telemetry in #51 is an active value-object prerequisite, not shipped sampling. MV3 remains a Planned complete compatibility program while protected-main and active-PR evidence are separately identified. | +| TRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Implementation inventory separates protected-main status from active/non-shipped evidence instead of composite labels. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth. #47/#50 tighten the resolution-to-socket freshness boundary only on active work; #48 is a revocation-material freshness primitive without any protected-main revocation claim; #51 is active telemetry structure without OS/Chromium sampling. | +| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium compatibility-kernel + Rust control-plane direction, explicit authority stack and protected-main truth rule. #47/#50 tighten the already-governed ADR 0004 destination/rebinding authority rather than creating a new service/topology. #45/#46 remain within ADR 0007. #48 adds no revocation fetch/cache/service boundary and #51 adds no sampler/runtime component. Reconcile implementation-facing details after these lanes integrate or the real Chromium vertical slice stabilizes. | +| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Indexes Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 without promoting Proposed decisions. Identifier allocation is treated as a cross-main-and-active-work reservation problem. No new ADR is justified solely by #45/#46, #47/#50, #48 or #51 because those lanes remain inside existing authority decisions and introduce no new durable service, trust domain, persistence owner or externally versioned protocol. | +| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 covers MV3 compatibility vs extension-to-Agent authority; Proposed ADR 0014 covers ADR acceptance governance. Their presence does not imply Acceptance. HTTP ADRs in PR #37 remain active-PR evidence. #47/#50 are implementation evidence under ADR 0004, #45/#46 under ADR 0007, and #48/#51 do not by themselves create a new accepted architecture boundary. | +| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. This PR adds `uml/extension-authority.md`. The network-authority sequence should be reconciled once #50's executable consumer signature is stable because the sequence changes from untimed resolution to fresh resolution authority plus trusted monotonic use time; that does not require a fictitious new component. No new UML is justified for #45/#46/#48/#51 until a real runtime/service/transaction boundary appears. A detailed real-Chromium vertical-slice sequence remains deferred until issue #28 contracts stabilize. | +| Conceptual ERD/domain model | **PRESENT-CURRENT** | Explicitly conceptual unless an adapter/schema is separately implemented; distinguishes current value/evidence concepts from planned durable records and adapter-owned representations. #45/#46/#47/#48/#50/#51 introduce no physical persistence owner, so adding tables merely to represent active in-memory/value primitives would be false architecture. | +| Traceability | **REPAIRED IN THIS CHANGE with volatile evidence refresh required** | Separates `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`. Current active evidence includes #37/#40/#43/#45/#46/#47/#48/#49/#50/#51 and cannot be promoted to protected-main truth merely because an individual PR is green. | +| Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, network, secret, provenance and extension risks. #47/#50 narrow the DNS-rebinding/TOCTOU interval only when one fresh authority chain reaches socket planning; #48 proves only signed-window freshness for already-verified revocation material and does not prove an unrevoked certificate; #46 narrows stale-count/replay risk only within one in-process mutable state object. Update threat/runtime claims only after the corresponding active paths integrate. | +| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code function/line/region/branch coverage, rustdoc and realistic boundary testing are explicit. Active lanes use intentional RED boundaries followed by narrow production changes and exact-head proof. Real browser and MV3 evidence remain pinned-browser executable evidence rather than source-text claims, and pending/failed predecessor evidence never transfers to a later head. | +| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. #45/#46/#47/#48/#51 intentionally add no new durable service or daemon, so no runbook/SLO/RPO/RTO is fabricated. #50 changes first-party socket authority composition but not deployment topology. Protected-main runtime/scheduled evidence remains required for operational closure where applicable. | +| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented; much browser adapter implementation remains Planned. External protocol identifiers are never durable authority by themselves. On active #50, the ordinary public untimed network planner is being structurally removed so first-party consumers must cross fresh-resolution authorization; until integration that is active-PR evidence only. #46/#51 are internal reusable control-plane/value APIs, not new external wire/schema contracts. | +| Release / rollback / provenance | **PRESENT-CURRENT** | Feature-branch green checks cannot become release readiness. Release remains bound to one exact integrated protected head and applicable CI/security/coverage/package/provenance/recovery/compatibility/review evidence. Active stacks such as #47→#50 and #43→#49 must preserve dependency order; predecessor-head success cannot satisfy a later head. | +| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. Active PR #45 adds credential-free handle lifecycle evidence; active PR #46 adds a bounded in-process reservation counter that removes caller-supplied prior-use state from the reservation operation. #47/#48/#50/#51 add timestamps/measurements or authority metadata without protected values. Trusted broker storage, cross-process transactionality, revocation, protected-value resolution/fill, compensation, encryption/KMS and model-disclosure lifecycle remain open under issue #10. | | Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references are kept in doctoring documents with draft/experimental status distinguished from final normative standards. | ## 3. Reconciliation findings and resolution state @@ -56,15 +56,15 @@ PR #46's mutable-borrow serialization is deliberately **not** described as durab ### 3.3 Manifest V3 compatibility -Protected main has executable pinned-Chromium evidence for service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart persistence and repeatability. Active PR #43 adds real bounded downloads evidence. Issue #27 remains open for the complete compatibility/release matrix and additional managed/native-messaging boundaries. +Protected main has executable pinned-Chromium evidence for service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart persistence and repeatability. Active PR #43 adds real bounded downloads evidence; stacked PR #49 adds a regression for per-trial ephemeral profile isolation. Issue #27 remains open for the complete compatibility/release matrix and additional managed/native-messaging boundaries. -**Resolved on this documentation branch:** PRD/TRD/traceability represent complete compatibility as Planned while separately naming partial protected-main evidence and active-PR downloads evidence. Proposed ADR 0013 separates compatibility evidence from Agent-authority evidence. +**Resolved on this documentation branch:** PRD/TRD/traceability represent complete compatibility as Planned while separately naming partial protected-main evidence and active-PR evidence. Proposed ADR 0013 separates compatibility evidence from Agent-authority evidence. #49 must not be represented as protected-main behavior while its #43 prerequisite remains active. ### 3.4 Browser identifier authority -Protected main contains session/context/document/node authority foundations under Accepted ADR 0010. Active PR #40 owns a bounded registry mapping protocol-local identifiers into that authority model. +Protected main contains session/context/document/node authority foundations under Accepted ADR 0010. Active PR #40 exact head `9e635e80e9813a1d2a9c408155d52221b76eeed3` owns a bounded registry mapping protocol-local identifiers into that authority model and is active/non-shipped evidence. -**Resolved on this documentation branch:** PRD/TRD/traceability identify the protected-main core foundation separately from #40 active/non-shipped registry evidence. Detailed adapter-sequence UML is deliberately deferred until its executable contracts stabilize. +**Resolved on this documentation branch:** PRD/TRD/traceability identify the protected-main core foundation separately from #40 active registry evidence. Detailed adapter-sequence UML remains deferred until executable browser adapter contracts stabilize. ### 3.5 ADR discoverability and identifier allocation @@ -84,6 +84,26 @@ The first audit incorrectly called resource-pressure and hourly automation views **Resolved on this documentation branch:** the assessment recognizes those views and adds only the genuinely missing extension-permission-to-Agent-authority diagram. +### 3.8 Resolution freshness authority + +Protected main already validates, pins and non-expansively revalidates destination addresses, but it does not yet require a bounded approval-to-socket-use interval. Active PR #47 exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` implements the reusable `FreshResolutionSnapshot` primitive with a repository-owned 30-second maximum validity budget and exact-head gate evidence. + +Stacked PR #50 owns first-party network consumption. During this reconciliation run, the parallel-wrapper design was rejected as insufficient because public `ConnectionPlan::new(&ResolutionSnapshot, ...)` remained an untimed bypass. The active branch now structurally hides that untimed planner and is migrating first-party TLS integration helpers to `FreshConnectionPlan` with explicit trusted monotonic approval/use times. This remains **active-PR / PARTIAL** evidence until the exact consumer head is gate-clean and both prerequisite and consumer integrate in dependency order. + +**Documentation consequence:** no new ADR, physical ERD entity or deployed component is justified. The change tightens Accepted ADR 0004. The network-authority sequence should be reconciled after the #50 public consumer contract stabilizes so the diagram explicitly shows fresh resolution authority plus trusted monotonic use time before socket authority. + +### 3.9 TLS revocation-material freshness + +Protected main deliberately reports revocation as `NotConfigured`. Active PR #48 exact head `9bbe12860436027a3b7cd5786775f1dacfbc835d` adds a reusable signed-window freshness check for already-verified revocation material. + +**Documentation consequence:** #48 may be represented as `IMPLEMENTED_ON_ACTIVE_PR` for the freshness primitive only. It must not be described as OCSP/CRL acquisition, signature/path validation, cache operation, or proof that a certificate is unrevoked. No new revocation service/cache topology or physical ERD is documented until such a runtime actually exists. + +### 3.10 Browser task telemetry + +Active PR #51 exact head `1c85b966087191f52b4a709a2822b2a53fb0e2fa` adds a bounded `BrowserTaskTelemetry` value object for RSS bytes, observation bytes, action latency and task duration. It does not sample Chromium or the operating system and does not create a GPU/local-model claim. + +**Documentation consequence:** this is a reusable active-PR prerequisite for issue #28 resource evidence, not a new runtime component, persistence entity, sampler service or release metric. Architecture/UML/ERD remain unchanged until an actual measurement adapter establishes those boundaries. + ## 4. Durable conversation decisions captured in GitHub The canonical graph must continue to preserve these durable decisions: @@ -109,6 +129,9 @@ The canonical graph must continue to preserve these durable decisions: 19. Work-conserving maintenance continues to another safe lane rather than stopping on one merge, document, RCA, queued check or external approval gap. 20. ADR numbers, migrations, schema/API/protocol versions and other collision-sensitive repository identifiers are reserved across protected main **and active work** before allocation. 21. A policy primitive may narrow stale-count/replay risk without claiming the durable trusted broker exists; in-memory serialization, cross-process transactionality, lifecycle evidence and protected-value release remain separate maturity claims. +22. A validated DNS answer is not sufficient socket authority indefinitely; the resolution-to-socket interval must be bounded by caller-supplied trusted monotonic freshness and ordinary first-party socket planning must not retain an untimed bypass. +23. Revocation-material freshness, revocation-material cryptographic validity, acquisition/cache operation and an unrevoked-certificate claim are separate evidence authorities. +24. Browser-resource telemetry values and actual OS/Chromium measurement adapters are separate maturity claims; value-object availability cannot be promoted to measured runtime evidence. ## 5. Architecture views still legitimately deferred @@ -128,7 +151,23 @@ Chromium MV3 permission Compatibility evidence cannot substitute for Agent-authority isolation evidence, and vice versa. -### 5.2 Real Chromium vertical slice — deferred until issue #28 stabilizes +### 5.2 Network freshness sequence — existing view requires bounded reconciliation after #50 stabilizes + +The durable sequence must make the freshness boundary explicit without encoding temporary branch-only API names: + +```text +resolver answer +-> destination policy + origin binding +-> fresh resolution approval [trusted monotonic interval] +-> connection authorization at trusted monotonic use time +-> exact socket candidate +-> observed TCP peer +-> TLS/HTTP authority layers +``` + +This is a sequence refinement inside the existing network authority model, not a new deployed component or persistence boundary. + +### 5.3 Real Chromium vertical slice — deferred until issue #28 stabilizes The eventual sequence must cover: @@ -147,7 +186,7 @@ isolated profile/context Do not freeze temporary protocol/field names into authoritative UML before the executable contracts stabilize. -### 5.3 Trusted sensitive-data broker — deferred until issue #10 owns a real runtime boundary +### 5.4 Trusted sensitive-data broker — deferred until issue #10 owns a real runtime boundary Current protected-main policy/evidence plus active #45/#46 primitives do not justify inventing a broker process, database table, transaction manager, KMS path or browser-fill adapter in timeless Architecture/UML/ERD. When a real broker slice exists, the documentation graph must add the actual component/transaction/data-lifecycle views and mark persisted versus in-memory versus external state from executable evidence. @@ -165,13 +204,15 @@ Current protected-main policy/evidence plus active #45/#46 primitives do not jus - conceptual ERD truth discipline; - documentation fitness and regression contracts; - current browser/protocol standards doctoring; -- active-sensitive-data evidence reconciliation without promoting #45/#46 to shipped or inventing broker persistence. +- active-sensitive-data evidence reconciliation without promoting #45/#46 to shipped or inventing broker persistence; +- explicit freshness/revocation/telemetry maturity boundaries for active #47/#48/#50/#51 without inventing new architecture or persistence. ### Still required - exact-head CI/security/review acceptance of this documentation PR; - integration before any of these branch repairs become protected-main truth; -- re-reconciliation after active PR #37, #40, #43, #45 or #46 integrates, because active-PR status must then move to protected-main evidence; +- re-reconciliation whenever active PR #37, #40, #43, #45, #46, #47, #48, #49, #50 or #51 integrates, closes, is superseded or materially changes head, because active-PR status must then move or be removed rather than silently becoming protected-main truth; +- network-authority sequence reconciliation after #50's executable consumer contract is stable and proven; - detailed real-Chromium vertical-slice UML when issue #28 implementation contracts are stable; - trusted-broker UML/ERD/operability additions only when issue #10 establishes real runtime/persistence ownership; - future ERD changes only when persistence ownership/entities actually change; From c66afb990d2956ea9c86af9a3771fae1be22f95a Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 01:25:09 +0900 Subject: [PATCH 060/130] docs: refresh exact active-PR maturity evidence --- docs/evidence/2026-08-10-active-pr-maturity.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index d3f7e3c0..ac2811e3 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -1,5 +1,7 @@ # Active pull-request maturity evidence — 2026-08-10 +> Last refreshed: 2026-08-11 + This dated appendix records volatile implementation evidence that must not be embedded as timeless architecture truth. Protected `main` remains the only shipped-code authority. Active pull requests are implementation evidence only until they integrate and protected-main acceptance is re-established. ## Protected-main anchor @@ -10,18 +12,18 @@ This dated appendix records volatile implementation evidence that must not be em ## Active implementation evidence -| PR | Scope | Maturity on 2026-08-10 | Dependency / evidence boundary | +| PR | Scope | Maturity | Dependency / evidence boundary | |---|---|---|---| | #37 | Bounded HTTP/1.1 over authenticated governed transport | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `a38980683f073c8df8bebb8d674efaca4cf3e66d` is gate-clean and mergeable; protected main still reports HTTP as Planned. Historical #11 remains predecessor lineage until protected integration. | -| #40 | Browser protocol identifier → OriginWeave authority registry | **IMPLEMENTED_ON_ACTIVE_PR** | Current exact head `c30c76ecc217497fb23b188e095ad486fd612498` is gate-clean across CI, Security Scan, SAST, Manifest V3 Compatibility and CodeRabbit; the real browser adapter remains Planned under #28. | +| #40 | Browser protocol identifier → OriginWeave authority registry | **IMPLEMENTED_ON_ACTIVE_PR** | Current exact head `9e635e80e9813a1d2a9c408155d52221b76eeed3` is gate-clean across CI, Security Scan, SAST, Manifest V3 Compatibility and CodeRabbit; the real browser adapter remains Planned under #28. | | #43 | Real pinned-Chromium Manifest V3 downloads compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `27ce89066ed1473dcd66eb26a2f91becf9df5424` is gate-clean; this proves one declared compatibility surface, not full extension compatibility or Agent authority. | | #44 | Canonical documentation reconciliation | **IMPLEMENTED_ON_ACTIVE_PR** | This branch owns the documentation repair itself; its content does not become protected-main truth until integration. | | #45 | Credential-free sensitive-handle lifecycle evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0f07fea031090c72a448fd9501b49d4dd7568419` is gate-clean; trusted broker/storage/value resolution remain Planned under #10. | | #46 | In-process authoritative sensitive-handle use reservation | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `5f212cdfbf3c453472069973138fd9563cf7bff8` is gate-clean; no cross-process/database transactionality or protected-value resolution is claimed. | -| #47 | Bounded resolution freshness authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` is gate-clean; first-party socket planning must still consume this authority immediately before I/O. | +| #47 | Bounded resolution freshness authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` is gate-clean. Its first-party consumer is now implemented on stacked #50, but neither capability is protected-main truth until dependency-ordered integration. | | #48 | TLS revocation-material freshness primitive | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `9bbe12860436027a3b7cd5786775f1dacfbc835d` is gate-clean; no OCSP/CRL acquisition, signature validation, cache, or unrevoked claim is implemented. | | #49 | Ephemeral Agent Task profile-isolation regression | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43 at exact head `96a4e949d96b5794ef473ccf813987b8e69ea566`; CI is green but dependency-gated and not independently integrable before #43. | -| #50 | First-party network consumption of resolution freshness | **PARTIAL** | Draft stacked on #47. The prior exact head `18d3b19523de61f59dd47a11c2c82d6451512272` established a real compile-boundary RED because tests required fresh authority while the exported network API still exposed the untimed planner. Production/export/test repair is active; no protected-main claim is permitted. | +| #50 | First-party network consumption of resolution freshness | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392`. Exact head `f8b43bc94444986ab23aa4ef3086e446a0b39295` structurally hides the untimed public network planner, migrates first-party TLS integration helpers through `FreshConnectionPlan`, and passes CI run `31408474576` including exact owned function/line/region/branch coverage; CodeRabbit exact-head status is success. Dependency order, not implementation incompleteness, keeps the PR Draft. | | #51 | Browser-task runtime telemetry value object | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `1c85b966087191f52b4a709a2822b2a53fb0e2fa` is CI/Security/SAST/CodeRabbit clean and Ready for review; it carries validated measurements but performs no OS/Chromium sampling itself. | ## Historical lineage From 110c42034e932e6e836e9b07ecbd97a46a9ddc18 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 01:25:45 +0900 Subject: [PATCH 061/130] docs: reconcile fresh-socket authority exact evidence --- .../resolution-freshness-authority.md | 39 ++++++++++--------- 1 file changed, 21 insertions(+), 18 deletions(-) diff --git a/docs/traceability/resolution-freshness-authority.md b/docs/traceability/resolution-freshness-authority.md index f8bade0a..b88bff95 100644 --- a/docs/traceability/resolution-freshness-authority.md +++ b/docs/traceability/resolution-freshness-authority.md @@ -13,9 +13,9 @@ Protected `main` already classifies, approves, pins, and non-expansively revalid PR #47 exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` contains the reusable production `FreshResolutionSnapshot` primitive and has terminal successful CI/security/SAST/exact-coverage evidence. That primitive is therefore **IMPLEMENTED_ON_ACTIVE_PR** evidence only; it is not protected-main truth. -PR #50 is the dependent consumer lane. Its intended contract requires the first-party direct-socket planning boundary to consume the fresh snapshot together with one caller-supplied trusted monotonic current time, reject expired authority before socket I/O, and retain only credential-free freshness timestamps needed to prove the planning decision. PR #50 remains Draft and non-shipped. Current exact head `18d3b19523de61f59dd47a11c2c82d6451512272` adds a production `FreshConnectionPlan`, but leaves the original public `ConnectionPlan::new(&ResolutionSnapshot, ...)` bypass available and leaves the acceptance test intentionally calling that old path. Exact-head CI therefore fails at the intended policy boundary rather than proving the consumer complete. The complete resolution-to-socket interval remains **PARTIAL**. +PR #50 exact head `f8b43bc94444986ab23aa4ef3086e446a0b39295` now implements the dependent first-party consumer boundary. It keeps the untimed `ConnectionPlan` internal to `originweave-network`, exposes `FreshConnectionPlan` as the ordinary direct-socket planner, requires a `FreshResolutionSnapshot` plus caller-supplied trusted monotonic current time, rejects expired authority before socket I/O, and migrates the existing TLS integration helpers through that same fresh boundary. Exact-head CI run `31408474576` passes repository contracts, formatting, workspace check/tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status is success. -Neither an active primitive nor an alternative wrapper may be cited as shipped implementation evidence while the first-party untimed planning path remains callable. The overall DNS-rebinding/TOCTOU boundary becomes protected-main implemented only after the primitive and the first-party consumer integrate under one exact trusted clock/authority chain and no ordinary first-party socket plan can bypass freshness. +Both #47 and #50 remain **IMPLEMENTED_ON_ACTIVE_PR**, not shipped. PR #50 is correctly Draft because it is stacked on #47 and must not integrate before its prerequisite. The overall protected-main resolution-to-socket interval therefore remains **PARTIAL** until dependency-ordered integration and fresh protected-main acceptance prove the same authority chain without an untimed public bypass. ## Current exact-head RCA @@ -25,45 +25,48 @@ The first production-complete PR #47 head reached all ordinary Rust contracts an That was a realistic DNS-rebinding case rather than an impossible instrumentation artifact. The branch added a focused one-address expansion regression requiring `ResolutionSetExpanded`, retained the two-address expansion case, and exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` subsequently passed CI including exact production function/line/region/branch coverage, Security Scan, and SAST Semgrep. -The freshness ceiling is also executable active-PR evidence rather than an aspirational requirement. `crates/originweave-destination/src/resolution.rs` owns `MAX_RESOLUTION_VALIDITY: Duration = Duration::from_secs(30)`. `FreshResolutionSnapshot::approve` rejects `Duration::ZERO` and any interval above that constant with `DestinationError::InvalidResolutionValidity`; `crates/originweave-destination/tests/resolution_freshness.rs::fresh_resolution_rejects_invalid_or_overflowing_validity` verifies both the zero and greater-than-30-second boundaries plus approval-time overflow. This evidence remains active-PR-only until PR #47 integrates. +The freshness ceiling is executable active-PR evidence rather than an aspirational requirement. `crates/originweave-destination/src/resolution.rs` owns `MAX_RESOLUTION_VALIDITY: Duration = Duration::from_secs(30)`. `FreshResolutionSnapshot::approve` rejects `Duration::ZERO` and any interval above that constant with `DestinationError::InvalidResolutionValidity`; `crates/originweave-destination/tests/resolution_freshness.rs::fresh_resolution_rejects_invalid_or_overflowing_validity` verifies both the zero and greater-than-30-second boundaries plus approval-time overflow. This evidence remains active-PR-only until PR #47 integrates. ### PR #50 consumer -PR #50 began from exact PR #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` with a test contract that intentionally does not compile against the old `ConnectionPlan::new(&ResolutionSnapshot, ...)` API. Predecessor CI also exposed and removed a setup-only `OriginError` formatting defect, leaving the production API mismatch as the valid RED boundary. +PR #50 began from exact PR #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` with a RED consumer contract requiring fresh resolution authority plus one trusted monotonic current time before direct socket planning. -Current exact head `18d3b19523de61f59dd47a11c2c82d6451512272` implements a separate `FreshConnectionPlan`. That wrapper first calls `FreshResolutionSnapshot::authorize_connection`, then delegates to the existing untimed `ConnectionPlan`, and stores approval/expiry/authorization timestamps. This is useful implementation progress, but it does **not** yet satisfy the accepted consumer contract because the existing public `ConnectionPlan::new(&ResolutionSnapshot, ...)` remains a first-party route that can bypass freshness entirely. +A first production repair added a public `FreshConnectionPlan` wrapper that authorized freshness and then delegated to the existing untimed `ConnectionPlan`. That implementation made the positive/expiry path available but did not close the buyer/security gap because the original public `ConnectionPlan::new(&ResolutionSnapshot, ...)` remained callable. Canonical review therefore rejected the parallel-wrapper design as insufficient rather than weakening the acceptance boundary. -CI run `31400013559` checked out exactly `18d3b19523de61f59dd47a11c2c82d6451512272`; repository contracts and rustfmt passed, then `cargo check --locked --workspace --all-targets` failed in `crates/originweave-network/tests/fresh_resolution_plan.rs`. The test still supplies a `FreshResolutionSnapshot` plus trusted current time to `ConnectionPlan::new` and requires freshness evidence accessors. Rust correctly reports the old four-argument untimed signature and missing freshness accessors. Production coverage also fails because the workspace does not compile. +The corrected implementation removed `ConnectionPlan` from the public crate exports while retaining it as a private implementation detail. Exact-head CI run `31407686307` then failed at the intended first-party migration boundary: `cargo check --locked --workspace --all-targets` found exactly three TLS integration tests still importing the now-private stale planner (`handshake_deadline.rs`, `handshake_integration.rs`, and `validity_horizon_integration.rs`). That compile failure was useful evidence because it enumerated remaining first-party bypass consumers instead of hiding them behind a compatibility re-export. -The root cause is therefore **not** a formatting, runner, dependency, or coverage-instrumentation defect, and the smallest correct remedy is **not** to weaken the acceptance test to call `FreshConnectionPlan` while leaving an ordinary untimed `ConnectionPlan` public. The product boundary requires eliminating or structurally constraining the bypass: for example, make the externally consumable direct planner itself require `FreshResolutionSnapshot` + trusted time, or make the untimed planner an internal implementation detail reachable only after freshness authorization. Any chosen remedy must preserve current socket-validation semantics, use the same trusted monotonic clock domain, and reacquire exact-head CI/security/coverage evidence. +Those integration helpers were migrated to deterministic `FreshResolutionSnapshot` + `FreshConnectionPlan` fixtures with one explicit trusted monotonic clock domain. A later run `31408143459` found only missing end-of-file newlines under rustfmt; that formatting-only defect was corrected without changing the authority contract. Current exact head `f8b43bc94444986ab23aa4ef3086e446a0b39295` then passed CI run `31408474576` end to end, including exact owned function/line/region/branch coverage. + +The accepted remedy is therefore now realized on the active branch: ordinary first-party direct planning cannot import the untimed planner, while the private implementation remains reusable only after `FreshConnectionPlan` performs freshness authorization. This proves the active consumer implementation, but dependency order and protected-main truth rules still prevent a shipped claim. ## Deterministic authority contract -The active work is intended to prove one continuous destination-to-socket authority chain with all of the following properties: +The active work proves one continuous destination-to-socket authority chain with all of the following properties: 1. approval time is explicit and supplied from one trusted monotonic clock domain; 2. validity is non-zero and capped by the active implementation's repository-owned `MAX_RESOLUTION_VALIDITY` safety budget (30 seconds on PR #47 exact head), with shorter caller-selected intervals permitted; 3. the usable interval is half-open: `approved_at <= now < valid_until`; 4. use before approval, use at/after expiry, arithmetic overflow, unapproved addresses, and set expansion fail closed with typed errors; -5. the first-party socket planner cannot accept an untimed `ResolutionSnapshot` as sufficient authority once the consumer integration is complete; +5. the ordinary first-party socket planner no longer publicly accepts an untimed `ResolutionSnapshot` as sufficient authority on PR #50 exact head; 6. credential-free planning evidence records approval, expiry, and authorization times without introducing credentials, resolver internals, or protected values; 7. non-expanding revalidation may renew the bounded interval only while rerunning existing destination-policy validation against the newly supplied answer; and -8. the primitive and planning boundary perform no DNS lookup, wall-clock read, ambient proxy selection, TLS, HTTP, browser control, persistence, secret, or model call. +8. the primitive and planning boundary perform no DNS lookup, wall-clock read, ambient proxy selection, TLS policy mutation, HTTP, browser control, persistence, secret, or model call. ## Architecture and ADR assessment The primitive and its first-party consumer tighten the already Accepted destination/rebinding authority governed by ADR 0004. They do not introduce a new component, persistence owner, wire protocol, browser adapter, or trust domain. Therefore a new ADR, deployment component, or physical ERD object would be false precision at this stage. -The network-authority UML should be reconciled when the PR #50 consumer stabilizes because the executable sequence changes materially from `resolution snapshot -> socket plan` to `fresh resolution authority + trusted monotonic use time -> socket plan`. A new or superseding ADR becomes appropriate only if integration changes the governing ownership boundary—for example, durable cross-process freshness state, a separate resolver service, a different trusted-clock owner, or a new externally versioned protocol. +The network-authority UML now has a stable enough durable sequence to reconcile: `resolver answer -> destination/origin validation -> fresh resolution approval -> trusted monotonic connection authorization -> exact socket candidate -> observed TCP peer -> TLS/HTTP authority`. That is a sequence refinement within the existing network-authority component graph, not a new topology. A new or superseding ADR becomes appropriate only if later integration changes ownership—for example, durable cross-process freshness state, a separate resolver service, a different trusted-clock owner, or a new externally versioned protocol. ## Evidence progression | Evidence state | Allowed maturity claim | |---|---| | Test-only consumer head with unresolved production API | intentional RED contract only; not implementation evidence | -| Active PR #47 production primitive + unchanged exact-head CI/security/100% coverage | `IMPLEMENTED_ON_ACTIVE_PR` for the primitive; overall path remains `PARTIAL` | -| Active PR #50 adds a freshness wrapper while an ordinary untimed planner remains public | implementation progress only; bypass still makes the overall path `PARTIAL` | -| Active PR #50 production consumer structurally requires fresh authority but has non-passing gates | `IMPLEMENTED_ON_ACTIVE_PR` only for code already present and testable; overall path remains `PARTIAL` | +| Active PR #47 production primitive + unchanged exact-head CI/security/100% coverage | `IMPLEMENTED_ON_ACTIVE_PR` for the primitive; overall protected-main path remains `PARTIAL` | +| Active PR #50 adds a freshness wrapper while an ordinary untimed planner remains public | implementation progress only; bypass still makes the consumer incomplete | +| Active PR #50 hides the untimed planner and exact compile evidence finds stale first-party consumers | valid structural remedy with migration still incomplete | +| Active PR #50 exact head `f8b43bc...` migrates first-party consumers and passes exact CI/coverage | `IMPLEMENTED_ON_ACTIVE_PR` for the consumer; dependency-gated and non-shipped | | PR #47 + #50 exact heads are individually gate-clean but neither is on protected main | active-PR evidence only; no shipped claim | | Protected-main primitive, but direct socket consumer can still bypass freshness | `PARTIAL` | | Protected-main direct socket path requires exact fresh authority and tests prove pre-approval/expiry/rebinding behavior | `IMPLEMENTED_ON_PROTECTED_MAIN` for the bounded resolution-to-socket interval | @@ -72,9 +75,9 @@ The network-authority UML should be reconciled when the PR #50 consumer stabiliz ## Required follow-through - keep PR #47 as active/non-shipped evidence until repository governance integrates it; -- on PR #50, preserve the valid RED at the public first-party planning API and remove or structurally constrain the untimed `ResolutionSnapshot` bypass rather than weakening the test to accept a parallel wrapper; -- require terminal exact-head workspace/tests/Clippy/rustdoc/100% function-line-region-branch coverage plus security evidence after that production boundary changes; -- keep PRD/TRD/traceability from calling the DNS-rebinding/TOCTOU interval closed while either prerequisite is active or any ordinary socket path can bypass freshness; -- update network-authority sequence documentation after the executable consumer signature/evidence contract stabilizes, without encoding temporary branch-only details as protected-main truth; +- keep PR #50 Draft and dependency-gated while #47 remains active; do not transfer its green evidence to protected main; +- preserve the structural invariant that ordinary first-party direct planning cannot import an untimed `ConnectionPlan`; +- keep PRD/TRD/traceability from calling the DNS-rebinding/TOCTOU interval closed while either prerequisite is active; +- reconcile the existing network-authority UML with the now-stable durable freshness sequence, without encoding temporary branch-only identifiers as timeless architecture; - retain the existing conceptual ERD unless a real persistence owner is introduced; and - after both layers integrate, rerun protected-main operational/release acceptance before promoting the capability maturity. From c251e073dae59ad49371e4ea93698002d680d560 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 02:10:19 +0900 Subject: [PATCH 062/130] test(docs): track semantic observation maturity --- tests/test_documentation_fitness_contract.py | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index 1168c286..bf0db775 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -96,6 +96,7 @@ def test_documentation_fitness_distinguishes_design_from_protected_main(self) -> self.assertIn("HTTP lineage", assessment) self.assertIn("Manifest V3 compatibility", assessment) self.assertIn("Browser identifier authority", assessment) + self.assertIn("Semantic observation authority", assessment) self.assertIn("integration before any of these branch repairs become protected-main truth", assessment) def test_every_adr_is_indexed_once_with_its_file_status(self) -> None: @@ -149,13 +150,30 @@ def test_current_replacement_lanes_are_not_promoted_to_protected_main(self) -> N """Canonical docs must distinguish active implementation from shipped implementation.""" assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") traceability = (DOCS_ROOT / "traceability" / "README.md").read_text(encoding="utf-8") - for marker in ("PR #37", "PR #40", "PR #43", "issue #10", "issue #27", "issue #28"): + for marker in ( + "PR #37", + "PR #40", + "PR #43", + "PR #52", + "issue #10", + "issue #27", + "issue #28", + ): with self.subTest(marker=marker): self.assertTrue(marker in assessment or marker in traceability) self.assertIn("IMPLEMENTED_ON_ACTIVE_PR", traceability) self.assertIn("IMPLEMENTED_ON_PROTECTED_MAIN", traceability) self.assertIn("Active-PR behavior is never protected-main truth", traceability) + def test_semantic_observation_lane_stays_non_shipped_and_provenance_bound(self) -> None: + """The semantic observation value object must not be documented as a real browser adapter.""" + assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") + prd = (DOCS_ROOT / "PRD.md").read_text(encoding="utf-8") + self.assertIn("PR #52", assessment) + self.assertIn("evidence channel", assessment) + self.assertIn("active PR #52", prd) + self.assertIn("not a browser observation adapter", prd) + def test_prd_does_not_restore_superseded_active_pr_claims(self) -> None: """Historical feature branches must not reappear as the current implementation lane.""" prd = (DOCS_ROOT / "PRD.md").read_text(encoding="utf-8") From cc4990aa2ab08e94679204fde4500aee73b1ea6b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 02:15:17 +0900 Subject: [PATCH 063/130] docs: reconcile semantic observation maturity --- docs/DOCUMENTATION_FITNESS.md | 52 +++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 21 deletions(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index 6cd61200..c88d4d52 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -17,20 +17,20 @@ File existence alone is never sufficient. An artifact can exist and still be sta | Documentation family | Fitness | Current evidence / remaining boundary | |---|---|---| -| PRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | HTTP names active replacement PR #37 while retaining `Planned` protected-main status; historical PR #11 is predecessor lineage. Purpose-bound sensitive disclosure is an Implemented protected-main policy kernel while broker/storage/lifecycle remain Planned under issue #10; active PRs #45/#46 add bounded non-shipped lifecycle/use-state evidence. Resolution freshness is active in #47 with first-party network consumption stacked in #50; neither is protected-main truth. Browser task telemetry in #51 is an active value-object prerequisite, not shipped sampling. MV3 remains a Planned complete compatibility program while protected-main and active-PR evidence are separately identified. | -| TRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Implementation inventory separates protected-main status from active/non-shipped evidence instead of composite labels. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth. #47/#50 tighten the resolution-to-socket freshness boundary only on active work; #48 is a revocation-material freshness primitive without any protected-main revocation claim; #51 is active telemetry structure without OS/Chromium sampling. | -| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium compatibility-kernel + Rust control-plane direction, explicit authority stack and protected-main truth rule. #47/#50 tighten the already-governed ADR 0004 destination/rebinding authority rather than creating a new service/topology. #45/#46 remain within ADR 0007. #48 adds no revocation fetch/cache/service boundary and #51 adds no sampler/runtime component. Reconcile implementation-facing details after these lanes integrate or the real Chromium vertical slice stabilizes. | -| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Indexes Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 without promoting Proposed decisions. Identifier allocation is treated as a cross-main-and-active-work reservation problem. No new ADR is justified solely by #45/#46, #47/#50, #48 or #51 because those lanes remain inside existing authority decisions and introduce no new durable service, trust domain, persistence owner or externally versioned protocol. | -| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 covers MV3 compatibility vs extension-to-Agent authority; Proposed ADR 0014 covers ADR acceptance governance. Their presence does not imply Acceptance. HTTP ADRs in PR #37 remain active-PR evidence. #47/#50 are implementation evidence under ADR 0004, #45/#46 under ADR 0007, and #48/#51 do not by themselves create a new accepted architecture boundary. | -| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. This PR adds `uml/extension-authority.md`. The network-authority sequence should be reconciled once #50's executable consumer signature is stable because the sequence changes from untimed resolution to fresh resolution authority plus trusted monotonic use time; that does not require a fictitious new component. No new UML is justified for #45/#46/#48/#51 until a real runtime/service/transaction boundary appears. A detailed real-Chromium vertical-slice sequence remains deferred until issue #28 contracts stabilize. | -| Conceptual ERD/domain model | **PRESENT-CURRENT** | Explicitly conceptual unless an adapter/schema is separately implemented; distinguishes current value/evidence concepts from planned durable records and adapter-owned representations. #45/#46/#47/#48/#50/#51 introduce no physical persistence owner, so adding tables merely to represent active in-memory/value primitives would be false architecture. | -| Traceability | **REPAIRED IN THIS CHANGE with volatile evidence refresh required** | Separates `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`. Current active evidence includes #37/#40/#43/#45/#46/#47/#48/#49/#50/#51 and cannot be promoted to protected-main truth merely because an individual PR is green. | -| Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, network, secret, provenance and extension risks. #47/#50 narrow the DNS-rebinding/TOCTOU interval only when one fresh authority chain reaches socket planning; #48 proves only signed-window freshness for already-verified revocation material and does not prove an unrevoked certificate; #46 narrows stale-count/replay risk only within one in-process mutable state object. Update threat/runtime claims only after the corresponding active paths integrate. | -| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code function/line/region/branch coverage, rustdoc and realistic boundary testing are explicit. Active lanes use intentional RED boundaries followed by narrow production changes and exact-head proof. Real browser and MV3 evidence remain pinned-browser executable evidence rather than source-text claims, and pending/failed predecessor evidence never transfers to a later head. | -| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. #45/#46/#47/#48/#51 intentionally add no new durable service or daemon, so no runbook/SLO/RPO/RTO is fabricated. #50 changes first-party socket authority composition but not deployment topology. Protected-main runtime/scheduled evidence remains required for operational closure where applicable. | -| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented; much browser adapter implementation remains Planned. External protocol identifiers are never durable authority by themselves. On active #50, the ordinary public untimed network planner is being structurally removed so first-party consumers must cross fresh-resolution authorization; until integration that is active-PR evidence only. #46/#51 are internal reusable control-plane/value APIs, not new external wire/schema contracts. | -| Release / rollback / provenance | **PRESENT-CURRENT** | Feature-branch green checks cannot become release readiness. Release remains bound to one exact integrated protected head and applicable CI/security/coverage/package/provenance/recovery/compatibility/review evidence. Active stacks such as #47→#50 and #43→#49 must preserve dependency order; predecessor-head success cannot satisfy a later head. | -| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. Active PR #45 adds credential-free handle lifecycle evidence; active PR #46 adds a bounded in-process reservation counter that removes caller-supplied prior-use state from the reservation operation. #47/#48/#50/#51 add timestamps/measurements or authority metadata without protected values. Trusted broker storage, cross-process transactionality, revocation, protected-value resolution/fill, compensation, encryption/KMS and model-disclosure lifecycle remain open under issue #10. | +| PRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | HTTP names active replacement PR #37 while retaining `Planned` protected-main status; historical PR #11 is predecessor lineage. Purpose-bound sensitive disclosure is an Implemented protected-main policy kernel while broker/storage/lifecycle remain Planned under issue #10; active PRs #45/#46 add bounded non-shipped lifecycle/use-state evidence. Resolution freshness is active in #47 with first-party network consumption stacked in #50; neither is protected-main truth. Browser task telemetry in #51 and semantic observation value work in active PR #52 are prerequisites for issue #28, not shipped Chromium runtime evidence. MV3 remains a Planned complete compatibility program while protected-main and active-PR evidence are separately identified. | +| TRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Implementation inventory separates protected-main status from active/non-shipped evidence instead of composite labels. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth. #47/#50 tighten resolution-to-socket freshness only on active work; #48 is a revocation-material freshness primitive; #51 is telemetry structure without sampling; #52 is a bounded semantic-observation value contract without browser I/O. | +| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium compatibility-kernel + Rust control-plane direction, explicit authority stack and protected-main truth rule. #47/#50 tighten ADR 0004; #45/#46 remain within ADR 0007; #52 stays within the existing structured-observation and browser-authority decisions. #48/#51/#52 add no deployed service, persistence owner or new trust domain. Reconcile implementation-facing details after these lanes integrate or the real Chromium vertical slice stabilizes. | +| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Indexes Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 without promoting Proposed decisions. Identifier allocation is treated as a cross-main-and-active-work reservation problem. No new ADR is justified solely by #45/#46, #47/#50, #48, #51 or #52 because those lanes remain inside existing authority decisions and introduce no new durable service, trust domain, persistence owner or externally versioned protocol. | +| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 covers MV3 compatibility vs extension-to-Agent authority; Proposed ADR 0014 covers ADR acceptance governance. Their presence does not imply Acceptance. HTTP ADRs in PR #37 remain active-PR evidence. #47/#50 are implementation evidence under ADR 0004, #45/#46 under ADR 0007, and #52 remains bounded by ADR 0010 plus the structured-observation decision rather than creating a new architecture boundary. | +| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. This PR adds `uml/extension-authority.md`. The network-authority sequence should be reconciled once #50 stabilizes. Active #52 supplies a value contract for the already-planned semantic-observation stage, but no real adapter/process boundary, so a new topology diagram would overstate maturity. Detailed real-Chromium sequence remains deferred until issue #28 contracts stabilize. | +| Conceptual ERD/domain model | **PRESENT-CURRENT** | Explicitly conceptual unless an adapter/schema is separately implemented; distinguishes current value/evidence concepts from planned durable records and adapter-owned representations. #45/#46/#47/#48/#50/#51/#52 introduce no physical persistence owner, so adding tables merely to represent active in-memory/value primitives would be false architecture. | +| Traceability | **REPAIRED IN THIS CHANGE with volatile evidence refresh required** | Separates `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`. Current active evidence includes #37/#40/#43/#45/#46/#47/#48/#49/#50/#51/#52 and cannot be promoted to protected-main truth merely because an individual PR is green. | +| Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, network, secret, provenance and extension risks. #47/#50 narrow DNS-rebinding/TOCTOU only on active work; #48 proves signed-window freshness only; #46 narrows stale-count/replay only in-process. #52 requires a non-empty explicit evidence-channel provenance set so a semantic observation cannot exist without naming how it was observed; evidence channel and advertised node actions remain descriptive and grant no execution authority. | +| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code function/line/region/branch coverage, rustdoc and realistic boundary testing are explicit. Active lanes use intentional RED boundaries followed by narrow production changes and exact-head proof. #52 includes an intentional provenance regression proving empty evidence-channel observations fail closed. Real browser and MV3 evidence remain pinned-browser executable evidence rather than source-text claims. | +| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. #45/#46/#47/#48/#51/#52 intentionally add no new durable service or daemon, so no runbook/SLO/RPO/RTO is fabricated. #50 changes first-party socket authority composition but not deployment topology. | +| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented; much browser adapter implementation remains Planned. External protocol identifiers are never durable authority by themselves. #52 is an internal reusable semantic-observation value API bound to an OriginWeave-owned node handle and explicit evidence channel; it is not a BiDi/CDP/WebMCP wire contract and not a browser observation adapter. | +| Release / rollback / provenance | **PRESENT-CURRENT** | Feature-branch green checks cannot become release readiness. Release remains bound to one exact integrated protected head and applicable CI/security/coverage/package/provenance/recovery/compatibility/review evidence. Active stacks such as #40→#52, #47→#50 and #43→#49 must preserve dependency order; predecessor-head success cannot satisfy a later head. | +| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. Active #45/#46 add bounded sensitive-handle primitives; #47/#48/#50/#51 add timestamps/measurements or authority metadata. #52 contains bounded semantic strings and provenance classifications but no protected-value broker/storage path. Trusted broker storage, cross-process transactionality, revocation, protected-value resolution/fill, compensation, encryption/KMS and model-disclosure lifecycle remain open under issue #10. | | Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references are kept in doctoring documents with draft/experimental status distinguished from final normative standards. | ## 3. Reconciliation findings and resolution state @@ -52,7 +52,7 @@ Two newer active lanes provide narrower non-shipped evidence: PR #46's mutable-borrow serialization is deliberately **not** described as durable or cross-process atomic broker enforcement. It stores neither the opaque token nor protected data and does not implement revocation, transactionally durable reservation, value resolution/fill, compensation, encryption/KMS, retention, or model/provider/region disclosure policy. -**Resolved on this documentation branch:** the design verdict remains unchanged. PRD/TRD/traceability may identify #45/#46 as `IMPLEMENTED_ON_ACTIVE_PR`/partial evidence while the complete broker/runtime stays `Planned` under issue #10. Root Architecture, UML and ERD do not gain fictitious service/database boundaries before those boundaries actually exist. +**Resolved on this documentation branch:** PRD/TRD/traceability may identify #45/#46 as `IMPLEMENTED_ON_ACTIVE_PR`/partial evidence while the complete broker/runtime stays `Planned` under issue #10. Root Architecture, UML and ERD do not gain fictitious service/database boundaries before those boundaries actually exist. ### 3.3 Manifest V3 compatibility @@ -88,15 +88,15 @@ The first audit incorrectly called resource-pressure and hourly automation views Protected main already validates, pins and non-expansively revalidates destination addresses, but it does not yet require a bounded approval-to-socket-use interval. Active PR #47 exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` implements the reusable `FreshResolutionSnapshot` primitive with a repository-owned 30-second maximum validity budget and exact-head gate evidence. -Stacked PR #50 owns first-party network consumption. During this reconciliation run, the parallel-wrapper design was rejected as insufficient because public `ConnectionPlan::new(&ResolutionSnapshot, ...)` remained an untimed bypass. The active branch now structurally hides that untimed planner and is migrating first-party TLS integration helpers to `FreshConnectionPlan` with explicit trusted monotonic approval/use times. This remains **active-PR / PARTIAL** evidence until the exact consumer head is gate-clean and both prerequisite and consumer integrate in dependency order. +Stacked PR #50 owns first-party network consumption. The active branch structurally hides the untimed planner and migrates first-party TLS integration helpers to `FreshConnectionPlan` with explicit trusted monotonic approval/use times. This remains **active-PR / PARTIAL** evidence until the exact consumer head is gate-clean and both prerequisite and consumer integrate in dependency order. -**Documentation consequence:** no new ADR, physical ERD entity or deployed component is justified. The change tightens Accepted ADR 0004. The network-authority sequence should be reconciled after the #50 public consumer contract stabilizes so the diagram explicitly shows fresh resolution authority plus trusted monotonic use time before socket authority. +**Documentation consequence:** no new ADR, physical ERD entity or deployed component is justified. The change tightens Accepted ADR 0004. The network-authority sequence should be reconciled after #50's public consumer contract stabilizes. ### 3.9 TLS revocation-material freshness Protected main deliberately reports revocation as `NotConfigured`. Active PR #48 exact head `9bbe12860436027a3b7cd5786775f1dacfbc835d` adds a reusable signed-window freshness check for already-verified revocation material. -**Documentation consequence:** #48 may be represented as `IMPLEMENTED_ON_ACTIVE_PR` for the freshness primitive only. It must not be described as OCSP/CRL acquisition, signature/path validation, cache operation, or proof that a certificate is unrevoked. No new revocation service/cache topology or physical ERD is documented until such a runtime actually exists. +**Documentation consequence:** #48 may be represented as `IMPLEMENTED_ON_ACTIVE_PR` for the freshness primitive only. It must not be described as OCSP/CRL acquisition, signature/path validation, cache operation, or proof that a certificate is unrevoked. No new revocation service/cache topology or physical ERD is documented until such a runtime exists. ### 3.10 Browser task telemetry @@ -104,6 +104,14 @@ Active PR #51 exact head `1c85b966087191f52b4a709a2822b2a53fb0e2fa` adds a bound **Documentation consequence:** this is a reusable active-PR prerequisite for issue #28 resource evidence, not a new runtime component, persistence entity, sampler service or release metric. Architecture/UML/ERD remain unchanged until an actual measurement adapter establishes those boundaries. +### 3.11 Semantic observation authority + +Active PR #52 is stacked on active browser-registry PR #40 and therefore remains non-shipped. Its current lane adds a bounded `SemanticNodeObservation` value contract that carries an OriginWeave-owned `ObservedNodeHandle`, bounded role/accessibility-name/visible-text fields, observed state, typed node-local action descriptors, and an explicit non-empty evidence-channel provenance set. The provenance regression deliberately rejects an observation with no evidence channel. + +The evidence channel records how the value was observed; it does not elevate Accessibility, DOM, layout, WebMCP, structured-data or visual content into trusted instruction. Likewise, an advertised `NodeActionKind` is descriptive evidence of a meaningful node-local operation, not an execution capability or policy grant. + +**Documentation consequence:** active PR #52 is `IMPLEMENTED_ON_ACTIVE_PR` evidence for a semantic-observation value primitive only. It is not a browser observation adapter, does not perform BiDi/CDP/WebMCP I/O, does not dispatch actions, does not prove mutation invalidation, and does not establish a service or persistence boundary. No new ADR or physical ERD entity is justified; the lane remains governed by the existing browser-authority and structured-observation decisions and issue #28. + ## 4. Durable conversation decisions captured in GitHub The canonical graph must continue to preserve these durable decisions: @@ -132,6 +140,7 @@ The canonical graph must continue to preserve these durable decisions: 22. A validated DNS answer is not sufficient socket authority indefinitely; the resolution-to-socket interval must be bounded by caller-supplied trusted monotonic freshness and ordinary first-party socket planning must not retain an untimed bypass. 23. Revocation-material freshness, revocation-material cryptographic validity, acquisition/cache operation and an unrevoked-certificate claim are separate evidence authorities. 24. Browser-resource telemetry values and actual OS/Chromium measurement adapters are separate maturity claims; value-object availability cannot be promoted to measured runtime evidence. +25. Every semantic observation must identify at least one contributing evidence channel; observation provenance and advertised node-local actions are descriptive evidence and never grant execution authority. ## 5. Architecture views still legitimately deferred @@ -184,7 +193,7 @@ isolated profile/context -> teardown/recovery ``` -Do not freeze temporary protocol/field names into authoritative UML before the executable contracts stabilize. +Active #52 makes the semantic-observation value boundary more concrete but still does not establish the browser adapter, process topology or action-dispatch sequence. Do not freeze temporary protocol/field names into authoritative UML before the executable contracts stabilize. ### 5.4 Trusted sensitive-data broker — deferred until issue #10 owns a real runtime boundary @@ -205,13 +214,14 @@ Current protected-main policy/evidence plus active #45/#46 primitives do not jus - documentation fitness and regression contracts; - current browser/protocol standards doctoring; - active-sensitive-data evidence reconciliation without promoting #45/#46 to shipped or inventing broker persistence; -- explicit freshness/revocation/telemetry maturity boundaries for active #47/#48/#50/#51 without inventing new architecture or persistence. +- explicit freshness/revocation/telemetry maturity boundaries for active #47/#48/#50/#51 without inventing new architecture or persistence; +- semantic-observation maturity/provenance boundary for active #52 without promoting it to a real browser adapter. ### Still required - exact-head CI/security/review acceptance of this documentation PR; - integration before any of these branch repairs become protected-main truth; -- re-reconciliation whenever active PR #37, #40, #43, #45, #46, #47, #48, #49, #50 or #51 integrates, closes, is superseded or materially changes head, because active-PR status must then move or be removed rather than silently becoming protected-main truth; +- re-reconciliation whenever active PR #37, #40, #43, #45, #46, #47, #48, #49, #50, #51 or #52 integrates, closes, is superseded or materially changes head, because active-PR status must then move or be removed rather than silently becoming protected-main truth; - network-authority sequence reconciliation after #50's executable consumer contract is stable and proven; - detailed real-Chromium vertical-slice UML when issue #28 implementation contracts are stable; - trusted-broker UML/ERD/operability additions only when issue #10 establishes real runtime/persistence ownership; From 121be9c9033e96be7cf86e3b1ca3992fa05b31d6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 02:16:54 +0900 Subject: [PATCH 064/130] docs(prd): track semantic observation provenance --- docs/PRD.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/PRD.md b/docs/PRD.md index 64a0948a..40539a28 100644 --- a/docs/PRD.md +++ b/docs/PRD.md @@ -84,7 +84,7 @@ The status applies to the **whole named product surface**, not to every implemen |---|---|---|---| | **OriginWeave Browser** | Chromium-compatible interactive distribution with governed agent entry points | Planned | No protected-main branded browser distribution yet | | **OriginWeave Runtime** | Headless/embedded governed web-task runtime | Planned | Rust authority kernels exist; browser integration remains incomplete | -| **OriginWeave Observe** | Structured observation from tools, structured data, network, accessibility, DOM/layout and visual fallback | Planned | Session/context/node-authority foundations are on protected main; semantic browser observation adapter is incomplete | +| **OriginWeave Observe** | Structured observation from tools, structured data, network, accessibility, DOM/layout and visual fallback | Planned | Session/context/node-authority foundations are on protected main; active PR #52 adds a bounded authority-bound semantic-observation value primitive with explicit evidence-channel provenance, but it is not a browser observation adapter and remains non-shipped | | **OriginWeave Capture** | Schema-bound extraction, crawler controls, downloads and WARC/PROV-oriented capture | Planned | Evidence foundations and partial real-Chromium extension compatibility evidence exist; complete capture runtime is not shipped | | **OriginWeave Governor** | CPU, RAM, GPU, VRAM, admission and model/browser priority governance | Accepted architecture | Deterministic resource-budget and CPU-worker admission foundations are implemented; platform telemetry/scheduling adapters remain incomplete | | **OriginWeave Policy** | Capability, origin, purpose, risk, crawler, approval and sensitive-data authority | Accepted architecture | Capability/origin/purpose/risk/crawler/approval and purpose-bound sensitive-data policy foundations are implemented on protected main; trusted sensitive-data broker/storage/lifecycle remain planned under issue #10 | @@ -193,9 +193,9 @@ public-crawl purpose |---|---|---|---| | PRD-OBS-001 | Autonomous observations can carry explicit browser-session, browsing-context, canonical-origin and document-epoch authority | Implemented | `ObservedNodeHandle`, `BrowserSessionId`, `BrowsingContextId` and `DocumentEpoch` are on protected main under Accepted ADR 0010; real browser adapter remains planned | | PRD-OBS-002 | Actionable semantic-node handles are invalidated by relevant document-epoch changes at the action linearization boundary | Accepted architecture | Core exact-authority validation exists; adapter lifecycle/mutation invalidation and atomic dispatch evidence remain planned; active PR #40 owns the bounded protocol-ID registry and remains non-shipped evidence | -| PRD-OBS-003 | Observation prefers typed/structured evidence before accessibility/DOM/layout and bounded visual fallback | Accepted architecture | ADR 0103 | +| PRD-OBS-003 | Observation prefers typed/structured evidence before accessibility/DOM/layout and bounded visual fallback | Accepted architecture | ADR 0103; active PR #52 adds a bounded `SemanticNodeObservation` value contract bound to `ObservedNodeHandle`, typed node-local action descriptors and explicit non-empty evidence-channel provenance. It is not a browser observation adapter and remains active/non-shipped evidence | | PRD-OBS-004 | Observation can use bounded incremental updates rather than full repeated snapshots | Planned | Adapter-specific design needed | -| PRD-OBS-005 | Source channel and trust/provenance remain explicit | Accepted architecture | Evidence model foundations exist | +| PRD-OBS-005 | Source channel and trust/provenance remain explicit | Accepted architecture | Evidence model foundations exist; active PR #52 fails closed when a semantic observation has no contributing evidence channel, while channel identity itself grants no execution authority | ### 9.3 Typed action execution From 44d3f5fdec6ec16d5d9b22e6d63f13a5724136ae Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 02:23:38 +0900 Subject: [PATCH 065/130] docs(traceability): map semantic observation provenance --- docs/traceability/README.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/docs/traceability/README.md b/docs/traceability/README.md index 42ff1de4..e30b9eda 100644 --- a/docs/traceability/README.md +++ b/docs/traceability/README.md @@ -62,11 +62,12 @@ ADR lifecycle is separate and remains `Proposed`, `Accepted`, `Superseded`, `Dep | Proxy/PAC route authority must be explicit | PARTIAL | PRD-NET-005; TRD Section 6.3 | Protected-main direct-route authority exists; PAC evaluation/proxy transport/CONNECT remain incomplete | | Bounded HTTP semantics require an authenticated governed connection and resource bounds | IMPLEMENTED_ON_ACTIVE_PR | PRD-NET-006; issue #9; active PR #37 | `originweave-http` replacement exists on active PR #37; historical PR #11 is SUPERSEDED implementation lineage and is not current evidence; no protected-main HTTP claim yet | | Node handles bind session/context/origin/document lifetime | PARTIAL | ADR 0010; PRD-OBS-001/002; TRD Section 5 | Core opaque session/context/document/node authority is on protected main; active PR #40 owns the protocol-ID registry and remains non-shipped evidence | +| Semantic observations retain OriginWeave node authority and explicit source-channel provenance | IMPLEMENTED_ON_ACTIVE_PR | PRD-OBS-001/003/005; ADR 0010; structured-observation architecture | Active PR #52, stacked on #40, implements a bounded `SemanticNodeObservation` value primitive that rejects missing evidence-channel provenance. It is not a browser observation adapter; channels and advertised node actions are descriptive evidence and grant no execution authority | | Raw secrets never enter model context | PARTIAL | PRD-DATA-001; ADR 0002; TRD Section 9 | Core secret-delivery policy exists; trusted broker/runtime completion remains Planned | | Sensitive disclosure is purpose- and classification-bound | PARTIAL | ADR 0007; PRD-DATA-002; issue #10 | Purpose-bound policy/evidence foundations are on protected main; active PR #45 adds credential-free handle-lifecycle evidence and #46 adds bounded in-process authoritative use reservation, while trusted storage/revocation/value resolution/cross-process lifecycle/model-disclosure remain open | | Evidence/provenance are product outputs, not debug leftovers | PARTIAL | ADR 0003; PRD Section 9.6 | `originweave-evidence` foundations exist; complete durable Evidence Trail/WARC/PROV adapters remain Planned | | Human interaction outranks inference/background collection | PARTIAL | `ARCHITECTURE.md`; PRD-RES-002 | Deterministic resource mitigation/CPU-worker admission foundations exist; platform telemetry/actuation remain Planned | -| Structured observation precedes raw HTML/screenshot fallback | ACCEPTED_ARCHITECTURE | PRD-OBS-003; TRD Section 7 | Real semantic observation adapter remains Planned | +| Structured observation precedes raw HTML/screenshot fallback | ACCEPTED_ARCHITECTURE | PRD-OBS-003; TRD Section 7 | Active PR #52 supplies a non-shipped bounded semantic value primitive; real browser observation and fallback adapters remain Planned | | WebDriver BiDi / CDP / WebMCP / MCP are adapters, not internal authority | ACCEPTED_ARCHITECTURE | PRD Section 9.8; TRD Section 12 | Protocol adapter implementation remains Planned/active under issue #28; active PR #40 may not be called shipped | | Manifest V3 compatibility is preserved upstream where practical | PARTIAL | ADR 0001; issue #27; Proposed ADR 0013 | Protected main has pinned real-Chromium compatibility evidence for service worker/content script/storage/DNR/tabs/windows/scripting/commands/side panel/bookmarks/history/restart/repeatability; active PR #43 adds real bounded downloads evidence; full issue #27 matrix remains incomplete | | Extension permission does not imply OriginWeave Agent capability | PARTIAL | protected-main extension authority kernel; Proposed ADR 0013 | Core extension-to-Agent authority isolation exists on protected main; complete managed-extension/native-messaging/enterprise release policy remains incomplete | @@ -92,6 +93,7 @@ ADR lifecycle is separate and remains `Proposed`, `Accepted`, `Superseded`, `Dep | Bounded HTTP/1.1 | active `originweave-http` replacement in PR #37 | issue #9; active-PR unit/integration/coverage evidence | IMPLEMENTED_ON_ACTIVE_PR | | Proxy/PAC | destination/route foundation + future adapter | roadmap/TRD | PARTIAL | | Session/context/document/node authority | `originweave-core` authority values; active registry work in PR #40 | ADR 0010; roadmap/TRD/UML | PARTIAL | +| Semantic observation value authority/provenance | active `originweave-core` work in PR #52, stacked on #40 | `semantic_node_observation` tests; PRD-OBS-001/003/005; issue #28 | IMPLEMENTED_ON_ACTIVE_PR | | Manifest V3 compatibility evidence | `scripts/ci/run_mv3_compatibility.py` + controlled MV3 fixture; active downloads lane #43 | issue #27; real-browser contracts | PARTIAL | | Extension-to-Agent authority | protected-main core authority kernel + Proposed ADR 0013 | issue #27; extension authority UML | PARTIAL | | Purpose-bound sensitive-data policy/evidence | `originweave-policy` + evidence foundations; active lifecycle/reservation work #45/#46 | ADR 0007; issue #10 | PARTIAL | @@ -112,6 +114,7 @@ ADR lifecycle is separate and remains `Proposed`, `Accepted`, `Superseded`, `Dep | Purpose-bound sensitive-data authority | ADR 0007 (Accepted); trusted broker/storage/lifecycle still issue #10 | | TLS delegated-task leaf-validity horizon | ADR 0008 (Accepted) | | Session/context/document/node binding | ADR 0010 (Accepted); active registry implementation #40 remains non-shipped | +| Semantic observation authority/provenance | Existing session/node authority plus structured-observation architecture; active PR #52 narrows the value contract without creating a new service, trust owner, persistence boundary, or external protocol and therefore does not justify a new ADR by itself | | Manifest V3 compatibility + extension-to-Agent authority | ADR 0013 is Proposed on documentation PR #44; protected-main extension authority code does not auto-Accept the ADR | | Architecture-decision acceptance governance | ADR 0014 is Proposed on documentation PR #44; protected-main AGENTS + live policy remain authoritative | | HTTP semantics | active PR #37 contains its feature ADR lineage; it is active-PR evidence until protected merge and index reconciliation | @@ -145,13 +148,13 @@ Material claims should update `docs/doctoring.md` with current primary evidence |---|---| | UML component/bounded-context view | Product family, Chromium/Rust ownership, adapter boundaries | | Network authority sequence | PRD-NET-001..007; TRD-INV-002; HTTP remains active-PR until #37 integrates; resolution freshness remains an active lower-layer primitive until the socket consumer requires it | -| Observation/action sequence | PRD-OBS, PRD-ACT, PRD-DATA, trust separation | +| Observation/action sequence | PRD-OBS, PRD-ACT, PRD-DATA, trust separation; active #52 makes the bounded semantic-observation value/provenance contract explicit without establishing browser I/O or action dispatch | | Delegated-task state machine | session lifecycle, approval, resource pause, cancellation/recovery, post-condition truth | | Deployment topology | renderer trust, orchestrator/model/store boundaries | | Evidence authority flow | PRD-EVD; proposal/policy/approval/execution/outcome separation | | Extension authority sequence | MV3 compatibility plane vs explicit OriginWeave extension grant and Agent capability separation | -| Conceptual ERD | session/action/network/sensitive/resource/provenance identity; active freshness primitives introduce no physical persistence | -| Real Chromium vertical-slice sequence | PLANNED until issue #28 implementation stabilizes; do not encode temporary adapter fields as shipped architecture | +| Conceptual ERD | session/action/network/sensitive/resource/provenance identity; active freshness and semantic-value primitives introduce no physical persistence | +| Real Chromium vertical-slice sequence | PLANNED until issue #28 implementation stabilizes; active #40/#51/#52 are prerequisites, not proof of the real adapter flow; do not encode temporary adapter fields as shipped architecture | ## 8. Conversation-to-repository capture rule @@ -179,8 +182,9 @@ Repository contracts should fail when canonical PRD/TRD/ADR/UML/ERD/traceability - **Open:** after #37 integrates, move bounded HTTP from `IMPLEMENTED_ON_ACTIVE_PR` into protected-main evidence and close historical PR #11 only after unique-work preservation and protected-main verification are proven. - **Open:** after #43 integrates, move bounded MV3 downloads from `IMPLEMENTED_ON_ACTIVE_PR` into the protected-main compatibility evidence inventory while issue #27 remains open for the complete matrix. - **Open:** after #40 stabilizes/integrates, map its registry API and tests without presenting raw BiDi/CDP identifiers as durable authority. +- **Open:** after stacked #52 stabilizes/integrates behind #40, reclassify only its bounded semantic-observation value/provenance primitive; keep real browser observation I/O, action dispatch, mutation invalidation and post-condition evidence under issue #28 until implemented. - **Open:** after #45/#46 integrate, reclassify their narrow lifecycle/reservation primitives while keeping durable trusted-broker storage/revocation/value-resolution/model-disclosure boundaries under issue #10 until implemented. - **Open:** attach concrete release profiles and quantitative benchmark thresholds after reproducible benchmark evidence exists. - **Open:** map every future public OriginWeave Protocol operation to risk/capability/authority and conformance tests. - **Open:** map enterprise controls to exact SOC 2/CSAP-oriented control evidence without claiming certification. -- **Open:** add data-retention and residency lifecycle diagrams when persistence/tenant adapters become concrete. \ No newline at end of file +- **Open:** add data-retention and residency lifecycle diagrams when persistence/tenant adapters become concrete. From fc0ed49b2977aa09c4696c2f58be73237b6086ee Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 03:34:48 +0900 Subject: [PATCH 066/130] docs: refresh active PR maturity through #55 --- docs/evidence/2026-08-10-active-pr-maturity.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index ac2811e3..5b99efa5 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -25,6 +25,10 @@ This dated appendix records volatile implementation evidence that must not be em | #49 | Ephemeral Agent Task profile-isolation regression | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43 at exact head `96a4e949d96b5794ef473ccf813987b8e69ea566`; CI is green but dependency-gated and not independently integrable before #43. | | #50 | First-party network consumption of resolution freshness | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392`. Exact head `f8b43bc94444986ab23aa4ef3086e446a0b39295` structurally hides the untimed public network planner, migrates first-party TLS integration helpers through `FreshConnectionPlan`, and passes CI run `31408474576` including exact owned function/line/region/branch coverage; CodeRabbit exact-head status is success. Dependency order, not implementation incompleteness, keeps the PR Draft. | | #51 | Browser-task runtime telemetry value object | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `1c85b966087191f52b4a709a2822b2a53fb0e2fa` is CI/Security/SAST/CodeRabbit clean and Ready for review; it carries validated measurements but performs no OS/Chromium sampling itself. | +| #52 | Bounded semantic-node observation value contract | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #40 at exact head `661091dcc52f0a52e7a6a636b0f4bcea5469f82d`; CI and Manifest V3 Compatibility are green, provenance must be non-empty, and the value contract performs no browser I/O or action dispatch. | +| #53 | Authoritative in-process sensitive-handle revocation state | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #46 at exact head `86ce4bc1c11c270dc532593d673c42bd6f623d74`; CI and CodeRabbit are green. It adds typed first-revocation-wins state but no durable broker, cross-process transactionality, protected-value resolution, KMS, or persistence. | +| #54 | Recheck resolution freshness at socket use | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #50 at exact head `ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e`; CI and CodeRabbit are green. `connect_at` revalidates freshness immediately before socket I/O and the compatibility path derives elapsed monotonic time; no resolver, DNS lookup, proxy/PAC or wall-clock authority is added. | +| #55 | Bind opaque sensitive-value handle use to a non-transferable audience | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #53. Current exact head `09b9f4e45e6f4d177e7ed11d39ed3e6f7d267082` applies the canonical rustfmt repair after run `31419061773` proved exact production coverage success but failed only formatting on predecessor head `490178b465b44996361371bd80433d09b1bdbe93`; exact-head CI run `31419594448` is in progress. The primitive still relies on a future trusted broker to derive audience from authenticated workload/service identity. | ## Historical lineage @@ -37,3 +41,4 @@ PR #11 is a historical HTTP predecessor, not current implementation authority. I 3. A Draft or stacked PR remains dependency-gated even if its own checks pass. 4. Exact heads and workflow run identifiers are volatile evidence and belong in dated appendices such as this one, not in timeless Architecture/PRD/TRD claims. 5. After an active PR integrates, canonical PRD/TRD/Architecture/UML/ERD/traceability must be re-evaluated from the new protected-main head before reclassifying the capability. +6. A formatting-only or metadata-only correction invalidates predecessor-head exactness: current-head checks must be rerun before a lane is called gate-clean. From 57bcd020aa96c035ce43ab75a68416f4e5487a31 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 03:38:01 +0900 Subject: [PATCH 067/130] test(docs): keep active maturity evidence current --- tests/test_documentation_fitness_contract.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index bf0db775..8a4eaed0 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -174,6 +174,20 @@ def test_semantic_observation_lane_stays_non_shipped_and_provenance_bound(self) self.assertIn("active PR #52", prd) self.assertIn("not a browser observation adapter", prd) + def test_active_pr_maturity_appendix_tracks_current_dependency_stacks(self) -> None: + """Volatile evidence must retain the current browser/network/sensitive stacks explicitly.""" + appendix = (DOCS_ROOT / "evidence" / "2026-08-10-active-pr-maturity.md").read_text( + encoding="utf-8" + ) + for marker in ("| #52 |", "| #53 |", "| #54 |", "| #55 |"): + with self.subTest(marker=marker): + self.assertIn(marker, appendix) + self.assertIn("authenticated workload/service identity", appendix) + self.assertIn( + "formatting-only or metadata-only correction invalidates predecessor-head exactness", + appendix, + ) + def test_prd_does_not_restore_superseded_active_pr_claims(self) -> None: """Historical feature branches must not reappear as the current implementation lane.""" prd = (DOCS_ROOT / "PRD.md").read_text(encoding="utf-8") From b1e4d42021c4682a092200d047d74f0af76e7737 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 03:39:11 +0900 Subject: [PATCH 068/130] docs: trace socket-use freshness enforcement --- .../resolution-freshness-authority.md | 58 ++++++++++++------- 1 file changed, 37 insertions(+), 21 deletions(-) diff --git a/docs/traceability/resolution-freshness-authority.md b/docs/traceability/resolution-freshness-authority.md index b88bff95..edb91e4b 100644 --- a/docs/traceability/resolution-freshness-authority.md +++ b/docs/traceability/resolution-freshness-authority.md @@ -3,19 +3,22 @@ - **Documentation status:** Active-PR traceability - **Protected-main capability status:** **PARTIAL** - **Primitive implementation lane:** PR #47, `feat/resolution-freshness-authority-main` -- **First-party consumer lane:** PR #50, `feat/network-consume-resolution-freshness` +- **First-party planning consumer lane:** PR #50, `feat/network-consume-resolution-freshness` +- **Socket-use freshness lane:** PR #54, `fix/network-resolution-freshness-at-use` - **Governing existing decision boundary:** ADR 0004 and the protected-main destination/rebinding authority model -- **Buyer-visible gap:** bind the interval between a validated resolution answer and socket use so DNS-rebinding/TOCTOU exposure is explicit and fail-closed +- **Buyer-visible gap:** bind the interval between a validated resolution answer and actual socket use so DNS-rebinding/TOCTOU exposure is explicit and fail-closed ## Truth boundary -Protected `main` already classifies, approves, pins, and non-expansively revalidates resolved destination addresses. It does **not** yet require a time-bounded resolution authority at the first-party direct-socket planning boundary. +Protected `main` already classifies, approves, pins, and non-expansively revalidates resolved destination addresses. It does **not** yet require a time-bounded resolution authority through the entire first-party direct-socket path. PR #47 exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` contains the reusable production `FreshResolutionSnapshot` primitive and has terminal successful CI/security/SAST/exact-coverage evidence. That primitive is therefore **IMPLEMENTED_ON_ACTIVE_PR** evidence only; it is not protected-main truth. -PR #50 exact head `f8b43bc94444986ab23aa4ef3086e446a0b39295` now implements the dependent first-party consumer boundary. It keeps the untimed `ConnectionPlan` internal to `originweave-network`, exposes `FreshConnectionPlan` as the ordinary direct-socket planner, requires a `FreshResolutionSnapshot` plus caller-supplied trusted monotonic current time, rejects expired authority before socket I/O, and migrates the existing TLS integration helpers through that same fresh boundary. Exact-head CI run `31408474576` passes repository contracts, formatting, workspace check/tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status is success. +PR #50 exact head `f8b43bc94444986ab23aa4ef3086e446a0b39295` implements the dependent first-party planning boundary. It keeps the untimed `ConnectionPlan` internal to `originweave-network`, exposes `FreshConnectionPlan` as the ordinary direct-socket planner, requires a `FreshResolutionSnapshot` plus caller-supplied trusted monotonic current time, rejects expired authority at plan authorization, and migrates existing TLS integration helpers through that same fresh boundary. Exact-head CI run `31408474576` passes repository contracts, formatting, workspace check/tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status is success. -Both #47 and #50 remain **IMPLEMENTED_ON_ACTIVE_PR**, not shipped. PR #50 is correctly Draft because it is stacked on #47 and must not integrate before its prerequisite. The overall protected-main resolution-to-socket interval therefore remains **PARTIAL** until dependency-ordered integration and fresh protected-main acceptance prove the same authority chain without an untimed public bypass. +PR #54 exact head `ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e` closes a later plan-to-connect TOCTOU discovered after #50: freshness checked only when the plan was created could expire before socket I/O. The active lane retains the exact `FreshResolutionSnapshot` in the single-use plan, exposes `connect_at(current_time)` to re-run freshness immediately before socket use under the caller's trusted monotonic clock domain, and keeps the legacy `connect()` surface fail-closed by adding process-local monotonic elapsed time to the original authorization checkpoint before delegating to `connect_at`. CI run `31418337788` passes repository contracts, formatting, workspace checks/tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status is successful. + +PRs #47, #50 and #54 remain **IMPLEMENTED_ON_ACTIVE_PR**, not shipped. #50 remains dependency-gated on #47 and #54 remains dependency-gated on #50. The overall protected-main resolution-to-socket interval therefore remains **PARTIAL** until dependency-ordered integration and fresh protected-main acceptance prove the same authority chain without an untimed planning or delayed-use bypass. ## Current exact-head RCA @@ -27,7 +30,7 @@ That was a realistic DNS-rebinding case rather than an impossible instrumentatio The freshness ceiling is executable active-PR evidence rather than an aspirational requirement. `crates/originweave-destination/src/resolution.rs` owns `MAX_RESOLUTION_VALIDITY: Duration = Duration::from_secs(30)`. `FreshResolutionSnapshot::approve` rejects `Duration::ZERO` and any interval above that constant with `DestinationError::InvalidResolutionValidity`; `crates/originweave-destination/tests/resolution_freshness.rs::fresh_resolution_rejects_invalid_or_overflowing_validity` verifies both the zero and greater-than-30-second boundaries plus approval-time overflow. This evidence remains active-PR-only until PR #47 integrates. -### PR #50 consumer +### PR #50 planning consumer PR #50 began from exact PR #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` with a RED consumer contract requiring fresh resolution authority plus one trusted monotonic current time before direct socket planning. @@ -37,47 +40,60 @@ The corrected implementation removed `ConnectionPlan` from the public crate expo Those integration helpers were migrated to deterministic `FreshResolutionSnapshot` + `FreshConnectionPlan` fixtures with one explicit trusted monotonic clock domain. A later run `31408143459` found only missing end-of-file newlines under rustfmt; that formatting-only defect was corrected without changing the authority contract. Current exact head `f8b43bc94444986ab23aa4ef3086e446a0b39295` then passed CI run `31408474576` end to end, including exact owned function/line/region/branch coverage. -The accepted remedy is therefore now realized on the active branch: ordinary first-party direct planning cannot import the untimed planner, while the private implementation remains reusable only after `FreshConnectionPlan` performs freshness authorization. This proves the active consumer implementation, but dependency order and protected-main truth rules still prevent a shipped claim. +The accepted remedy is therefore realized on the active branch: ordinary first-party direct planning cannot import the untimed planner, while the private implementation remains reusable only after `FreshConnectionPlan` performs freshness authorization. This proves the active planning implementation, but not freshness at a later delayed socket-use instant. + +### PR #54 socket-use consumer + +PR #54 follows #50 because a plan authorized within the resolution window could be retained until that window expired and then connected. The first failing boundary was therefore no longer public planner construction; it was the time between plan authorization and the exact operating-system connect operation. + +The accepted active-branch remedy keeps the admitted freshness snapshot with the non-cloneable single-use plan and revalidates it at the socket-use boundary. `connect_at(current_time)` is the explicit deterministic path and rejects both expiry and an authorization-time regression using the existing destination error taxonomy. The compatibility `connect()` path does not freeze the old authorization timestamp: it anchors a process-local monotonic `Instant` at plan construction, adds actual elapsed time to the admitted authorization time, and delegates to `connect_at`, so delayed legacy callers cannot replay stale authority indefinitely. + +The regression suite proves explicit success, deadline expiry, trusted-time regression, unchanged connection-parameter validation, and expiry of the compatibility path with a deliberately short real monotonic interval. Current exact head `ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e` passes CI run `31418337788`. This remains active-PR evidence and does not add DNS lookup, a wall-clock authority, proxy/PAC, or a resolver service. ## Deterministic authority contract -The active work proves one continuous destination-to-socket authority chain with all of the following properties: +The active stack proves one continuous destination-to-socket authority chain with all of the following properties: 1. approval time is explicit and supplied from one trusted monotonic clock domain; 2. validity is non-zero and capped by the active implementation's repository-owned `MAX_RESOLUTION_VALIDITY` safety budget (30 seconds on PR #47 exact head), with shorter caller-selected intervals permitted; 3. the usable interval is half-open: `approved_at <= now < valid_until`; 4. use before approval, use at/after expiry, arithmetic overflow, unapproved addresses, and set expansion fail closed with typed errors; 5. the ordinary first-party socket planner no longer publicly accepts an untimed `ResolutionSnapshot` as sufficient authority on PR #50 exact head; -6. credential-free planning evidence records approval, expiry, and authorization times without introducing credentials, resolver internals, or protected values; -7. non-expanding revalidation may renew the bounded interval only while rerunning existing destination-policy validation against the newly supplied answer; and -8. the primitive and planning boundary perform no DNS lookup, wall-clock read, ambient proxy selection, TLS policy mutation, HTTP, browser control, persistence, secret, or model call. +6. a single-use plan rechecks the retained freshness authority immediately before socket I/O on PR #54 rather than assuming plan-time admission remains fresh; +7. the compatibility socket path derives a new use time from monotonic elapsed duration and therefore cannot preserve stale plan-time authority indefinitely; +8. credential-free planning evidence records approval, expiry, and authorization times without introducing credentials, resolver internals, or protected values; +9. non-expanding revalidation may renew the bounded interval only while rerunning existing destination-policy validation against the newly supplied answer; and +10. the primitive and planning/use boundaries perform no DNS lookup, wall-clock read, ambient proxy selection, TLS policy mutation, HTTP, browser control, persistence, secret, or model call. ## Architecture and ADR assessment -The primitive and its first-party consumer tighten the already Accepted destination/rebinding authority governed by ADR 0004. They do not introduce a new component, persistence owner, wire protocol, browser adapter, or trust domain. Therefore a new ADR, deployment component, or physical ERD object would be false precision at this stage. +The primitive and its first-party planning/socket consumers tighten the already Accepted destination/rebinding authority governed by ADR 0004. They do not introduce a new component, persistence owner, wire protocol, browser adapter, or trust domain. Therefore a new ADR, deployment component, or physical ERD object would be false precision at this stage. -The network-authority UML now has a stable enough durable sequence to reconcile: `resolver answer -> destination/origin validation -> fresh resolution approval -> trusted monotonic connection authorization -> exact socket candidate -> observed TCP peer -> TLS/HTTP authority`. That is a sequence refinement within the existing network-authority component graph, not a new topology. A new or superseding ADR becomes appropriate only if later integration changes ownership—for example, durable cross-process freshness state, a separate resolver service, a different trusted-clock owner, or a new externally versioned protocol. +The durable network-authority sequence is now `resolver answer -> destination/origin validation -> fresh resolution approval -> trusted monotonic plan authorization -> socket-use freshness recheck -> exact socket candidate -> observed TCP peer -> TLS/HTTP authority`. That is a sequence refinement within the existing network-authority component graph, not a new topology. A new or superseding ADR becomes appropriate only if later integration changes ownership—for example, durable cross-process freshness state, a separate resolver service, a different trusted-clock owner, or a new externally versioned protocol. ## Evidence progression | Evidence state | Allowed maturity claim | |---|---| -| Test-only consumer head with unresolved production API | intentional RED contract only; not implementation evidence | +| Test-only primitive/consumer head with unresolved production API | intentional RED contract only; not implementation evidence | | Active PR #47 production primitive + unchanged exact-head CI/security/100% coverage | `IMPLEMENTED_ON_ACTIVE_PR` for the primitive; overall protected-main path remains `PARTIAL` | | Active PR #50 adds a freshness wrapper while an ordinary untimed planner remains public | implementation progress only; bypass still makes the consumer incomplete | | Active PR #50 hides the untimed planner and exact compile evidence finds stale first-party consumers | valid structural remedy with migration still incomplete | -| Active PR #50 exact head `f8b43bc...` migrates first-party consumers and passes exact CI/coverage | `IMPLEMENTED_ON_ACTIVE_PR` for the consumer; dependency-gated and non-shipped | -| PR #47 + #50 exact heads are individually gate-clean but neither is on protected main | active-PR evidence only; no shipped claim | -| Protected-main primitive, but direct socket consumer can still bypass freshness | `PARTIAL` | -| Protected-main direct socket path requires exact fresh authority and tests prove pre-approval/expiry/rebinding behavior | `IMPLEMENTED_ON_PROTECTED_MAIN` for the bounded resolution-to-socket interval | +| Active PR #50 exact head `f8b43bc...` migrates first-party consumers and passes exact CI/coverage | `IMPLEMENTED_ON_ACTIVE_PR` for planning; delayed socket-use freshness still requires #54 | +| Active PR #54 exact head `ec81031c...` rechecks freshness immediately before socket I/O and passes exact CI/coverage | `IMPLEMENTED_ON_ACTIVE_PR` for socket-use freshness; dependency-gated and non-shipped | +| PR #47 + #50 + #54 exact heads are individually gate-clean but none are on protected main | active-PR evidence only; no shipped claim | +| Protected-main primitive/planner, but delayed socket use can outlive freshness | `PARTIAL` | +| Protected-main direct socket path requires exact fresh authority and rechecks it at use, with tests proving pre-approval/expiry/rebinding/delay behavior | `IMPLEMENTED_ON_PROTECTED_MAIN` for the bounded resolution-to-socket interval | | Browser/network adapter proves the same clock and authority chain under real navigation | additional integration/release evidence; not implied by lower-layer primitives | ## Required follow-through - keep PR #47 as active/non-shipped evidence until repository governance integrates it; - keep PR #50 Draft and dependency-gated while #47 remains active; do not transfer its green evidence to protected main; +- keep PR #54 Draft and dependency-gated while #50 remains active; do not transfer its green evidence to #50 or protected main; - preserve the structural invariant that ordinary first-party direct planning cannot import an untimed `ConnectionPlan`; -- keep PRD/TRD/traceability from calling the DNS-rebinding/TOCTOU interval closed while either prerequisite is active; -- reconcile the existing network-authority UML with the now-stable durable freshness sequence, without encoding temporary branch-only identifiers as timeless architecture; +- preserve the socket-use invariant that a delayed call cannot reuse plan-time freshness without a new trusted monotonic use-time check; +- keep PRD/TRD/traceability from calling the DNS-rebinding/TOCTOU interval closed while any prerequisite remains active; +- reconcile the existing network-authority UML with the stable durable freshness sequence without encoding temporary branch-only identifiers as timeless architecture; - retain the existing conceptual ERD unless a real persistence owner is introduced; and -- after both layers integrate, rerun protected-main operational/release acceptance before promoting the capability maturity. +- after all three layers integrate, rerun protected-main operational/release acceptance before promoting capability maturity. From 1c605bbffeffad46ad104b453ee65fdd812dcb42 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 03:41:22 +0900 Subject: [PATCH 069/130] test(docs): retain socket-use freshness trace --- tests/test_freshness_traceability_contract.py | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tests/test_freshness_traceability_contract.py b/tests/test_freshness_traceability_contract.py index d12fb9e6..a9e0e4f0 100644 --- a/tests/test_freshness_traceability_contract.py +++ b/tests/test_freshness_traceability_contract.py @@ -36,6 +36,15 @@ def test_active_freshness_traces_preserve_protected_main_maturity(self) -> None: self.assertIn("IMPLEMENTED_ON_ACTIVE_PR", text) self.assertIn("not protected-main truth", text) + def test_resolution_trace_requires_socket_use_freshness_not_only_plan_time(self) -> None: + """The DNS freshness trace must retain the delayed-use boundary added by PR #54.""" + text = (TRACEABILITY / "resolution-freshness-authority.md").read_text(encoding="utf-8") + self.assertIn("Socket-use freshness lane:** PR #54", text) + self.assertIn("connect_at(current_time)", text) + self.assertIn("rechecks the retained freshness authority immediately before socket I/O", text) + self.assertIn("delayed call cannot reuse plan-time freshness", text) + self.assertIn("#47 + #50 + #54", text) + if __name__ == "__main__": unittest.main() From e054442ee4aa5c8d0503839863c17295f88e396c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 03:43:20 +0900 Subject: [PATCH 070/130] test(docs): enforce complete maturity and UML contracts --- tests/test_product_documentation_contract.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tests/test_product_documentation_contract.py b/tests/test_product_documentation_contract.py index a22ccdbb..1313189e 100644 --- a/tests/test_product_documentation_contract.py +++ b/tests/test_product_documentation_contract.py @@ -218,6 +218,11 @@ def test_hourly_automation_adr_requires_exit_sweep(self) -> None: def test_uml_and_erd_are_diagram_as_code(self) -> None: """Architecture flows and the conceptual domain model must be reviewable in Git.""" uml = (ROOT / "docs/uml/README.md").read_text(encoding="utf-8") + authority_view = ROOT / "docs/uml/extension-authority.md" + self.assertTrue(authority_view.is_file()) + self.assertIn("](extension-authority.md)", uml) + self.assertIn("```mermaid", authority_view.read_text(encoding="utf-8")) + erd = (ROOT / "docs/erd/README.md").read_text(encoding="utf-8") self.assertGreaterEqual(uml.count("```mermaid"), 8) self.assertIn("sequenceDiagram", uml) @@ -316,6 +321,9 @@ def test_traceability_labels_conversation_derived_future_work(self) -> None: "PARTIAL", "ACCEPTED_ARCHITECTURE", "PLANNED", + "RESEARCH_ONLY", + "SUPERSEDED", + "OUT_OF_SCOPE", "conversation-derived", "docs/doctoring.md", "Active-PR behavior is never protected-main truth", From d80305a1d2798e70e89f5f5a07b73d2e6eeb78a0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 03:44:29 +0900 Subject: [PATCH 071/130] test(docs): bind active PR evidence to exact maturity rows --- tests/test_documentation_fitness_contract.py | 46 ++++++++++++++------ 1 file changed, 32 insertions(+), 14 deletions(-) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index 8a4eaed0..cfaacba1 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -78,6 +78,15 @@ def _parse_adr_index(text: str) -> dict[str, str]: return mapping +def _active_pr_row(text: str, pr_number: int) -> str: + """Return one exact active-PR evidence row from the dated maturity appendix.""" + prefix = f"| #{pr_number} |" + rows = [line for line in text.splitlines() if line.startswith(prefix)] + if len(rows) != 1: + raise AssertionError(f"expected exactly one maturity row for PR #{pr_number}, got {len(rows)}") + return rows[0] + + class DocumentationFitnessContractTests(unittest.TestCase): """Keep architecture discovery and implementation-maturity metadata coherent.""" @@ -147,30 +156,39 @@ def test_proposed_adr_provenance_does_not_promote_branch_to_protected_main(self) self.assertIn("exist only on this documentation branch until it integrates", adr_index) def test_current_replacement_lanes_are_not_promoted_to_protected_main(self) -> None: - """Canonical docs must distinguish active implementation from shipped implementation.""" + """Each active implementation lane must carry its own exact non-shipped maturity mapping.""" assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") traceability = (DOCS_ROOT / "traceability" / "README.md").read_text(encoding="utf-8") - for marker in ( - "PR #37", - "PR #40", - "PR #43", - "PR #52", - "issue #10", - "issue #27", - "issue #28", - ): + appendix = (DOCS_ROOT / "evidence" / "2026-08-10-active-pr-maturity.md").read_text( + encoding="utf-8" + ) + + for pr_number in (37, 40, 43, 52): + row = _active_pr_row(appendix, pr_number) + with self.subTest(pr_number=pr_number): + self.assertIn("**IMPLEMENTED_ON_ACTIVE_PR**", row) + self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", row) + + for marker in ("issue #10", "issue #27", "issue #28"): with self.subTest(marker=marker): self.assertTrue(marker in assessment or marker in traceability) + self.assertIn("IMPLEMENTED_ON_ACTIVE_PR", traceability) self.assertIn("IMPLEMENTED_ON_PROTECTED_MAIN", traceability) self.assertIn("Active-PR behavior is never protected-main truth", traceability) def test_semantic_observation_lane_stays_non_shipped_and_provenance_bound(self) -> None: - """The semantic observation value object must not be documented as a real browser adapter.""" - assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") + """The semantic observation value object must stay active-only and distinct from browser I/O.""" + appendix = (DOCS_ROOT / "evidence" / "2026-08-10-active-pr-maturity.md").read_text( + encoding="utf-8" + ) prd = (DOCS_ROOT / "PRD.md").read_text(encoding="utf-8") - self.assertIn("PR #52", assessment) - self.assertIn("evidence channel", assessment) + row = _active_pr_row(appendix, 52) + + self.assertIn("**IMPLEMENTED_ON_ACTIVE_PR**", row) + self.assertIn("semantic-node observation", row) + self.assertIn("no browser I/O or action dispatch", row) + self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", row) self.assertIn("active PR #52", prd) self.assertIn("not a browser observation adapter", prd) From 8a3828d3110fc44692cfb5eace37160090d0a2af Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 03:47:17 +0900 Subject: [PATCH 072/130] docs: refresh audience and evidence provenance --- docs/evidence/2026-08-10-active-pr-maturity.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index 5b99efa5..da40f70d 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -1,6 +1,8 @@ -# Active pull-request maturity evidence — 2026-08-10 +# Active pull-request maturity evidence series — opened 2026-08-10 -> Last refreshed: 2026-08-11 +- **Evidence series opened:** 2026-08-10 +- **Last refreshed:** 2026-08-11 +- **Filename semantics:** the date in this filename is the date this evidence series was opened; refresh provenance is recorded separately and is never backdated to match the filename. This dated appendix records volatile implementation evidence that must not be embedded as timeless architecture truth. Protected `main` remains the only shipped-code authority. Active pull requests are implementation evidence only until they integrate and protected-main acceptance is re-established. @@ -28,7 +30,7 @@ This dated appendix records volatile implementation evidence that must not be em | #52 | Bounded semantic-node observation value contract | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #40 at exact head `661091dcc52f0a52e7a6a636b0f4bcea5469f82d`; CI and Manifest V3 Compatibility are green, provenance must be non-empty, and the value contract performs no browser I/O or action dispatch. | | #53 | Authoritative in-process sensitive-handle revocation state | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #46 at exact head `86ce4bc1c11c270dc532593d673c42bd6f623d74`; CI and CodeRabbit are green. It adds typed first-revocation-wins state but no durable broker, cross-process transactionality, protected-value resolution, KMS, or persistence. | | #54 | Recheck resolution freshness at socket use | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #50 at exact head `ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e`; CI and CodeRabbit are green. `connect_at` revalidates freshness immediately before socket I/O and the compatibility path derives elapsed monotonic time; no resolver, DNS lookup, proxy/PAC or wall-clock authority is added. | -| #55 | Bind opaque sensitive-value handle use to a non-transferable audience | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #53. Current exact head `09b9f4e45e6f4d177e7ed11d39ed3e6f7d267082` applies the canonical rustfmt repair after run `31419061773` proved exact production coverage success but failed only formatting on predecessor head `490178b465b44996361371bd80433d09b1bdbe93`; exact-head CI run `31419594448` is in progress. The primitive still relies on a future trusted broker to derive audience from authenticated workload/service identity. | +| #55 | Bind opaque sensitive-value handle use to a non-transferable audience | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #53 head `86ce4bc1c11c270dc532593d673c42bd6f623d74`. Test-only head `95f0f1e418024f5dbe7aa613e5fd1e9d88a9417a` and CI run `31419991170` proved a real regression: audience binding had caused a revoked handle with later mismatched policy state to return `ScopeMismatch` instead of authoritative `Revoked`. Current exact head `b83c10977a0d0103fb0307222720f70c6dc7cf3d` restores revocation precedence while retaining audience binding and passes CI run `31420279920`, including repository contracts, rustfmt, all workspace tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status is success. A future trusted broker must still derive the audience from authenticated workload/service identity. | ## Historical lineage From dd51ef8f0cd2dd9ea34b83b7af3a82915ebd5194 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 05:10:58 +0900 Subject: [PATCH 073/130] docs: refresh active implementation maturity through PR 56 --- docs/evidence/2026-08-10-active-pr-maturity.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index da40f70d..6d163931 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -27,10 +27,11 @@ This dated appendix records volatile implementation evidence that must not be em | #49 | Ephemeral Agent Task profile-isolation regression | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43 at exact head `96a4e949d96b5794ef473ccf813987b8e69ea566`; CI is green but dependency-gated and not independently integrable before #43. | | #50 | First-party network consumption of resolution freshness | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392`. Exact head `f8b43bc94444986ab23aa4ef3086e446a0b39295` structurally hides the untimed public network planner, migrates first-party TLS integration helpers through `FreshConnectionPlan`, and passes CI run `31408474576` including exact owned function/line/region/branch coverage; CodeRabbit exact-head status is success. Dependency order, not implementation incompleteness, keeps the PR Draft. | | #51 | Browser-task runtime telemetry value object | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `1c85b966087191f52b4a709a2822b2a53fb0e2fa` is CI/Security/SAST/CodeRabbit clean and Ready for review; it carries validated measurements but performs no OS/Chromium sampling itself. | -| #52 | Bounded semantic-node observation value contract | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #40 at exact head `661091dcc52f0a52e7a6a636b0f4bcea5469f82d`; CI and Manifest V3 Compatibility are green, provenance must be non-empty, and the value contract performs no browser I/O or action dispatch. | +| #52 | Bounded semantic-node observation and relationship value contract | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #40. Test-only exact head `b1bd4f8bd3b5597dac8ad3c40530beba7288e8ca` intentionally proved the missing bounded parent/child relationship boundary by failing compilation and also exposed one canonical rustfmt delta. Current exact head `dbe75ca557fc6f501b0e54846c81dffa58812ced` adds at most 128 ordered child relationships, optional parent linkage, exact session/context/origin/document authority matching, self/duplicate rejection and stable credential-free errors. Current-head CI is still running, so predecessor-head success is not promoted to exact-head gate evidence. The value contract still performs no browser I/O or action dispatch. | | #53 | Authoritative in-process sensitive-handle revocation state | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #46 at exact head `86ce4bc1c11c270dc532593d673c42bd6f623d74`; CI and CodeRabbit are green. It adds typed first-revocation-wins state but no durable broker, cross-process transactionality, protected-value resolution, KMS, or persistence. | | #54 | Recheck resolution freshness at socket use | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #50 at exact head `ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e`; CI and CodeRabbit are green. `connect_at` revalidates freshness immediately before socket I/O and the compatibility path derives elapsed monotonic time; no resolver, DNS lookup, proxy/PAC or wall-clock authority is added. | -| #55 | Bind opaque sensitive-value handle use to a non-transferable audience | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #53 head `86ce4bc1c11c270dc532593d673c42bd6f623d74`. Test-only head `95f0f1e418024f5dbe7aa613e5fd1e9d88a9417a` and CI run `31419991170` proved a real regression: audience binding had caused a revoked handle with later mismatched policy state to return `ScopeMismatch` instead of authoritative `Revoked`. Current exact head `b83c10977a0d0103fb0307222720f70c6dc7cf3d` restores revocation precedence while retaining audience binding and passes CI run `31420279920`, including repository contracts, rustfmt, all workspace tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status is success. A future trusted broker must still derive the audience from authenticated workload/service identity. | +| #55 | Bind opaque sensitive-value handle use to a non-transferable audience | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #53 head `86ce4bc1c11c270dc532593d673c42bd6f623d74`. Test-only head `95f0f1e418024f5dbe7aa613e5fd1e9d88a9417a` and CI run `31419991170` proved a real regression: audience binding had caused a revoked handle with later mismatched policy state to return `ScopeMismatch` instead of authoritative `Revoked`. Current exact head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8` restores revocation precedence, retains audience binding, and adds a synchronized one-use concurrency regression. CI run `31421061134` passes repository contracts, rustfmt, locked workspace check, all workspace tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status is success. A future trusted broker must still derive the audience from authenticated workload/service identity. | +| #56 | Real pinned-Chromium bookmark mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43. Exact predecessor head `50111a845927bd6e657063b85ce76da45c13436e` already passed the real Manifest V3 browser workflow but CI exposed one stale repository contract that still required read-only `chrome.bookmarks.getTree`. Current exact head `e1099e35ac000c7bf87ea75666cfdd928a386370` aligns that contract with the bounded create → get → remove lifecycle; CI run `31427219564`, Manifest V3 Compatibility run `31427220684`, and CodeRabbit exact-head status all succeed. This is compatibility evidence only: it grants no OriginWeave Agent capability and does not complete issue #27's full extension matrix. | ## Historical lineage From 8a1d09a39e6a0de9217c859c7cbdf9a969baef2b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 05:15:11 +0900 Subject: [PATCH 074/130] docs: reconcile latest runtime and compatibility evidence --- docs/DOCUMENTATION_FITNESS.md | 118 +++++++++++++++++++--------------- 1 file changed, 66 insertions(+), 52 deletions(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index c88d4d52..6e725e2f 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -9,7 +9,7 @@ **DESIGN-SUFFICIENT** means the repository has a coherent product, technical, architecture, decision, diagram, data-model, security, testing, operability, protocol and release graph sufficient to implement and review OriginWeave without reconstructing product intent from chat history. -**PROTECTED-MAIN-PARTIAL** now means something narrower than it did at the beginning of this reconciliation: this PR has repaired the known PRD/TRD/traceability/index semantic drift on its own branch, but protected `main` does not receive those repairs until this documentation line passes exact-head governance and integrates. Active feature PRs also remain non-shipped evidence. The branch therefore must not relabel protected main as documentation-closed before integration. +**PROTECTED-MAIN-PARTIAL** means the design graph is sufficient, while protected `main` still lacks the canonical reconciliation and several active implementation slices. Active pull requests are implementation evidence only. Neither a green feature branch nor a Proposed ADR becomes shipped truth through documentation wording. File existence alone is never sufficient. An artifact can exist and still be stale, contradictory, overclaiming, underclaiming, or disconnected from executable evidence. @@ -17,21 +17,21 @@ File existence alone is never sufficient. An artifact can exist and still be sta | Documentation family | Fitness | Current evidence / remaining boundary | |---|---|---| -| PRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | HTTP names active replacement PR #37 while retaining `Planned` protected-main status; historical PR #11 is predecessor lineage. Purpose-bound sensitive disclosure is an Implemented protected-main policy kernel while broker/storage/lifecycle remain Planned under issue #10; active PRs #45/#46 add bounded non-shipped lifecycle/use-state evidence. Resolution freshness is active in #47 with first-party network consumption stacked in #50; neither is protected-main truth. Browser task telemetry in #51 and semantic observation value work in active PR #52 are prerequisites for issue #28, not shipped Chromium runtime evidence. MV3 remains a Planned complete compatibility program while protected-main and active-PR evidence are separately identified. | -| TRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Implementation inventory separates protected-main status from active/non-shipped evidence instead of composite labels. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth. #47/#50 tighten resolution-to-socket freshness only on active work; #48 is a revocation-material freshness primitive; #51 is telemetry structure without sampling; #52 is a bounded semantic-observation value contract without browser I/O. | -| Root Architecture | **PRESENT-CURRENT with follow-up** | Correct Chromium compatibility-kernel + Rust control-plane direction, explicit authority stack and protected-main truth rule. #47/#50 tighten ADR 0004; #45/#46 remain within ADR 0007; #52 stays within the existing structured-observation and browser-authority decisions. #48/#51/#52 add no deployed service, persistence owner or new trust domain. Reconcile implementation-facing details after these lanes integrate or the real Chromium vertical slice stabilizes. | -| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Indexes Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 without promoting Proposed decisions. Identifier allocation is treated as a cross-main-and-active-work reservation problem. No new ADR is justified solely by #45/#46, #47/#50, #48, #51 or #52 because those lanes remain inside existing authority decisions and introduce no new durable service, trust domain, persistence owner or externally versioned protocol. | -| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 covers MV3 compatibility vs extension-to-Agent authority; Proposed ADR 0014 covers ADR acceptance governance. Their presence does not imply Acceptance. HTTP ADRs in PR #37 remain active-PR evidence. #47/#50 are implementation evidence under ADR 0004, #45/#46 under ADR 0007, and #52 remains bounded by ADR 0010 plus the structured-observation decision rather than creating a new architecture boundary. | -| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. This PR adds `uml/extension-authority.md`. The network-authority sequence should be reconciled once #50 stabilizes. Active #52 supplies a value contract for the already-planned semantic-observation stage, but no real adapter/process boundary, so a new topology diagram would overstate maturity. Detailed real-Chromium sequence remains deferred until issue #28 contracts stabilize. | -| Conceptual ERD/domain model | **PRESENT-CURRENT** | Explicitly conceptual unless an adapter/schema is separately implemented; distinguishes current value/evidence concepts from planned durable records and adapter-owned representations. #45/#46/#47/#48/#50/#51/#52 introduce no physical persistence owner, so adding tables merely to represent active in-memory/value primitives would be false architecture. | -| Traceability | **REPAIRED IN THIS CHANGE with volatile evidence refresh required** | Separates `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`. Current active evidence includes #37/#40/#43/#45/#46/#47/#48/#49/#50/#51/#52 and cannot be promoted to protected-main truth merely because an individual PR is green. | -| Threat model / Security | **PRESENT-CURRENT with follow-up** | Covers major untrusted-content, network, secret, provenance and extension risks. #47/#50 narrow DNS-rebinding/TOCTOU only on active work; #48 proves signed-window freshness only; #46 narrows stale-count/replay only in-process. #52 requires a non-empty explicit evidence-channel provenance set so a semantic observation cannot exist without naming how it was observed; evidence channel and advertised node actions remain descriptive and grant no execution authority. | -| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code function/line/region/branch coverage, rustdoc and realistic boundary testing are explicit. Active lanes use intentional RED boundaries followed by narrow production changes and exact-head proof. #52 includes an intentional provenance regression proving empty evidence-channel observations fail closed. Real browser and MV3 evidence remain pinned-browser executable evidence rather than source-text claims. | -| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. #45/#46/#47/#48/#51/#52 intentionally add no new durable service or daemon, so no runbook/SLO/RPO/RTO is fabricated. #50 changes first-party socket authority composition but not deployment topology. | -| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented; much browser adapter implementation remains Planned. External protocol identifiers are never durable authority by themselves. #52 is an internal reusable semantic-observation value API bound to an OriginWeave-owned node handle and explicit evidence channel; it is not a BiDi/CDP/WebMCP wire contract and not a browser observation adapter. | -| Release / rollback / provenance | **PRESENT-CURRENT** | Feature-branch green checks cannot become release readiness. Release remains bound to one exact integrated protected head and applicable CI/security/coverage/package/provenance/recovery/compatibility/review evidence. Active stacks such as #40→#52, #47→#50 and #43→#49 must preserve dependency order; predecessor-head success cannot satisfy a later head. | -| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. Active #45/#46 add bounded sensitive-handle primitives; #47/#48/#50/#51 add timestamps/measurements or authority metadata. #52 contains bounded semantic strings and provenance classifications but no protected-value broker/storage path. Trusted broker storage, cross-process transactionality, revocation, protected-value resolution/fill, compensation, encryption/KMS and model-disclosure lifecycle remain open under issue #10. | -| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references are kept in doctoring documents with draft/experimental status distinguished from final normative standards. | +| PRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Protected-main requirements remain distinct from active evidence. #37 is the current bounded-HTTP replacement; #45→#46→#53→#55 narrows sensitive-handle lifecycle, reservation, revocation and audience admission without creating the trusted broker; #47→#50→#54 narrows resolution freshness through the socket-use boundary; #51/#52 are browser-runtime prerequisites, not a real Chromium adapter; #43/#49/#56 are MV3 compatibility evidence, not Agent authority. | +| TRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Implementation inventory uses one protected-main status plus separate active/non-shipped evidence. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth. Active value objects and compatibility fixtures do not imply deployed services or complete runtime paths. | +| Root Architecture | **PRESENT-CURRENT with follow-up** | Chromium compatibility kernel + Rust authority-bearing control plane remains correct. #47/#50/#54 tighten ADR 0004; #45/#46/#53/#55 remain inside ADR 0007; #40/#52 remain inside browser authority/structured-observation decisions; #43/#49/#56 remain compatibility work under issue #27. No later lane introduces a new trust domain, persistence owner or deployed component. | +| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 are discoverable without promoting Proposed decisions. Repository-scoped identifiers are reserved across protected main and active work. | +| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 separates MV3 compatibility from extension-to-Agent authority; Proposed ADR 0014 governs ADR acceptance. #53/#54/#55/#56 refine existing decisions and do not independently justify new ADRs. | +| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. `uml/extension-authority.md` closes the permission-vs-Agent-authority gap. Network freshness should reflect the socket-use recheck after #54 integrates; detailed real-Chromium sequence remains deferred until issue #28 stabilizes. | +| Conceptual ERD/domain model | **PRESENT-CURRENT** | The ERD remains explicitly conceptual unless a real persistence owner/schema is implemented. #45/#46/#47/#48/#50/#51/#52/#53/#54/#55/#56 add no OriginWeave-owned durable store, so manufacturing tables for in-memory/value/fixture primitives would be false architecture. | +| Traceability | **REPAIRED IN THIS CHANGE with volatile evidence refresh required** | Uses `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`. The dated maturity appendix carries volatile exact heads for current active lanes through #56. | +| Threat model / Security | **PRESENT-CURRENT with follow-up** | Untrusted content, network, secret, provenance and extension risks are covered. #54 narrows resolution-to-socket TOCTOU only on active work; #48 is revocation-material freshness only; #53/#55 narrow handle revocation/audience misuse only in process; #52 binds semantic relationships to exact browser authority. None creates a broader authority grant. | +| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code function/line/region/branch coverage, rustdoc and realistic boundary testing remain explicit. Active work uses intentional RED evidence followed by narrow production changes. #52's relationship boundary was compile-time RED before production implementation; #56 proved a stale compatibility contract against a real browser workflow. | +| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. Later active lanes add no new daemon/service, so no SLO/RPO/RTO or runbook is fabricated. First-party socket timing and browser fixture cleanup remain implementation concerns within existing runtime boundaries. | +| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented. #52 is an internal authority-bound semantic-observation API, not a BiDi/CDP/WebMCP wire protocol; #55 is an in-process policy API, not authenticated service identity; #56 is a compatibility fixture, not a product protocol. | +| Release / rollback / provenance | **PRESENT-CURRENT** | Release remains bound to one exact integrated protected head. Active stacks #40→#52, #47→#50→#54, #45→#46→#53→#55, and #43→#49/#56 must preserve dependency order; predecessor-head success cannot satisfy a later head. | +| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. #53 adds first-revocation-wins in-process state and #55 adds audience binding, but authenticated workload identity, durable broker storage, protected-value resolution/fill, KMS, cross-process transactionality, compensation, retention and model-disclosure lifecycle remain open under issue #10. | +| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references distinguish draft/experimental material from final normative standards. | ## 3. Reconciliation findings and resolution state @@ -45,72 +45,80 @@ Protected-main PRD previously named historical PR #11 as active HTTP evidence. C Protected main contains a purpose-bound sensitive-data policy/evidence foundation governed by Accepted ADR 0007, while the complete trusted broker remains unimplemented. -Two newer active lanes provide narrower non-shipped evidence: +The current active dependency chain is #45 → #46 → #53 → #55: -- PR #45 records credential-free handle lifecycle evidence in `originweave-evidence` without storing protected values; and -- PR #46 adds `SensitiveHandleUseState`, an in-process authoritative reservation count in `originweave-policy` that increments only after existing exact-scope/classification/expiry/use-limit admission and does not trust a reservation caller to supply the prior-use count. +- #45 records credential-free handle lifecycle evidence without storing protected values; +- #46 adds an in-process authoritative reservation count and removes caller authority over the prior-use count; +- #53 adds typed first-revocation-wins in-process state; and +- #55 binds handle admission to a bounded non-transferable audience and proves synchronized one-use contention while retaining revocation precedence. -PR #46's mutable-borrow serialization is deliberately **not** described as durable or cross-process atomic broker enforcement. It stores neither the opaque token nor protected data and does not implement revocation, transactionally durable reservation, value resolution/fill, compensation, encryption/KMS, retention, or model/provider/region disclosure policy. +The audience string accepted by the value/policy primitive is **not authentication**. A future trusted broker must derive audience from authenticated workload/service identity rather than caller-controlled input. Likewise, mutable-borrow or externally synchronized one-process serialization is not durable/cross-process atomicity. -**Resolved on this documentation branch:** PRD/TRD/traceability may identify #45/#46 as `IMPLEMENTED_ON_ACTIVE_PR`/partial evidence while the complete broker/runtime stays `Planned` under issue #10. Root Architecture, UML and ERD do not gain fictitious service/database boundaries before those boundaries actually exist. +**Resolved on this documentation branch:** these lanes may be represented as `IMPLEMENTED_ON_ACTIVE_PR` evidence while the complete broker/runtime stays `Planned` under issue #10. They do not justify a fictitious broker process, KMS path, database table, transaction manager, browser-fill adapter, new deployment topology or physical ERD entity. ### 3.3 Manifest V3 compatibility -Protected main has executable pinned-Chromium evidence for service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart persistence and repeatability. Active PR #43 adds real bounded downloads evidence; stacked PR #49 adds a regression for per-trial ephemeral profile isolation. Issue #27 remains open for the complete compatibility/release matrix and additional managed/native-messaging boundaries. +Protected main has executable pinned-Chromium evidence for service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart persistence and repeatability. Active #43 adds bounded downloads compatibility; #49 adds per-trial ephemeral-profile isolation; #56 proves a bounded real bookmark mutation lifecycle using `chrome.bookmarks.create` → `get` → `remove` with cleanup while retaining history coverage. -**Resolved on this documentation branch:** PRD/TRD/traceability represent complete compatibility as Planned while separately naming partial protected-main evidence and active-PR evidence. Proposed ADR 0013 separates compatibility evidence from Agent-authority evidence. #49 must not be represented as protected-main behavior while its #43 prerequisite remains active. +PR #56 also exposed and repaired a repository-contract drift: the real browser workflow already exercised mutation successfully while a Python source contract still required historical read-only `chrome.bookmarks.getTree`. + +**Resolved on this documentation branch:** complete compatibility remains Planned under issue #27. #43/#49/#56 are active compatibility evidence only. Proposed ADR 0013 remains the authority separator: Chromium permission or browser compatibility success is not an OriginWeave Agent capability, policy grant, approval or protected-value authority. ### 3.4 Browser identifier authority -Protected main contains session/context/document/node authority foundations under Accepted ADR 0010. Active PR #40 exact head `9e635e80e9813a1d2a9c408155d52221b76eeed3` owns a bounded registry mapping protocol-local identifiers into that authority model and is active/non-shipped evidence. +Protected main contains session/context/document/node authority foundations under Accepted ADR 0010. Active #40 owns a bounded registry that maps protocol-local identifiers into that authority model and remains active/non-shipped evidence. -**Resolved on this documentation branch:** PRD/TRD/traceability identify the protected-main core foundation separately from #40 active registry evidence. Detailed adapter-sequence UML remains deferred until executable browser adapter contracts stabilize. +**Resolved on this documentation branch:** protected-main foundations and active registry evidence remain separate. Detailed adapter-sequence UML remains deferred until executable browser adapter contracts stabilize. ### 3.5 ADR discoverability and identifier allocation -The prior index omitted Accepted ADRs 0007, 0008 and 0010 and Proposed ADR 0009. During this reconciliation, candidate ADR numbers 0011/0012 were also found to be reserved by active PR #37. +The earlier index omitted existing ADRs, and candidate ADR identifiers 0011/0012 were already reserved by active #37. -**Resolved on this documentation branch:** lifecycle indexes are complete for the branch, extension/governance decisions use non-colliding 0013/0014, and repository-scoped collision-sensitive identifiers are reserved across protected main plus active work rather than allocated from main alone. +**Resolved on this documentation branch:** lifecycle indexes are complete for the branch, extension/governance decisions use non-colliding 0013/0014, and collision-sensitive identifiers are reserved across protected main plus active work. ### 3.6 Documentation contract parser The first fitness contract accepted only bare lifecycle metadata, while Accepted ADR 0007 legitimately contains a descriptive suffix after `Accepted`. -**Resolved on this documentation branch:** the parser reads the leading supported lifecycle token and accepts repository-valid descriptive suffixes without accepting unknown lifecycle states. +**Resolved on this documentation branch:** the parser validates the leading supported lifecycle token while accepting repository-valid descriptive suffixes and rejecting unknown lifecycle states. ### 3.7 Initial UML audit false positive The first audit incorrectly called resource-pressure and hourly automation views missing. Protected-main UML already contained them. -**Resolved on this documentation branch:** the assessment recognizes those views and adds only the genuinely missing extension-permission-to-Agent-authority diagram. +**Resolved on this documentation branch:** those existing views are recognized, and only the genuinely missing extension-permission-to-Agent-authority view was added. ### 3.8 Resolution freshness authority -Protected main already validates, pins and non-expansively revalidates destination addresses, but it does not yet require a bounded approval-to-socket-use interval. Active PR #47 exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` implements the reusable `FreshResolutionSnapshot` primitive with a repository-owned 30-second maximum validity budget and exact-head gate evidence. +Protected main validates, pins and non-expansively revalidates destination addresses, but it does not yet ship a bounded approval-to-socket-use interval. Active #47 provides the reusable resolution-freshness primitive; #50 makes first-party connection planning consume freshness; #54 rechecks freshness at `connect_at(current_time)` immediately before socket I/O. -Stacked PR #50 owns first-party network consumption. The active branch structurally hides the untimed planner and migrates first-party TLS integration helpers to `FreshConnectionPlan` with explicit trusted monotonic approval/use times. This remains **active-PR / PARTIAL** evidence until the exact consumer head is gate-clean and both prerequisite and consumer integrate in dependency order. +The active stack deliberately does not claim resolver implementation, DNS acquisition, proxy/PAC authority or wall-clock authority. It narrows the plan-to-connect TOCTOU window using trusted monotonic timing and exact socket candidates. -**Documentation consequence:** no new ADR, physical ERD entity or deployed component is justified. The change tightens Accepted ADR 0004. The network-authority sequence should be reconciled after #50's public consumer contract stabilizes. +**Documentation consequence:** this remains a refinement of Accepted ADR 0004, not a new deployed component or persistence entity. The network-authority sequence should be reconciled to protected-main truth only after dependency-ordered integration. ### 3.9 TLS revocation-material freshness -Protected main deliberately reports revocation as `NotConfigured`. Active PR #48 exact head `9bbe12860436027a3b7cd5786775f1dacfbc835d` adds a reusable signed-window freshness check for already-verified revocation material. +Protected main deliberately reports revocation as `NotConfigured`. Active #48 adds a reusable signed-window freshness check for already-verified revocation material. -**Documentation consequence:** #48 may be represented as `IMPLEMENTED_ON_ACTIVE_PR` for the freshness primitive only. It must not be described as OCSP/CRL acquisition, signature/path validation, cache operation, or proof that a certificate is unrevoked. No new revocation service/cache topology or physical ERD is documented until such a runtime exists. +**Documentation consequence:** #48 is `IMPLEMENTED_ON_ACTIVE_PR` for freshness only. It is not OCSP/CRL acquisition, signature/path validation, cache operation or proof that a certificate is unrevoked. No revocation service/cache topology or physical ERD is invented. ### 3.10 Browser task telemetry -Active PR #51 exact head `1c85b966087191f52b4a709a2822b2a53fb0e2fa` adds a bounded `BrowserTaskTelemetry` value object for RSS bytes, observation bytes, action latency and task duration. It does not sample Chromium or the operating system and does not create a GPU/local-model claim. +Active #51 adds a bounded `BrowserTaskTelemetry` value object for RSS bytes, observation bytes, action latency and task duration. It does not sample Chromium or the operating system and does not create a GPU/local-model claim. -**Documentation consequence:** this is a reusable active-PR prerequisite for issue #28 resource evidence, not a new runtime component, persistence entity, sampler service or release metric. Architecture/UML/ERD remain unchanged until an actual measurement adapter establishes those boundaries. +**Documentation consequence:** this is a reusable active-PR prerequisite for issue #28 resource evidence, not a runtime sampler service, persistence entity or release metric. ### 3.11 Semantic observation authority -Active PR #52 is stacked on active browser-registry PR #40 and therefore remains non-shipped. Its current lane adds a bounded `SemanticNodeObservation` value contract that carries an OriginWeave-owned `ObservedNodeHandle`, bounded role/accessibility-name/visible-text fields, observed state, typed node-local action descriptors, and an explicit non-empty evidence-channel provenance set. The provenance regression deliberately rejects an observation with no evidence channel. +Active PR #52 is stacked on browser-registry PR #40 and remains non-shipped. Its current semantic-observation contract carries an OriginWeave-owned `ObservedNodeHandle`, bounded role/accessibility-name/visible-text fields, observed state, typed node-local action descriptors, and a non-empty evidence-channel provenance set. + +The latest active refinement adds optional parent and ordered child relationships with at most 128 children. Every relationship must remain inside the same browser session, browsing context, canonical origin and document epoch as the observation handle. Self-parent/self-child relationships and duplicate child handles fail closed. The relationship graph remains descriptive evidence; it cannot create execution capability or cross-document authority. + +The test-only relationship head intentionally failed compilation because the production fields, accessors, bound and error variants did not exist. The current production head implements that boundary, but current-head gate evidence must be observed independently before it is called gate-clean. -The evidence channel records how the value was observed; it does not elevate Accessibility, DOM, layout, WebMCP, structured-data or visual content into trusted instruction. Likewise, an advertised `NodeActionKind` is descriptive evidence of a meaningful node-local operation, not an execution capability or policy grant. +The evidence channel records how a value was observed; Accessibility, DOM, layout, WebMCP, structured-data and visual content remain untrusted observations. An advertised `NodeActionKind` likewise remains descriptive and grants no execution authority. -**Documentation consequence:** active PR #52 is `IMPLEMENTED_ON_ACTIVE_PR` evidence for a semantic-observation value primitive only. It is not a browser observation adapter, does not perform BiDi/CDP/WebMCP I/O, does not dispatch actions, does not prove mutation invalidation, and does not establish a service or persistence boundary. No new ADR or physical ERD entity is justified; the lane remains governed by the existing browser-authority and structured-observation decisions and issue #28. +**Documentation consequence:** #52 is `IMPLEMENTED_ON_ACTIVE_PR` evidence for a semantic-observation value primitive only. It is not a browser observation adapter, performs no BiDi/CDP/WebMCP I/O or action dispatch, and establishes no service or persistence boundary. No new ADR or physical ERD entity is justified. ## 4. Durable conversation decisions captured in GitHub @@ -129,7 +137,7 @@ The canonical graph must continue to preserve these durable decisions: 11. Raw secrets stay outside model-visible context; sensitive values use purpose-bound authority, opaque handles and trusted fill paths. 12. Browser correctness/human interaction outrank optional local-model throughput under resource pressure. 13. Provenance distinguishes source observation, model judgement, policy, approval, action and verified outcome; WARC/PROV are adapters rather than collapsed truth. -14. WebDriver BiDi, CDP, WebMCP and MCP are versioned adapters, never the product's authority model by themselves. +14. WebDriver BiDi, CDP, WebMCP and MCP are versioned adapters, never the product authority model by themselves. 15. The first browser proof is a pinned-stock-Chromium vertical slice before any broad Chromium fork. 16. High-risk actions remain approval-bound; Crawler Mode remains read-only and excludes CAPTCHA/block-evasion features. 17. Autonomous development uses OpenCode/NVIDIA NIM under deterministic gates and separate review/publication authority, never `COPILOT_GITHUB_TOKEN` as the development-model credential. @@ -141,12 +149,15 @@ The canonical graph must continue to preserve these durable decisions: 23. Revocation-material freshness, revocation-material cryptographic validity, acquisition/cache operation and an unrevoked-certificate claim are separate evidence authorities. 24. Browser-resource telemetry values and actual OS/Chromium measurement adapters are separate maturity claims; value-object availability cannot be promoted to measured runtime evidence. 25. Every semantic observation must identify at least one contributing evidence channel; observation provenance and advertised node-local actions are descriptive evidence and never grant execution authority. +26. Semantic parent/child relationships must be bounded and remain inside the observation's exact session/context/origin/document authority; relationship metadata cannot mint capability. +27. Sensitive-handle audience must ultimately be derived from authenticated workload/service identity; accepting an audience string in an internal value object is not authentication. +28. A real browser compatibility fixture may mutate and clean up test state, but compatibility success still cannot substitute for OriginWeave Agent-authority evidence. ## 5. Architecture views still legitimately deferred ### 5.1 Extension authority — present in this branch -`uml/extension-authority.md` shows: +`uml/extension-authority.md` shows the durable separation: ```text Chromium MV3 permission @@ -160,15 +171,16 @@ Chromium MV3 permission Compatibility evidence cannot substitute for Agent-authority isolation evidence, and vice versa. -### 5.2 Network freshness sequence — existing view requires bounded reconciliation after #50 stabilizes +### 5.2 Network freshness sequence — reconcile after #47 → #50 → #54 integrates -The durable sequence must make the freshness boundary explicit without encoding temporary branch-only API names: +The durable sequence is: ```text resolver answer -> destination policy + origin binding -> fresh resolution approval [trusted monotonic interval] -> connection authorization at trusted monotonic use time +-> socket-use freshness recheck -> exact socket candidate -> observed TCP peer -> TLS/HTTP authority layers @@ -185,6 +197,7 @@ isolated profile/context -> BiDi/CDP adapter -> OriginWeave registry -> semantic observation +-> bounded exact-authority relationships -> opaque node authority -> typed policy decision -> real browser input @@ -193,11 +206,11 @@ isolated profile/context -> teardown/recovery ``` -Active #52 makes the semantic-observation value boundary more concrete but still does not establish the browser adapter, process topology or action-dispatch sequence. Do not freeze temporary protocol/field names into authoritative UML before the executable contracts stabilize. +Active #52 makes semantic-observation relationships more concrete but still does not establish the browser adapter, process topology or action-dispatch sequence. Temporary protocol/field names must not be frozen into authoritative UML before executable contracts stabilize. ### 5.4 Trusted sensitive-data broker — deferred until issue #10 owns a real runtime boundary -Current protected-main policy/evidence plus active #45/#46 primitives do not justify inventing a broker process, database table, transaction manager, KMS path or browser-fill adapter in timeless Architecture/UML/ERD. When a real broker slice exists, the documentation graph must add the actual component/transaction/data-lifecycle views and mark persisted versus in-memory versus external state from executable evidence. +Protected-main policy/evidence plus active #45→#46→#53→#55 do not justify inventing a broker process, database table, transaction manager, KMS path, authenticated service-identity mechanism or browser-fill adapter. When a real broker slice exists, the documentation graph must add actual component/transaction/data-lifecycle views and mark persisted versus in-memory versus external state from executable evidence. ## 6. What remains before documentation closure @@ -212,20 +225,21 @@ Current protected-main policy/evidence plus active #45/#46 primitives do not jus - extension authority UML; - conceptual ERD truth discipline; - documentation fitness and regression contracts; -- current browser/protocol standards doctoring; -- active-sensitive-data evidence reconciliation without promoting #45/#46 to shipped or inventing broker persistence; -- explicit freshness/revocation/telemetry maturity boundaries for active #47/#48/#50/#51 without inventing new architecture or persistence; -- semantic-observation maturity/provenance boundary for active #52 without promoting it to a real browser adapter. +- browser/protocol standards doctoring; +- sensitive-data evidence reconciliation through #55 without inventing broker persistence or authenticated service identity; +- resolution-freshness reconciliation through socket-use recheck #54 without inventing resolver/proxy authority; +- semantic-observation authority/relationship reconciliation for #52 without promoting it to a browser adapter; and +- MV3 compatibility reconciliation through #56 without equating browser permission with Agent authority. ### Still required - exact-head CI/security/review acceptance of this documentation PR; - integration before any of these branch repairs become protected-main truth; -- re-reconciliation whenever active PR #37, #40, #43, #45, #46, #47, #48, #49, #50, #51 or #52 integrates, closes, is superseded or materially changes head, because active-PR status must then move or be removed rather than silently becoming protected-main truth; -- network-authority sequence reconciliation after #50's executable consumer contract is stable and proven; +- re-reconciliation whenever active PR #37, #40, #43, #45, #46, #47, #48, #49, #50, #51, #52, #53, #54, #55 or #56 integrates, closes, is superseded or materially changes head; +- network-authority sequence reconciliation after #47→#50→#54 reaches protected main; - detailed real-Chromium vertical-slice UML when issue #28 implementation contracts are stable; - trusted-broker UML/ERD/operability additions only when issue #10 establishes real runtime/persistence ownership; -- future ERD changes only when persistence ownership/entities actually change; +- future ERD changes only when persistence ownership/entities actually change; and - ongoing security/operability/release reconciliation as real browser/runtime boundaries integrate. ## 7. Completion criteria From 1d7fa5a7c42bcb621d65fe1fea359364ef434e3c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 05:15:43 +0900 Subject: [PATCH 075/130] test(docs): bind latest active evidence to documentation fitness --- ...cumentation_active_pr_evidence_contract.py | 91 +++++++++++++++++++ 1 file changed, 91 insertions(+) create mode 100644 tests/test_documentation_active_pr_evidence_contract.py diff --git a/tests/test_documentation_active_pr_evidence_contract.py b/tests/test_documentation_active_pr_evidence_contract.py new file mode 100644 index 00000000..6463748b --- /dev/null +++ b/tests/test_documentation_active_pr_evidence_contract.py @@ -0,0 +1,91 @@ +"""Regression contracts for volatile active-PR evidence in canonical documentation.""" + +from pathlib import Path +import unittest + + +ROOT = Path(__file__).resolve().parents[1] +DOCS = ROOT / "docs" +FITNESS = DOCS / "DOCUMENTATION_FITNESS.md" +MATURITY = DOCS / "evidence" / "2026-08-10-active-pr-maturity.md" + + +def active_pr_row(text: str, pr_number: int) -> str: + """Return exactly one maturity row for an active pull request.""" + prefix = f"| #{pr_number} |" + rows = [line for line in text.splitlines() if line.startswith(prefix)] + if len(rows) != 1: + raise AssertionError( + f"expected exactly one active maturity row for PR #{pr_number}, got {len(rows)}" + ) + return rows[0] + + +class ActivePullRequestDocumentationContractTests(unittest.TestCase): + """Keep volatile implementation evidence separate from protected-main truth.""" + + @classmethod + def setUpClass(cls) -> None: + cls.fitness = FITNESS.read_text(encoding="utf-8") + cls.maturity = MATURITY.read_text(encoding="utf-8") + + def test_dependency_stacks_are_explicit_and_non_shipped(self) -> None: + """Current browser, network, sensitive and compatibility stacks stay active-only.""" + for pr_number in (52, 53, 54, 55, 56): + with self.subTest(pr_number=pr_number): + row = active_pr_row(self.maturity, pr_number) + self.assertIn("**IMPLEMENTED_ON_ACTIVE_PR**", row) + self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", row) + + for stack in ( + "#47 → #50 → #54", + "#45 → #46 → #53 → #55", + "#40→#52", + "#43→#49/#56", + ): + with self.subTest(stack=stack): + self.assertIn(stack, self.fitness) + + def test_semantic_relationship_evidence_stays_bounded_and_authority_scoped(self) -> None: + """PR #52 cannot turn relationship metadata into browser or execution authority.""" + row = active_pr_row(self.maturity, 52) + for marker in ("128", "relationship", "session/context/origin/document"): + with self.subTest(marker=marker): + self.assertIn(marker, row) + + for marker in ( + "same browser session, browsing context, canonical origin and document epoch", + "Self-parent/self-child relationships and duplicate child handles fail closed", + "relationship graph remains descriptive evidence", + "not a browser observation adapter", + ): + with self.subTest(marker=marker): + self.assertIn(marker, self.fitness) + + def test_sensitive_audience_evidence_does_not_claim_authentication(self) -> None: + """An internal audience field is not authenticated workload/service identity.""" + row = active_pr_row(self.maturity, 55) + self.assertIn("authenticated workload/service identity", row) + self.assertIn("audience string accepted by the value/policy primitive is **not authentication**", self.fitness) + self.assertIn("no new deployment topology or physical ERD entity", self.fitness) + + def test_bookmark_mutation_is_compatibility_not_agent_authority(self) -> None: + """Real MV3 mutation evidence must remain separate from OriginWeave capability grants.""" + row = active_pr_row(self.maturity, 56) + for marker in ("create", "get", "remove", "compatibility evidence only"): + with self.subTest(marker=marker): + self.assertIn(marker, row) + + self.assertIn("Manifest V3 compatibility", self.fitness) + self.assertIn("Chromium permission or browser compatibility success is not an OriginWeave Agent capability", self.fitness) + self.assertIn("does not justify", self.fitness) + + def test_erd_stays_conceptual_without_persistence_owner(self) -> None: + """Active in-memory/value primitives must not manufacture a physical data model.""" + self.assertIn("Conceptual ERD/domain model", self.fitness) + self.assertIn("add no OriginWeave-owned durable store", self.fitness) + self.assertIn("false architecture", self.fitness) + + +if __name__ == "__main__": + unittest.main() From 6d9b13d750ac5aae7ce298e7f5434024c92adc85 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 05:16:17 +0900 Subject: [PATCH 076/130] test(docs): align broker boundary assertion with canonical wording --- ...test_documentation_active_pr_evidence_contract.py | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/tests/test_documentation_active_pr_evidence_contract.py b/tests/test_documentation_active_pr_evidence_contract.py index 6463748b..346b2997 100644 --- a/tests/test_documentation_active_pr_evidence_contract.py +++ b/tests/test_documentation_active_pr_evidence_contract.py @@ -66,8 +66,11 @@ def test_sensitive_audience_evidence_does_not_claim_authentication(self) -> None """An internal audience field is not authenticated workload/service identity.""" row = active_pr_row(self.maturity, 55) self.assertIn("authenticated workload/service identity", row) - self.assertIn("audience string accepted by the value/policy primitive is **not authentication**", self.fitness) - self.assertIn("no new deployment topology or physical ERD entity", self.fitness) + self.assertIn( + "audience string accepted by the value/policy primitive is **not authentication**", + self.fitness, + ) + self.assertIn("new deployment topology or physical ERD entity", self.fitness) def test_bookmark_mutation_is_compatibility_not_agent_authority(self) -> None: """Real MV3 mutation evidence must remain separate from OriginWeave capability grants.""" @@ -77,7 +80,10 @@ def test_bookmark_mutation_is_compatibility_not_agent_authority(self) -> None: self.assertIn(marker, row) self.assertIn("Manifest V3 compatibility", self.fitness) - self.assertIn("Chromium permission or browser compatibility success is not an OriginWeave Agent capability", self.fitness) + self.assertIn( + "Chromium permission or browser compatibility success is not an OriginWeave Agent capability", + self.fitness, + ) self.assertIn("does not justify", self.fitness) def test_erd_stays_conceptual_without_persistence_owner(self) -> None: From 1ee9a71e7cadeff6327e3ae0b03e392245303a97 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 05:20:30 +0900 Subject: [PATCH 077/130] test(docs): assert explicit MV3 compatibility boundary --- tests/test_documentation_active_pr_evidence_contract.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_documentation_active_pr_evidence_contract.py b/tests/test_documentation_active_pr_evidence_contract.py index 346b2997..82f6c133 100644 --- a/tests/test_documentation_active_pr_evidence_contract.py +++ b/tests/test_documentation_active_pr_evidence_contract.py @@ -84,7 +84,7 @@ def test_bookmark_mutation_is_compatibility_not_agent_authority(self) -> None: "Chromium permission or browser compatibility success is not an OriginWeave Agent capability", self.fitness, ) - self.assertIn("does not justify", self.fitness) + self.assertIn("#43/#49/#56 are active compatibility evidence only", self.fitness) def test_erd_stays_conceptual_without_persistence_owner(self) -> None: """Active in-memory/value primitives must not manufacture a physical data model.""" From ab70e33215bfbd276a0abdabfacf2733b32b95fe Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 05:40:48 +0900 Subject: [PATCH 078/130] docs(evidence): track typed semantic query active maturity --- docs/evidence/2026-08-10-active-pr-maturity.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index 6d163931..dada627d 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -32,6 +32,7 @@ This dated appendix records volatile implementation evidence that must not be em | #54 | Recheck resolution freshness at socket use | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #50 at exact head `ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e`; CI and CodeRabbit are green. `connect_at` revalidates freshness immediately before socket I/O and the compatibility path derives elapsed monotonic time; no resolver, DNS lookup, proxy/PAC or wall-clock authority is added. | | #55 | Bind opaque sensitive-value handle use to a non-transferable audience | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #53 head `86ce4bc1c11c270dc532593d673c42bd6f623d74`. Test-only head `95f0f1e418024f5dbe7aa613e5fd1e9d88a9417a` and CI run `31419991170` proved a real regression: audience binding had caused a revoked handle with later mismatched policy state to return `ScopeMismatch` instead of authoritative `Revoked`. Current exact head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8` restores revocation precedence, retains audience binding, and adds a synchronized one-use concurrency regression. CI run `31421061134` passes repository contracts, rustfmt, locked workspace check, all workspace tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status is success. A future trusted broker must still derive the audience from authenticated workload/service identity. | | #56 | Real pinned-Chromium bookmark mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43. Exact predecessor head `50111a845927bd6e657063b85ce76da45c13436e` already passed the real Manifest V3 browser workflow but CI exposed one stale repository contract that still required read-only `chrome.bookmarks.getTree`. Current exact head `e1099e35ac000c7bf87ea75666cfdd928a386370` aligns that contract with the bounded create → get → remove lifecycle; CI run `31427219564`, Manifest V3 Compatibility run `31427220684`, and CodeRabbit exact-head status all succeed. This is compatibility evidence only: it grants no OriginWeave Agent capability and does not complete issue #27's full extension matrix. | +| #57 | Typed semantic-node query over bounded observation evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #52 head `94fd284fe41746eeba9edc05d9753903b1c41ebf`. Test-only head `d0cd133f5be62fff99612d5b08aa4cf08ce2f29f` and CI run `31429065905` intentionally proved the missing public query boundary by failing compilation on absent `SemanticNodeQuery`/`SemanticNodeQueryError`. Current exact head `b4fa49953cbbb21c879a3340e264a6e132e41634` implements bounded exact role, accessible-name and typed-action selection against already validated `SemanticNodeObservation` values, with no CSS/XPath/raw DOM selector language, arbitrary JavaScript, browser I/O or action authority. Manifest V3 Compatibility is exact-head success; current CI is still running after a strict-Clippy remediation, so no predecessor-head gate result is transferred. | ## Historical lineage From 979d61fcab46674080a418e106eef200f6f4edb3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 05:41:13 +0900 Subject: [PATCH 079/130] test(docs): guard typed semantic query maturity evidence --- ...cumentation_active_pr_evidence_contract.py | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/tests/test_documentation_active_pr_evidence_contract.py b/tests/test_documentation_active_pr_evidence_contract.py index 82f6c133..681aec5a 100644 --- a/tests/test_documentation_active_pr_evidence_contract.py +++ b/tests/test_documentation_active_pr_evidence_contract.py @@ -31,7 +31,7 @@ def setUpClass(cls) -> None: def test_dependency_stacks_are_explicit_and_non_shipped(self) -> None: """Current browser, network, sensitive and compatibility stacks stay active-only.""" - for pr_number in (52, 53, 54, 55, 56): + for pr_number in (52, 53, 54, 55, 56, 57): with self.subTest(pr_number=pr_number): row = active_pr_row(self.maturity, pr_number) self.assertIn("**IMPLEMENTED_ON_ACTIVE_PR**", row) @@ -62,6 +62,23 @@ def test_semantic_relationship_evidence_stays_bounded_and_authority_scoped(self) with self.subTest(marker=marker): self.assertIn(marker, self.fitness) + def test_typed_semantic_query_evidence_stays_descriptive_and_bounded(self) -> None: + """PR #57 cannot turn semantic matching into selector or execution authority.""" + row = active_pr_row(self.maturity, 57) + for marker in ( + "SemanticNodeQuery", + "role", + "accessible-name", + "typed-action", + "no CSS/XPath/raw DOM selector language", + "no browser I/O or action authority", + ): + with self.subTest(marker=marker): + self.assertIn(marker, row) + + self.assertIn("Draft stacked on exact #52 head", row) + self.assertIn("predecessor-head gate result is transferred", row) + def test_sensitive_audience_evidence_does_not_claim_authentication(self) -> None: """An internal audience field is not authenticated workload/service identity.""" row = active_pr_row(self.maturity, 55) From a1e99edbdf29ac5f091d33ee39c7abd4423cd1d5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 05:42:34 +0900 Subject: [PATCH 080/130] docs(evidence): record exact semantic query acceptance --- docs/evidence/2026-08-10-active-pr-maturity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index dada627d..8586270c 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -32,7 +32,7 @@ This dated appendix records volatile implementation evidence that must not be em | #54 | Recheck resolution freshness at socket use | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #50 at exact head `ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e`; CI and CodeRabbit are green. `connect_at` revalidates freshness immediately before socket I/O and the compatibility path derives elapsed monotonic time; no resolver, DNS lookup, proxy/PAC or wall-clock authority is added. | | #55 | Bind opaque sensitive-value handle use to a non-transferable audience | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #53 head `86ce4bc1c11c270dc532593d673c42bd6f623d74`. Test-only head `95f0f1e418024f5dbe7aa613e5fd1e9d88a9417a` and CI run `31419991170` proved a real regression: audience binding had caused a revoked handle with later mismatched policy state to return `ScopeMismatch` instead of authoritative `Revoked`. Current exact head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8` restores revocation precedence, retains audience binding, and adds a synchronized one-use concurrency regression. CI run `31421061134` passes repository contracts, rustfmt, locked workspace check, all workspace tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status is success. A future trusted broker must still derive the audience from authenticated workload/service identity. | | #56 | Real pinned-Chromium bookmark mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43. Exact predecessor head `50111a845927bd6e657063b85ce76da45c13436e` already passed the real Manifest V3 browser workflow but CI exposed one stale repository contract that still required read-only `chrome.bookmarks.getTree`. Current exact head `e1099e35ac000c7bf87ea75666cfdd928a386370` aligns that contract with the bounded create → get → remove lifecycle; CI run `31427219564`, Manifest V3 Compatibility run `31427220684`, and CodeRabbit exact-head status all succeed. This is compatibility evidence only: it grants no OriginWeave Agent capability and does not complete issue #27's full extension matrix. | -| #57 | Typed semantic-node query over bounded observation evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #52 head `94fd284fe41746eeba9edc05d9753903b1c41ebf`. Test-only head `d0cd133f5be62fff99612d5b08aa4cf08ce2f29f` and CI run `31429065905` intentionally proved the missing public query boundary by failing compilation on absent `SemanticNodeQuery`/`SemanticNodeQueryError`. Current exact head `b4fa49953cbbb21c879a3340e264a6e132e41634` implements bounded exact role, accessible-name and typed-action selection against already validated `SemanticNodeObservation` values, with no CSS/XPath/raw DOM selector language, arbitrary JavaScript, browser I/O or action authority. Manifest V3 Compatibility is exact-head success; current CI is still running after a strict-Clippy remediation, so no predecessor-head gate result is transferred. | +| #57 | Typed semantic-node query over bounded observation evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #52 head `94fd284fe41746eeba9edc05d9753903b1c41ebf`. Test-only head `d0cd133f5be62fff99612d5b08aa4cf08ce2f29f` and CI run `31429065905` intentionally proved the missing public query boundary by failing compilation on absent `SemanticNodeQuery`/`SemanticNodeQueryError`. Current exact head `b4fa49953cbbb21c879a3340e264a6e132e41634` implements bounded exact role, accessible-name and typed-action selection against already validated `SemanticNodeObservation` values, with no CSS/XPath/raw DOM selector language, arbitrary JavaScript, browser I/O or action authority. CI run `31429995885` passes repository contracts, rustfmt, locked workspace check, all workspace tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; Manifest V3 Compatibility run `31429997851` and CodeRabbit exact-head status also succeed. The PR remains Draft because #52/#40 are active prerequisites. | ## Historical lineage From 302708f273d69d6989c3fc96b3e95ff2e3393d9e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 05:44:12 +0900 Subject: [PATCH 081/130] fix(docs): bind semantic query evidence contract to exact facts --- tests/test_documentation_active_pr_evidence_contract.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/tests/test_documentation_active_pr_evidence_contract.py b/tests/test_documentation_active_pr_evidence_contract.py index 681aec5a..6ceef28a 100644 --- a/tests/test_documentation_active_pr_evidence_contract.py +++ b/tests/test_documentation_active_pr_evidence_contract.py @@ -71,13 +71,15 @@ def test_typed_semantic_query_evidence_stays_descriptive_and_bounded(self) -> No "accessible-name", "typed-action", "no CSS/XPath/raw DOM selector language", - "no browser I/O or action authority", + "browser I/O or action authority", ): with self.subTest(marker=marker): self.assertIn(marker, row) self.assertIn("Draft stacked on exact #52 head", row) - self.assertIn("predecessor-head gate result is transferred", row) + self.assertIn("CI run `31429995885` passes", row) + self.assertIn("exact owned production function/line/region/branch coverage", row) + self.assertIn("remains Draft because #52/#40 are active prerequisites", row) def test_sensitive_audience_evidence_does_not_claim_authentication(self) -> None: """An internal audience field is not authenticated workload/service identity.""" From 234c9d0bf6c4f565ea0ce83d16ef820d80394da2 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 05:50:09 +0900 Subject: [PATCH 082/130] docs(fitness): reconcile typed semantic query maturity --- docs/DOCUMENTATION_FITNESS.md | 41 +++++++++++++++++++++-------------- 1 file changed, 25 insertions(+), 16 deletions(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index 6e725e2f..a256d5a4 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -17,19 +17,19 @@ File existence alone is never sufficient. An artifact can exist and still be sta | Documentation family | Fitness | Current evidence / remaining boundary | |---|---|---| -| PRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Protected-main requirements remain distinct from active evidence. #37 is the current bounded-HTTP replacement; #45→#46→#53→#55 narrows sensitive-handle lifecycle, reservation, revocation and audience admission without creating the trusted broker; #47→#50→#54 narrows resolution freshness through the socket-use boundary; #51/#52 are browser-runtime prerequisites, not a real Chromium adapter; #43/#49/#56 are MV3 compatibility evidence, not Agent authority. | -| TRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Implementation inventory uses one protected-main status plus separate active/non-shipped evidence. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth. Active value objects and compatibility fixtures do not imply deployed services or complete runtime paths. | -| Root Architecture | **PRESENT-CURRENT with follow-up** | Chromium compatibility kernel + Rust authority-bearing control plane remains correct. #47/#50/#54 tighten ADR 0004; #45/#46/#53/#55 remain inside ADR 0007; #40/#52 remain inside browser authority/structured-observation decisions; #43/#49/#56 remain compatibility work under issue #27. No later lane introduces a new trust domain, persistence owner or deployed component. | +| PRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Protected-main requirements remain distinct from active evidence. #37 is the current bounded-HTTP replacement; #45→#46→#53→#55 narrows sensitive-handle lifecycle, reservation, revocation and audience admission without creating the trusted broker; #47→#50→#54 narrows resolution freshness through the socket-use boundary; #51/#52/#57 are browser-runtime prerequisites, not a real Chromium adapter; #43/#49/#56 are MV3 compatibility evidence, not Agent authority. | +| TRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Implementation inventory uses one protected-main status plus separate active/non-shipped evidence. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth. Active value objects, semantic matching and compatibility fixtures do not imply deployed services or complete runtime paths. | +| Root Architecture | **PRESENT-CURRENT with follow-up** | Chromium compatibility kernel + Rust authority-bearing control plane remains correct. #47/#50/#54 tighten ADR 0004; #45/#46/#53/#55 remain inside ADR 0007; #40/#52/#57 remain inside browser authority/structured-observation/action-boundary decisions; #43/#49/#56 remain compatibility work under issue #27. No later lane introduces a new trust domain, persistence owner or deployed component. | | ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 are discoverable without promoting Proposed decisions. Repository-scoped identifiers are reserved across protected main and active work. | -| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 separates MV3 compatibility from extension-to-Agent authority; Proposed ADR 0014 governs ADR acceptance. #53/#54/#55/#56 refine existing decisions and do not independently justify new ADRs. | +| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 separates MV3 compatibility from extension-to-Agent authority; Proposed ADR 0014 governs ADR acceptance. #53/#54/#55/#56/#57 refine existing decisions and do not independently justify new ADRs. | | UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. `uml/extension-authority.md` closes the permission-vs-Agent-authority gap. Network freshness should reflect the socket-use recheck after #54 integrates; detailed real-Chromium sequence remains deferred until issue #28 stabilizes. | -| Conceptual ERD/domain model | **PRESENT-CURRENT** | The ERD remains explicitly conceptual unless a real persistence owner/schema is implemented. #45/#46/#47/#48/#50/#51/#52/#53/#54/#55/#56 add no OriginWeave-owned durable store, so manufacturing tables for in-memory/value/fixture primitives would be false architecture. | -| Traceability | **REPAIRED IN THIS CHANGE with volatile evidence refresh required** | Uses `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`. The dated maturity appendix carries volatile exact heads for current active lanes through #56. | -| Threat model / Security | **PRESENT-CURRENT with follow-up** | Untrusted content, network, secret, provenance and extension risks are covered. #54 narrows resolution-to-socket TOCTOU only on active work; #48 is revocation-material freshness only; #53/#55 narrow handle revocation/audience misuse only in process; #52 binds semantic relationships to exact browser authority. None creates a broader authority grant. | -| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code function/line/region/branch coverage, rustdoc and realistic boundary testing remain explicit. Active work uses intentional RED evidence followed by narrow production changes. #52's relationship boundary was compile-time RED before production implementation; #56 proved a stale compatibility contract against a real browser workflow. | +| Conceptual ERD/domain model | **PRESENT-CURRENT** | The ERD remains explicitly conceptual unless a real persistence owner/schema is implemented. #45/#46/#47/#48/#50/#51/#52/#53/#54/#55/#56/#57 add no OriginWeave-owned durable store, so manufacturing tables for in-memory/value/query/fixture primitives would be false architecture. | +| Traceability | **REPAIRED IN THIS CHANGE with volatile evidence refresh required** | Uses `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`. The dated maturity appendix carries volatile exact heads for current active lanes through #57. | +| Threat model / Security | **PRESENT-CURRENT with follow-up** | Untrusted content, network, secret, provenance and extension risks are covered. #54 narrows resolution-to-socket TOCTOU only on active work; #48 is revocation-material freshness only; #53/#55 narrow handle revocation/audience misuse only in process; #52 binds semantic relationships to exact browser authority; #57 performs bounded semantic matching without minting selector or action authority. None creates a broader authority grant. | +| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code function/line/region/branch coverage, rustdoc and realistic boundary testing remain explicit. Active work uses intentional RED evidence followed by narrow production changes. #52's relationship boundary and #57's typed-query boundary were compile-time RED before production implementation; #56 proved a stale compatibility contract against a real browser workflow. | | Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. Later active lanes add no new daemon/service, so no SLO/RPO/RTO or runbook is fabricated. First-party socket timing and browser fixture cleanup remain implementation concerns within existing runtime boundaries. | -| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented. #52 is an internal authority-bound semantic-observation API, not a BiDi/CDP/WebMCP wire protocol; #55 is an in-process policy API, not authenticated service identity; #56 is a compatibility fixture, not a product protocol. | -| Release / rollback / provenance | **PRESENT-CURRENT** | Release remains bound to one exact integrated protected head. Active stacks #40→#52, #47→#50→#54, #45→#46→#53→#55, and #43→#49/#56 must preserve dependency order; predecessor-head success cannot satisfy a later head. | +| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented. #52 is an internal authority-bound semantic-observation API and #57 is an internal bounded typed-query API over those observations; neither is a BiDi/CDP/WebMCP wire protocol or action executor. #55 is an in-process policy API, not authenticated service identity; #56 is a compatibility fixture, not a product protocol. | +| Release / rollback / provenance | **PRESENT-CURRENT** | Release remains bound to one exact integrated protected head. Active stacks #40→#52→#57, #47→#50→#54, #45→#46→#53→#55, and #43→#49/#56 must preserve dependency order; predecessor-head success cannot satisfy a later head. | | Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. #53 adds first-revocation-wins in-process state and #55 adds audience binding, but authenticated workload identity, durable broker storage, protected-value resolution/fill, KMS, cross-process transactionality, compensation, retention and model-disclosure lifecycle remain open under issue #10. | | Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references distinguish draft/experimental material from final normative standards. | @@ -114,12 +114,18 @@ Active PR #52 is stacked on browser-registry PR #40 and remains non-shipped. Its The latest active refinement adds optional parent and ordered child relationships with at most 128 children. Every relationship must remain inside the same browser session, browsing context, canonical origin and document epoch as the observation handle. Self-parent/self-child relationships and duplicate child handles fail closed. The relationship graph remains descriptive evidence; it cannot create execution capability or cross-document authority. -The test-only relationship head intentionally failed compilation because the production fields, accessors, bound and error variants did not exist. The current production head implements that boundary, but current-head gate evidence must be observed independently before it is called gate-clean. - The evidence channel records how a value was observed; Accessibility, DOM, layout, WebMCP, structured-data and visual content remain untrusted observations. An advertised `NodeActionKind` likewise remains descriptive and grants no execution authority. **Documentation consequence:** #52 is `IMPLEMENTED_ON_ACTIVE_PR` evidence for a semantic-observation value primitive only. It is not a browser observation adapter, performs no BiDi/CDP/WebMCP I/O or action dispatch, and establishes no service or persistence boundary. No new ADR or physical ERD entity is justified. +### 3.12 Typed semantic query authority + +Active PR #57 is stacked on exact semantic-observation authority from #52 and remains non-shipped. Its `SemanticNodeQuery` requires at least one bounded typed selector and matches exact semantic role, accessible name and advertised `NodeActionKind` only against already validated `SemanticNodeObservation` values. + +The test-only head intentionally failed compilation on the absent public query/error boundary. The current exact #57 head passes repository contracts, formatting, workspace checks/tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage, plus the inherited Manifest V3 compatibility gate. + +**Documentation consequence:** query matching is descriptive selection only. #57 does not expose CSS/XPath/raw DOM selector languages, arbitrary JavaScript, browser I/O, action dispatch, capability grants, policy approval or persistence. It refines the existing observation/action architecture and therefore does not independently justify a new ADR, deployed component, topology view or physical ERD entity. + ## 4. Durable conversation decisions captured in GitHub The canonical graph must continue to preserve these durable decisions: @@ -152,6 +158,7 @@ The canonical graph must continue to preserve these durable decisions: 26. Semantic parent/child relationships must be bounded and remain inside the observation's exact session/context/origin/document authority; relationship metadata cannot mint capability. 27. Sensitive-handle audience must ultimately be derived from authenticated workload/service identity; accepting an audience string in an internal value object is not authentication. 28. A real browser compatibility fixture may mutate and clean up test state, but compatibility success still cannot substitute for OriginWeave Agent-authority evidence. +29. A semantic node query may select bounded reviewed observation evidence, but query success is neither browser-selector authority nor permission to execute the advertised node-local action. ## 5. Architecture views still legitimately deferred @@ -198,6 +205,7 @@ isolated profile/context -> OriginWeave registry -> semantic observation -> bounded exact-authority relationships +-> typed semantic query -> opaque node authority -> typed policy decision -> real browser input @@ -206,7 +214,7 @@ isolated profile/context -> teardown/recovery ``` -Active #52 makes semantic-observation relationships more concrete but still does not establish the browser adapter, process topology or action-dispatch sequence. Temporary protocol/field names must not be frozen into authoritative UML before executable contracts stabilize. +Active #52 and #57 make the semantic-observation and typed-query boundaries more concrete but still do not establish the browser adapter, process topology, policy-to-node action bridge, real input or post-condition verification sequence. Temporary protocol/field names must not be frozen into authoritative UML before executable contracts stabilize. ### 5.4 Trusted sensitive-data broker — deferred until issue #10 owns a real runtime boundary @@ -228,14 +236,15 @@ Protected-main policy/evidence plus active #45→#46→#53→#55 do not justify - browser/protocol standards doctoring; - sensitive-data evidence reconciliation through #55 without inventing broker persistence or authenticated service identity; - resolution-freshness reconciliation through socket-use recheck #54 without inventing resolver/proxy authority; -- semantic-observation authority/relationship reconciliation for #52 without promoting it to a browser adapter; and +- semantic-observation authority/relationship reconciliation for #52 without promoting it to a browser adapter; +- typed semantic-query reconciliation for #57 without promoting semantic matching to selector/action authority; and - MV3 compatibility reconciliation through #56 without equating browser permission with Agent authority. ### Still required -- exact-head CI/security/review acceptance of this documentation PR; +- exact-head CI/security/review acceptance of this documentation PR after every documentation mutation; - integration before any of these branch repairs become protected-main truth; -- re-reconciliation whenever active PR #37, #40, #43, #45, #46, #47, #48, #49, #50, #51, #52, #53, #54, #55 or #56 integrates, closes, is superseded or materially changes head; +- re-reconciliation whenever active PR #37, #40, #43, #45, #46, #47, #48, #49, #50, #51, #52, #53, #54, #55, #56 or #57 integrates, closes, is superseded or materially changes head; - network-authority sequence reconciliation after #47→#50→#54 reaches protected main; - detailed real-Chromium vertical-slice UML when issue #28 implementation contracts are stable; - trusted-broker UML/ERD/operability additions only when issue #10 establishes real runtime/persistence ownership; From 4f4d460a9da6cb9e8a5c71ecd9d7c227c39f7e7b Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:08:50 +0900 Subject: [PATCH 083/130] docs(fitness): refresh active maturity through PR 59 --- docs/evidence/2026-08-10-active-pr-maturity.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index 8586270c..a264cb09 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -27,12 +27,14 @@ This dated appendix records volatile implementation evidence that must not be em | #49 | Ephemeral Agent Task profile-isolation regression | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43 at exact head `96a4e949d96b5794ef473ccf813987b8e69ea566`; CI is green but dependency-gated and not independently integrable before #43. | | #50 | First-party network consumption of resolution freshness | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392`. Exact head `f8b43bc94444986ab23aa4ef3086e446a0b39295` structurally hides the untimed public network planner, migrates first-party TLS integration helpers through `FreshConnectionPlan`, and passes CI run `31408474576` including exact owned function/line/region/branch coverage; CodeRabbit exact-head status is success. Dependency order, not implementation incompleteness, keeps the PR Draft. | | #51 | Browser-task runtime telemetry value object | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `1c85b966087191f52b4a709a2822b2a53fb0e2fa` is CI/Security/SAST/CodeRabbit clean and Ready for review; it carries validated measurements but performs no OS/Chromium sampling itself. | -| #52 | Bounded semantic-node observation and relationship value contract | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #40. Test-only exact head `b1bd4f8bd3b5597dac8ad3c40530beba7288e8ca` intentionally proved the missing bounded parent/child relationship boundary by failing compilation and also exposed one canonical rustfmt delta. Current exact head `dbe75ca557fc6f501b0e54846c81dffa58812ced` adds at most 128 ordered child relationships, optional parent linkage, exact session/context/origin/document authority matching, self/duplicate rejection and stable credential-free errors. Current-head CI is still running, so predecessor-head success is not promoted to exact-head gate evidence. The value contract still performs no browser I/O or action dispatch. | +| #52 | Bounded semantic-node observation and relationship value contract | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #40. Exact head `94fd284fe41746eeba9edc05d9753903b1c41ebf` adds at most 128 ordered child relationships, optional parent linkage, exact session/context/origin/document authority matching, self/duplicate rejection and stable credential-free errors. CI run `31428454410`, Manifest V3 Compatibility run `31428454350`, and CodeRabbit exact-head status succeed, including exact owned production function/line/region/branch coverage. The value contract still performs no browser I/O or action dispatch. | | #53 | Authoritative in-process sensitive-handle revocation state | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #46 at exact head `86ce4bc1c11c270dc532593d673c42bd6f623d74`; CI and CodeRabbit are green. It adds typed first-revocation-wins state but no durable broker, cross-process transactionality, protected-value resolution, KMS, or persistence. | | #54 | Recheck resolution freshness at socket use | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #50 at exact head `ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e`; CI and CodeRabbit are green. `connect_at` revalidates freshness immediately before socket I/O and the compatibility path derives elapsed monotonic time; no resolver, DNS lookup, proxy/PAC or wall-clock authority is added. | | #55 | Bind opaque sensitive-value handle use to a non-transferable audience | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #53 head `86ce4bc1c11c270dc532593d673c42bd6f623d74`. Test-only head `95f0f1e418024f5dbe7aa613e5fd1e9d88a9417a` and CI run `31419991170` proved a real regression: audience binding had caused a revoked handle with later mismatched policy state to return `ScopeMismatch` instead of authoritative `Revoked`. Current exact head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8` restores revocation precedence, retains audience binding, and adds a synchronized one-use concurrency regression. CI run `31421061134` passes repository contracts, rustfmt, locked workspace check, all workspace tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status is success. A future trusted broker must still derive the audience from authenticated workload/service identity. | -| #56 | Real pinned-Chromium bookmark mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43. Exact predecessor head `50111a845927bd6e657063b85ce76da45c13436e` already passed the real Manifest V3 browser workflow but CI exposed one stale repository contract that still required read-only `chrome.bookmarks.getTree`. Current exact head `e1099e35ac000c7bf87ea75666cfdd928a386370` aligns that contract with the bounded create → get → remove lifecycle; CI run `31427219564`, Manifest V3 Compatibility run `31427220684`, and CodeRabbit exact-head status all succeed. This is compatibility evidence only: it grants no OriginWeave Agent capability and does not complete issue #27's full extension matrix. | -| #57 | Typed semantic-node query over bounded observation evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #52 head `94fd284fe41746eeba9edc05d9753903b1c41ebf`. Test-only head `d0cd133f5be62fff99612d5b08aa4cf08ce2f29f` and CI run `31429065905` intentionally proved the missing public query boundary by failing compilation on absent `SemanticNodeQuery`/`SemanticNodeQueryError`. Current exact head `b4fa49953cbbb21c879a3340e264a6e132e41634` implements bounded exact role, accessible-name and typed-action selection against already validated `SemanticNodeObservation` values, with no CSS/XPath/raw DOM selector language, arbitrary JavaScript, browser I/O or action authority. CI run `31429995885` passes repository contracts, rustfmt, locked workspace check, all workspace tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; Manifest V3 Compatibility run `31429997851` and CodeRabbit exact-head status also succeed. The PR remains Draft because #52/#40 are active prerequisites. | +| #56 | Real pinned-Chromium bookmark mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43. Exact head `e1099e35ac000c7bf87ea75666cfdd928a386370` aligns the fixture and repository contracts with the bounded create → get → remove bookmark lifecycle; CI run `31427219564`, Manifest V3 Compatibility run `31427220684`, and CodeRabbit exact-head status all succeed. This is compatibility evidence only: it grants no OriginWeave Agent capability and does not complete issue #27's full extension matrix. | +| #57 | Typed semantic-node query over bounded observation evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #52 head `94fd284fe41746eeba9edc05d9753903b1c41ebf`. Test-only head `d0cd133f5be62fff99612d5b08aa4cf08ce2f29f` and CI run `31429065905` intentionally proved the missing public query boundary by failing compilation on absent `SemanticNodeQuery`/`SemanticNodeQueryError`. Current exact head `b4fa49953cbbb21c879a3340e264a6e132e41634` implements bounded exact role, accessible-name and typed-action selection against already validated `SemanticNodeObservation` values, with no CSS/XPath/raw DOM selector language, arbitrary JavaScript, browser I/O or action authority. CI run `31429995885`, Manifest V3 Compatibility run `31429997851`, and CodeRabbit exact-head status succeed. The PR remains Draft because #52/#40 are active prerequisites. | +| #58 | Authority-bound semantic-node action target | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #57. Current exact head `efe440c7a609cac187faacfa03a4df904a99386f` accepts only an advertised `NodeActionKind`, carries the exact OriginWeave-owned node handle, and delegates immediate-use session/context/origin/document-epoch validation to the browser authority boundary. CI run `31431277478`, Manifest V3 Compatibility run `31431277521`, and CodeRabbit exact-head status succeed. This remains descriptive execution input, not policy authorization, business-risk classification, browser I/O or action success. | +| #59 | Real pinned-Chromium history mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #56. Test-only head `4b5f393a7420541723a07243b83cdaa7e28948de` and CI run `31432051381` established the intended repository-contract RED because controlled `history.addUrl`/`deleteUrl` lifecycle support was absent. Current exact head `b0d9c905fd7a50128eb1dde643b8a3a0f9cb1dc8` adds a loopback-only add → exact readback → delete → absence-verification lifecycle in the ephemeral compatibility profile and records it in the changelog. Exact-head checks are still in progress; no predecessor-head success is transferred. This remains compatibility evidence only and grants no Agent history capability. | ## Historical lineage From de845bb8cd061ebec7c02610b126ce443639a643 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:10:12 +0900 Subject: [PATCH 084/130] docs(fitness): reconcile action-target and history lanes --- docs/DOCUMENTATION_FITNESS.md | 61 +++++++++++++++++++++++------------ 1 file changed, 40 insertions(+), 21 deletions(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index a256d5a4..9dd90774 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -17,21 +17,21 @@ File existence alone is never sufficient. An artifact can exist and still be sta | Documentation family | Fitness | Current evidence / remaining boundary | |---|---|---| -| PRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Protected-main requirements remain distinct from active evidence. #37 is the current bounded-HTTP replacement; #45→#46→#53→#55 narrows sensitive-handle lifecycle, reservation, revocation and audience admission without creating the trusted broker; #47→#50→#54 narrows resolution freshness through the socket-use boundary; #51/#52/#57 are browser-runtime prerequisites, not a real Chromium adapter; #43/#49/#56 are MV3 compatibility evidence, not Agent authority. | -| TRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Implementation inventory uses one protected-main status plus separate active/non-shipped evidence. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth. Active value objects, semantic matching and compatibility fixtures do not imply deployed services or complete runtime paths. | -| Root Architecture | **PRESENT-CURRENT with follow-up** | Chromium compatibility kernel + Rust authority-bearing control plane remains correct. #47/#50/#54 tighten ADR 0004; #45/#46/#53/#55 remain inside ADR 0007; #40/#52/#57 remain inside browser authority/structured-observation/action-boundary decisions; #43/#49/#56 remain compatibility work under issue #27. No later lane introduces a new trust domain, persistence owner or deployed component. | +| PRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Protected-main requirements remain distinct from active evidence. #37 is the current bounded-HTTP replacement; #45→#46→#53→#55 narrows sensitive-handle lifecycle, reservation, revocation and audience admission without creating the trusted broker; #47→#50→#54 narrows resolution freshness through the socket-use boundary; #51/#52/#57/#58 are browser-runtime prerequisites, not a real Chromium adapter; #43/#49/#56/#59 are MV3 compatibility evidence, not Agent authority. | +| TRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Implementation inventory uses one protected-main status plus separate active/non-shipped evidence. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth. Active value objects, semantic matching/action-target binding and compatibility fixtures do not imply deployed services or complete runtime paths. | +| Root Architecture | **PRESENT-CURRENT with follow-up** | Chromium compatibility kernel + Rust authority-bearing control plane remains correct. #47/#50/#54 tighten ADR 0004; #45/#46/#53/#55 remain inside ADR 0007; #40/#52/#57/#58 remain inside browser authority/structured-observation/action-boundary decisions; #43/#49/#56/#59 remain compatibility work under issue #27. No later lane introduces a new trust domain, persistence owner or deployed component. | | ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 are discoverable without promoting Proposed decisions. Repository-scoped identifiers are reserved across protected main and active work. | -| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 separates MV3 compatibility from extension-to-Agent authority; Proposed ADR 0014 governs ADR acceptance. #53/#54/#55/#56/#57 refine existing decisions and do not independently justify new ADRs. | -| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. `uml/extension-authority.md` closes the permission-vs-Agent-authority gap. Network freshness should reflect the socket-use recheck after #54 integrates; detailed real-Chromium sequence remains deferred until issue #28 stabilizes. | -| Conceptual ERD/domain model | **PRESENT-CURRENT** | The ERD remains explicitly conceptual unless a real persistence owner/schema is implemented. #45/#46/#47/#48/#50/#51/#52/#53/#54/#55/#56/#57 add no OriginWeave-owned durable store, so manufacturing tables for in-memory/value/query/fixture primitives would be false architecture. | -| Traceability | **REPAIRED IN THIS CHANGE with volatile evidence refresh required** | Uses `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`. The dated maturity appendix carries volatile exact heads for current active lanes through #57. | -| Threat model / Security | **PRESENT-CURRENT with follow-up** | Untrusted content, network, secret, provenance and extension risks are covered. #54 narrows resolution-to-socket TOCTOU only on active work; #48 is revocation-material freshness only; #53/#55 narrow handle revocation/audience misuse only in process; #52 binds semantic relationships to exact browser authority; #57 performs bounded semantic matching without minting selector or action authority. None creates a broader authority grant. | -| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code function/line/region/branch coverage, rustdoc and realistic boundary testing remain explicit. Active work uses intentional RED evidence followed by narrow production changes. #52's relationship boundary and #57's typed-query boundary were compile-time RED before production implementation; #56 proved a stale compatibility contract against a real browser workflow. | -| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. Later active lanes add no new daemon/service, so no SLO/RPO/RTO or runbook is fabricated. First-party socket timing and browser fixture cleanup remain implementation concerns within existing runtime boundaries. | -| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented. #52 is an internal authority-bound semantic-observation API and #57 is an internal bounded typed-query API over those observations; neither is a BiDi/CDP/WebMCP wire protocol or action executor. #55 is an in-process policy API, not authenticated service identity; #56 is a compatibility fixture, not a product protocol. | -| Release / rollback / provenance | **PRESENT-CURRENT** | Release remains bound to one exact integrated protected head. Active stacks #40→#52→#57, #47→#50→#54, #45→#46→#53→#55, and #43→#49/#56 must preserve dependency order; predecessor-head success cannot satisfy a later head. | +| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 separates MV3 compatibility from extension-to-Agent authority; Proposed ADR 0014 governs ADR acceptance. #53/#54/#55/#56/#57/#58/#59 refine existing decisions and do not independently justify new ADRs. | +| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. `uml/extension-authority.md` closes the permission-vs-Agent-authority gap. Network freshness should reflect the socket-use recheck after #54 integrates; detailed real-Chromium sequence remains deferred until issue #28 stabilizes. #58 narrows an internal action-target bridge but does not yet justify freezing adapter/process topology. | +| Conceptual ERD/domain model | **PRESENT-CURRENT** | The ERD remains explicitly conceptual unless a real persistence owner/schema is implemented. #45/#46/#47/#48/#50/#51/#52/#53/#54/#55/#56/#57/#58/#59 add no OriginWeave-owned durable store, so manufacturing tables for in-memory/value/query/action-target/fixture primitives would be false architecture. | +| Traceability | **REPAIRED IN THIS CHANGE with volatile evidence refresh required** | Uses `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`. The dated maturity appendix carries volatile exact heads for current active lanes through #59. | +| Threat model / Security | **PRESENT-CURRENT with follow-up** | Untrusted content, network, secret, provenance and extension risks are covered. #54 narrows resolution-to-socket TOCTOU only on active work; #48 is revocation-material freshness only; #53/#55 narrow handle revocation/audience misuse only in process; #52 binds semantic relationships to exact browser authority; #57 performs bounded semantic matching; #58 binds an advertised node-local action to the exact node authority without minting policy authority; #59 mutates only controlled ephemeral history state for compatibility evidence. None creates a broader authority grant. | +| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code function/line/region/branch coverage, rustdoc and realistic boundary testing remain explicit. Active work uses intentional RED evidence followed by narrow production changes. #52's relationship boundary, #57's typed-query boundary and #58's action-target boundary were compile-time RED before production implementation; #56 repaired stale bookmark compatibility evidence, and #59 established an exact repository-contract RED before adding a real Chromium history add/read/delete/absence-verification lifecycle. | +| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. Later active lanes add no new daemon/service, so no SLO/RPO/RTO or runbook is fabricated. First-party socket timing and browser fixture cleanup remain implementation concerns within existing runtime boundaries. #59 explicitly verifies cleanup of its synthetic history entry. | +| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented. #52 is an internal authority-bound semantic-observation API, #57 is an internal bounded typed-query API, and #58 is an internal authority-bound node-action-target bridge; none is a BiDi/CDP/WebMCP wire protocol, browser input executor, policy approval or post-condition proof. #55 is an in-process policy API, not authenticated service identity; #56/#59 are compatibility fixtures, not product protocols. | +| Release / rollback / provenance | **PRESENT-CURRENT** | Release remains bound to one exact integrated protected head. Active stacks #40→#52→#57→#58, #47→#50→#54, #45→#46→#53→#55, and #43→#49/#56→#59 must preserve dependency order; predecessor-head success cannot satisfy a later head. | | Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. #53 adds first-revocation-wins in-process state and #55 adds audience binding, but authenticated workload identity, durable broker storage, protected-value resolution/fill, KMS, cross-process transactionality, compensation, retention and model-disclosure lifecycle remain open under issue #10. | -| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references distinguish draft/experimental material from final normative standards. | +| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references distinguish draft/experimental material from final normative standards. Chrome's current `history` API contract confirms `history` permission plus `addUrl`, `search` and `deleteUrl`; exact release evidence remains pinned to the repository's Chromium compatibility baseline rather than this living documentation alone. | ## 3. Reconciliation findings and resolution state @@ -58,11 +58,11 @@ The audience string accepted by the value/policy primitive is **not authenticati ### 3.3 Manifest V3 compatibility -Protected main has executable pinned-Chromium evidence for service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart persistence and repeatability. Active #43 adds bounded downloads compatibility; #49 adds per-trial ephemeral-profile isolation; #56 proves a bounded real bookmark mutation lifecycle using `chrome.bookmarks.create` → `get` → `remove` with cleanup while retaining history coverage. +Protected main has executable pinned-Chromium evidence for service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart persistence and repeatability. Active #43 adds bounded downloads compatibility; #49 adds per-trial ephemeral-profile isolation; #56 proves a bounded real bookmark mutation lifecycle using `chrome.bookmarks.create` → `get` → `remove` with cleanup; #59 adds a separate controlled history mutation lifecycle using `chrome.history.addUrl` → exact readback → `deleteUrl` → absence verification. -PR #56 also exposed and repaired a repository-contract drift: the real browser workflow already exercised mutation successfully while a Python source contract still required historical read-only `chrome.bookmarks.getTree`. +PR #56 exposed and repaired repository-contract drift where real browser mutation already succeeded while a Python source contract still required historical read-only `chrome.bookmarks.getTree`. PR #59 begins from the opposite direction: exact-head CI first proves that the requested history mutation lifecycle is absent, then the fixture implementation supplies that behavior. The current Chrome Extensions history reference requires the `history` permission and exposes Promise-returning `addUrl`, `search` and `deleteUrl`; OriginWeave still binds release evidence to its pinned Chromium fixture rather than treating living vendor documentation as execution proof. -**Resolved on this documentation branch:** complete compatibility remains Planned under issue #27. #43/#49/#56 are active compatibility evidence only. Proposed ADR 0013 remains the authority separator: Chromium permission or browser compatibility success is not an OriginWeave Agent capability, policy grant, approval or protected-value authority. +**Resolved on this documentation branch:** complete compatibility remains Planned under issue #27. #43/#49/#56/#59 are active compatibility evidence only. Proposed ADR 0013 remains the authority separator: Chromium permission or browser compatibility success is not an OriginWeave Agent capability, policy grant, approval or protected-value authority. ### 3.4 Browser identifier authority @@ -126,6 +126,22 @@ The test-only head intentionally failed compilation on the absent public query/e **Documentation consequence:** query matching is descriptive selection only. #57 does not expose CSS/XPath/raw DOM selector languages, arbitrary JavaScript, browser I/O, action dispatch, capability grants, policy approval or persistence. It refines the existing observation/action architecture and therefore does not independently justify a new ADR, deployed component, topology view or physical ERD entity. +### 3.13 Authority-bound semantic node action target + +Active PR #58 is stacked on #57 and remains non-shipped. Its action-target bridge accepts only a `NodeActionKind` advertised by an already validated semantic observation, carries the exact OriginWeave-owned node handle, and delegates immediate-use validation to the existing browser session/context/origin/document-epoch authority boundary. + +Current exact-head CI, the inherited pinned-Chromium compatibility workflow and CodeRabbit are green. The bridge is intentionally narrower than execution authority: it does not classify the business risk of an action, make a policy or approval decision, dispatch browser input, observe a post-condition, expose raw selectors, or make a browser/protocol identifier durable. + +**Documentation consequence:** #58 is `IMPLEMENTED_ON_ACTIVE_PR` evidence for an internal authority-preserving action-target value only. It refines existing Accepted browser observation/action decisions and does not independently justify a new ADR, deployed component, process topology, physical ERD entity or product protocol. + +### 3.14 Controlled Manifest V3 history mutation compatibility + +Active PR #59 is stacked on #56 and remains non-shipped. Its test-only exact head established a deliberate RED because the compatibility fixture exposed history search only and lacked a bounded add/delete lifecycle. The subsequent implementation is restricted to the controlled loopback sender, creates one synthetic `history-entry.html` visit, requires exact readback, removes it in `finally`, and verifies the synthetic URL is absent afterwards. + +The exact Chrome API surface is vendor compatibility evidence, not authority: the extension needs the `history` permission, while `addUrl`, `search` and `deleteUrl` operate inside the isolated compatibility profile. No history value is exposed to a model, no human/default profile is used, and no OriginWeave Agent history capability is created. + +**Documentation consequence:** #59 remains `IMPLEMENTED_ON_ACTIVE_PR` compatibility evidence under issue #27. It does not justify a new ADR, UML topology, persistence entity, general history tool or policy grant. Its current exact head remains under validation until all exact-head checks complete. + ## 4. Durable conversation decisions captured in GitHub The canonical graph must continue to preserve these durable decisions: @@ -159,6 +175,8 @@ The canonical graph must continue to preserve these durable decisions: 27. Sensitive-handle audience must ultimately be derived from authenticated workload/service identity; accepting an audience string in an internal value object is not authentication. 28. A real browser compatibility fixture may mutate and clean up test state, but compatibility success still cannot substitute for OriginWeave Agent-authority evidence. 29. A semantic node query may select bounded reviewed observation evidence, but query success is neither browser-selector authority nor permission to execute the advertised node-local action. +30. Binding a queried semantic node to one advertised node-local action must preserve the exact OriginWeave node authority and remain separate from business-risk classification, policy approval, browser dispatch and verified success. +31. Manifest V3 history mutation compatibility may create and remove only controlled synthetic test state in the isolated fixture profile; browser-history compatibility is not an OriginWeave Agent history grant. ## 5. Architecture views still legitimately deferred @@ -206,7 +224,7 @@ isolated profile/context -> semantic observation -> bounded exact-authority relationships -> typed semantic query --> opaque node authority +-> authority-bound semantic action target -> typed policy decision -> real browser input -> observed post-condition @@ -214,7 +232,7 @@ isolated profile/context -> teardown/recovery ``` -Active #52 and #57 make the semantic-observation and typed-query boundaries more concrete but still do not establish the browser adapter, process topology, policy-to-node action bridge, real input or post-condition verification sequence. Temporary protocol/field names must not be frozen into authoritative UML before executable contracts stabilize. +Active #52, #57 and #58 make the semantic-observation, typed-query and authority-preserving action-target boundaries more concrete but still do not establish the browser adapter, process topology, business-risk policy bridge, real input or post-condition verification sequence. Temporary protocol/field names must not be frozen into authoritative UML before executable contracts stabilize. ### 5.4 Trusted sensitive-data broker — deferred until issue #10 owns a real runtime boundary @@ -237,14 +255,15 @@ Protected-main policy/evidence plus active #45→#46→#53→#55 do not justify - sensitive-data evidence reconciliation through #55 without inventing broker persistence or authenticated service identity; - resolution-freshness reconciliation through socket-use recheck #54 without inventing resolver/proxy authority; - semantic-observation authority/relationship reconciliation for #52 without promoting it to a browser adapter; -- typed semantic-query reconciliation for #57 without promoting semantic matching to selector/action authority; and -- MV3 compatibility reconciliation through #56 without equating browser permission with Agent authority. +- typed semantic-query reconciliation for #57 without promoting semantic matching to selector/action authority; +- semantic action-target reconciliation for #58 without promoting node-local action binding to policy approval or browser execution; and +- MV3 compatibility reconciliation through #59 without equating browser permission or controlled fixture mutation with Agent authority. ### Still required - exact-head CI/security/review acceptance of this documentation PR after every documentation mutation; - integration before any of these branch repairs become protected-main truth; -- re-reconciliation whenever active PR #37, #40, #43, #45, #46, #47, #48, #49, #50, #51, #52, #53, #54, #55, #56 or #57 integrates, closes, is superseded or materially changes head; +- re-reconciliation whenever active PR #37, #40, #43, #45, #46, #47, #48, #49, #50, #51, #52, #53, #54, #55, #56, #57, #58 or #59 integrates, closes, is superseded or materially changes head; - network-authority sequence reconciliation after #47→#50→#54 reaches protected main; - detailed real-Chromium vertical-slice UML when issue #28 implementation contracts are stable; - trusted-broker UML/ERD/operability additions only when issue #10 establishes real runtime/persistence ownership; From ce41fc1319ae6458b8a86d61702083013f0586ee Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:10:52 +0900 Subject: [PATCH 085/130] test(docs): enforce maturity through PR 59 --- tests/test_documentation_fitness_contract.py | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index cfaacba1..53707864 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -163,7 +163,7 @@ def test_current_replacement_lanes_are_not_promoted_to_protected_main(self) -> N encoding="utf-8" ) - for pr_number in (37, 40, 43, 52): + for pr_number in (37, 40, 43, 52, 58, 59): row = _active_pr_row(appendix, pr_number) with self.subTest(pr_number=pr_number): self.assertIn("**IMPLEMENTED_ON_ACTIVE_PR**", row) @@ -192,12 +192,28 @@ def test_semantic_observation_lane_stays_non_shipped_and_provenance_bound(self) self.assertIn("active PR #52", prd) self.assertIn("not a browser observation adapter", prd) + def test_action_target_and_history_lanes_preserve_authority_boundaries(self) -> None: + """New active lanes must not turn descriptive or compatibility evidence into authority.""" + assessment = (DOCS_ROOT / "DOCUMENTATION_FITNESS.md").read_text(encoding="utf-8") + appendix = (DOCS_ROOT / "evidence" / "2026-08-10-active-pr-maturity.md").read_text( + encoding="utf-8" + ) + action_row = _active_pr_row(appendix, 58) + history_row = _active_pr_row(appendix, 59) + + self.assertIn("descriptive execution input, not policy authorization", action_row) + self.assertIn("grants no Agent history capability", history_row) + self.assertIn("business-risk classification", assessment) + self.assertIn("OriginWeave Agent history grant", assessment) + self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", action_row) + self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", history_row) + def test_active_pr_maturity_appendix_tracks_current_dependency_stacks(self) -> None: """Volatile evidence must retain the current browser/network/sensitive stacks explicitly.""" appendix = (DOCS_ROOT / "evidence" / "2026-08-10-active-pr-maturity.md").read_text( encoding="utf-8" ) - for marker in ("| #52 |", "| #53 |", "| #54 |", "| #55 |"): + for marker in ("| #52 |", "| #53 |", "| #54 |", "| #55 |", "| #58 |", "| #59 |"): with self.subTest(marker=marker): self.assertIn(marker, appendix) self.assertIn("authenticated workload/service identity", appendix) From f7aa7bc8aa49e189833d67c61da8f5ee0a1e9b4e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:13:47 +0900 Subject: [PATCH 086/130] docs(doctoring): record current history API evidence --- docs/doctoring/mv3-compatibility.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/docs/doctoring/mv3-compatibility.md b/docs/doctoring/mv3-compatibility.md index 607a2485..394fc801 100644 --- a/docs/doctoring/mv3-compatibility.md +++ b/docs/doctoring/mv3-compatibility.md @@ -1,12 +1,14 @@ # Manifest V3 compatibility evidence baseline - **Status:** Active implementation evidence for issue #27 -- **Reviewed:** 2026-08-09 +- **Reviewed:** 2026-08-11 - **Pinned browser:** Chrome for Testing `150.0.7871.129`, Chromium revision `r1639810` -OriginWeave uses Chromium as its compatibility kernel, so browser-extension compatibility must be demonstrated with executable Chromium evidence rather than inferred from architecture alone. This first bounded lane exercises a controlled unpacked Manifest V3 extension against one exact Chrome for Testing build. It covers an extension service worker, content-script injection, `chrome.storage.local`, declarative network blocking, and one real WebDriver click/post-condition. It does **not claim 100% Chrome extension compatibility** and does not make claims about Chrome Web Store distribution, Google-only services, proprietary codecs, DRM, native messaging, enterprise policy, restart/update migration, or every Chrome extension API. +OriginWeave uses Chromium as its compatibility kernel, so browser-extension compatibility must be demonstrated with executable Chromium evidence rather than inferred from architecture alone. This first bounded lane exercises a controlled unpacked Manifest V3 extension against one exact Chrome for Testing build. It covers an extension service worker, content-script injection, `chrome.storage.local`, declarative network blocking, and one real WebDriver click/post-condition. Active stacked compatibility work additionally exercises declared Chrome API surfaces such as downloads, bookmark mutation, and controlled history mutation. It does **not claim 100% Chrome extension compatibility** and does not make claims about Chrome Web Store distribution, Google-only services, proprietary codecs, DRM, native messaging, enterprise policy, restart/update migration, or every Chrome extension API. -The checked-in fixture is intentionally local-only. Its host permission is limited to loopback HTTP used by the deterministic test server. It contains no remote code, user credential, model call, external content, native-messaging host, or production PII. Chrome permissions remain distinct from the explicit OriginWeave extension-to-Agent grant implemented in `originweave-core`. +The checked-in fixture is intentionally local-only. Its host permission is limited to loopback HTTP used by the deterministic test server. It contains no remote code, user credential, model call, external content, native-messaging host, or production PII. Chrome permissions remain distinct from the explicit OriginWeave extension-to-Agent grant implemented in `originweave-core`. Compatibility mutation tests create only controlled synthetic state inside the ephemeral test profile and must clean it up; successful API compatibility never grants the OriginWeave Agent ambient bookmarks/history/downloads authority. + +For history compatibility specifically, the current official Chrome Extensions API documents the `history` manifest permission and Promise-returning `chrome.history.addUrl`, `chrome.history.search`, and `chrome.history.deleteUrl` methods. This living vendor reference establishes API semantics only. OriginWeave release evidence continues to depend on the exact pinned Chromium fixture and exact-head CI result rather than inferring compatibility from documentation. The CI lane downloads the exact Chrome/ChromeDriver version from the official Chrome for Testing public bucket, records SHA-256 receipts for the downloaded archives, verifies the runtime-reported browser version, and emits bounded JSON compatibility evidence. A future release-quality compatibility matrix should additionally pin published artifact digests or equivalent immutable supply-chain identity when the upstream distribution exposes that identity in an authoritative machine-readable form. @@ -20,6 +22,8 @@ Chrome for Developers. (2023, May 2). *The extension service worker lifecycle*. Chrome for Developers. (n.d.). *chrome.declarativeNetRequest*. Google. Retrieved August 9, 2026, from https://developer.chrome.com/docs/extensions/reference/api/declarativeNetRequest +Chrome for Developers. (n.d.). *chrome.history*. Google. Retrieved August 11, 2026, from https://developer.chrome.com/docs/extensions/reference/api/history + Chrome for Developers. (n.d.). *Manifest file format*. Google. Retrieved August 9, 2026, from https://developer.chrome.com/docs/extensions/reference/manifest Bynens, M. (2023, June 12). *Chrome for Testing*. Chrome for Developers. https://developer.chrome.com/docs/automation-and-testing/chrome-for-testing From cc5650d1bb35bf6b77314314e1e02e5d10e65b37 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:20:47 +0900 Subject: [PATCH 087/130] test(docs): bind active evidence checks to semantics --- tests/test_documentation_active_pr_evidence_contract.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/test_documentation_active_pr_evidence_contract.py b/tests/test_documentation_active_pr_evidence_contract.py index 6ceef28a..5e961adc 100644 --- a/tests/test_documentation_active_pr_evidence_contract.py +++ b/tests/test_documentation_active_pr_evidence_contract.py @@ -77,8 +77,8 @@ def test_typed_semantic_query_evidence_stays_descriptive_and_bounded(self) -> No self.assertIn(marker, row) self.assertIn("Draft stacked on exact #52 head", row) - self.assertIn("CI run `31429995885` passes", row) - self.assertIn("exact owned production function/line/region/branch coverage", row) + self.assertIn("CI run `31429995885`", row) + self.assertIn("CodeRabbit exact-head status succeed", row) self.assertIn("remains Draft because #52/#40 are active prerequisites", row) def test_sensitive_audience_evidence_does_not_claim_authentication(self) -> None: @@ -103,7 +103,7 @@ def test_bookmark_mutation_is_compatibility_not_agent_authority(self) -> None: "Chromium permission or browser compatibility success is not an OriginWeave Agent capability", self.fitness, ) - self.assertIn("#43/#49/#56 are active compatibility evidence only", self.fitness) + self.assertIn("#43/#49/#56/#59 are active compatibility evidence only", self.fitness) def test_erd_stays_conceptual_without_persistence_owner(self) -> None: """Active in-memory/value primitives must not manufacture a physical data model.""" From ff0f0129edc980f1c4b3878f0b948ac8bbce0b1f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:30:45 +0900 Subject: [PATCH 088/130] docs(mv3): publish supported capability evidence matrix --- docs/doctoring/mv3-compatibility.md | 37 +++++++++++++++++++++++++++-- 1 file changed, 35 insertions(+), 2 deletions(-) diff --git a/docs/doctoring/mv3-compatibility.md b/docs/doctoring/mv3-compatibility.md index 394fc801..2ac3459e 100644 --- a/docs/doctoring/mv3-compatibility.md +++ b/docs/doctoring/mv3-compatibility.md @@ -4,13 +4,46 @@ - **Reviewed:** 2026-08-11 - **Pinned browser:** Chrome for Testing `150.0.7871.129`, Chromium revision `r1639810` -OriginWeave uses Chromium as its compatibility kernel, so browser-extension compatibility must be demonstrated with executable Chromium evidence rather than inferred from architecture alone. This first bounded lane exercises a controlled unpacked Manifest V3 extension against one exact Chrome for Testing build. It covers an extension service worker, content-script injection, `chrome.storage.local`, declarative network blocking, and one real WebDriver click/post-condition. Active stacked compatibility work additionally exercises declared Chrome API surfaces such as downloads, bookmark mutation, and controlled history mutation. It does **not claim 100% Chrome extension compatibility** and does not make claims about Chrome Web Store distribution, Google-only services, proprietary codecs, DRM, native messaging, enterprise policy, restart/update migration, or every Chrome extension API. +OriginWeave uses Chromium as its compatibility kernel, so browser-extension compatibility must be demonstrated with executable Chromium evidence rather than inferred from architecture alone. The protected-main lane exercises a controlled unpacked Manifest V3 extension against one exact Chrome for Testing build and proves service-worker, content-script, storage, declarative-network-request, tabs, windows, scripting, commands, side-panel, bookmarks/history read compatibility, restart persistence, repeatability, and one real WebDriver click/post-condition. Active stacked compatibility work adds downloads, bounded bookmark/history mutation, profile isolation, and explicit extension update/version-migration evidence. OriginWeave does **not claim 100% Chrome extension compatibility**. The checked-in fixture is intentionally local-only. Its host permission is limited to loopback HTTP used by the deterministic test server. It contains no remote code, user credential, model call, external content, native-messaging host, or production PII. Chrome permissions remain distinct from the explicit OriginWeave extension-to-Agent grant implemented in `originweave-core`. Compatibility mutation tests create only controlled synthetic state inside the ephemeral test profile and must clean it up; successful API compatibility never grants the OriginWeave Agent ambient bookmarks/history/downloads authority. +## Supported-capability evidence matrix + +This matrix separates protected-main executable evidence from active, non-shipped evidence and from genuinely unproven surfaces. A row marked **ACTIVE_PR** is never a release claim; exact head/run provenance belongs in `docs/evidence/2026-08-10-active-pr-maturity.md` and must be refreshed when the branch changes. + +| Compatibility surface | Evidence maturity | Current evidence boundary | Known gap / non-claim | +|---|---|---|---| +| Manifest V3 unpacked extension load | **PROTECTED_MAIN** | Exact pinned Chromium fixture loads through the dedicated compatibility workflow. | No Chrome Web Store distribution or arbitrary third-party extension-install claim. | +| Service worker start/restart + event response | **PROTECTED_MAIN** | Worker startup count and message response are observed across a real browser restart. | Suspend timing and the full Chrome event catalog are not exhaustively covered. | +| Content-script injection + isolated fixture page | **PROTECTED_MAIN** | Controlled content script mutates bounded DOM evidence on loopback. | This is not a general raw-DOM or arbitrary-script Agent API. | +| `chrome.storage.local` + restart persistence | **PROTECTED_MAIN** | State is initialized on the first browser pass and required to persist on restart. | No OriginWeave-owned durable application database is implied. | +| `declarativeNetRequest` | **PROTECTED_MAIN** | Controlled local rule blocks its fixture request in pinned Chromium. | No claim for every DNR rule/action combination. | +| `tabs`, `windows`, `scripting`, `commands`, `sidePanel` | **PROTECTED_MAIN** | Each declared API is exercised in real Chromium and required by the repeatability gate. | Chrome API permission does not become Agent capability. | +| Bookmarks read compatibility | **PROTECTED_MAIN** | Protected-main fixture exercises the declared bookmarks surface. | Ambient human-profile bookmark authority is not granted. | +| Bookmarks create/read/delete lifecycle | **ACTIVE_PR #56** | Controlled synthetic bookmark is created, read back, and removed in the ephemeral compatibility profile. | Compatibility only; no Agent bookmark capability. | +| History read compatibility | **PROTECTED_MAIN** | Protected-main fixture exercises bounded history search in the isolated profile. | No model-visible browsing-history content or default-profile access. | +| History add/read/delete lifecycle | **ACTIVE_PR #59** | Controlled synthetic loopback visit is added, exactly read back, deleted in `finally`, and required to be absent afterward. | Compatibility only; no Agent history capability. | +| Downloads | **ACTIVE_PR #43** | Controlled loopback payload is downloaded and validated through pinned Chromium. | No general download persistence, unsafe filename, or Agent filesystem authority claim. | +| Per-trial Agent Task profile isolation | **ACTIVE_PR #49** | Compatibility trials use isolated ephemeral profiles rather than ambient human state. | Full production Agent Task browser orchestration remains issue #28 work. | +| Extension update/version migration | **ACTIVE_PR #60** | Trial-local extension copy transitions `1.0.0` → `1.0.1` on the same ephemeral profile; versioned storage state is required to migrate and real pinned-Chromium evidence reports the update-migration surface. | No Chrome Web Store updater, enterprise deployment channel, arbitrary downgrade, or protected-main release claim. | +| Managed enterprise extension policy | **PLANNED** | No protected-main executable compatibility proof yet. | Do not infer managed-policy support from Chromium ancestry alone. | +| Native messaging | **PLANNED / SECURITY-GATED** | No compatibility claim. | Future support requires an explicit host-managed allow-list and process boundary. | +| Google-only services, proprietary codecs, DRM, Web Store licensing | **OUT_OF_SCOPE FOR COMPATIBILITY CLAIM** | Deliberately excluded from the open compatibility claim. | Chromium/API compatibility must not be conflated with Google service or licensing equivalence. | + +The release-quality capability matrix must remain coupled to executable evidence. Adding a row to documentation never creates support; declaring a new supported capability must first add a realistic regression test and pinned-Chromium proof. Conversely, if a declared protected-main capability regresses, the release gate must fail rather than silently downgrading the matrix. + +## History API primary evidence + For history compatibility specifically, the current official Chrome Extensions API documents the `history` manifest permission and Promise-returning `chrome.history.addUrl`, `chrome.history.search`, and `chrome.history.deleteUrl` methods. This living vendor reference establishes API semantics only. OriginWeave release evidence continues to depend on the exact pinned Chromium fixture and exact-head CI result rather than inferring compatibility from documentation. -The CI lane downloads the exact Chrome/ChromeDriver version from the official Chrome for Testing public bucket, records SHA-256 receipts for the downloaded archives, verifies the runtime-reported browser version, and emits bounded JSON compatibility evidence. A future release-quality compatibility matrix should additionally pin published artifact digests or equivalent immutable supply-chain identity when the upstream distribution exposes that identity in an authoritative machine-readable form. +## Update-migration evidence boundary + +Restart persistence and extension update migration are separate compatibility claims. A successful restart proves only that state survives a new browser process. The active update-migration lane additionally uses a trial-local copy of the checked-in fixture, preserves the same extension path and ephemeral profile across passes, changes only the controlled manifest version from `1.0.0` to `1.0.1`, observes `chrome.runtime.getManifest().version`, and requires the fixture schema marker to migrate from version 1 to version 2. The checked-in fixture is not rewritten by the test. This establishes one deterministic unpacked-extension version transition; it does not establish Chrome Web Store update behavior, enterprise rollout semantics, downgrade behavior, or arbitrary third-party extension migration safety. + +## Supply-chain and repeatability evidence + +The CI lane downloads the exact Chrome/ChromeDriver version from the official Chrome for Testing public bucket, records SHA-256 receipts for the downloaded archives, verifies the runtime-reported browser version, and emits bounded JSON compatibility evidence. A future release-quality matrix should additionally pin published artifact digests or equivalent immutable supply-chain identity when the upstream distribution exposes that identity in an authoritative machine-readable form. ## Primary references — APA 7th From 66a6032d12c1a9503553689e04bc6f33813d1c4c Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:31:45 +0900 Subject: [PATCH 089/130] docs(fitness): refresh active maturity through PR 60 --- docs/evidence/2026-08-10-active-pr-maturity.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index a264cb09..ee17e3df 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -34,7 +34,8 @@ This dated appendix records volatile implementation evidence that must not be em | #56 | Real pinned-Chromium bookmark mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43. Exact head `e1099e35ac000c7bf87ea75666cfdd928a386370` aligns the fixture and repository contracts with the bounded create → get → remove bookmark lifecycle; CI run `31427219564`, Manifest V3 Compatibility run `31427220684`, and CodeRabbit exact-head status all succeed. This is compatibility evidence only: it grants no OriginWeave Agent capability and does not complete issue #27's full extension matrix. | | #57 | Typed semantic-node query over bounded observation evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #52 head `94fd284fe41746eeba9edc05d9753903b1c41ebf`. Test-only head `d0cd133f5be62fff99612d5b08aa4cf08ce2f29f` and CI run `31429065905` intentionally proved the missing public query boundary by failing compilation on absent `SemanticNodeQuery`/`SemanticNodeQueryError`. Current exact head `b4fa49953cbbb21c879a3340e264a6e132e41634` implements bounded exact role, accessible-name and typed-action selection against already validated `SemanticNodeObservation` values, with no CSS/XPath/raw DOM selector language, arbitrary JavaScript, browser I/O or action authority. CI run `31429995885`, Manifest V3 Compatibility run `31429997851`, and CodeRabbit exact-head status succeed. The PR remains Draft because #52/#40 are active prerequisites. | | #58 | Authority-bound semantic-node action target | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #57. Current exact head `efe440c7a609cac187faacfa03a4df904a99386f` accepts only an advertised `NodeActionKind`, carries the exact OriginWeave-owned node handle, and delegates immediate-use session/context/origin/document-epoch validation to the browser authority boundary. CI run `31431277478`, Manifest V3 Compatibility run `31431277521`, and CodeRabbit exact-head status succeed. This remains descriptive execution input, not policy authorization, business-risk classification, browser I/O or action success. | -| #59 | Real pinned-Chromium history mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #56. Test-only head `4b5f393a7420541723a07243b83cdaa7e28948de` and CI run `31432051381` established the intended repository-contract RED because controlled `history.addUrl`/`deleteUrl` lifecycle support was absent. Current exact head `b0d9c905fd7a50128eb1dde643b8a3a0f9cb1dc8` adds a loopback-only add → exact readback → delete → absence-verification lifecycle in the ephemeral compatibility profile and records it in the changelog. Exact-head checks are still in progress; no predecessor-head success is transferred. This remains compatibility evidence only and grants no Agent history capability. | +| #59 | Real pinned-Chromium history mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #56. Test-only head `4b5f393a7420541723a07243b83cdaa7e28948de` and CI run `31432051381` established the intended repository-contract RED because controlled `history.addUrl`/`deleteUrl` lifecycle support was absent. Current exact head `b0d9c905fd7a50128eb1dde643b8a3a0f9cb1dc8` adds loopback-only add → exact readback → delete → absence verification. CI run `31432338572`, Manifest V3 Compatibility run `31432338759`, and CodeRabbit exact-head status succeed, including exact owned production function/line/region/branch coverage. Compatibility evidence only; no Agent history capability. | +| #60 | Real pinned-Chromium extension update/version migration | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #59. Test-only head `a60875f70f8412db27ff1025b75d7ad4b8ddc38e` and CI run `31433305976` established the intended RED because no trial-local extension copy, version transition, migration state, or update-migration evidence existed. Current exact head `e696e19c9eaf3dedb104a5de4bdbd7970abf90d4` uses an ephemeral extension copy and one profile across initial `1.0.0`/initialized → restart `1.0.0`/current → update `1.0.1`/migrated passes. CI run `31433968874`, Manifest V3 Compatibility run `31433968931`, and CodeRabbit exact-head status succeed; the real browser evidence reports 3/3 trials and the exact update-migration surface. This does not claim Chrome Web Store/enterprise update semantics or Agent authority. | ## Historical lineage From 4b294780b931420ca80a37c776c4c18f1307fefc Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:32:35 +0900 Subject: [PATCH 090/130] test(docs): enforce MV3 capability matrix maturity --- ...v3_supported_capability_matrix_contract.py | 73 +++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 tests/test_mv3_supported_capability_matrix_contract.py diff --git a/tests/test_mv3_supported_capability_matrix_contract.py b/tests/test_mv3_supported_capability_matrix_contract.py new file mode 100644 index 00000000..2f056ab7 --- /dev/null +++ b/tests/test_mv3_supported_capability_matrix_contract.py @@ -0,0 +1,73 @@ +"""Regression contract for the canonical MV3 supported-capability evidence matrix.""" + +from __future__ import annotations + +import pathlib +import unittest + +ROOT = pathlib.Path(__file__).resolve().parents[1] +DOCTORING = ROOT / "docs" / "doctoring" / "mv3-compatibility.md" +MATURITY = ROOT / "docs" / "evidence" / "2026-08-10-active-pr-maturity.md" + + +class ManifestV3SupportedCapabilityMatrixContractTests(unittest.TestCase): + """Keep compatibility claims executable, maturity-scoped, and authority-safe.""" + + @classmethod + def setUpClass(cls) -> None: + cls.doctoring = DOCTORING.read_text(encoding="utf-8") + cls.maturity = MATURITY.read_text(encoding="utf-8") + + def test_matrix_separates_protected_active_planned_and_out_of_scope(self) -> None: + """The matrix must never collapse active evidence into protected-main support.""" + + for marker in ( + "## Supported-capability evidence matrix", + "**PROTECTED_MAIN**", + "**ACTIVE_PR #43**", + "**ACTIVE_PR #56**", + "**ACTIVE_PR #59**", + "**ACTIVE_PR #60**", + "**PLANNED**", + "**PLANNED / SECURITY-GATED**", + "**OUT_OF_SCOPE FOR COMPATIBILITY CLAIM**", + ): + with self.subTest(marker=marker): + self.assertIn(marker, self.doctoring) + + def test_update_migration_is_not_documented_as_restart_only(self) -> None: + """Update compatibility requires a version transition plus migrated state.""" + + for marker in ( + "Restart persistence and extension update migration are separate compatibility claims", + "`1.0.0` to `1.0.1`", + "schema marker to migrate from version 1 to version 2", + "checked-in fixture is not rewritten", + ): + with self.subTest(marker=marker): + self.assertIn(marker, self.doctoring) + + row = next( + line for line in self.maturity.splitlines() if line.startswith("| #60 |") + ) + self.assertIn("**IMPLEMENTED_ON_ACTIVE_PR**", row) + self.assertIn("e696e19c9eaf3dedb104a5de4bdbd7970abf90d4", row) + self.assertIn("CI run `31433968874`", row) + self.assertIn("Manifest V3 Compatibility run `31433968931`", row) + self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", row) + + def test_compatibility_never_grants_agent_authority(self) -> None: + """Chrome API success must remain separate from OriginWeave Agent grants.""" + + for marker in ( + "Chrome API permission does not become Agent capability", + "no Agent bookmark capability", + "no Agent history capability", + "does not claim Chrome Web Store/enterprise update semantics or Agent authority", + ): + with self.subTest(marker=marker): + self.assertTrue(marker in self.doctoring or marker in self.maturity) + + +if __name__ == "__main__": + unittest.main() From e93e5b3f9398ce5b95227c9e88eb3eb9e5874a59 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:38:39 +0900 Subject: [PATCH 091/130] test(docs): bind history authority assertion to semantics --- tests/test_documentation_fitness_contract.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/test_documentation_fitness_contract.py b/tests/test_documentation_fitness_contract.py index 53707864..33aefed2 100644 --- a/tests/test_documentation_fitness_contract.py +++ b/tests/test_documentation_fitness_contract.py @@ -202,7 +202,7 @@ def test_action_target_and_history_lanes_preserve_authority_boundaries(self) -> history_row = _active_pr_row(appendix, 59) self.assertIn("descriptive execution input, not policy authorization", action_row) - self.assertIn("grants no Agent history capability", history_row) + self.assertIn("no Agent history capability", history_row) self.assertIn("business-risk classification", assessment) self.assertIn("OriginWeave Agent history grant", assessment) self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", action_row) From 99c18b376f85e2990207497a3858b60c8a93d423 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:40:13 +0900 Subject: [PATCH 092/130] docs(mv3): separate isolated-world compatibility evidence --- docs/doctoring/mv3-compatibility.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/docs/doctoring/mv3-compatibility.md b/docs/doctoring/mv3-compatibility.md index 2ac3459e..571c4932 100644 --- a/docs/doctoring/mv3-compatibility.md +++ b/docs/doctoring/mv3-compatibility.md @@ -4,7 +4,7 @@ - **Reviewed:** 2026-08-11 - **Pinned browser:** Chrome for Testing `150.0.7871.129`, Chromium revision `r1639810` -OriginWeave uses Chromium as its compatibility kernel, so browser-extension compatibility must be demonstrated with executable Chromium evidence rather than inferred from architecture alone. The protected-main lane exercises a controlled unpacked Manifest V3 extension against one exact Chrome for Testing build and proves service-worker, content-script, storage, declarative-network-request, tabs, windows, scripting, commands, side-panel, bookmarks/history read compatibility, restart persistence, repeatability, and one real WebDriver click/post-condition. Active stacked compatibility work adds downloads, bounded bookmark/history mutation, profile isolation, and explicit extension update/version-migration evidence. OriginWeave does **not claim 100% Chrome extension compatibility**. +OriginWeave uses Chromium as its compatibility kernel, so browser-extension compatibility must be demonstrated with executable Chromium evidence rather than inferred from architecture alone. The protected-main lane exercises a controlled unpacked Manifest V3 extension against one exact Chrome for Testing build and proves service-worker, content-script, storage, declarative-network-request, tabs, windows, scripting, commands, side-panel, bookmarks/history read compatibility, restart persistence, repeatability, and one real WebDriver click/post-condition. Active stacked compatibility work adds downloads, bounded bookmark/history mutation, profile isolation, explicit extension update/version-migration evidence, and an exact content-script isolated-world check. OriginWeave does **not claim 100% Chrome extension compatibility**. The checked-in fixture is intentionally local-only. Its host permission is limited to loopback HTTP used by the deterministic test server. It contains no remote code, user credential, model call, external content, native-messaging host, or production PII. Chrome permissions remain distinct from the explicit OriginWeave extension-to-Agent grant implemented in `originweave-core`. Compatibility mutation tests create only controlled synthetic state inside the ephemeral test profile and must clean it up; successful API compatibility never grants the OriginWeave Agent ambient bookmarks/history/downloads authority. @@ -16,7 +16,8 @@ This matrix separates protected-main executable evidence from active, non-shippe |---|---|---|---| | Manifest V3 unpacked extension load | **PROTECTED_MAIN** | Exact pinned Chromium fixture loads through the dedicated compatibility workflow. | No Chrome Web Store distribution or arbitrary third-party extension-install claim. | | Service worker start/restart + event response | **PROTECTED_MAIN** | Worker startup count and message response are observed across a real browser restart. | Suspend timing and the full Chrome event catalog are not exhaustively covered. | -| Content-script injection + isolated fixture page | **PROTECTED_MAIN** | Controlled content script mutates bounded DOM evidence on loopback. | This is not a general raw-DOM or arbitrary-script Agent API. | +| Content-script injection | **PROTECTED_MAIN** | Controlled content script mutates bounded DOM evidence on loopback. | Injection alone does not prove JavaScript isolated-world semantics. | +| Content-script isolated-world separation | **ACTIVE_PR #61** | Page main-world and extension isolated-world JavaScript assign the same sentinel name to distinct values; compatibility reports ready only while the page still reads `page` and the content script reads `extension` in real pinned Chromium. | One deterministic fixture proof only; no arbitrary page-JavaScript bridge or Agent authority. | | `chrome.storage.local` + restart persistence | **PROTECTED_MAIN** | State is initialized on the first browser pass and required to persist on restart. | No OriginWeave-owned durable application database is implied. | | `declarativeNetRequest` | **PROTECTED_MAIN** | Controlled local rule blocks its fixture request in pinned Chromium. | No claim for every DNR rule/action combination. | | `tabs`, `windows`, `scripting`, `commands`, `sidePanel` | **PROTECTED_MAIN** | Each declared API is exercised in real Chromium and required by the repeatability gate. | Chrome API permission does not become Agent capability. | @@ -41,6 +42,10 @@ For history compatibility specifically, the current official Chrome Extensions A Restart persistence and extension update migration are separate compatibility claims. A successful restart proves only that state survives a new browser process. The active update-migration lane additionally uses a trial-local copy of the checked-in fixture, preserves the same extension path and ephemeral profile across passes, changes only the controlled manifest version from `1.0.0` to `1.0.1`, observes `chrome.runtime.getManifest().version`, and requires the fixture schema marker to migrate from version 1 to version 2. The checked-in fixture is not rewritten by the test. This establishes one deterministic unpacked-extension version transition; it does not establish Chrome Web Store update behavior, enterprise rollout semantics, downgrade behavior, or arbitrary third-party extension migration safety. +## Isolated-world evidence boundary + +Content-script injection and content-script JavaScript isolation are separate compatibility claims. Active PR #61 writes `window.originweaveWorldSentinel = "page"` in the fixture page's main world and repeatedly publishes that value through one controlled DOM attribute. The content script assigns the same global name to `"extension"` in its own execution world, waits a bounded interval, and only reports the existing compatibility surface ready when it simultaneously observes the page's published `page` value and its own `extension` value. If both scripts share one JavaScript global namespace, the page publisher changes to `extension` and real-browser compatibility fails. DOM sharing here is deliberate test evidence, not permission for arbitrary page content to become trusted instruction or Agent authority. + ## Supply-chain and repeatability evidence The CI lane downloads the exact Chrome/ChromeDriver version from the official Chrome for Testing public bucket, records SHA-256 receipts for the downloaded archives, verifies the runtime-reported browser version, and emits bounded JSON compatibility evidence. A future release-quality matrix should additionally pin published artifact digests or equivalent immutable supply-chain identity when the upstream distribution exposes that identity in an authoritative machine-readable form. From 17aeac6f0204578929860315c34ab86b090d1dd1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:41:02 +0900 Subject: [PATCH 093/130] docs(fitness): refresh active maturity through PR 61 --- docs/evidence/2026-08-10-active-pr-maturity.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index ee17e3df..7aaf0d8b 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -36,6 +36,7 @@ This dated appendix records volatile implementation evidence that must not be em | #58 | Authority-bound semantic-node action target | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #57. Current exact head `efe440c7a609cac187faacfa03a4df904a99386f` accepts only an advertised `NodeActionKind`, carries the exact OriginWeave-owned node handle, and delegates immediate-use session/context/origin/document-epoch validation to the browser authority boundary. CI run `31431277478`, Manifest V3 Compatibility run `31431277521`, and CodeRabbit exact-head status succeed. This remains descriptive execution input, not policy authorization, business-risk classification, browser I/O or action success. | | #59 | Real pinned-Chromium history mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #56. Test-only head `4b5f393a7420541723a07243b83cdaa7e28948de` and CI run `31432051381` established the intended repository-contract RED because controlled `history.addUrl`/`deleteUrl` lifecycle support was absent. Current exact head `b0d9c905fd7a50128eb1dde643b8a3a0f9cb1dc8` adds loopback-only add → exact readback → delete → absence verification. CI run `31432338572`, Manifest V3 Compatibility run `31432338759`, and CodeRabbit exact-head status succeed, including exact owned production function/line/region/branch coverage. Compatibility evidence only; no Agent history capability. | | #60 | Real pinned-Chromium extension update/version migration | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #59. Test-only head `a60875f70f8412db27ff1025b75d7ad4b8ddc38e` and CI run `31433305976` established the intended RED because no trial-local extension copy, version transition, migration state, or update-migration evidence existed. Current exact head `e696e19c9eaf3dedb104a5de4bdbd7970abf90d4` uses an ephemeral extension copy and one profile across initial `1.0.0`/initialized → restart `1.0.0`/current → update `1.0.1`/migrated passes. CI run `31433968874`, Manifest V3 Compatibility run `31433968931`, and CodeRabbit exact-head status succeed; the real browser evidence reports 3/3 trials and the exact update-migration surface. This does not claim Chrome Web Store/enterprise update semantics or Agent authority. | +| #61 | Real pinned-Chromium content-script isolated-world separation | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #60. Test-only head `e81cdbd9b31a62227698bd3d824fd901551061f0` and CI run `31434443638` established the intended RED because the fixture had no page-main/content-isolated sentinel contract. Current exact head `c1705ad9fd2d96e620b89bb6e7ea1235063dcb6a` requires the page to retain `window.originweaveWorldSentinel = "page"` while the content script independently retains the same-named global as `"extension"`; the existing content compatibility surface fails if the JavaScript worlds collapse. CI run `31434670642`, Manifest V3 Compatibility run `31434670629`, and CodeRabbit exact-head status succeed; real browser evidence reports 3/3 repeatability trials. Compatibility evidence only; no arbitrary page-JavaScript bridge or Agent authority. | ## Historical lineage From b13556a237bc09ed9221c3f717396f9066567312 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:41:31 +0900 Subject: [PATCH 094/130] test(docs): enforce isolated-world evidence maturity --- ...v3_supported_capability_matrix_contract.py | 24 +++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/tests/test_mv3_supported_capability_matrix_contract.py b/tests/test_mv3_supported_capability_matrix_contract.py index 2f056ab7..fcc24db5 100644 --- a/tests/test_mv3_supported_capability_matrix_contract.py +++ b/tests/test_mv3_supported_capability_matrix_contract.py @@ -28,6 +28,7 @@ def test_matrix_separates_protected_active_planned_and_out_of_scope(self) -> Non "**ACTIVE_PR #56**", "**ACTIVE_PR #59**", "**ACTIVE_PR #60**", + "**ACTIVE_PR #61**", "**PLANNED**", "**PLANNED / SECURITY-GATED**", "**OUT_OF_SCOPE FOR COMPATIBILITY CLAIM**", @@ -56,6 +57,28 @@ def test_update_migration_is_not_documented_as_restart_only(self) -> None: self.assertIn("Manifest V3 Compatibility run `31433968931`", row) self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", row) + def test_isolated_world_evidence_stays_active_only(self) -> None: + """Content-script isolation proof must not be promoted into protected-main support.""" + + for marker in ( + "Content-script injection | **PROTECTED_MAIN**", + "Content-script isolated-world separation | **ACTIVE_PR #61**", + "Content-script injection and content-script JavaScript isolation are separate compatibility claims", + "page publisher changes to `extension` and real-browser compatibility fails", + ): + with self.subTest(marker=marker): + self.assertIn(marker, self.doctoring) + + row = next( + line for line in self.maturity.splitlines() if line.startswith("| #61 |") + ) + self.assertIn("**IMPLEMENTED_ON_ACTIVE_PR**", row) + self.assertIn("c1705ad9fd2d96e620b89bb6e7ea1235063dcb6a", row) + self.assertIn("CI run `31434670642`", row) + self.assertIn("Manifest V3 Compatibility run `31434670629`", row) + self.assertIn("3/3 repeatability trials", row) + self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", row) + def test_compatibility_never_grants_agent_authority(self) -> None: """Chrome API success must remain separate from OriginWeave Agent grants.""" @@ -64,6 +87,7 @@ def test_compatibility_never_grants_agent_authority(self) -> None: "no Agent bookmark capability", "no Agent history capability", "does not claim Chrome Web Store/enterprise update semantics or Agent authority", + "no arbitrary page-JavaScript bridge or Agent authority", ): with self.subTest(marker=marker): self.assertTrue(marker in self.doctoring or marker in self.maturity) From 2eeba2296cd9f8e708198eb201b0fdd09df3c988 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:48:50 +0900 Subject: [PATCH 095/130] docs(fitness): reconcile compatibility through PR 61 --- docs/DOCUMENTATION_FITNESS.md | 269 +++++++++++++++------------------- 1 file changed, 115 insertions(+), 154 deletions(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index 9dd90774..1637b5a5 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -17,172 +17,172 @@ File existence alone is never sufficient. An artifact can exist and still be sta | Documentation family | Fitness | Current evidence / remaining boundary | |---|---|---| -| PRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Protected-main requirements remain distinct from active evidence. #37 is the current bounded-HTTP replacement; #45→#46→#53→#55 narrows sensitive-handle lifecycle, reservation, revocation and audience admission without creating the trusted broker; #47→#50→#54 narrows resolution freshness through the socket-use boundary; #51/#52/#57/#58 are browser-runtime prerequisites, not a real Chromium adapter; #43/#49/#56/#59 are MV3 compatibility evidence, not Agent authority. | -| TRD | **REPAIRED IN THIS CHANGE with active-lane follow-up** | Implementation inventory uses one protected-main status plus separate active/non-shipped evidence. Session/node, route, sensitive-data, HTTP, proxy/PAC, MV3 and broker boundaries remain reconciled to protected-main truth. Active value objects, semantic matching/action-target binding and compatibility fixtures do not imply deployed services or complete runtime paths. | -| Root Architecture | **PRESENT-CURRENT with follow-up** | Chromium compatibility kernel + Rust authority-bearing control plane remains correct. #47/#50/#54 tighten ADR 0004; #45/#46/#53/#55 remain inside ADR 0007; #40/#52/#57/#58 remain inside browser authority/structured-observation/action-boundary decisions; #43/#49/#56/#59 remain compatibility work under issue #27. No later lane introduces a new trust domain, persistence owner or deployed component. | -| ADR index/lifecycle | **REPAIRED IN THIS CHANGE** | Accepted ADRs 0001-0008 and 0010 plus Proposed 0009, 0013, 0014 and 0100-0109 are discoverable without promoting Proposed decisions. Repository-scoped identifiers are reserved across protected main and active work. | -| Individual ADRs | **PARTIAL BY LIFECYCLE** | Accepted ADRs remain governing design authority. Proposed ADR 0013 separates MV3 compatibility from extension-to-Agent authority; Proposed ADR 0014 governs ADR acceptance. #53/#54/#55/#56/#57/#58/#59 refine existing decisions and do not independently justify new ADRs. | -| UML / control-flow diagrams | **PRESENT-CURRENT with follow-up** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows already exist. `uml/extension-authority.md` closes the permission-vs-Agent-authority gap. Network freshness should reflect the socket-use recheck after #54 integrates; detailed real-Chromium sequence remains deferred until issue #28 stabilizes. #58 narrows an internal action-target bridge but does not yet justify freezing adapter/process topology. | -| Conceptual ERD/domain model | **PRESENT-CURRENT** | The ERD remains explicitly conceptual unless a real persistence owner/schema is implemented. #45/#46/#47/#48/#50/#51/#52/#53/#54/#55/#56/#57/#58/#59 add no OriginWeave-owned durable store, so manufacturing tables for in-memory/value/query/action-target/fixture primitives would be false architecture. | -| Traceability | **REPAIRED IN THIS CHANGE with volatile evidence refresh required** | Uses `IMPLEMENTED_ON_PROTECTED_MAIN`, `IMPLEMENTED_ON_ACTIVE_PR`, `PARTIAL`, `ACCEPTED_ARCHITECTURE`, `PLANNED`, `RESEARCH_ONLY`, `SUPERSEDED`, and `OUT_OF_SCOPE`. The dated maturity appendix carries volatile exact heads for current active lanes through #59. | -| Threat model / Security | **PRESENT-CURRENT with follow-up** | Untrusted content, network, secret, provenance and extension risks are covered. #54 narrows resolution-to-socket TOCTOU only on active work; #48 is revocation-material freshness only; #53/#55 narrow handle revocation/audience misuse only in process; #52 binds semantic relationships to exact browser authority; #57 performs bounded semantic matching; #58 binds an advertised node-local action to the exact node authority without minting policy authority; #59 mutates only controlled ephemeral history state for compatibility evidence. None creates a broader authority grant. | -| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned-code function/line/region/branch coverage, rustdoc and realistic boundary testing remain explicit. Active work uses intentional RED evidence followed by narrow production changes. #52's relationship boundary, #57's typed-query boundary and #58's action-target boundary were compile-time RED before production implementation; #56 repaired stale bookmark compatibility evidence, and #59 established an exact repository-contract RED before adding a real Chromium history add/read/delete/absence-verification lifecycle. | -| Operability / incident response | **PRESENT-CURRENT with follow-up** | Failure, readiness, quarantine and recovery concepts exist. Later active lanes add no new daemon/service, so no SLO/RPO/RTO or runbook is fabricated. First-party socket timing and browser fixture cleanup remain implementation concerns within existing runtime boundaries. #59 explicitly verifies cleanup of its synthetic history entry. | -| API / protocol contracts | **PRESENT-CURRENT as target contracts** | OriginWeave Protocol and adapter boundaries are documented. #52 is an internal authority-bound semantic-observation API, #57 is an internal bounded typed-query API, and #58 is an internal authority-bound node-action-target bridge; none is a BiDi/CDP/WebMCP wire protocol, browser input executor, policy approval or post-condition proof. #55 is an in-process policy API, not authenticated service identity; #56/#59 are compatibility fixtures, not product protocols. | -| Release / rollback / provenance | **PRESENT-CURRENT** | Release remains bound to one exact integrated protected head. Active stacks #40→#52→#57→#58, #47→#50→#54, #45→#46→#53→#55, and #43→#49/#56→#59 must preserve dependency order; predecessor-head success cannot satisfy a later head. | -| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. #53 adds first-revocation-wins in-process state and #55 adds audience binding, but authenticated workload identity, durable broker storage, protected-value resolution/fill, KMS, cross-process transactionality, compensation, retention and model-disclosure lifecycle remain open under issue #10. | -| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references distinguish draft/experimental material from final normative standards. Chrome's current `history` API contract confirms `history` permission plus `addUrl`, `search` and `deleteUrl`; exact release evidence remains pinned to the repository's Chromium compatibility baseline rather than this living documentation alone. | - -## 3. Reconciliation findings and resolution state +| PRD | **PRESENT-CURRENT on this branch / protected-main follow-up required** | Protected-main requirements remain distinct from active evidence. #37 is the bounded-HTTP replacement; #45→#46→#53→#55 narrows sensitive-handle authority without creating the trusted broker; #47→#50→#54 narrows resolution freshness through socket use; #40→#52→#57→#58 provides browser authority/semantic prerequisites; #43→#56→#59→#60→#61 plus #49 provide active MV3 compatibility evidence only. | +| TRD | **PRESENT-CURRENT on this branch / protected-main follow-up required** | One protected-main implementation state is kept separate from volatile active/non-shipped evidence. Value objects, fixtures and compatibility tests do not imply deployed services, browser adapters or completed runtime paths. | +| Root Architecture | **PRESENT-CURRENT** | The Chromium compatibility kernel plus Rust authority-bearing control plane remains correct. #47/#50/#54 refine ADR 0004; #45/#46/#53/#55 refine ADR 0007; #40/#52/#57/#58 refine browser observation/action boundaries; #43/#49/#56/#59/#60/#61 remain compatibility work under issue #27. No later lane introduces a new trust domain, persistence owner or deployed component. | +| ADR index/lifecycle | **PRESENT-CURRENT on this branch** | Accepted ADRs remain distinct from Proposed decisions. ADR 0013 separates MV3 compatibility from Agent authority; ADR 0014 governs architecture-decision lifecycle. Their branch presence or later integration cannot silently promote them to Accepted. | +| Individual ADRs | **SUFFICIENT BY LIFECYCLE** | Existing Accepted decisions cover current material trust boundaries. #59/#60/#61 refine compatibility evidence and do not independently justify new ADRs. | +| UML / control-flow diagrams | **PRESENT-CURRENT with one legitimate deferral** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows exist. `uml/extension-authority.md` closes the permission-vs-Agent-authority gap. Detailed real-Chromium adapter/input/post-condition UML remains deferred until issue #28 executable contracts stabilize. | +| Conceptual ERD/domain model | **PRESENT-CURRENT** | The ERD remains explicitly conceptual until a real persistence owner/schema exists. #45/#46/#47/#48/#50/#51/#52/#53/#54/#55/#56/#57/#58/#59/#60/#61 add no OriginWeave-owned durable store. Manufacturing tables for in-memory state, value objects, query/action-target primitives or compatibility fixtures would be false architecture. | +| Traceability | **PRESENT-CURRENT on this branch** | Uses explicit protected-main, active-PR, partial, accepted-architecture, planned, research-only, superseded and out-of-scope maturity vocabulary. Volatile exact-head evidence lives in the dated maturity appendix, now through #61. | +| Threat model / Security | **PRESENT-CURRENT with implementation follow-up** | Untrusted content, network, secret, provenance and extension risks are covered. Active browser semantics remain descriptive until policy and execution. #59/#60/#61 mutate only controlled compatibility state and add no Agent authority. | +| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned production function/line/region/branch coverage, rustdoc and realistic boundary testing are explicit. Active compatibility work uses exact RED→GREEN evidence, pinned real Chromium and repeated trials rather than source-text claims alone. | +| Operability / incident response | **PRESENT-CURRENT** | Failure, readiness, quarantine, cleanup and recovery concepts exist. The active fixture lanes add no daemon/service or persistence owner, so new SLO/RPO/RTO claims would be fabricated. | +| API / protocol contracts | **PRESENT-CURRENT as target contracts** | #52 is an internal semantic-observation value API, #57 a bounded typed-query API, and #58 an authority-bound action-target bridge; none is a BiDi/CDP/WebMCP wire protocol, browser input executor, business-risk classification, policy approval or post-condition proof. | +| Release / rollback / provenance | **PRESENT-CURRENT** | Release remains bound to one exact integrated protected head. Active stacks #40→#52→#57→#58, #47→#50→#54, #45→#46→#53→#55, and #43→#56→#59→#60→#61 plus parallel #49 preserve dependency order; predecessor-head success cannot satisfy a later head. | +| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. Authenticated workload identity, durable trusted-broker storage, protected-value resolution/fill, KMS, cross-process transactionality, compensation, retention and model-disclosure lifecycle remain open under issue #10. | +| Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references distinguish living/vendor/experimental material from final normative standards. Exact browser release evidence stays pinned to executable Chromium evidence rather than documentation alone. | + +## 3. Reconciliation findings ### 3.1 HTTP lineage -Protected-main PRD previously named historical PR #11 as active HTTP evidence. Current executable replacement work is PR #37, while protected main still does not ship bounded HTTP semantics. +Protected-main PRD previously named historical PR #11 as active HTTP evidence. Current replacement work is PR #37, while protected main still does not ship the reconstructed bounded HTTP capability. -**Resolved on this documentation branch:** PRD, TRD and traceability name #37 only as active/non-shipped evidence, retain protected-main `Planned`, and treat #11 as predecessor lineage. Old-head checks/reviews do not transfer. +**Resolution:** #37 is active/non-shipped implementation evidence, #11 is historical predecessor lineage, and integration before any of these branch repairs become protected-main truth remains mandatory. Old-head checks, reviews and mergeability never transfer. ### 3.2 Sensitive-data authority and broker lifecycle -Protected main contains a purpose-bound sensitive-data policy/evidence foundation governed by Accepted ADR 0007, while the complete trusted broker remains unimplemented. +Protected main contains purpose-bound sensitive-data policy/evidence governed by Accepted ADR 0007. The active dependency chain is #45 → #46 → #53 → #55: lifecycle evidence, authoritative in-process use reservation, first-revocation-wins state, then audience binding. -The current active dependency chain is #45 → #46 → #53 → #55: +The audience string accepted by the value/policy primitive is **not authentication**. A future trusted broker must derive audience from authenticated workload/service identity rather than caller-controlled input. One-process synchronization is not durable/cross-process atomicity. -- #45 records credential-free handle lifecycle evidence without storing protected values; -- #46 adds an in-process authoritative reservation count and removes caller authority over the prior-use count; -- #53 adds typed first-revocation-wins in-process state; and -- #55 binds handle admission to a bounded non-transferable audience and proves synchronized one-use contention while retaining revocation precedence. +**Resolution:** these lanes may be `IMPLEMENTED_ON_ACTIVE_PR`; the complete broker remains Planned under issue #10. They do not justify a fictitious broker process, KMS path, database table, transaction manager, browser-fill adapter, new deployment topology or physical ERD entity. -The audience string accepted by the value/policy primitive is **not authentication**. A future trusted broker must derive audience from authenticated workload/service identity rather than caller-controlled input. Likewise, mutable-borrow or externally synchronized one-process serialization is not durable/cross-process atomicity. +### 3.3 Manifest V3 compatibility -**Resolved on this documentation branch:** these lanes may be represented as `IMPLEMENTED_ON_ACTIVE_PR` evidence while the complete broker/runtime stays `Planned` under issue #10. They do not justify a fictitious broker process, KMS path, database table, transaction manager, browser-fill adapter, new deployment topology or physical ERD entity. +Protected main already proves a pinned-Chromium baseline for service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks/history read behavior, restart persistence and repeatability. The active compatibility stack adds: -### 3.3 Manifest V3 compatibility +- #43: controlled downloads; +- #49: per-trial ephemeral profile isolation; +- #56: bookmark create/read/delete cleanup; +- #59: history add/read/delete/absence verification; +- #60: trial-local unpacked-extension `1.0.0` → `1.0.1` update with explicit schema migration; and +- #61: real content-script isolated-world evidence in which the page main world retains a `page` sentinel while the content script independently retains an `extension` sentinel. -Protected main has executable pinned-Chromium evidence for service worker, content script, storage, DNR, tabs, windows, scripting, commands, side panel, bookmarks, history, restart persistence and repeatability. Active #43 adds bounded downloads compatibility; #49 adds per-trial ephemeral-profile isolation; #56 proves a bounded real bookmark mutation lifecycle using `chrome.bookmarks.create` → `get` → `remove` with cleanup; #59 adds a separate controlled history mutation lifecycle using `chrome.history.addUrl` → exact readback → `deleteUrl` → absence verification. +#43/#49/#56/#59/#60/#61 are active compatibility evidence only. Chromium permission or browser compatibility success is not an OriginWeave Agent capability, policy grant, approval or protected-value authority. A successful fixture cannot become an OriginWeave Agent history grant, bookmark grant, download grant or arbitrary page-JavaScript bridge. -PR #56 exposed and repaired repository-contract drift where real browser mutation already succeeded while a Python source contract still required historical read-only `chrome.bookmarks.getTree`. PR #59 begins from the opposite direction: exact-head CI first proves that the requested history mutation lifecycle is absent, then the fixture implementation supplies that behavior. The current Chrome Extensions history reference requires the `history` permission and exposes Promise-returning `addUrl`, `search` and `deleteUrl`; OriginWeave still binds release evidence to its pinned Chromium fixture rather than treating living vendor documentation as execution proof. +The supported-capability matrix in `docs/doctoring/mv3-compatibility.md` separates `PROTECTED_MAIN`, `ACTIVE_PR`, `PLANNED`, security-gated and out-of-scope claims. Update migration is intentionally distinct from restart persistence, and isolated-world behavior is intentionally distinct from injection alone. -**Resolved on this documentation branch:** complete compatibility remains Planned under issue #27. #43/#49/#56/#59 are active compatibility evidence only. Proposed ADR 0013 remains the authority separator: Chromium permission or browser compatibility success is not an OriginWeave Agent capability, policy grant, approval or protected-value authority. +**Resolution:** complete compatibility remains Planned under issue #27. Proposed ADR 0013 remains the authority separator. #59/#60/#61 are refinements of that decision, not new architecture decisions. ### 3.4 Browser identifier authority -Protected main contains session/context/document/node authority foundations under Accepted ADR 0010. Active #40 owns a bounded registry that maps protocol-local identifiers into that authority model and remains active/non-shipped evidence. +Protected main contains session/context/document/node foundations under Accepted ADR 0010. Active #40 maps protocol-local identifiers into OriginWeave-owned authority and remains non-shipped. -**Resolved on this documentation branch:** protected-main foundations and active registry evidence remain separate. Detailed adapter-sequence UML remains deferred until executable browser adapter contracts stabilize. +**Resolution:** protocol identifiers remain adapter-local, and detailed adapter sequence UML remains deferred until issue #28 stabilizes executable BiDi/CDP contracts. ### 3.5 ADR discoverability and identifier allocation -The earlier index omitted existing ADRs, and candidate ADR identifiers 0011/0012 were already reserved by active #37. +The earlier index omitted existing ADRs, and active #37 already reserves ADR identifiers 0011/0012. -**Resolved on this documentation branch:** lifecycle indexes are complete for the branch, extension/governance decisions use non-colliding 0013/0014, and collision-sensitive identifiers are reserved across protected main plus active work. +**Resolution:** the branch indexes every ADR by lifecycle, uses non-colliding 0013/0014 for new Proposed decisions, and treats collision-sensitive identifiers as reserved across protected main plus active work. ### 3.6 Documentation contract parser -The first fitness contract accepted only bare lifecycle metadata, while Accepted ADR 0007 legitimately contains a descriptive suffix after `Accepted`. +The first fitness contract accepted only bare lifecycle metadata even though repository-valid ADRs can carry descriptive suffixes. -**Resolved on this documentation branch:** the parser validates the leading supported lifecycle token while accepting repository-valid descriptive suffixes and rejecting unknown lifecycle states. +**Resolution:** machine checks validate the leading supported lifecycle state and reject unknown states without rejecting valid suffixes. -### 3.7 Initial UML audit false positive +### 3.7 UML audit correction -The first audit incorrectly called resource-pressure and hourly automation views missing. Protected-main UML already contained them. +An early audit incorrectly called resource-pressure and hourly-automation views missing. -**Resolved on this documentation branch:** those existing views are recognized, and only the genuinely missing extension-permission-to-Agent-authority view was added. +**Resolution:** the existing resource-pressure/GPU fallback and hourly automation flows are recognized. Only the genuinely missing extension-permission-to-Agent-authority view was added. ### 3.8 Resolution freshness authority -Protected main validates, pins and non-expansively revalidates destination addresses, but it does not yet ship a bounded approval-to-socket-use interval. Active #47 provides the reusable resolution-freshness primitive; #50 makes first-party connection planning consume freshness; #54 rechecks freshness at `connect_at(current_time)` immediately before socket I/O. +Active #47 → #50 → #54 progressively binds approved resolution state to first-party network planning and rechecks freshness immediately before socket I/O under trusted monotonic time. -The active stack deliberately does not claim resolver implementation, DNS acquisition, proxy/PAC authority or wall-clock authority. It narrows the plan-to-connect TOCTOU window using trusted monotonic timing and exact socket candidates. - -**Documentation consequence:** this remains a refinement of Accepted ADR 0004, not a new deployed component or persistence entity. The network-authority sequence should be reconciled to protected-main truth only after dependency-ordered integration. +**Resolution:** this refines Accepted ADR 0004 rather than introducing a resolver service, proxy/PAC authority, wall-clock authority, persistence owner or new deployed component. ### 3.9 TLS revocation-material freshness -Protected main deliberately reports revocation as `NotConfigured`. Active #48 adds a reusable signed-window freshness check for already-verified revocation material. +Active #48 provides a bounded freshness primitive for already verified revocation material. -**Documentation consequence:** #48 is `IMPLEMENTED_ON_ACTIVE_PR` for freshness only. It is not OCSP/CRL acquisition, signature/path validation, cache operation or proof that a certificate is unrevoked. No revocation service/cache topology or physical ERD is invented. +**Resolution:** this is not OCSP/CRL acquisition, signature/path validation, cache operation or an unrevoked-certificate claim. No fictitious revocation-service topology is added. ### 3.10 Browser task telemetry -Active #51 adds a bounded `BrowserTaskTelemetry` value object for RSS bytes, observation bytes, action latency and task duration. It does not sample Chromium or the operating system and does not create a GPU/local-model claim. +Active #51 provides bounded RSS, observation-byte, action-latency and task-duration values but performs no OS/Chromium sampling. -**Documentation consequence:** this is a reusable active-PR prerequisite for issue #28 resource evidence, not a runtime sampler service, persistence entity or release metric. +**Resolution:** value-object availability cannot be promoted to measured runtime evidence or GPU/local-model evidence. ### 3.11 Semantic observation authority -Active PR #52 is stacked on browser-registry PR #40 and remains non-shipped. Its current semantic-observation contract carries an OriginWeave-owned `ObservedNodeHandle`, bounded role/accessibility-name/visible-text fields, observed state, typed node-local action descriptors, and a non-empty evidence-channel provenance set. +Active #52 carries an OriginWeave-owned node handle, bounded semantic fields, typed advertised actions, provenance channels and bounded relationships. Every relationship must remain inside the same browser session, browsing context, canonical origin and document epoch. Self-parent/self-child relationships and duplicate child handles fail closed. The relationship graph remains descriptive evidence. -The latest active refinement adds optional parent and ordered child relationships with at most 128 children. Every relationship must remain inside the same browser session, browsing context, canonical origin and document epoch as the observation handle. Self-parent/self-child relationships and duplicate child handles fail closed. The relationship graph remains descriptive evidence; it cannot create execution capability or cross-document authority. +**Resolution:** #52 is not a browser observation adapter. Accessibility, DOM, layout, WebMCP, structured-data and visual inputs remain untrusted observations and cannot mint capability. -The evidence channel records how a value was observed; Accessibility, DOM, layout, WebMCP, structured-data and visual content remain untrusted observations. An advertised `NodeActionKind` likewise remains descriptive and grants no execution authority. +### 3.12 Typed semantic query authority -**Documentation consequence:** #52 is `IMPLEMENTED_ON_ACTIVE_PR` evidence for a semantic-observation value primitive only. It is not a browser observation adapter, performs no BiDi/CDP/WebMCP I/O or action dispatch, and establishes no service or persistence boundary. No new ADR or physical ERD entity is justified. +Active #57 performs bounded exact role, accessible-name and required-typed-action matching only against already validated semantic observations. -### 3.12 Typed semantic query authority +**Resolution:** semantic query success is descriptive selection, not CSS/XPath/raw-DOM authority, arbitrary JavaScript, browser I/O, action dispatch or policy approval. -Active PR #57 is stacked on exact semantic-observation authority from #52 and remains non-shipped. Its `SemanticNodeQuery` requires at least one bounded typed selector and matches exact semantic role, accessible name and advertised `NodeActionKind` only against already validated `SemanticNodeObservation` values. +### 3.13 Authority-bound semantic node action target -The test-only head intentionally failed compilation on the absent public query/error boundary. The current exact #57 head passes repository contracts, formatting, workspace checks/tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage, plus the inherited Manifest V3 compatibility gate. +Active #58 accepts only an advertised `NodeActionKind`, carries the exact OriginWeave-owned node handle and revalidates session/context/origin/document epoch immediately before later use. -**Documentation consequence:** query matching is descriptive selection only. #57 does not expose CSS/XPath/raw DOM selector languages, arbitrary JavaScript, browser I/O, action dispatch, capability grants, policy approval or persistence. It refines the existing observation/action architecture and therefore does not independently justify a new ADR, deployed component, topology view or physical ERD entity. +**Resolution:** this remains descriptive execution input. A node advertising `Click` cannot determine business-risk classification: the same click could represent navigation, submit, purchase, delete, permission management or legal consent. Policy intent, approval, browser dispatch and verified success remain separate boundaries under issue #28. -### 3.13 Authority-bound semantic node action target +### 3.14 Controlled history mutation compatibility -Active PR #58 is stacked on #57 and remains non-shipped. Its action-target bridge accepts only a `NodeActionKind` advertised by an already validated semantic observation, carries the exact OriginWeave-owned node handle, and delegates immediate-use validation to the existing browser session/context/origin/document-epoch authority boundary. +Active #59 creates one synthetic loopback history entry, requires exact readback, removes it in `finally` and proves its absence afterwards. -Current exact-head CI, the inherited pinned-Chromium compatibility workflow and CodeRabbit are green. The bridge is intentionally narrower than execution authority: it does not classify the business risk of an action, make a policy or approval decision, dispatch browser input, observe a post-condition, expose raw selectors, or make a browser/protocol identifier durable. +**Resolution:** browser history compatibility is not an OriginWeave Agent history grant. No history values are exposed to a model and no human/default profile is used. -**Documentation consequence:** #58 is `IMPLEMENTED_ON_ACTIVE_PR` evidence for an internal authority-preserving action-target value only. It refines existing Accepted browser observation/action decisions and does not independently justify a new ADR, deployed component, process topology, physical ERD entity or product protocol. +### 3.15 Controlled extension update migration -### 3.14 Controlled Manifest V3 history mutation compatibility +Active #60 copies the checked-in fixture into a trial-local directory, keeps one ephemeral profile and one extension path, transitions only `1.0.0` → `1.0.1`, observes the loaded version and requires schema state 1 → 2 migration. -Active PR #59 is stacked on #56 and remains non-shipped. Its test-only exact head established a deliberate RED because the compatibility fixture exposed history search only and lacked a bounded add/delete lifecycle. The subsequent implementation is restricted to the controlled loopback sender, creates one synthetic `history-entry.html` visit, requires exact readback, removes it in `finally`, and verifies the synthetic URL is absent afterwards. +**Resolution:** this proves one deterministic unpacked-extension version transition. It does not establish Chrome Web Store updates, enterprise rollout, arbitrary downgrade or third-party migration safety. -The exact Chrome API surface is vendor compatibility evidence, not authority: the extension needs the `history` permission, while `addUrl`, `search` and `deleteUrl` operate inside the isolated compatibility profile. No history value is exposed to a model, no human/default profile is used, and no OriginWeave Agent history capability is created. +### 3.16 Content-script isolated-world compatibility -**Documentation consequence:** #59 remains `IMPLEMENTED_ON_ACTIVE_PR` compatibility evidence under issue #27. It does not justify a new ADR, UML topology, persistence entity, general history tool or policy grant. Its current exact head remains under validation until all exact-head checks complete. +Active #61 gives the page main world and the MV3 content script the same JavaScript global name with different values and requires the page to keep publishing `page` while the content script observes its own `extension` value. If the worlds collapse, the existing compatibility gate fails in real pinned Chromium. -## 4. Durable conversation decisions captured in GitHub +**Resolution:** this is a bounded compatibility proof, not a trusted page-content channel, arbitrary JavaScript bridge or Agent capability. -The canonical graph must continue to preserve these durable decisions: +## 4. Durable product decisions captured by the canonical graph -1. OriginWeave is **Browse. Act. Prove.** — an enterprise agentic web runtime and provenance-native browser platform, not merely Selenium-style automation. -2. Chromium remains the compatibility kernel; Blink/V8 are not rewritten for product differentiation. -3. Rust owns new authority-bearing control-plane semantics and remains usable independently in headless/MSA composition. -4. Human, Assist, Agent Task and Crawler modes have distinct authority/profile semantics; Agent Task does not ambiently inherit Human Mode authority. +1. OriginWeave is **Browse. Act. Prove.**: an enterprise agentic web runtime and provenance-native browser platform, not Selenium-style automation. +2. Chromium remains the compatibility kernel; Blink/V8 are not rewritten for differentiation. +3. Rust owns new authority-bearing control-plane semantics and remains independently reusable. +4. Human, Assist, Agent Task and Crawler modes have distinct authority/profile semantics; Agent Task does not ambiently inherit Human authority. 5. Page, extension, WebMCP and model content are untrusted observations, not goal/policy authority. 6. Structured observation precedes raw HTML or screenshot-only interpretation. -7. Typed actions and observed post-conditions replace arbitrary script execution and command-return-as-success. +7. Typed actions and observed post-conditions replace arbitrary-script and command-return-as-success semantics. 8. Logical origin, destination, route/proxy, TCP peer, TLS identity and HTTP semantics are separate authorities. 9. Session/context/document epoch/node identity is separate from raw BiDi/CDP identifiers. 10. Manifest V3 permission is not an OriginWeave Agent capability; compatibility evidence and Agent-authority evidence are independent. 11. Raw secrets stay outside model-visible context; sensitive values use purpose-bound authority, opaque handles and trusted fill paths. -12. Browser correctness/human interaction outrank optional local-model throughput under resource pressure. -13. Provenance distinguishes source observation, model judgement, policy, approval, action and verified outcome; WARC/PROV are adapters rather than collapsed truth. +12. Browser correctness/human interaction outrank optional local-model throughput under pressure. +13. Provenance distinguishes source observation, model judgement, policy, approval, action and verified outcome. 14. WebDriver BiDi, CDP, WebMCP and MCP are versioned adapters, never the product authority model by themselves. -15. The first browser proof is a pinned-stock-Chromium vertical slice before any broad Chromium fork. +15. The first browser proof uses pinned stock Chromium before any broad fork. 16. High-risk actions remain approval-bound; Crawler Mode remains read-only and excludes CAPTCHA/block-evasion features. 17. Autonomous development uses OpenCode/NVIDIA NIM under deterministic gates and separate review/publication authority, never `COPILOT_GITHUB_TOKEN` as the development-model credential. 18. Documentation, checks, reviews, model judgements and operational evidence are separate evidence authorities. -19. Work-conserving maintenance continues to another safe lane rather than stopping on one merge, document, RCA, queued check or external approval gap. -20. ADR numbers, migrations, schema/API/protocol versions and other collision-sensitive repository identifiers are reserved across protected main **and active work** before allocation. -21. A policy primitive may narrow stale-count/replay risk without claiming the durable trusted broker exists; in-memory serialization, cross-process transactionality, lifecycle evidence and protected-value release remain separate maturity claims. -22. A validated DNS answer is not sufficient socket authority indefinitely; the resolution-to-socket interval must be bounded by caller-supplied trusted monotonic freshness and ordinary first-party socket planning must not retain an untimed bypass. -23. Revocation-material freshness, revocation-material cryptographic validity, acquisition/cache operation and an unrevoked-certificate claim are separate evidence authorities. -24. Browser-resource telemetry values and actual OS/Chromium measurement adapters are separate maturity claims; value-object availability cannot be promoted to measured runtime evidence. -25. Every semantic observation must identify at least one contributing evidence channel; observation provenance and advertised node-local actions are descriptive evidence and never grant execution authority. -26. Semantic parent/child relationships must be bounded and remain inside the observation's exact session/context/origin/document authority; relationship metadata cannot mint capability. -27. Sensitive-handle audience must ultimately be derived from authenticated workload/service identity; accepting an audience string in an internal value object is not authentication. -28. A real browser compatibility fixture may mutate and clean up test state, but compatibility success still cannot substitute for OriginWeave Agent-authority evidence. -29. A semantic node query may select bounded reviewed observation evidence, but query success is neither browser-selector authority nor permission to execute the advertised node-local action. -30. Binding a queried semantic node to one advertised node-local action must preserve the exact OriginWeave node authority and remain separate from business-risk classification, policy approval, browser dispatch and verified success. -31. Manifest V3 history mutation compatibility may create and remove only controlled synthetic test state in the isolated fixture profile; browser-history compatibility is not an OriginWeave Agent history grant. - -## 5. Architecture views still legitimately deferred - -### 5.1 Extension authority — present in this branch - -`uml/extension-authority.md` shows the durable separation: +19. Work-conserving maintenance continues to another safe lane rather than stopping on one merge, document, RCA, queued check or approval gap. +20. Collision-sensitive repository identifiers are reserved across protected main and active work before allocation. +21. In-memory sensitive-handle primitives may narrow replay/revocation risk without claiming the durable trusted broker exists. +22. A validated DNS answer is not sufficient socket authority indefinitely; resolution-to-socket use requires bounded trusted-monotonic freshness. +23. Revocation-material freshness, cryptographic validity, acquisition/cache operation and an unrevoked claim remain separate evidence authorities. +24. Browser telemetry values and actual OS/Chromium measurement adapters are separate maturity claims. +25. Semantic observation provenance and advertised node-local actions are descriptive evidence and never execution authority. +26. Semantic relationships remain bounded within exact session/context/origin/document authority. +27. Sensitive-handle audience must ultimately derive from authenticated workload/service identity. +28. Real browser compatibility fixtures may mutate and clean controlled synthetic state without creating Agent authority. +29. Semantic query success is neither selector authority nor permission to execute an advertised action. +30. Semantic action-target binding preserves exact node authority but remains separate from business-risk classification, policy approval, dispatch and observed success. +31. Update migration, restart persistence, injection and isolated-world behavior are separate compatibility claims and must retain distinct executable evidence. + +## 5. Architecture views legitimately deferred + +### 5.1 Extension authority — present + +`uml/extension-authority.md` captures: ```text Chromium MV3 permission @@ -194,16 +194,14 @@ Chromium MV3 permission -> deterministic policy ``` -Compatibility evidence cannot substitute for Agent-authority isolation evidence, and vice versa. +Compatibility evidence cannot substitute for Agent-authority evidence, or vice versa. ### 5.2 Network freshness sequence — reconcile after #47 → #50 → #54 integrates -The durable sequence is: - ```text resolver answer -> destination policy + origin binding --> fresh resolution approval [trusted monotonic interval] +-> fresh resolution approval -> connection authorization at trusted monotonic use time -> socket-use freshness recheck -> exact socket candidate @@ -211,77 +209,40 @@ resolver answer -> TLS/HTTP authority layers ``` -This is a sequence refinement inside the existing network authority model, not a new deployed component or persistence boundary. - ### 5.3 Real Chromium vertical slice — deferred until issue #28 stabilizes -The eventual sequence must cover: - ```text isolated profile/context -> BiDi/CDP adapter -> OriginWeave registry -> semantic observation --> bounded exact-authority relationships -> typed semantic query -> authority-bound semantic action target --> typed policy decision +-> explicit business intent / deterministic policy -> real browser input -> observed post-condition -> credential-safe evidence -> teardown/recovery ``` -Active #52, #57 and #58 make the semantic-observation, typed-query and authority-preserving action-target boundaries more concrete but still do not establish the browser adapter, process topology, business-risk policy bridge, real input or post-condition verification sequence. Temporary protocol/field names must not be frozen into authoritative UML before executable contracts stabilize. - -### 5.4 Trusted sensitive-data broker — deferred until issue #10 owns a real runtime boundary - -Protected-main policy/evidence plus active #45→#46→#53→#55 do not justify inventing a broker process, database table, transaction manager, KMS path, authenticated service-identity mechanism or browser-fill adapter. When a real broker slice exists, the documentation graph must add actual component/transaction/data-lifecycle views and mark persisted versus in-memory versus external state from executable evidence. - -## 6. What remains before documentation closure - -### Completed or materially advanced on this branch - -- PRD current-state reconciliation; -- TRD current-state reconciliation; -- requirement/decision/module/evidence traceability reconciliation; -- ADR lifecycle/index repair; -- Proposed ADR 0013 for MV3/extension authority separation; -- Proposed ADR 0014 for architecture-decision acceptance governance; -- extension authority UML; -- conceptual ERD truth discipline; -- documentation fitness and regression contracts; -- browser/protocol standards doctoring; -- sensitive-data evidence reconciliation through #55 without inventing broker persistence or authenticated service identity; -- resolution-freshness reconciliation through socket-use recheck #54 without inventing resolver/proxy authority; -- semantic-observation authority/relationship reconciliation for #52 without promoting it to a browser adapter; -- typed semantic-query reconciliation for #57 without promoting semantic matching to selector/action authority; -- semantic action-target reconciliation for #58 without promoting node-local action binding to policy approval or browser execution; and -- MV3 compatibility reconciliation through #59 without equating browser permission or controlled fixture mutation with Agent authority. - -### Still required - -- exact-head CI/security/review acceptance of this documentation PR after every documentation mutation; -- integration before any of these branch repairs become protected-main truth; -- re-reconciliation whenever active PR #37, #40, #43, #45, #46, #47, #48, #49, #50, #51, #52, #53, #54, #55, #56, #57, #58 or #59 integrates, closes, is superseded or materially changes head; -- network-authority sequence reconciliation after #47→#50→#54 reaches protected main; -- detailed real-Chromium vertical-slice UML when issue #28 implementation contracts are stable; -- trusted-broker UML/ERD/operability additions only when issue #10 establishes real runtime/persistence ownership; -- future ERD changes only when persistence ownership/entities actually change; and -- ongoing security/operability/release reconciliation as real browser/runtime boundaries integrate. - -## 7. Completion criteria - -The documentation graph becomes **PROTECTED-MAIN-SUFFICIENT** only when: - -1. PRD/TRD implementation inventories agree with protected-main crates/APIs/executable browser evidence; -2. no canonical document identifies historical/superseded PR lineage as current implementation evidence; -3. ADR indexes discover every protected-main ADR and match its lifecycle metadata; -4. UML covers every currently implemented material authority flow, with planned diagrams clearly marked; -5. ERD/domain models accurately distinguish conceptual, in-memory, persisted, adapter-owned and external entities; -6. traceability maps every material requirement/Accepted decision to protected-main evidence, explicitly active-PR evidence, or an open issue; -7. documentation tests catch stale status/index/link/ownership/identifier terminology; -8. security, test, operability, data-governance and release docs agree on shipped-vs-planned boundaries; and -9. this documentation reconciliation itself reaches protected main through live repository governance. +#40/#52/#57/#58 make the authority/value boundaries concrete but do not yet establish browser I/O, typed business policy, native input or post-condition proof. Freezing temporary protocol fields into authoritative UML before those executable contracts exist would create false architecture. + +### 5.4 Trusted sensitive-data broker — deferred until issue #10 establishes a real runtime boundary + +Protected-main policy/evidence plus #45→#46→#53→#55 do not justify inventing a broker process, durable database, KMS topology, authenticated service-identity mechanism or browser-fill adapter. Add physical ERD/component/transaction views only when executable ownership exists. + +## 6. Completion criteria + +The graph becomes **PROTECTED-MAIN-SUFFICIENT** only when: + +1. PRD/TRD implementation inventories agree with the exact protected-main crates/APIs/browser evidence; +2. no historical/superseded lineage is presented as current implementation evidence; +3. ADR indexes discover every protected-main ADR and match lifecycle metadata; +4. UML covers every implemented material authority flow, with planned diagrams clearly marked; +5. ERD/domain models distinguish conceptual, in-memory, persisted, adapter-owned and external state truthfully; +6. traceability maps each material requirement/Accepted decision to protected-main evidence, explicitly active-PR evidence or an open issue; +7. documentation tests catch stale status/index/link/ownership/identifier/maturity terminology; +8. security, test, operability, privacy and release docs agree on shipped-vs-planned boundaries; and +9. this documentation reconciliation itself reaches protected main through repository governance and is re-evaluated against whatever feature heads actually integrated. Until then, OriginWeave is **design-documented but not protected-main documentation-closed**. That finding must never be used as an excuse to stop unrelated safe implementation work. From 0f19c5096cd24f3b7082fa09805f65d111860fae Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 06:49:18 +0900 Subject: [PATCH 096/130] test(docs): track current active dependency stacks --- ...cumentation_active_pr_evidence_contract.py | 29 ++++++++++++++----- 1 file changed, 21 insertions(+), 8 deletions(-) diff --git a/tests/test_documentation_active_pr_evidence_contract.py b/tests/test_documentation_active_pr_evidence_contract.py index 5e961adc..b87623ef 100644 --- a/tests/test_documentation_active_pr_evidence_contract.py +++ b/tests/test_documentation_active_pr_evidence_contract.py @@ -31,7 +31,7 @@ def setUpClass(cls) -> None: def test_dependency_stacks_are_explicit_and_non_shipped(self) -> None: """Current browser, network, sensitive and compatibility stacks stay active-only.""" - for pr_number in (52, 53, 54, 55, 56, 57): + for pr_number in (52, 53, 54, 55, 56, 57, 58, 59, 60, 61): with self.subTest(pr_number=pr_number): row = active_pr_row(self.maturity, pr_number) self.assertIn("**IMPLEMENTED_ON_ACTIVE_PR**", row) @@ -40,12 +40,14 @@ def test_dependency_stacks_are_explicit_and_non_shipped(self) -> None: for stack in ( "#47 → #50 → #54", "#45 → #46 → #53 → #55", - "#40→#52", - "#43→#49/#56", + "#40→#52→#57→#58", + "#43→#56→#59→#60→#61", ): with self.subTest(stack=stack): self.assertIn(stack, self.fitness) + self.assertIn("#49", self.fitness) + def test_semantic_relationship_evidence_stays_bounded_and_authority_scoped(self) -> None: """PR #52 cannot turn relationship metadata into browser or execution authority.""" row = active_pr_row(self.maturity, 52) @@ -91,19 +93,30 @@ def test_sensitive_audience_evidence_does_not_claim_authentication(self) -> None ) self.assertIn("new deployment topology or physical ERD entity", self.fitness) - def test_bookmark_mutation_is_compatibility_not_agent_authority(self) -> None: - """Real MV3 mutation evidence must remain separate from OriginWeave capability grants.""" - row = active_pr_row(self.maturity, 56) + def test_mv3_mutation_and_isolation_are_compatibility_not_agent_authority(self) -> None: + """Real MV3 evidence must remain separate from OriginWeave capability grants.""" + bookmark_row = active_pr_row(self.maturity, 56) for marker in ("create", "get", "remove", "compatibility evidence only"): with self.subTest(marker=marker): - self.assertIn(marker, row) + self.assertIn(marker, bookmark_row) + + for pr_number in (59, 60, 61): + with self.subTest(pr_number=pr_number): + row = active_pr_row(self.maturity, pr_number) + self.assertIn("**IMPLEMENTED_ON_ACTIVE_PR**", row) + self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", row) self.assertIn("Manifest V3 compatibility", self.fitness) self.assertIn( "Chromium permission or browser compatibility success is not an OriginWeave Agent capability", self.fitness, ) - self.assertIn("#43/#49/#56/#59 are active compatibility evidence only", self.fitness) + self.assertIn( + "#43/#49/#56/#59/#60/#61 are active compatibility evidence only", + self.fitness, + ) + self.assertIn("Update migration is intentionally distinct from restart persistence", self.fitness) + self.assertIn("isolated-world behavior is intentionally distinct from injection alone", self.fitness) def test_erd_stays_conceptual_without_persistence_owner(self) -> None: """Active in-memory/value primitives must not manufacture a physical data model.""" From 69af6f2ac8105b69963a939f954e246b43ae4e89 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 07:00:35 +0900 Subject: [PATCH 097/130] docs(fitness): record extension policy isolation evidence --- docs/evidence/2026-08-10-active-pr-maturity.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index 7aaf0d8b..5b82a673 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -37,6 +37,7 @@ This dated appendix records volatile implementation evidence that must not be em | #59 | Real pinned-Chromium history mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #56. Test-only head `4b5f393a7420541723a07243b83cdaa7e28948de` and CI run `31432051381` established the intended repository-contract RED because controlled `history.addUrl`/`deleteUrl` lifecycle support was absent. Current exact head `b0d9c905fd7a50128eb1dde643b8a3a0f9cb1dc8` adds loopback-only add → exact readback → delete → absence verification. CI run `31432338572`, Manifest V3 Compatibility run `31432338759`, and CodeRabbit exact-head status succeed, including exact owned production function/line/region/branch coverage. Compatibility evidence only; no Agent history capability. | | #60 | Real pinned-Chromium extension update/version migration | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #59. Test-only head `a60875f70f8412db27ff1025b75d7ad4b8ddc38e` and CI run `31433305976` established the intended RED because no trial-local extension copy, version transition, migration state, or update-migration evidence existed. Current exact head `e696e19c9eaf3dedb104a5de4bdbd7970abf90d4` uses an ephemeral extension copy and one profile across initial `1.0.0`/initialized → restart `1.0.0`/current → update `1.0.1`/migrated passes. CI run `31433968874`, Manifest V3 Compatibility run `31433968931`, and CodeRabbit exact-head status succeed; the real browser evidence reports 3/3 trials and the exact update-migration surface. This does not claim Chrome Web Store/enterprise update semantics or Agent authority. | | #61 | Real pinned-Chromium content-script isolated-world separation | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #60. Test-only head `e81cdbd9b31a62227698bd3d824fd901551061f0` and CI run `31434443638` established the intended RED because the fixture had no page-main/content-isolated sentinel contract. Current exact head `c1705ad9fd2d96e620b89bb6e7ea1235063dcb6a` requires the page to retain `window.originweaveWorldSentinel = "page"` while the content script independently retains the same-named global as `"extension"`; the existing content compatibility surface fails if the JavaScript worlds collapse. CI run `31434670642`, Manifest V3 Compatibility run `31434670629`, and CodeRabbit exact-head status succeed; real browser evidence reports 3/3 repeatability trials. Compatibility evidence only; no arbitrary page-JavaScript bridge or Agent authority. | +| #62 | Extension proposal → Agent policy isolation regression | **IMPLEMENTED_ON_ACTIVE_PR** | Ready PR based directly on protected main. Exact head `277df965602a97b1c221df2fc7a228ff5ac6c540` first proves the exact extension/session/context `ProposeTypedAction` grant is allowed, then proves that ordinary Agent policy still independently rejects an out-of-grant target origin, a missing core `Navigate` capability, and `WebContent` as an untrusted instruction source. CI run `31436078746` including exact production function/line/region/branch coverage, Security Scan run `31436078045`, SAST Semgrep run `31436078163`, and CodeRabbit exact-head status succeed. This adds no production API or real Chromium adapter and does not convert extension proposal authority into Agent action/origin authority. | ## Historical lineage From 1e68bd5ea04ca42921c5f06f660ef77e7647d980 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 07:01:42 +0900 Subject: [PATCH 098/130] test(docs): enforce extension policy isolation maturity --- ...cumentation_active_pr_evidence_contract.py | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/tests/test_documentation_active_pr_evidence_contract.py b/tests/test_documentation_active_pr_evidence_contract.py index b87623ef..1b2baa09 100644 --- a/tests/test_documentation_active_pr_evidence_contract.py +++ b/tests/test_documentation_active_pr_evidence_contract.py @@ -31,7 +31,7 @@ def setUpClass(cls) -> None: def test_dependency_stacks_are_explicit_and_non_shipped(self) -> None: """Current browser, network, sensitive and compatibility stacks stay active-only.""" - for pr_number in (52, 53, 54, 55, 56, 57, 58, 59, 60, 61): + for pr_number in (52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62): with self.subTest(pr_number=pr_number): row = active_pr_row(self.maturity, pr_number) self.assertIn("**IMPLEMENTED_ON_ACTIVE_PR**", row) @@ -118,6 +118,24 @@ def test_mv3_mutation_and_isolation_are_compatibility_not_agent_authority(self) self.assertIn("Update migration is intentionally distinct from restart persistence", self.fitness) self.assertIn("isolated-world behavior is intentionally distinct from injection alone", self.fitness) + def test_extension_proposal_grant_does_not_become_agent_policy_authority(self) -> None: + """PR #62 must remain a policy-isolation regression, not a new action grant.""" + row = active_pr_row(self.maturity, 62) + for marker in ( + "ProposeTypedAction", + "out-of-grant target origin", + "missing core `Navigate` capability", + "untrusted instruction source", + "adds no production API or real Chromium adapter", + "does not convert extension proposal authority into Agent action/origin authority", + ): + with self.subTest(marker=marker): + self.assertIn(marker, row) + self.assertIn("CI run `31436078746`", row) + self.assertIn("Security Scan run `31436078045`", row) + self.assertIn("SAST Semgrep run `31436078163`", row) + self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", row) + def test_erd_stays_conceptual_without_persistence_owner(self) -> None: """Active in-memory/value primitives must not manufacture a physical data model.""" self.assertIn("Conceptual ERD/domain model", self.fitness) From f17d7ab0d3c6befc64556cf42e338272adf845e0 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 07:07:31 +0900 Subject: [PATCH 099/130] docs(traceability): record extension authority security evidence --- .../extension-authority-security.md | 87 +++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 docs/traceability/extension-authority-security.md diff --git a/docs/traceability/extension-authority-security.md b/docs/traceability/extension-authority-security.md new file mode 100644 index 00000000..f48d7648 --- /dev/null +++ b/docs/traceability/extension-authority-security.md @@ -0,0 +1,87 @@ +# Extension-to-Agent Security Traceability + +- **Documentation status:** Active-PR evidence dossier +- **Canonical owner:** PR #44 (`docs: reconcile architecture documentation fitness`) +- **Protected-main baseline:** `67af7c87589edc2039545af335c95064d9b8391c` +- **Capability maturity:** **PARTIAL** +- **Governing decision:** Proposed ADR 0013 separates Manifest V3 compatibility from OriginWeave Agent authority. + +## 1. Why this dossier exists + +Manifest V3 compatibility and OriginWeave Agent authority are intentionally different evidence domains. A Chromium extension may possess Chrome permissions and may be explicitly granted a narrow OriginWeave extension capability without receiving Agent origin grants, Agent action capability, instruction trust, secret-delivery authority, approval, or protected-value access. + +This dossier records the current executable composition evidence for that separation. It does not promote active pull requests to protected-main shipped truth and it does not claim the trusted sensitive-data broker from issue #10 is complete. + +## 2. Protected-main authority + +Protected `main` already provides: + +- exact extension/session/context-scoped `ExtensionAgentGrant` evaluation; +- a distinction between `ObserveCurrentContext` and `ProposeTypedAction` extension capabilities; +- deterministic Agent policy evaluation for typed actions; +- fail-closed treatment of `InstructionSource::WebContent`; +- explicit Agent capability and readable/writable-origin gates; +- `FillSecret` policy that rejects raw secret delivery and requires `SecretDelivery::BrokerHandle`; and +- ordinary action-risk approval semantics that remain separate from extension permission. + +These foundations are **IMPLEMENTED_ON_PROTECTED_MAIN**. They do not by themselves prove every issue #27 cross-boundary composition case. + +## 3. Active executable evidence + +### PR #62 — proposal authority cannot widen Agent authority + +**Capability maturity:** `IMPLEMENTED_ON_ACTIVE_PR` + +Exact head `277df965602a97b1c221df2fc7a228ff5ac6c540` proves that, after an extension is genuinely allowed to `ProposeTypedAction`: + +1. a proposed navigation outside the Agent readable-origin grant is still denied; +2. proposal permission cannot supply the missing Agent `Navigate` capability; and +3. extension-produced untrusted content remains rejected as instruction authority. + +The branch adds no production API and no extension runtime. It is compositional security evidence over protected-main authorities. + +### PR #63 — proposal authority cannot widen secret authority + +**Capability maturity:** `IMPLEMENTED_ON_ACTIVE_PR` + +Exact initial head `3059fead1ef0b6cf2f7df765b03c4b00a669b9cf` adds a separate integration regression showing that, after the same exact proposal grant is admitted: + +1. `FillSecret` with `SecretDelivery::RawValue` remains denied as `SecretBrokerRequired`; +2. broker-handle `FillSecret` still reaches the ordinary R3 approval boundary rather than becoming implicitly allowed; and +3. broker material attached to a non-secret `Observe` action remains denied as `UnexpectedSecretMaterial`. + +This evidence carries no raw secret bytes and does not create a broker, browser-fill adapter, protected-value store, KMS path, authenticated workload identity, persistence owner, or release claim. + +## 4. Security interpretation + +The executable authority chain is therefore intentionally non-transitive: + +```text +Chromium extension permission +-> explicit extension/session/context grant +-> permission to propose a typed action +-/> Agent capability +-/> Agent readable/writable origin +-/> trusted instruction source +-/> secret-delivery authority +-/> approval +-/> protected-value resolution +``` + +A future real extension adapter must preserve these separations. Chrome permissions and extension proposal grants are inputs to policy composition, never ambient authority that bypasses the deterministic Agent policy or the sensitive-data broker boundary. + +## 5. Remaining issue #27 / #10 boundary + +This dossier does **not** close issue #27 or issue #10. Remaining material work includes, among other accepted requirements: + +- real managed-extension allow-list and enterprise policy integration; +- native-messaging host boundary and process isolation; +- complete supported-capability release matrix and regression gate; +- authenticated workload/service identity for sensitive-data broker audience; +- protected-value resolution/fill outside model-visible context; +- durable transactional handle lifecycle, retention, encryption/KMS, deletion and audit-export controls; and +- protected-main integration plus fresh acceptance before any active-PR evidence becomes shipped truth. + +## 6. Documentation fitness consequence + +The existing ADR/PRD/TRD/Architecture/UML/ERD graph remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. PRs #62 and #63 narrow the executable extension-authority evidence gap without introducing a new trust domain, deployment component, persistence entity, database schema, or independent architecture decision. Proposed ADR 0013 remains Proposed until its own lifecycle authority changes. \ No newline at end of file From 6e71663ab3099a669af29655ab007c056c1eb21d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 07:07:52 +0900 Subject: [PATCH 100/130] test(docs): lock extension authority traceability --- ...tension_authority_traceability_contract.py | 48 +++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 tests/test_extension_authority_traceability_contract.py diff --git a/tests/test_extension_authority_traceability_contract.py b/tests/test_extension_authority_traceability_contract.py new file mode 100644 index 00000000..e806ea29 --- /dev/null +++ b/tests/test_extension_authority_traceability_contract.py @@ -0,0 +1,48 @@ +"""Regression contract for extension-to-Agent security traceability.""" + +from pathlib import Path +import unittest + + +REPOSITORY_ROOT = Path(__file__).resolve().parents[1] +TRACEABILITY = ( + REPOSITORY_ROOT / "docs" / "traceability" / "extension-authority-security.md" +) + + +class ExtensionAuthorityTraceabilityContractTests(unittest.TestCase): + """Keep compatibility, Agent authority, and secret authority as separate claims.""" + + def test_extension_security_dossier_preserves_maturity_boundaries(self) -> None: + """Active security proofs must never be promoted to protected-main shipped truth.""" + text = TRACEABILITY.read_text(encoding="utf-8") + + self.assertIn("DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL", text) + self.assertIn("IMPLEMENTED_ON_PROTECTED_MAIN", text) + self.assertIn("IMPLEMENTED_ON_ACTIVE_PR", text) + self.assertIn("PR #62", text) + self.assertIn("PR #63", text) + self.assertIn("Proposed ADR 0013", text) + self.assertIn("SecretBrokerRequired", text) + self.assertIn("UnexpectedSecretMaterial", text) + self.assertIn("R3 approval", text) + self.assertIn("does not close issue #27 or issue #10", text) + + def test_extension_proposal_authority_is_explicitly_non_transitive(self) -> None: + """The dossier must forbid proposal permission from becoming broader Agent authority.""" + text = TRACEABILITY.read_text(encoding="utf-8") + + for boundary in ( + "-/> Agent capability", + "-/> Agent readable/writable origin", + "-/> trusted instruction source", + "-/> secret-delivery authority", + "-/> approval", + "-/> protected-value resolution", + ): + with self.subTest(boundary=boundary): + self.assertIn(boundary, text) + + +if __name__ == "__main__": + unittest.main() From 9e2be616b261e45aaac5bf875a637020976e4c80 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 07:10:59 +0900 Subject: [PATCH 101/130] fix(docs): ignore markdown emphasis in closure contract --- tests/test_extension_authority_traceability_contract.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tests/test_extension_authority_traceability_contract.py b/tests/test_extension_authority_traceability_contract.py index e806ea29..3ca5c5cd 100644 --- a/tests/test_extension_authority_traceability_contract.py +++ b/tests/test_extension_authority_traceability_contract.py @@ -16,8 +16,9 @@ class ExtensionAuthorityTraceabilityContractTests(unittest.TestCase): def test_extension_security_dossier_preserves_maturity_boundaries(self) -> None: """Active security proofs must never be promoted to protected-main shipped truth.""" text = TRACEABILITY.read_text(encoding="utf-8") + semantic_text = text.replace("**", "") - self.assertIn("DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL", text) + self.assertIn("DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL", semantic_text) self.assertIn("IMPLEMENTED_ON_PROTECTED_MAIN", text) self.assertIn("IMPLEMENTED_ON_ACTIVE_PR", text) self.assertIn("PR #62", text) @@ -26,7 +27,7 @@ def test_extension_security_dossier_preserves_maturity_boundaries(self) -> None: self.assertIn("SecretBrokerRequired", text) self.assertIn("UnexpectedSecretMaterial", text) self.assertIn("R3 approval", text) - self.assertIn("does not close issue #27 or issue #10", text) + self.assertIn("does not close issue #27 or issue #10", semantic_text) def test_extension_proposal_authority_is_explicitly_non_transitive(self) -> None: """The dossier must forbid proposal permission from becoming broader Agent authority.""" From 536207eb670b2b9c999a3dc549fefb6869f60a42 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 07:26:48 +0900 Subject: [PATCH 102/130] docs(traceability): reconcile extension security ownership --- .../extension-authority-security.md | 24 +++++++++---------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/docs/traceability/extension-authority-security.md b/docs/traceability/extension-authority-security.md index f48d7648..a36380a3 100644 --- a/docs/traceability/extension-authority-security.md +++ b/docs/traceability/extension-authority-security.md @@ -28,33 +28,31 @@ These foundations are **IMPLEMENTED_ON_PROTECTED_MAIN**. They do not by themselv ## 3. Active executable evidence -### PR #62 — proposal authority cannot widen Agent authority +### PR #62 — proposal authority cannot widen Agent, instruction, or secret-material authority **Capability maturity:** `IMPLEMENTED_ON_ACTIVE_PR` -Exact head `277df965602a97b1c221df2fc7a228ff5ac6c540` proves that, after an extension is genuinely allowed to `ProposeTypedAction`: +Exact head `a57873b3688984711918be17aadd348ed9fb12a9` proves that, after an extension is genuinely allowed to `ProposeTypedAction`: 1. a proposed navigation outside the Agent readable-origin grant is still denied; -2. proposal permission cannot supply the missing Agent `Navigate` capability; and -3. extension-produced untrusted content remains rejected as instruction authority. +2. proposal permission cannot supply the missing Agent `Navigate` capability; +3. extension-produced untrusted content remains rejected as instruction authority; +4. `FillSecret` with `SecretDelivery::RawValue` remains denied as `SecretBrokerRequired`; and +5. secret material attached to a non-secret action remains denied as `UnexpectedSecretMaterial`. The branch adds no production API and no extension runtime. It is compositional security evidence over protected-main authorities. -### PR #63 — proposal authority cannot widen secret authority +### PR #63 — proposal authority cannot manufacture high-risk approval **Capability maturity:** `IMPLEMENTED_ON_ACTIVE_PR` -Exact initial head `3059fead1ef0b6cf2f7df765b03c4b00a669b9cf` adds a separate integration regression showing that, after the same exact proposal grant is admitted: +Exact head `e83749acd1cf5a0b778ba38eb9d6ed5a9bd1e68f` deliberately keeps only the distinct approval-composition proof after duplicate regressions were removed in favor of PR #62 ownership. It proves that, after the same exact proposal grant is admitted and the Agent context independently possesses `FillSecret` plus exact readable/writable origin authority, broker-handle `FillSecret` still reaches the ordinary R3 approval boundary rather than becoming implicitly allowed. -1. `FillSecret` with `SecretDelivery::RawValue` remains denied as `SecretBrokerRequired`; -2. broker-handle `FillSecret` still reaches the ordinary R3 approval boundary rather than becoming implicitly allowed; and -3. broker material attached to a non-secret `Observe` action remains denied as `UnexpectedSecretMaterial`. - -This evidence carries no raw secret bytes and does not create a broker, browser-fill adapter, protected-value store, KMS path, authenticated workload identity, persistence owner, or release claim. +The exact head has successful CI, exact owned production coverage, Security Scan, SAST and CodeRabbit status and is Ready for review. It has no raw secret bytes and does not create approval evidence, a broker, browser-fill adapter, protected-value store, KMS path, authenticated workload identity, persistence owner, or release claim. ## 4. Security interpretation -The executable authority chain is therefore intentionally non-transitive: +The executable authority chain is intentionally non-transitive: ```text Chromium extension permission @@ -84,4 +82,4 @@ This dossier does **not** close issue #27 or issue #10. Remaining material work ## 6. Documentation fitness consequence -The existing ADR/PRD/TRD/Architecture/UML/ERD graph remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. PRs #62 and #63 narrow the executable extension-authority evidence gap without introducing a new trust domain, deployment component, persistence entity, database schema, or independent architecture decision. Proposed ADR 0013 remains Proposed until its own lifecycle authority changes. \ No newline at end of file +The existing ADR/PRD/TRD/Architecture/UML/ERD graph remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. PRs #62 and #63 narrow distinct executable extension-authority evidence gaps without introducing a new trust domain, deployment component, persistence entity, database schema, or independent architecture decision. Proposed ADR 0013 remains Proposed until its own lifecycle authority changes. \ No newline at end of file From e4d6af228bde632e52a7985ffd768e6315991bb1 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 07:27:17 +0900 Subject: [PATCH 103/130] docs(traceability): record action post-condition evidence boundary --- .../action-postcondition-evidence.md | 99 +++++++++++++++++++ 1 file changed, 99 insertions(+) create mode 100644 docs/traceability/action-postcondition-evidence.md diff --git a/docs/traceability/action-postcondition-evidence.md b/docs/traceability/action-postcondition-evidence.md new file mode 100644 index 00000000..a343c207 --- /dev/null +++ b/docs/traceability/action-postcondition-evidence.md @@ -0,0 +1,99 @@ +# Action Post-Condition Evidence Traceability + +- **Documentation status:** Active-PR evidence dossier +- **Canonical owner:** PR #44 (`docs: reconcile architecture documentation fitness`) +- **Protected-main baseline:** `67af7c87589edc2039545af335c95064d9b8391c` +- **Capability maturity:** **PARTIAL** +- **Governing decisions:** Accepted ADR 0003 plus Proposed ADR 0106 preserve provenance-native evidence and separation of action execution from verification. + +## 1. Why this dossier exists + +OriginWeave's protected-main API contract already defines a durable product rule: returning from a browser command is not equivalent to successful action completion. A state-changing action becomes successful only after the declared or derived post-condition is observed and verified. Protected main also provides generic credential-safe provenance with explicit verification state, but that design rule was not yet represented by a reusable typed action-outcome evidence object. + +This dossier records the active implementation evidence that narrows that gap. It does not promote active pull requests to protected-main shipped truth and it does not claim that a real Chromium adapter already observes the post-condition after dispatch. + +## 2. Protected-main design and implementation boundary + +Protected `main` already provides: + +- typed `ActionKind` and immutable `ActionIntentDigest` values; +- canonical `Origin` authority values; +- credential-safe `ProvenanceRecord` with explicit `VerificationResult`; +- API/TRD requirements that state-changing success waits for an observed post-condition; and +- provenance architecture that keeps observation, policy, execution, and verification as distinct authorities. + +The generic value primitives are **IMPLEMENTED_ON_PROTECTED_MAIN**. The complete action dispatch → observation → independent verification → successful outcome chain remains **PARTIAL** because protected main does not yet contain the real Chromium runtime that composes them end to end. + +## 3. Active executable evidence + +### PR #64 — verified post-condition becomes typed action-outcome evidence + +**Capability maturity:** `IMPLEMENTED_ON_ACTIVE_PR` + +Exact head `98bb2efba830fb8968331b64cf16929c4005863c` adds `VerifiedActionOutcomeEvidence` in the existing credential-safe evidence crate. It binds: + +1. the exact typed `ActionKind`; +2. canonical target `Origin`; +3. complete immutable `ActionIntentDigest`; +4. a bounded first-slice `PostConditionKind` (`UrlChanged`, `NodeStateChanged`, `DialogStateChanged`, or `NetworkMutationObserved`); and +5. the exact `ProvenanceRecord` used as the post-condition proof. + +Construction fails closed unless the supplied provenance has `VerificationResult::Verified`. Both `Unverified` and `Rejected` observations are rejected as `PostConditionNotVerified`. + +The exact head has successful CI, exact owned production function/line/region/branch coverage, strict Clippy, rustdoc, Security Scan, SAST and CodeRabbit status and is Ready for review. + +## 4. Non-transitive success semantics + +The intended first-slice chain is: + +```text +typed action intent +-> policy-authorized dispatch +-> real browser input/event +-> observed bounded post-condition +-> independently verified provenance +-> VerifiedActionOutcomeEvidence +``` + +The active PR implements only the final typed evidence boundary. The following implications are explicitly invalid: + +```text +command return -/> successful action completion +protocol acknowledgement -/> successful action completion +Unverified -/> successful action completion +Rejected -/> successful action completion +VerifiedActionOutcomeEvidence type existence -/> proof of real Chromium execution +``` + +A future adapter must establish the event ordering and observation source before constructing the evidence. The type cannot by itself prove that a real browser was dispatched, that the observation happened after the dispatch, or that the observed state was caused by that action. + +## 5. Active prerequisite graph for issue #28 + +The first real Chromium vertical slice remains distributed across bounded active prerequisites rather than one shipped runtime: + +- PR #40 — protocol/browser identifiers → OriginWeave session/context/origin/document/node authority; +- PR #52 — bounded semantic node observation with explicit source-channel provenance; +- PR #57 — typed semantic-node query contract; +- PR #58 — authority-bound semantic node action target; +- PR #51 — bounded real-adapter telemetry value for RSS/observation bytes/action latency/task duration; and +- PR #64 — verified post-condition action-outcome evidence. + +These active PRs are non-shipped evidence. They do not themselves launch Chromium, implement WebDriver BiDi/CDP transport, dispatch a complete real input lifecycle, or prove deterministic teardown/recovery. + +## 6. Remaining issue #28 boundary + +This dossier does **not** close issue #28. Material remaining work includes: + +- pinned stock Chromium exercised as a reproducible supported runtime path; +- isolated Agent Task profile/context lifecycle and cleanup in the production vertical path; +- versioned WebDriver BiDi adapter plus explicitly bounded CDP observation fallback where needed; +- real semantic observation feeding typed query and policy-authorized typed action; +- real browser input dispatch followed by post-dispatch observation of the declared condition; +- hostile/stale/cross-session/cross-context/cross-origin/prompt-injection/secret-leak/crash/oversize regressions; +- deterministic failure/recovery evidence and task teardown; +- actual adapter resource telemetry; and +- protected-main integration plus fresh acceptance before any active-PR capability becomes shipped truth. + +## 7. Documentation fitness consequence + +The ADR/PRD/TRD/Architecture/UML/ERD graph remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. PR #64 narrows a typed evidence gap already governed by existing provenance/action-success decisions. It does not introduce a new trust domain, deployment component, persistence owner, database schema, or independent architecture decision, so a new ADR or physical ERD entity would overstate the implementation. Detailed real-Chromium dispatch/post-condition sequence diagrams should be reconciled when the executable adapter chain stabilizes rather than manufacturing as-built detail before that runtime exists. \ No newline at end of file From 2ed154c70e1348009f9349d2373baacb82a9a713 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 09:11:30 +0900 Subject: [PATCH 104/130] docs(traceability): reconcile action outcome and fixture evidence --- .../action-postcondition-evidence.md | 40 ++++++++++++------- 1 file changed, 26 insertions(+), 14 deletions(-) diff --git a/docs/traceability/action-postcondition-evidence.md b/docs/traceability/action-postcondition-evidence.md index a343c207..7ff74ecb 100644 --- a/docs/traceability/action-postcondition-evidence.md +++ b/docs/traceability/action-postcondition-evidence.md @@ -26,21 +26,30 @@ The generic value primitives are **IMPLEMENTED_ON_PROTECTED_MAIN**. The complete ## 3. Active executable evidence -### PR #64 — verified post-condition becomes typed action-outcome evidence +### PR #64 — verified, temporally ordered post-condition becomes typed action-outcome evidence **Capability maturity:** `IMPLEMENTED_ON_ACTIVE_PR` -Exact head `98bb2efba830fb8968331b64cf16929c4005863c` adds `VerifiedActionOutcomeEvidence` in the existing credential-safe evidence crate. It binds: +Exact head `2c45411ed9aa0eecca2d06c85659db9f4bb85e4d` adds `VerifiedActionOutcomeEvidence` in the existing credential-safe evidence crate. It binds: 1. the exact typed `ActionKind`; 2. canonical target `Origin`; 3. complete immutable `ActionIntentDigest`; -4. a bounded first-slice `PostConditionKind` (`UrlChanged`, `NodeStateChanged`, `DialogStateChanged`, or `NetworkMutationObserved`); and -5. the exact `ProvenanceRecord` used as the post-condition proof. +4. a bounded first-slice `PostConditionKind` (`UrlChanged`, `NodeStateChanged`, `DialogStateChanged`, or `NetworkMutationObserved`); +5. caller-supplied action-dispatch and post-condition-observation timestamps that must come from one monotonic clock domain; and +6. the exact `ProvenanceRecord` used as the post-condition proof. -Construction fails closed unless the supplied provenance has `VerificationResult::Verified`. Both `Unverified` and `Rejected` observations are rejected as `PostConditionNotVerified`. +Construction fails closed unless the supplied provenance has `VerificationResult::Verified`. Both `Unverified` and `Rejected` observations are rejected as `PostConditionNotVerified`. An observation timestamp earlier than dispatch is rejected as `PostConditionPredatesDispatch`; equal ticks remain valid for coarse monotonic clocks. -The exact head has successful CI, exact owned production function/line/region/branch coverage, strict Clippy, rustdoc, Security Scan, SAST and CodeRabbit status and is Ready for review. +On this exact head, CI run `31441848670`, Security Scan run `31441848649`, SAST Semgrep run `31441848615`, exact owned production function/line/region/branch coverage, strict Clippy, rustdoc and CodeRabbit exact-head status are successful. GitHub reports the PR mergeable and Ready for review; no formal reviews or inline review threads are currently returned. + +### PR #65 — controlled hostile local workflow fixture + +**Capability maturity:** `IMPLEMENTED_ON_ACTIVE_PR` only after its fail-first contract is satisfied; current state is **PARTIAL / RED-IN-PROGRESS**. + +Test-only head `d2580305f05aba93d10b5342ec1886d601c6752e` is based directly on the protected-main baseline and requires a checked-in `tests/fixtures/agent_task_basic/index.html` that does not yet exist. The contract intentionally requires a labelled semantic field, submit control, deterministic `idle` → `submitted` observable state change, one explicitly hidden/untrusted prompt-injection marker, and no password/OTP/API-key/secret collection surface. + +The missing fixture is deliberate fail-first evidence, not a shipped compatibility claim. The lane remains Draft until the exact RED is observed, the smallest controlled fixture is added, and exact-head verification succeeds. ## 4. Non-transitive success semantics @@ -52,7 +61,7 @@ typed action intent -> real browser input/event -> observed bounded post-condition -> independently verified provenance --> VerifiedActionOutcomeEvidence +-> temporally ordered VerifiedActionOutcomeEvidence ``` The active PR implements only the final typed evidence boundary. The following implications are explicitly invalid: @@ -62,10 +71,11 @@ command return -/> successful action completion protocol acknowledgement -/> successful action completion Unverified -/> successful action completion Rejected -/> successful action completion +caller-supplied timestamp ordering -/> proof of trusted clock provenance VerifiedActionOutcomeEvidence type existence -/> proof of real Chromium execution ``` -A future adapter must establish the event ordering and observation source before constructing the evidence. The type cannot by itself prove that a real browser was dispatched, that the observation happened after the dispatch, or that the observed state was caused by that action. +PR #64 now rejects a caller-supplied observation timestamp that predates caller-supplied dispatch time, but the type cannot independently prove the clock source, that a real browser actually dispatched the action, that the supplied provenance belongs to the claimed browser target/node, or that the observed state was caused by that action. Those claims remain the responsibility of the real adapter/runtime composition under issue #28. ## 5. Active prerequisite graph for issue #28 @@ -75,25 +85,27 @@ The first real Chromium vertical slice remains distributed across bounded active - PR #52 — bounded semantic node observation with explicit source-channel provenance; - PR #57 — typed semantic-node query contract; - PR #58 — authority-bound semantic node action target; -- PR #51 — bounded real-adapter telemetry value for RSS/observation bytes/action latency/task duration; and -- PR #64 — verified post-condition action-outcome evidence. +- PR #49 — ephemeral compatibility-profile lifecycle regression stacked on #43; +- PR #51 — bounded browser-task telemetry plus one explicitly supplied Linux PID `VmRSS` sampler; Chromium process discovery/process-set attribution remains outside that slice; +- PR #64 — verified and caller-timestamp-ordered post-condition action-outcome evidence; and +- PR #65 — controlled hostile local Agent Task workflow fixture currently in fail-first Draft state. -These active PRs are non-shipped evidence. They do not themselves launch Chromium, implement WebDriver BiDi/CDP transport, dispatch a complete real input lifecycle, or prove deterministic teardown/recovery. +These active PRs are non-shipped evidence. They do not themselves compose WebDriver BiDi/CDP transport, trusted Chromium process attribution, policy-authorized real input dispatch, causal post-condition observation, or deterministic end-to-end teardown/recovery into one protected-main runtime. ## 6. Remaining issue #28 boundary This dossier does **not** close issue #28. Material remaining work includes: -- pinned stock Chromium exercised as a reproducible supported runtime path; +- pinned stock Chromium exercised as one reproducible end-to-end Agent Task runtime path, not only extension compatibility fixtures; - isolated Agent Task profile/context lifecycle and cleanup in the production vertical path; - versioned WebDriver BiDi adapter plus explicitly bounded CDP observation fallback where needed; - real semantic observation feeding typed query and policy-authorized typed action; - real browser input dispatch followed by post-dispatch observation of the declared condition; - hostile/stale/cross-session/cross-context/cross-origin/prompt-injection/secret-leak/crash/oversize regressions; - deterministic failure/recovery evidence and task teardown; -- actual adapter resource telemetry; and +- Chromium process discovery/process-set attribution composed into resource telemetry; and - protected-main integration plus fresh acceptance before any active-PR capability becomes shipped truth. ## 7. Documentation fitness consequence -The ADR/PRD/TRD/Architecture/UML/ERD graph remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. PR #64 narrows a typed evidence gap already governed by existing provenance/action-success decisions. It does not introduce a new trust domain, deployment component, persistence owner, database schema, or independent architecture decision, so a new ADR or physical ERD entity would overstate the implementation. Detailed real-Chromium dispatch/post-condition sequence diagrams should be reconciled when the executable adapter chain stabilizes rather than manufacturing as-built detail before that runtime exists. \ No newline at end of file +The ADR/PRD/TRD/Architecture/UML/ERD graph remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. PR #64 narrows a typed evidence gap already governed by existing provenance/action-success decisions, while PR #65 supplies controlled test infrastructure for the eventual real-browser proof. Neither introduces a new trust domain, deployed component, persistence owner, database schema, or independent architecture decision, so a new ADR or physical ERD entity would overstate the implementation. Detailed real-Chromium dispatch/post-condition sequence diagrams should be reconciled when the executable adapter chain stabilizes rather than manufacturing as-built detail before that runtime exists. From dc0055eb41e270f783a6d4917a0f939308305e97 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 09:15:34 +0900 Subject: [PATCH 105/130] docs(traceability): record controlled fixture exact-head proof --- .../traceability/action-postcondition-evidence.md | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/docs/traceability/action-postcondition-evidence.md b/docs/traceability/action-postcondition-evidence.md index 7ff74ecb..23a6e764 100644 --- a/docs/traceability/action-postcondition-evidence.md +++ b/docs/traceability/action-postcondition-evidence.md @@ -45,11 +45,15 @@ On this exact head, CI run `31441848670`, Security Scan run `31441848649`, SAST ### PR #65 — controlled hostile local workflow fixture -**Capability maturity:** `IMPLEMENTED_ON_ACTIVE_PR` only after its fail-first contract is satisfied; current state is **PARTIAL / RED-IN-PROGRESS**. +**Capability maturity:** `IMPLEMENTED_ON_ACTIVE_PR` + +Test-only head `d2580305f05aba93d10b5342ec1886d601c6752e` was based directly on the protected-main baseline and intentionally required a checked-in `tests/fixtures/agent_task_basic/index.html` before that fixture existed. CI run `31445088008`, Rust contracts job `93637443229`, checked out that exact head and failed with three `FileNotFoundError` results for the missing fixture, establishing the intended fail-first boundary. + +Exact head `0888fe3a6ef6da547a37fd075733cc73dc52b2ab` adds the smallest controlled fixture satisfying the contract: a labelled semantic field, submit control, deterministic `idle` → `submitted` observable state change carrying only synthetic text, one explicitly hidden/untrusted prompt-injection marker, and no password/OTP/API-key/secret collection surface. -Test-only head `d2580305f05aba93d10b5342ec1886d601c6752e` is based directly on the protected-main baseline and requires a checked-in `tests/fixtures/agent_task_basic/index.html` that does not yet exist. The contract intentionally requires a labelled semantic field, submit control, deterministic `idle` → `submitted` observable state change, one explicitly hidden/untrusted prompt-injection marker, and no password/OTP/API-key/secret collection surface. +On that unchanged exact head, CI run `31445201739` succeeds; Rust contracts job `93637824750` passes repository contracts, formatting, locked workspace check, full tests, strict Clippy and rustdoc; Production coverage job `93637824824` passes exact owned production function/line/region/branch enforcement; Security Scan run `31445201774`, SAST Semgrep run `31445201669` and CodeRabbit exact-head status succeed. GitHub reports the PR mergeable and Ready for review with no formal reviews or inline review threads currently returned. -The missing fixture is deliberate fail-first evidence, not a shipped compatibility claim. The lane remains Draft until the exact RED is observed, the smallest controlled fixture is added, and exact-head verification succeeds. +This remains controlled test infrastructure rather than browser-execution evidence. The fixture itself does not establish WebDriver BiDi/CDP transport, Chromium semantic extraction, policy dispatch, native input, post-condition provenance, profile teardown or process attribution. ## 4. Non-transitive success semantics @@ -73,9 +77,10 @@ Unverified -/> successful action completion Rejected -/> successful action completion caller-supplied timestamp ordering -/> proof of trusted clock provenance VerifiedActionOutcomeEvidence type existence -/> proof of real Chromium execution +controlled fixture success -/> proof of real Chromium execution ``` -PR #64 now rejects a caller-supplied observation timestamp that predates caller-supplied dispatch time, but the type cannot independently prove the clock source, that a real browser actually dispatched the action, that the supplied provenance belongs to the claimed browser target/node, or that the observed state was caused by that action. Those claims remain the responsibility of the real adapter/runtime composition under issue #28. +PR #64 now rejects a caller-supplied observation timestamp that predates caller-supplied dispatch time, but the type cannot independently prove the clock source, that a real browser actually dispatched the action, that the supplied provenance belongs to the claimed browser target/node, or that the observed state was caused by that action. PR #65 supplies deterministic hostile input and a post-condition target but no browser execution. Those claims remain the responsibility of the real adapter/runtime composition under issue #28. ## 5. Active prerequisite graph for issue #28 @@ -88,7 +93,7 @@ The first real Chromium vertical slice remains distributed across bounded active - PR #49 — ephemeral compatibility-profile lifecycle regression stacked on #43; - PR #51 — bounded browser-task telemetry plus one explicitly supplied Linux PID `VmRSS` sampler; Chromium process discovery/process-set attribution remains outside that slice; - PR #64 — verified and caller-timestamp-ordered post-condition action-outcome evidence; and -- PR #65 — controlled hostile local Agent Task workflow fixture currently in fail-first Draft state. +- PR #65 — controlled hostile local Agent Task workflow fixture, gate-clean and Ready for review. These active PRs are non-shipped evidence. They do not themselves compose WebDriver BiDi/CDP transport, trusted Chromium process attribution, policy-authorized real input dispatch, causal post-condition observation, or deterministic end-to-end teardown/recovery into one protected-main runtime. From c92764938bdd21447622f354b6fbea9a93486b60 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 09:38:04 +0900 Subject: [PATCH 106/130] test(docs): require latest active PR maturity evidence --- ...cumentation_active_pr_evidence_contract.py | 57 +++++++++++++++++-- 1 file changed, 53 insertions(+), 4 deletions(-) diff --git a/tests/test_documentation_active_pr_evidence_contract.py b/tests/test_documentation_active_pr_evidence_contract.py index 1b2baa09..d2a067e5 100644 --- a/tests/test_documentation_active_pr_evidence_contract.py +++ b/tests/test_documentation_active_pr_evidence_contract.py @@ -31,7 +31,7 @@ def setUpClass(cls) -> None: def test_dependency_stacks_are_explicit_and_non_shipped(self) -> None: """Current browser, network, sensitive and compatibility stacks stay active-only.""" - for pr_number in (52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62): + for pr_number in (52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66): with self.subTest(pr_number=pr_number): row = active_pr_row(self.maturity, pr_number) self.assertIn("**IMPLEMENTED_ON_ACTIVE_PR**", row) @@ -42,6 +42,7 @@ def test_dependency_stacks_are_explicit_and_non_shipped(self) -> None: "#45 → #46 → #53 → #55", "#40→#52→#57→#58", "#43→#56→#59→#60→#61", + "#51→#66", ): with self.subTest(stack=stack): self.assertIn(stack, self.fitness) @@ -131,11 +132,59 @@ def test_extension_proposal_grant_does_not_become_agent_policy_authority(self) - ): with self.subTest(marker=marker): self.assertIn(marker, row) - self.assertIn("CI run `31436078746`", row) - self.assertIn("Security Scan run `31436078045`", row) - self.assertIn("SAST Semgrep run `31436078163`", row) + self.assertIn("CI run `31436844685`", row) + self.assertIn("Security Scan run `31436844615`", row) + self.assertIn("SAST Semgrep run `31436844646`", row) self.assertNotIn("IMPLEMENTED_ON_PROTECTED_MAIN", row) + def test_latest_agent_task_and_secret_composition_evidence_remains_partial(self) -> None: + """Newest active slices must not be promoted into a complete browser or broker runtime.""" + secret_approval = active_pr_row(self.maturity, 63) + for marker in ( + "ProposeTypedAction", + "RequireApproval(RiskClass::R3)", + "no secret broker", + ): + with self.subTest(pr_number=63, marker=marker): + self.assertIn(marker, secret_approval) + + action_outcome = active_pr_row(self.maturity, 64) + for marker in ( + "PostConditionPredatesDispatch", + "monotonic", + "not a browser dispatcher", + ): + with self.subTest(pr_number=64, marker=marker): + self.assertIn(marker, action_outcome) + + controlled_fixture = active_pr_row(self.maturity, 65) + for marker in ( + "controlled", + "prompt-injection", + "not a browser adapter", + ): + with self.subTest(pr_number=65, marker=marker): + self.assertIn(marker, controlled_fixture) + + process_set = active_pr_row(self.maturity, 66) + for marker in ( + "process-set RSS", + "duplicate", + "does not discover Chromium PIDs", + ): + with self.subTest(pr_number=66, marker=marker): + self.assertIn(marker, process_set) + + for marker in ( + "#62/#63", + "#64", + "#65", + "#51→#66", + "real Chromium", + ): + with self.subTest(fitness_marker=marker): + self.assertIn(marker, self.fitness) + def test_erd_stays_conceptual_without_persistence_owner(self) -> None: """Active in-memory/value primitives must not manufacture a physical data model.""" self.assertIn("Conceptual ERD/domain model", self.fitness) From 17ff48997081357351c5b0847d8304293be8ea6f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 09:44:51 +0900 Subject: [PATCH 107/130] docs: refresh active implementation maturity evidence --- docs/evidence/2026-08-10-active-pr-maturity.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index 5b82a673..10dd0daf 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -16,17 +16,17 @@ This dated appendix records volatile implementation evidence that must not be em | PR | Scope | Maturity | Dependency / evidence boundary | |---|---|---|---| -| #37 | Bounded HTTP/1.1 over authenticated governed transport | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `a38980683f073c8df8bebb8d674efaca4cf3e66d` is gate-clean and mergeable; protected main still reports HTTP as Planned. Historical #11 remains predecessor lineage until protected integration. | +| #37 | Bounded HTTP/1.1 over authenticated governed transport | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `9becaaf61f10d854b20ebd2e04ccd3f57dee97fe` is mergeable and passes CI `31439440664`, Security Scan `31439440691`, SAST Semgrep `31439440663`, exact owned production coverage and CodeRabbit exact-head status. Protected main still reports HTTP as Planned. Historical #11 remains predecessor lineage until protected integration. | | #40 | Browser protocol identifier → OriginWeave authority registry | **IMPLEMENTED_ON_ACTIVE_PR** | Current exact head `9e635e80e9813a1d2a9c408155d52221b76eeed3` is gate-clean across CI, Security Scan, SAST, Manifest V3 Compatibility and CodeRabbit; the real browser adapter remains Planned under #28. | | #43 | Real pinned-Chromium Manifest V3 downloads compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `27ce89066ed1473dcd66eb26a2f91becf9df5424` is gate-clean; this proves one declared compatibility surface, not full extension compatibility or Agent authority. | -| #44 | Canonical documentation reconciliation | **IMPLEMENTED_ON_ACTIVE_PR** | This branch owns the documentation repair itself; its content does not become protected-main truth until integration. | +| #44 | Canonical documentation reconciliation | **IMPLEMENTED_ON_ACTIVE_PR** | This branch owns the documentation repair itself; its content does not become protected-main truth until integration. Current-head evidence must be read from the live PR because every reconciliation commit intentionally invalidates predecessor-head exactness. | | #45 | Credential-free sensitive-handle lifecycle evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0f07fea031090c72a448fd9501b49d4dd7568419` is gate-clean; trusted broker/storage/value resolution remain Planned under #10. | | #46 | In-process authoritative sensitive-handle use reservation | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `5f212cdfbf3c453472069973138fd9563cf7bff8` is gate-clean; no cross-process/database transactionality or protected-value resolution is claimed. | | #47 | Bounded resolution freshness authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `6b5ed4dcea281b505f67db6180bb14c3bc95b392` is gate-clean. Its first-party consumer is now implemented on stacked #50, but neither capability is protected-main truth until dependency-ordered integration. | | #48 | TLS revocation-material freshness primitive | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `9bbe12860436027a3b7cd5786775f1dacfbc835d` is gate-clean; no OCSP/CRL acquisition, signature validation, cache, or unrevoked claim is implemented. | | #49 | Ephemeral Agent Task profile-isolation regression | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #43 at exact head `96a4e949d96b5794ef473ccf813987b8e69ea566`; CI is green but dependency-gated and not independently integrable before #43. | | #50 | First-party network consumption of resolution freshness | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #47 head `6b5ed4dcea281b505f67db6180bb14c3bc95b392`. Exact head `f8b43bc94444986ab23aa4ef3086e446a0b39295` structurally hides the untimed public network planner, migrates first-party TLS integration helpers through `FreshConnectionPlan`, and passes CI run `31408474576` including exact owned function/line/region/branch coverage; CodeRabbit exact-head status is success. Dependency order, not implementation incompleteness, keeps the PR Draft. | -| #51 | Browser-task runtime telemetry value object | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `1c85b966087191f52b4a709a2822b2a53fb0e2fa` is CI/Security/SAST/CodeRabbit clean and Ready for review; it carries validated measurements but performs no OS/Chromium sampling itself. | +| #51 | Browser-task runtime telemetry plus one-PID Linux RSS sampling | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `dab26e4e9652408fb67dc8eedf9fd1820e524805` validates browser/task telemetry and samples one explicitly supplied Linux PID through strict `/proc//status` `VmRSS` parsing. CI `31441792029`, production coverage job `93627900171`, Security Scan `31441792000`, SAST Semgrep `31441791982` and CodeRabbit exact-head status succeed. Chromium PID discovery, task attribution, process-set accounting, GPU/VRAM and cross-platform sampling remain separate responsibilities. | | #52 | Bounded semantic-node observation and relationship value contract | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #40. Exact head `94fd284fe41746eeba9edc05d9753903b1c41ebf` adds at most 128 ordered child relationships, optional parent linkage, exact session/context/origin/document authority matching, self/duplicate rejection and stable credential-free errors. CI run `31428454410`, Manifest V3 Compatibility run `31428454350`, and CodeRabbit exact-head status succeed, including exact owned production function/line/region/branch coverage. The value contract still performs no browser I/O or action dispatch. | | #53 | Authoritative in-process sensitive-handle revocation state | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #46 at exact head `86ce4bc1c11c270dc532593d673c42bd6f623d74`; CI and CodeRabbit are green. It adds typed first-revocation-wins state but no durable broker, cross-process transactionality, protected-value resolution, KMS, or persistence. | | #54 | Recheck resolution freshness at socket use | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #50 at exact head `ec81031c537f2b662910c1ce78c7ae0e0bfc9c1e`; CI and CodeRabbit are green. `connect_at` revalidates freshness immediately before socket I/O and the compatibility path derives elapsed monotonic time; no resolver, DNS lookup, proxy/PAC or wall-clock authority is added. | @@ -37,7 +37,11 @@ This dated appendix records volatile implementation evidence that must not be em | #59 | Real pinned-Chromium history mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #56. Test-only head `4b5f393a7420541723a07243b83cdaa7e28948de` and CI run `31432051381` established the intended repository-contract RED because controlled `history.addUrl`/`deleteUrl` lifecycle support was absent. Current exact head `b0d9c905fd7a50128eb1dde643b8a3a0f9cb1dc8` adds loopback-only add → exact readback → delete → absence verification. CI run `31432338572`, Manifest V3 Compatibility run `31432338759`, and CodeRabbit exact-head status succeed, including exact owned production function/line/region/branch coverage. Compatibility evidence only; no Agent history capability. | | #60 | Real pinned-Chromium extension update/version migration | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #59. Test-only head `a60875f70f8412db27ff1025b75d7ad4b8ddc38e` and CI run `31433305976` established the intended RED because no trial-local extension copy, version transition, migration state, or update-migration evidence existed. Current exact head `e696e19c9eaf3dedb104a5de4bdbd7970abf90d4` uses an ephemeral extension copy and one profile across initial `1.0.0`/initialized → restart `1.0.0`/current → update `1.0.1`/migrated passes. CI run `31433968874`, Manifest V3 Compatibility run `31433968931`, and CodeRabbit exact-head status succeed; the real browser evidence reports 3/3 trials and the exact update-migration surface. This does not claim Chrome Web Store/enterprise update semantics or Agent authority. | | #61 | Real pinned-Chromium content-script isolated-world separation | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #60. Test-only head `e81cdbd9b31a62227698bd3d824fd901551061f0` and CI run `31434443638` established the intended RED because the fixture had no page-main/content-isolated sentinel contract. Current exact head `c1705ad9fd2d96e620b89bb6e7ea1235063dcb6a` requires the page to retain `window.originweaveWorldSentinel = "page"` while the content script independently retains the same-named global as `"extension"`; the existing content compatibility surface fails if the JavaScript worlds collapse. CI run `31434670642`, Manifest V3 Compatibility run `31434670629`, and CodeRabbit exact-head status succeed; real browser evidence reports 3/3 repeatability trials. Compatibility evidence only; no arbitrary page-JavaScript bridge or Agent authority. | -| #62 | Extension proposal → Agent policy isolation regression | **IMPLEMENTED_ON_ACTIVE_PR** | Ready PR based directly on protected main. Exact head `277df965602a97b1c221df2fc7a228ff5ac6c540` first proves the exact extension/session/context `ProposeTypedAction` grant is allowed, then proves that ordinary Agent policy still independently rejects an out-of-grant target origin, a missing core `Navigate` capability, and `WebContent` as an untrusted instruction source. CI run `31436078746` including exact production function/line/region/branch coverage, Security Scan run `31436078045`, SAST Semgrep run `31436078163`, and CodeRabbit exact-head status succeed. This adds no production API or real Chromium adapter and does not convert extension proposal authority into Agent action/origin authority. | +| #62 | Extension proposal → Agent policy isolation regression | **IMPLEMENTED_ON_ACTIVE_PR** | Ready PR based directly on protected main. Exact head `a57873b3688984711918be17aadd348ed9fb12a9` first proves the exact extension/session/context `ProposeTypedAction` grant is allowed, then proves ordinary Agent policy independently rejects an out-of-grant target origin, a missing core `Navigate` capability, untrusted `WebContent`, raw secret delivery and unexpected secret material. CI `31436844685`, production coverage job `93612736291`, Security Scan `31436844615`, SAST Semgrep `31436844646`, and CodeRabbit exact-head status succeed. This adds no production API or real Chromium adapter and does not convert extension proposal authority into Agent action/origin/secret authority. | +| #63 | Extension proposal → secret high-risk approval isolation | **IMPLEMENTED_ON_ACTIVE_PR** | Ready PR based directly on protected main at exact head `e83749acd1cf5a0b778ba38eb9d6ed5a9bd1e68f`. The exact extension grant allows `ProposeTypedAction`, while ordinary Agent policy still returns `RequireApproval(RiskClass::R3)` for broker-handle `FillSecret`. CI `31437994464`, Rust contracts job `93616406126`, production coverage job `93616406182`, Security Scan `31437994491`, SAST Semgrep `31437994454`, and CodeRabbit exact-head status succeed. This is composition evidence only: it adds no secret broker, protected value, authenticated workload identity, browser adapter or approval evidence. | +| #64 | Verified action post-condition evidence with dispatch ordering | **IMPLEMENTED_ON_ACTIVE_PR** | Ready PR based directly on protected main at exact head `2c45411ed9aa0eecca2d06c85659db9f4bb85e4d`. `VerifiedActionOutcomeEvidence` requires verified provenance and caller-supplied monotonic dispatch/observation timestamps; observations before dispatch fail as `PostConditionPredatesDispatch`. CI `31441848670`, production coverage job `93628017556`, Security Scan `31441848649`, SAST Semgrep `31441848615`, and CodeRabbit exact-head status succeed. It is not a browser dispatcher and does not prove trusted clock provenance, real browser dispatch, target linkage, causality or a reached browser condition. | +| #65 | Controlled hostile Agent Task fixture | **IMPLEMENTED_ON_ACTIVE_PR** | Ready PR based directly on protected main at exact head `0888fe3a6ef6da547a37fd075733cc73dc52b2ab`. Test-only head `d2580305f05aba93d10b5342ec1886d601c6752e` and CI `31445088008` established the intended missing-fixture RED. The current fixture provides a labelled semantic form, deterministic same-document state transition and explicitly hidden/untrusted prompt-injection text using synthetic local data only. CI `31445201739`, Rust contracts job `93637824750`, production coverage job `93637824824`, Security Scan `31445201774`, SAST Semgrep `31445201669`, and CodeRabbit exact-head status succeed. It is controlled test infrastructure, not a browser adapter or proof of real Chromium execution. | +| #66 | Bounded explicit browser process-set RSS aggregation/sampling | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on exact #51 head `dab26e4e9652408fb67dc8eedf9fd1820e524805`. A predecessor implementation test incorrectly required two sequential `/proc` RSS reads to be equal; current regression instead verifies the kernel sample's positive byte/unit contract without assuming RSS immutability. Exact head `986958ab8a29b3ca708c80e44df45e1ec5f9f868` accepts at most 256 unique nonzero caller-owned PIDs, rejects empty/duplicate/oversized sets and checked-add overflow, and fails closed if any sampled member is unavailable. CI `31446842334` passes repository contracts, formatting, workspace checks/tests, strict Clippy, rustdoc and exact owned production function/line/region/branch coverage; CodeRabbit exact-head status succeeds. It does not discover Chromium PIDs, prove same-task attribution, walk a process tree/cgroup, or measure GPU/VRAM. | ## Historical lineage From d3c736dbde36086738a79a5a659e6a0f80c14c87 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 09:47:27 +0900 Subject: [PATCH 108/130] docs: reconcile latest active runtime evidence --- docs/DOCUMENTATION_FITNESS.md | 68 ++++++++++++++++++++++++----------- 1 file changed, 48 insertions(+), 20 deletions(-) diff --git a/docs/DOCUMENTATION_FITNESS.md b/docs/DOCUMENTATION_FITNESS.md index 1637b5a5..69f60325 100644 --- a/docs/DOCUMENTATION_FITNESS.md +++ b/docs/DOCUMENTATION_FITNESS.md @@ -17,20 +17,20 @@ File existence alone is never sufficient. An artifact can exist and still be sta | Documentation family | Fitness | Current evidence / remaining boundary | |---|---|---| -| PRD | **PRESENT-CURRENT on this branch / protected-main follow-up required** | Protected-main requirements remain distinct from active evidence. #37 is the bounded-HTTP replacement; #45→#46→#53→#55 narrows sensitive-handle authority without creating the trusted broker; #47→#50→#54 narrows resolution freshness through socket use; #40→#52→#57→#58 provides browser authority/semantic prerequisites; #43→#56→#59→#60→#61 plus #49 provide active MV3 compatibility evidence only. | -| TRD | **PRESENT-CURRENT on this branch / protected-main follow-up required** | One protected-main implementation state is kept separate from volatile active/non-shipped evidence. Value objects, fixtures and compatibility tests do not imply deployed services, browser adapters or completed runtime paths. | -| Root Architecture | **PRESENT-CURRENT** | The Chromium compatibility kernel plus Rust authority-bearing control plane remains correct. #47/#50/#54 refine ADR 0004; #45/#46/#53/#55 refine ADR 0007; #40/#52/#57/#58 refine browser observation/action boundaries; #43/#49/#56/#59/#60/#61 remain compatibility work under issue #27. No later lane introduces a new trust domain, persistence owner or deployed component. | +| PRD | **PRESENT-CURRENT on this branch / protected-main follow-up required** | Protected-main requirements remain distinct from active evidence. #37 is the bounded-HTTP replacement; #45→#46→#53→#55 narrows sensitive-handle authority without creating the trusted broker; #47→#50→#54 narrows resolution freshness through socket use; #40→#52→#57→#58 provides browser authority/semantic prerequisites; #43→#56→#59→#60→#61 plus #49 provide active MV3 compatibility evidence; #62/#63 prove extension-proposal isolation without widening Agent/secret approval authority; and #64/#65 plus #51→#66 add outcome, controlled-fixture and resource-measurement prerequisites without completing the real Chromium runtime. | +| TRD | **PRESENT-CURRENT on this branch / protected-main follow-up required** | One protected-main implementation state is kept separate from volatile active/non-shipped evidence. Value objects, fixtures, bounded Linux samplers and compatibility tests do not imply deployed services, Chromium process attribution, browser adapters or completed runtime paths. | +| Root Architecture | **PRESENT-CURRENT** | The Chromium compatibility kernel plus Rust authority-bearing control plane remains correct. #47/#50/#54 refine ADR 0004; #45/#46/#53/#55 refine ADR 0007; #40/#52/#57/#58 refine browser observation/action boundaries; #62/#63 exercise the existing extension/policy separation; #64/#65 and #51→#66 refine evidence/fixture/resource prerequisites; #43/#49/#56/#59/#60/#61 remain compatibility work under issue #27. None introduces a new trust domain, persistence owner or deployed component. | | ADR index/lifecycle | **PRESENT-CURRENT on this branch** | Accepted ADRs remain distinct from Proposed decisions. ADR 0013 separates MV3 compatibility from Agent authority; ADR 0014 governs architecture-decision lifecycle. Their branch presence or later integration cannot silently promote them to Accepted. | -| Individual ADRs | **SUFFICIENT BY LIFECYCLE** | Existing Accepted decisions cover current material trust boundaries. #59/#60/#61 refine compatibility evidence and do not independently justify new ADRs. | -| UML / control-flow diagrams | **PRESENT-CURRENT with one legitimate deferral** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows exist. `uml/extension-authority.md` closes the permission-vs-Agent-authority gap. Detailed real-Chromium adapter/input/post-condition UML remains deferred until issue #28 executable contracts stabilize. | -| Conceptual ERD/domain model | **PRESENT-CURRENT** | The ERD remains explicitly conceptual until a real persistence owner/schema exists. #45/#46/#47/#48/#50/#51/#52/#53/#54/#55/#56/#57/#58/#59/#60/#61 add no OriginWeave-owned durable store. Manufacturing tables for in-memory state, value objects, query/action-target primitives or compatibility fixtures would be false architecture. | -| Traceability | **PRESENT-CURRENT on this branch** | Uses explicit protected-main, active-PR, partial, accepted-architecture, planned, research-only, superseded and out-of-scope maturity vocabulary. Volatile exact-head evidence lives in the dated maturity appendix, now through #61. | -| Threat model / Security | **PRESENT-CURRENT with implementation follow-up** | Untrusted content, network, secret, provenance and extension risks are covered. Active browser semantics remain descriptive until policy and execution. #59/#60/#61 mutate only controlled compatibility state and add no Agent authority. | -| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned production function/line/region/branch coverage, rustdoc and realistic boundary testing are explicit. Active compatibility work uses exact RED→GREEN evidence, pinned real Chromium and repeated trials rather than source-text claims alone. | -| Operability / incident response | **PRESENT-CURRENT** | Failure, readiness, quarantine, cleanup and recovery concepts exist. The active fixture lanes add no daemon/service or persistence owner, so new SLO/RPO/RTO claims would be fabricated. | -| API / protocol contracts | **PRESENT-CURRENT as target contracts** | #52 is an internal semantic-observation value API, #57 a bounded typed-query API, and #58 an authority-bound action-target bridge; none is a BiDi/CDP/WebMCP wire protocol, browser input executor, business-risk classification, policy approval or post-condition proof. | -| Release / rollback / provenance | **PRESENT-CURRENT** | Release remains bound to one exact integrated protected head. Active stacks #40→#52→#57→#58, #47→#50→#54, #45→#46→#53→#55, and #43→#56→#59→#60→#61 plus parallel #49 preserve dependency order; predecessor-head success cannot satisfy a later head. | -| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. Authenticated workload identity, durable trusted-broker storage, protected-value resolution/fill, KMS, cross-process transactionality, compensation, retention and model-disclosure lifecycle remain open under issue #10. | +| Individual ADRs | **SUFFICIENT BY LIFECYCLE** | Existing Accepted and Proposed decisions cover current material trust boundaries. #62–#66 refine or test existing authority, evidence, fixture and resource boundaries and do not independently justify manufacturing a new ADR. | +| UML / control-flow diagrams | **PRESENT-CURRENT with one legitimate deferral** | Component, network authority, observation/action, delegated-task state, deployment, evidence, secret-fill, approval, resource-pressure/GPU fallback and hourly automation flows exist. `uml/extension-authority.md` closes the permission-vs-Agent-authority gap. Detailed real-Chromium adapter/input/post-condition/process-attribution UML remains deferred until issue #28 executable contracts stabilize. | +| Conceptual ERD/domain model | **PRESENT-CURRENT** | The ERD remains explicitly conceptual until a real persistence owner/schema exists. Current active #45–#66 value, policy, freshness, compatibility, fixture, evidence and resource slices add no OriginWeave-owned durable store. Manufacturing tables for in-memory state, value objects, browser fixtures or process samples would be false architecture. | +| Traceability | **PRESENT-CURRENT on this branch** | Uses explicit protected-main, active-PR, partial, accepted-architecture, planned, research-only, superseded and out-of-scope maturity vocabulary. Volatile exact-head evidence lives in the dated maturity appendix, now through #66. | +| Threat model / Security | **PRESENT-CURRENT with implementation follow-up** | Untrusted content, network, secret, provenance and extension risks are covered. #62/#63 prove extension proposal permission cannot replace Agent policy or R3 approval; #64 does not turn caller timestamps into trusted causality; #65's hostile page content remains a controlled untrusted fixture; #66 does not infer process ownership from caller-supplied PIDs. | +| Test strategy / quality gates | **PRESENT-CURRENT** | Exact owned production function/line/region/branch coverage, rustdoc and realistic boundary testing are explicit. Active work uses exact RED→GREEN evidence, pinned real Chromium where browser behavior is claimed, and fail-closed OS sampling contracts rather than source-text or self-reported claims alone. | +| Operability / incident response | **PRESENT-CURRENT** | Failure, readiness, quarantine, cleanup and recovery concepts exist. Current fixture/value/sampler lanes add no daemon/service or persistence owner, so new SLO/RPO/RTO claims would be fabricated. | +| API / protocol contracts | **PRESENT-CURRENT as target contracts** | #52 is an internal semantic-observation value API, #57 a bounded typed-query API, #58 an authority-bound action-target bridge, and #64 an outcome-evidence value boundary. None is a BiDi/CDP/WebMCP wire adapter, native browser input executor, trusted-clock source, business-risk classifier or post-condition observer. | +| Release / rollback / provenance | **PRESENT-CURRENT** | Release remains bound to one exact integrated protected head. Active stacks #40→#52→#57→#58, #47→#50→#54, #45→#46→#53→#55, #43→#56→#59→#60→#61 plus parallel #49, and #51→#66 preserve dependency order; #62/#63/#64/#65 are direct-main prerequisites. Predecessor-head success cannot satisfy a later head. | +| Data governance / privacy | **PRESENT-CURRENT architecture / PARTIAL runtime** | Purpose-bound policy/evidence foundations exist. #62/#63 prove that proposal authority cannot manufacture secret authority or approval, but authenticated workload identity, durable trusted-broker storage, protected-value resolution/fill, KMS, cross-process transactionality, compensation, retention and model-disclosure lifecycle remain open under issue #10. | | Standards / doctoring | **PRESENT-CURRENT with continuous watch** | Primary browser/protocol/standards evidence and APA 7 references distinguish living/vendor/experimental material from final normative standards. Exact browser release evidence stays pinned to executable Chromium evidence rather than documentation alone. | ## 3. Reconciliation findings @@ -102,11 +102,11 @@ Active #48 provides a bounded freshness primitive for already verified revocatio **Resolution:** this is not OCSP/CRL acquisition, signature/path validation, cache operation or an unrevoked-certificate claim. No fictitious revocation-service topology is added. -### 3.10 Browser task telemetry +### 3.10 Browser task telemetry and process-set RSS -Active #51 provides bounded RSS, observation-byte, action-latency and task-duration values but performs no OS/Chromium sampling. +Active #51 validates bounded RSS, observation-byte, action-latency and task-duration values and now samples one explicitly supplied Linux PID through strict `/proc//status` `VmRSS` parsing. Stacked #66 extends this to a bounded explicit process set: at most 256 unique nonzero caller-owned PIDs, checked aggregate addition, and fail-closed sampling when any member cannot be measured. -**Resolution:** value-object availability cannot be promoted to measured runtime evidence or GPU/local-model evidence. +**Resolution:** OS sampling is now real for caller-supplied Linux PIDs, but Chromium process discovery, same-task attribution, browser child-process/cgroup walking, GPU/VRAM, JS heap and cross-platform sampling remain unimplemented. A changing RSS value is runtime state, so correctness tests validate the sampling contract rather than assuming two sequential reads are byte-identical. ### 3.11 Semantic observation authority @@ -144,6 +144,30 @@ Active #61 gives the page main world and the MV3 content script the same JavaScr **Resolution:** this is a bounded compatibility proof, not a trusted page-content channel, arbitrary JavaScript bridge or Agent capability. +### 3.17 Extension proposal authority and secret approval composition + +Active #62/#63 exercise two sides of one architectural separator. #62 first proves the exact extension/session/context `ProposeTypedAction` grant is present and then requires ordinary Agent policy to reject origin/capability/instruction/secret widening. #63 gives the Agent context its independent `FillSecret` capability and broker-handle delivery request, but still requires the ordinary high-risk result `RequireApproval(RiskClass::R3)`. + +**Resolution:** extension proposal permission can neither mint Agent capability/origin/secret authority nor manufacture approval. These are regression proofs over existing boundaries, not a secret broker, browser adapter, approval service or new trust domain. Proposed ADR 0013 already captures the relevant permission-vs-Agent-authority decision. + +### 3.18 Verified action-outcome ordering + +Active #64 makes a successful action-outcome value require existing verified provenance plus one caller-supplied monotonic dispatch timestamp and an observation timestamp that is not earlier. An earlier observation fails closed as `PostConditionPredatesDispatch`; equality is allowed for coarse monotonic clocks. + +**Resolution:** temporal ordering prevents packaging a pre-dispatch observation as later success evidence, but it does not prove trusted clock provenance, actual browser dispatch, target linkage, causal effect or that a real browser reached the declared state. #64 is not a browser dispatcher or post-condition observer. + +### 3.19 Controlled Agent Task fixture + +Active #65 supplies a deterministic synthetic local web fixture with a labelled semantic input, submit control, same-document post-condition and explicitly hidden/untrusted prompt-injection text. The fixture contains no credential collection surface and requires no live third-party site. + +**Resolution:** the fixture makes the future real Chromium vertical slice reproducible without turning a third-party site into a test dependency. It is not a browser adapter, semantic extractor, input dispatcher, policy engine, trusted clock, process-attribution source or proof of real Chromium execution. + +### 3.20 Bounded browser process-set resource evidence + +Active #51→#66 establishes two distinct layers: #51 owns single explicitly supplied Linux PID sampling and the bounded telemetry value boundary; #66 owns bounded duplicate-safe aggregation/sampling over an exact caller-owned PID set. #66's exact current contract rejects empty, zero-PID, duplicate, oversized and overflow states and fails closed if any member cannot be sampled. + +**Resolution:** aggregate resource measurement must not silently undercount a known caller-owned process set, but process membership remains an external attribution responsibility. The implementation does not discover Chromium PIDs, prove process ancestry/task ownership, walk cgroups, sample GPU/VRAM or create a durable telemetry store. + ## 4. Durable product decisions captured by the canonical graph 1. OriginWeave is **Browse. Act. Prove.**: an enterprise agentic web runtime and provenance-native browser platform, not Selenium-style automation. @@ -169,7 +193,7 @@ Active #61 gives the page main world and the MV3 content script the same JavaScr 21. In-memory sensitive-handle primitives may narrow replay/revocation risk without claiming the durable trusted broker exists. 22. A validated DNS answer is not sufficient socket authority indefinitely; resolution-to-socket use requires bounded trusted-monotonic freshness. 23. Revocation-material freshness, cryptographic validity, acquisition/cache operation and an unrevoked claim remain separate evidence authorities. -24. Browser telemetry values and actual OS/Chromium measurement adapters are separate maturity claims. +24. Browser telemetry values, OS process sampling and Chromium/task process attribution are separate maturity claims. 25. Semantic observation provenance and advertised node-local actions are descriptive evidence and never execution authority. 26. Semantic relationships remain bounded within exact session/context/origin/document authority. 27. Sensitive-handle audience must ultimately derive from authenticated workload/service identity. @@ -177,6 +201,10 @@ Active #61 gives the page main world and the MV3 content script the same JavaScr 29. Semantic query success is neither selector authority nor permission to execute an advertised action. 30. Semantic action-target binding preserves exact node authority but remains separate from business-risk classification, policy approval, dispatch and observed success. 31. Update migration, restart persistence, injection and isolated-world behavior are separate compatibility claims and must retain distinct executable evidence. +32. Extension proposal authority never substitutes for Agent capability, origin/secret authority or independent high-risk approval. +33. Verified action-success evidence must not predate dispatch, while trusted clock provenance, browser dispatch, target linkage and causality remain separate authorities. +34. A controlled hostile page fixture is reproducible test infrastructure, not evidence that a real Chromium adapter exists. +35. Resource aggregation over known PIDs does not establish Chromium process discovery or task attribution. ## 5. Architecture views legitimately deferred @@ -194,7 +222,7 @@ Chromium MV3 permission -> deterministic policy ``` -Compatibility evidence cannot substitute for Agent-authority evidence, or vice versa. +Compatibility evidence cannot substitute for Agent-authority evidence, or vice versa. #62/#63 executable composition tests strengthen this existing view without changing its architecture. ### 5.2 Network freshness sequence — reconcile after #47 → #50 → #54 integrates @@ -225,11 +253,11 @@ isolated profile/context -> teardown/recovery ``` -#40/#52/#57/#58 make the authority/value boundaries concrete but do not yet establish browser I/O, typed business policy, native input or post-condition proof. Freezing temporary protocol fields into authoritative UML before those executable contracts exist would create false architecture. +#40/#52/#57/#58 make identifier/semantic/action-target authority concrete; #64 makes ordered verified outcome packaging concrete; #65 supplies a controlled hostile target application; and #51→#66 narrows resource measurement. None yet establishes the real Chromium transport/semantic extraction/native input/post-condition observer/trusted clock/process attribution chain. Freezing temporary protocol fields into authoritative UML before those executable contracts exist would create false architecture. ### 5.4 Trusted sensitive-data broker — deferred until issue #10 establishes a real runtime boundary -Protected-main policy/evidence plus #45→#46→#53→#55 do not justify inventing a broker process, durable database, KMS topology, authenticated service-identity mechanism or browser-fill adapter. Add physical ERD/component/transaction views only when executable ownership exists. +Protected-main policy/evidence plus #45→#46→#53→#55 and composition regressions #62/#63 do not justify inventing a broker process, durable database, KMS topology, authenticated service-identity mechanism or browser-fill adapter. Add physical ERD/component/transaction views only when executable ownership exists. ## 6. Completion criteria From 81f416f77fe5f109d630d5db41549bedfa07fdbf Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 09:53:22 +0900 Subject: [PATCH 109/130] docs: preserve extension-policy evidence contract --- docs/evidence/2026-08-10-active-pr-maturity.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/evidence/2026-08-10-active-pr-maturity.md b/docs/evidence/2026-08-10-active-pr-maturity.md index 10dd0daf..71353dca 100644 --- a/docs/evidence/2026-08-10-active-pr-maturity.md +++ b/docs/evidence/2026-08-10-active-pr-maturity.md @@ -37,7 +37,7 @@ This dated appendix records volatile implementation evidence that must not be em | #59 | Real pinned-Chromium history mutation compatibility | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #56. Test-only head `4b5f393a7420541723a07243b83cdaa7e28948de` and CI run `31432051381` established the intended repository-contract RED because controlled `history.addUrl`/`deleteUrl` lifecycle support was absent. Current exact head `b0d9c905fd7a50128eb1dde643b8a3a0f9cb1dc8` adds loopback-only add → exact readback → delete → absence verification. CI run `31432338572`, Manifest V3 Compatibility run `31432338759`, and CodeRabbit exact-head status succeed, including exact owned production function/line/region/branch coverage. Compatibility evidence only; no Agent history capability. | | #60 | Real pinned-Chromium extension update/version migration | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #59. Test-only head `a60875f70f8412db27ff1025b75d7ad4b8ddc38e` and CI run `31433305976` established the intended RED because no trial-local extension copy, version transition, migration state, or update-migration evidence existed. Current exact head `e696e19c9eaf3dedb104a5de4bdbd7970abf90d4` uses an ephemeral extension copy and one profile across initial `1.0.0`/initialized → restart `1.0.0`/current → update `1.0.1`/migrated passes. CI run `31433968874`, Manifest V3 Compatibility run `31433968931`, and CodeRabbit exact-head status succeed; the real browser evidence reports 3/3 trials and the exact update-migration surface. This does not claim Chrome Web Store/enterprise update semantics or Agent authority. | | #61 | Real pinned-Chromium content-script isolated-world separation | **IMPLEMENTED_ON_ACTIVE_PR** | Draft stacked on #60. Test-only head `e81cdbd9b31a62227698bd3d824fd901551061f0` and CI run `31434443638` established the intended RED because the fixture had no page-main/content-isolated sentinel contract. Current exact head `c1705ad9fd2d96e620b89bb6e7ea1235063dcb6a` requires the page to retain `window.originweaveWorldSentinel = "page"` while the content script independently retains the same-named global as `"extension"`; the existing content compatibility surface fails if the JavaScript worlds collapse. CI run `31434670642`, Manifest V3 Compatibility run `31434670629`, and CodeRabbit exact-head status succeed; real browser evidence reports 3/3 repeatability trials. Compatibility evidence only; no arbitrary page-JavaScript bridge or Agent authority. | -| #62 | Extension proposal → Agent policy isolation regression | **IMPLEMENTED_ON_ACTIVE_PR** | Ready PR based directly on protected main. Exact head `a57873b3688984711918be17aadd348ed9fb12a9` first proves the exact extension/session/context `ProposeTypedAction` grant is allowed, then proves ordinary Agent policy independently rejects an out-of-grant target origin, a missing core `Navigate` capability, untrusted `WebContent`, raw secret delivery and unexpected secret material. CI `31436844685`, production coverage job `93612736291`, Security Scan `31436844615`, SAST Semgrep `31436844646`, and CodeRabbit exact-head status succeed. This adds no production API or real Chromium adapter and does not convert extension proposal authority into Agent action/origin/secret authority. | +| #62 | Extension proposal → Agent policy isolation regression | **IMPLEMENTED_ON_ACTIVE_PR** | Ready PR based directly on protected main. Exact head `a57873b3688984711918be17aadd348ed9fb12a9` first proves the exact extension/session/context `ProposeTypedAction` grant is allowed, then proves ordinary Agent policy independently rejects an out-of-grant target origin, a missing core `Navigate` capability, `WebContent` as an untrusted instruction source, raw secret delivery and unexpected secret material. CI run `31436844685`, production coverage job `93612736291`, Security Scan run `31436844615`, SAST Semgrep run `31436844646`, and CodeRabbit exact-head status succeed. This adds no production API or real Chromium adapter and does not convert extension proposal authority into Agent action/origin authority; it also cannot manufacture secret authority. | | #63 | Extension proposal → secret high-risk approval isolation | **IMPLEMENTED_ON_ACTIVE_PR** | Ready PR based directly on protected main at exact head `e83749acd1cf5a0b778ba38eb9d6ed5a9bd1e68f`. The exact extension grant allows `ProposeTypedAction`, while ordinary Agent policy still returns `RequireApproval(RiskClass::R3)` for broker-handle `FillSecret`. CI `31437994464`, Rust contracts job `93616406126`, production coverage job `93616406182`, Security Scan `31437994491`, SAST Semgrep `31437994454`, and CodeRabbit exact-head status succeed. This is composition evidence only: it adds no secret broker, protected value, authenticated workload identity, browser adapter or approval evidence. | | #64 | Verified action post-condition evidence with dispatch ordering | **IMPLEMENTED_ON_ACTIVE_PR** | Ready PR based directly on protected main at exact head `2c45411ed9aa0eecca2d06c85659db9f4bb85e4d`. `VerifiedActionOutcomeEvidence` requires verified provenance and caller-supplied monotonic dispatch/observation timestamps; observations before dispatch fail as `PostConditionPredatesDispatch`. CI `31441848670`, production coverage job `93628017556`, Security Scan `31441848649`, SAST Semgrep `31441848615`, and CodeRabbit exact-head status succeed. It is not a browser dispatcher and does not prove trusted clock provenance, real browser dispatch, target linkage, causality or a reached browser condition. | | #65 | Controlled hostile Agent Task fixture | **IMPLEMENTED_ON_ACTIVE_PR** | Ready PR based directly on protected main at exact head `0888fe3a6ef6da547a37fd075733cc73dc52b2ab`. Test-only head `d2580305f05aba93d10b5342ec1886d601c6752e` and CI `31445088008` established the intended missing-fixture RED. The current fixture provides a labelled semantic form, deterministic same-document state transition and explicitly hidden/untrusted prompt-injection text using synthetic local data only. CI `31445201739`, Rust contracts job `93637824750`, production coverage job `93637824824`, Security Scan `31445201774`, SAST Semgrep `31445201669`, and CodeRabbit exact-head status succeed. It is controlled test infrastructure, not a browser adapter or proof of real Chromium execution. | From d913b626144f70d1de1a35f25a82d32a2434fd31 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 11:15:18 +0900 Subject: [PATCH 110/130] docs: record PR 67 and 68 maturity evidence --- .../2026-08-11-active-pr-maturity-delta.md | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 docs/evidence/2026-08-11-active-pr-maturity-delta.md diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md new file mode 100644 index 00000000..04cfb1e4 --- /dev/null +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -0,0 +1,34 @@ +# Active pull-request maturity evidence — 2026-08-11 delta + +- **Protected-main anchor:** `67af7c87589edc2039545af335c95064d9b8391c` +- **Canonical documentation verdict:** **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL** +- **Relationship to the existing series:** this file advances the dated evidence in [`2026-08-10-active-pr-maturity.md`](2026-08-10-active-pr-maturity.md) for active lanes opened after that appendix was refreshed through PR #66. It is volatile implementation evidence, not timeless architecture truth. + +Protected `main` remains the only shipped-code authority. Active pull requests, exact heads, CI runs, reviews, and coverage reports are evidence about non-shipped work until dependency-ordered integration and fresh protected-main acceptance are re-established. + +## Newly active implementation evidence + +| PR | Scope | Maturity | Exact evidence / authority boundary | +|---|---|---|---| +| #67 | Browser-task interruption and recovery evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `9d9ebffee234ed4ab662dab7850bd08450ec365b` is stacked on unchanged #64 head `2c45411ed9aa0eecca2d06c85659db9f4bb85e4d`. CI run `31448465680` is successful, including exact owned production function/line/region/branch coverage. The value contract distinguishes an interruption proven before external effect from an effect that may have committed and requires browser-context closure, task-resource reclamation, and evidence finalization before `SafeToRetry`. It does **not** detect Chromium crashes, prove caller-supplied cleanup facts, reconcile external mutations, restart Chromium, dispatch a retry, persist checkpoints, or complete issue #28's real-browser vertical slice. | +| #68 | Identity-bound settlement of failed sensitive-handle reservations | **PARTIAL** | The lane is stacked on exact #55 head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8`. Exact predecessor head `add3599bee784c58dfaa4275d17c477eaed781a9` passed repository contracts, formatting, workspace tests, strict Clippy and rustdoc but failed the exact coverage gate at `branches=495/496`, `lines=3666/3667`, `regions=4575/4576`. The uncovered branch was the production `next_reservation_sequence == None` path, while only a private unit test could manufacture that state; normal integration use could exercise only the opposite branch. Current exact head `17bc00790e75424afd97c8a73800d9b16c766300` replaces the finite synthetic sequence with an allocation-bound, non-copyable in-process reservation identity whose surviving stale token keeps its allocation live, preventing a later reservation from aliasing it. Rust contracts on CI run `31451682170` are successful; exact production coverage is still running at this evidence refresh and therefore may not yet be promoted to `IMPLEMENTED_ON_ACTIVE_PR`. The lane still provides no authenticated workload identity, protected-value resolution, durable/cross-process transaction, KMS, persistence, or proof that compensation is truthful. | + +## Documentation-fitness reconciliation + +The addition of #67 and #68 does **not** require another ADR, a new deployed component, or a physical ERD entity at this stage. + +- **ADR:** #67 refines the existing evidence/recovery architecture without changing a trust-domain or persistence-owner decision. #68 refines the in-process sensitive-handle lifecycle governed by Accepted ADR 0007; it remains short of the trusted broker required by issue #10. Existing ADR breadth remains sufficient. +- **PRD/TRD:** current requirements already separate verified post-condition/recovery evidence from browser dispatch and separate purpose-bound sensitive policy from the future trusted broker. Both lanes are active/non-shipped evidence and must not be described as `Implemented` on protected main. +- **Architecture/UML:** neither lane introduces a new deployed service or browser-protocol boundary. Detailed real-Chromium crash/retry sequencing remains legitimately deferred until issue #28 has an executable adapter path whose recovery facts can be authoritative rather than caller-supplied. +- **ERD/data model:** #67 is an immutable evidence value and #68 is explicitly in-process policy state. Neither creates an OriginWeave-owned durable persistence schema. The conceptual ERD remains the truthful artifact; manufacturing tables would overstate the implementation. +- **Security/privacy:** #67 remains credential-free and quarantines ambiguous-effect/incomplete-cleanup states. #68 narrows settlement to exact in-process reservation identity while preserving the rule that only a trusted broker may decide that compensation is valid before disclosure. +- **Test/release/traceability:** #67 has exact-head green evidence. #68 remains `PARTIAL` until the unchanged current head proves exact coverage and the other applicable gates. No predecessor-head success is transferable. + +## Interpretation rules + +1. `IMPLEMENTED_ON_ACTIVE_PR` and `PARTIAL` never mean shipped. +2. Exact-head CI/coverage evidence becomes stale immediately when that head moves. +3. A stacked PR cannot be independently integrated before its exact prerequisite lineage. +4. An active implementation refinement does not manufacture a new ADR merely to mirror every PR; create or supersede an ADR only when the governing architecture decision changes. +5. In-memory identities, immutable evidence values, controlled fixtures, and bounded samplers do not justify physical ERD entities without a real durable ownership boundary. +6. After any of these lanes integrates, re-evaluate PRD/TRD/Architecture/UML/ERD/traceability from the new protected-main head before changing maturity claims. From c7370ceede58af2c4b29ac878fee51ee76671aa4 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 11:15:48 +0900 Subject: [PATCH 111/130] docs: index latest active PR maturity delta --- docs/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/README.md b/docs/README.md index 95da4b18..659e34f7 100644 --- a/docs/README.md +++ b/docs/README.md @@ -13,6 +13,7 @@ - [Product and decision traceability](traceability/README.md) - [Documentation fitness assessment](DOCUMENTATION_FITNESS.md) - [Dated active-PR maturity evidence (2026-08-10)](evidence/2026-08-10-active-pr-maturity.md) +- [Active-PR maturity delta (2026-08-11)](evidence/2026-08-11-active-pr-maturity-delta.md) - [Threat model](THREAT_MODEL.md) - [Product-wide test strategy](TEST_STRATEGY.md) - [Operability and incident-response baseline](OPERABILITY.md) From fe60bffebe8d248c88720c341e1ab35e1856d04f Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 11:16:32 +0900 Subject: [PATCH 112/130] docs: record exact green settlement evidence --- docs/evidence/2026-08-11-active-pr-maturity-delta.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md index 04cfb1e4..7b3dcb1f 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-delta.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -11,7 +11,7 @@ Protected `main` remains the only shipped-code authority. Active pull requests, | PR | Scope | Maturity | Exact evidence / authority boundary | |---|---|---|---| | #67 | Browser-task interruption and recovery evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `9d9ebffee234ed4ab662dab7850bd08450ec365b` is stacked on unchanged #64 head `2c45411ed9aa0eecca2d06c85659db9f4bb85e4d`. CI run `31448465680` is successful, including exact owned production function/line/region/branch coverage. The value contract distinguishes an interruption proven before external effect from an effect that may have committed and requires browser-context closure, task-resource reclamation, and evidence finalization before `SafeToRetry`. It does **not** detect Chromium crashes, prove caller-supplied cleanup facts, reconcile external mutations, restart Chromium, dispatch a retry, persist checkpoints, or complete issue #28's real-browser vertical slice. | -| #68 | Identity-bound settlement of failed sensitive-handle reservations | **PARTIAL** | The lane is stacked on exact #55 head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8`. Exact predecessor head `add3599bee784c58dfaa4275d17c477eaed781a9` passed repository contracts, formatting, workspace tests, strict Clippy and rustdoc but failed the exact coverage gate at `branches=495/496`, `lines=3666/3667`, `regions=4575/4576`. The uncovered branch was the production `next_reservation_sequence == None` path, while only a private unit test could manufacture that state; normal integration use could exercise only the opposite branch. Current exact head `17bc00790e75424afd97c8a73800d9b16c766300` replaces the finite synthetic sequence with an allocation-bound, non-copyable in-process reservation identity whose surviving stale token keeps its allocation live, preventing a later reservation from aliasing it. Rust contracts on CI run `31451682170` are successful; exact production coverage is still running at this evidence refresh and therefore may not yet be promoted to `IMPLEMENTED_ON_ACTIVE_PR`. The lane still provides no authenticated workload identity, protected-value resolution, durable/cross-process transaction, KMS, persistence, or proof that compensation is truthful. | +| #68 | Identity-bound settlement of failed sensitive-handle reservations | **IMPLEMENTED_ON_ACTIVE_PR** | The lane is stacked on exact #55 head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8`. Exact predecessor head `add3599bee784c58dfaa4275d17c477eaed781a9` passed repository contracts, formatting, workspace tests, strict Clippy and rustdoc but failed the exact coverage gate at `branches=495/496`, `lines=3666/3667`, `regions=4575/4576`. The uncovered branch was the production `next_reservation_sequence == None` path, while only a private unit test could manufacture that state; normal integration use could exercise only the opposite branch. Current exact head `17bc00790e75424afd97c8a73800d9b16c766300` replaces the finite synthetic sequence with an allocation-bound, non-copyable in-process reservation identity whose surviving stale token keeps its allocation live, preventing a later reservation from aliasing it. CI run `31451682170` now succeeds: repository contracts, formatting, locked workspace/all-target checks, full tests, strict Clippy, rustdoc, and exact owned production function/line/region/branch coverage are all green; CodeRabbit exact-head status is success. The lane still provides no authenticated workload identity, protected-value resolution, durable/cross-process transaction, KMS, persistence, or proof that compensation is truthful. | ## Documentation-fitness reconciliation @@ -22,7 +22,7 @@ The addition of #67 and #68 does **not** require another ADR, a new deployed com - **Architecture/UML:** neither lane introduces a new deployed service or browser-protocol boundary. Detailed real-Chromium crash/retry sequencing remains legitimately deferred until issue #28 has an executable adapter path whose recovery facts can be authoritative rather than caller-supplied. - **ERD/data model:** #67 is an immutable evidence value and #68 is explicitly in-process policy state. Neither creates an OriginWeave-owned durable persistence schema. The conceptual ERD remains the truthful artifact; manufacturing tables would overstate the implementation. - **Security/privacy:** #67 remains credential-free and quarantines ambiguous-effect/incomplete-cleanup states. #68 narrows settlement to exact in-process reservation identity while preserving the rule that only a trusted broker may decide that compensation is valid before disclosure. -- **Test/release/traceability:** #67 has exact-head green evidence. #68 remains `PARTIAL` until the unchanged current head proves exact coverage and the other applicable gates. No predecessor-head success is transferable. +- **Test/release/traceability:** #67 and #68 both have exact-head green CI/coverage evidence, but remain active/non-shipped and dependency-gated where stacked. No predecessor-head success is transferable. ## Interpretation rules From a55a9731851ff9759dd818d85288e49e7af226ab Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 11:19:34 +0900 Subject: [PATCH 113/130] docs: follow current settlement head --- docs/evidence/2026-08-11-active-pr-maturity-delta.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md index 7b3dcb1f..950e9766 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-delta.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -11,7 +11,7 @@ Protected `main` remains the only shipped-code authority. Active pull requests, | PR | Scope | Maturity | Exact evidence / authority boundary | |---|---|---|---| | #67 | Browser-task interruption and recovery evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `9d9ebffee234ed4ab662dab7850bd08450ec365b` is stacked on unchanged #64 head `2c45411ed9aa0eecca2d06c85659db9f4bb85e4d`. CI run `31448465680` is successful, including exact owned production function/line/region/branch coverage. The value contract distinguishes an interruption proven before external effect from an effect that may have committed and requires browser-context closure, task-resource reclamation, and evidence finalization before `SafeToRetry`. It does **not** detect Chromium crashes, prove caller-supplied cleanup facts, reconcile external mutations, restart Chromium, dispatch a retry, persist checkpoints, or complete issue #28's real-browser vertical slice. | -| #68 | Identity-bound settlement of failed sensitive-handle reservations | **IMPLEMENTED_ON_ACTIVE_PR** | The lane is stacked on exact #55 head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8`. Exact predecessor head `add3599bee784c58dfaa4275d17c477eaed781a9` passed repository contracts, formatting, workspace tests, strict Clippy and rustdoc but failed the exact coverage gate at `branches=495/496`, `lines=3666/3667`, `regions=4575/4576`. The uncovered branch was the production `next_reservation_sequence == None` path, while only a private unit test could manufacture that state; normal integration use could exercise only the opposite branch. Current exact head `17bc00790e75424afd97c8a73800d9b16c766300` replaces the finite synthetic sequence with an allocation-bound, non-copyable in-process reservation identity whose surviving stale token keeps its allocation live, preventing a later reservation from aliasing it. CI run `31451682170` now succeeds: repository contracts, formatting, locked workspace/all-target checks, full tests, strict Clippy, rustdoc, and exact owned production function/line/region/branch coverage are all green; CodeRabbit exact-head status is success. The lane still provides no authenticated workload identity, protected-value resolution, durable/cross-process transaction, KMS, persistence, or proof that compensation is truthful. | +| #68 | Identity-bound settlement of failed sensitive-handle reservations | **PARTIAL** | The lane is stacked on exact #55 head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8`. Exact predecessor head `add3599bee784c58dfaa4275d17c477eaed781a9` passed repository contracts, formatting, workspace tests, strict Clippy and rustdoc but failed exact coverage at `branches=495/496`, `lines=3666/3667`, `regions=4575/4576`. The uncovered production `next_reservation_sequence == None` branch was synthetic/private-test-only, so the production design was replaced rather than weakening the gate. Exact head `17bc00790e75424afd97c8a73800d9b16c766300` replaced the finite sequence with an allocation-bound, non-copyable in-process reservation identity and passed CI `31451682170`, including exact owned function/line/region/branch coverage and CodeRabbit exact-head status. Current exact head `aa46d982b2bf786fe297744ac99f88b6c4c5f4cf` additionally proves a token from one state instance cannot commit or compensate another identical-scope state. Fresh CI run `31451963178` is still in progress, so predecessor-head success is not promoted to the current head. The lane still provides no authenticated workload identity, protected-value resolution, durable/cross-process transaction, KMS, persistence, or proof that compensation is truthful. | ## Documentation-fitness reconciliation @@ -22,7 +22,7 @@ The addition of #67 and #68 does **not** require another ADR, a new deployed com - **Architecture/UML:** neither lane introduces a new deployed service or browser-protocol boundary. Detailed real-Chromium crash/retry sequencing remains legitimately deferred until issue #28 has an executable adapter path whose recovery facts can be authoritative rather than caller-supplied. - **ERD/data model:** #67 is an immutable evidence value and #68 is explicitly in-process policy state. Neither creates an OriginWeave-owned durable persistence schema. The conceptual ERD remains the truthful artifact; manufacturing tables would overstate the implementation. - **Security/privacy:** #67 remains credential-free and quarantines ambiguous-effect/incomplete-cleanup states. #68 narrows settlement to exact in-process reservation identity while preserving the rule that only a trusted broker may decide that compensation is valid before disclosure. -- **Test/release/traceability:** #67 and #68 both have exact-head green CI/coverage evidence, but remain active/non-shipped and dependency-gated where stacked. No predecessor-head success is transferable. +- **Test/release/traceability:** #67 has exact-head green CI/coverage evidence. #68 is currently `PARTIAL` until its unchanged exact current head proves the fresh gates. No predecessor-head success is transferable. ## Interpretation rules From a61a990b4e3173096729c3b0c07dc8d566632969 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 11:21:13 +0900 Subject: [PATCH 114/130] docs: record green current settlement head --- docs/evidence/2026-08-11-active-pr-maturity-delta.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md index 950e9766..79ea6abb 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-delta.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -11,7 +11,7 @@ Protected `main` remains the only shipped-code authority. Active pull requests, | PR | Scope | Maturity | Exact evidence / authority boundary | |---|---|---|---| | #67 | Browser-task interruption and recovery evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `9d9ebffee234ed4ab662dab7850bd08450ec365b` is stacked on unchanged #64 head `2c45411ed9aa0eecca2d06c85659db9f4bb85e4d`. CI run `31448465680` is successful, including exact owned production function/line/region/branch coverage. The value contract distinguishes an interruption proven before external effect from an effect that may have committed and requires browser-context closure, task-resource reclamation, and evidence finalization before `SafeToRetry`. It does **not** detect Chromium crashes, prove caller-supplied cleanup facts, reconcile external mutations, restart Chromium, dispatch a retry, persist checkpoints, or complete issue #28's real-browser vertical slice. | -| #68 | Identity-bound settlement of failed sensitive-handle reservations | **PARTIAL** | The lane is stacked on exact #55 head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8`. Exact predecessor head `add3599bee784c58dfaa4275d17c477eaed781a9` passed repository contracts, formatting, workspace tests, strict Clippy and rustdoc but failed exact coverage at `branches=495/496`, `lines=3666/3667`, `regions=4575/4576`. The uncovered production `next_reservation_sequence == None` branch was synthetic/private-test-only, so the production design was replaced rather than weakening the gate. Exact head `17bc00790e75424afd97c8a73800d9b16c766300` replaced the finite sequence with an allocation-bound, non-copyable in-process reservation identity and passed CI `31451682170`, including exact owned function/line/region/branch coverage and CodeRabbit exact-head status. Current exact head `aa46d982b2bf786fe297744ac99f88b6c4c5f4cf` additionally proves a token from one state instance cannot commit or compensate another identical-scope state. Fresh CI run `31451963178` is still in progress, so predecessor-head success is not promoted to the current head. The lane still provides no authenticated workload identity, protected-value resolution, durable/cross-process transaction, KMS, persistence, or proof that compensation is truthful. | +| #68 | Identity-bound settlement of failed sensitive-handle reservations | **IMPLEMENTED_ON_ACTIVE_PR** | The lane is stacked on exact #55 head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8`. Exact predecessor head `add3599bee784c58dfaa4275d17c477eaed781a9` passed repository contracts, formatting, workspace tests, strict Clippy and rustdoc but failed exact coverage at `branches=495/496`, `lines=3666/3667`, `regions=4575/4576`. The uncovered production `next_reservation_sequence == None` branch was synthetic/private-test-only, so the production design was replaced rather than weakening the gate. Exact head `17bc00790e75424afd97c8a73800d9b16c766300` replaced the finite sequence with an allocation-bound, non-copyable in-process reservation identity and passed CI `31451682170`. Current exact head `aa46d982b2bf786fe297744ac99f88b6c4c5f4cf` additionally proves a reservation token from one state instance cannot commit or compensate another identical-scope state. Fresh CI run `31451963178` succeeds: repository contracts, formatting, locked workspace/all-target checks, full tests, strict Clippy, rustdoc, and exact owned production function/line/region/branch coverage are green; CodeRabbit exact-head status is also success. The lane still provides no authenticated workload identity, protected-value resolution, durable/cross-process transaction, KMS, persistence, or proof that compensation is truthful. | ## Documentation-fitness reconciliation @@ -22,7 +22,7 @@ The addition of #67 and #68 does **not** require another ADR, a new deployed com - **Architecture/UML:** neither lane introduces a new deployed service or browser-protocol boundary. Detailed real-Chromium crash/retry sequencing remains legitimately deferred until issue #28 has an executable adapter path whose recovery facts can be authoritative rather than caller-supplied. - **ERD/data model:** #67 is an immutable evidence value and #68 is explicitly in-process policy state. Neither creates an OriginWeave-owned durable persistence schema. The conceptual ERD remains the truthful artifact; manufacturing tables would overstate the implementation. - **Security/privacy:** #67 remains credential-free and quarantines ambiguous-effect/incomplete-cleanup states. #68 narrows settlement to exact in-process reservation identity while preserving the rule that only a trusted broker may decide that compensation is valid before disclosure. -- **Test/release/traceability:** #67 has exact-head green CI/coverage evidence. #68 is currently `PARTIAL` until its unchanged exact current head proves the fresh gates. No predecessor-head success is transferable. +- **Test/release/traceability:** #67 and #68 both have fresh exact-head green CI/coverage evidence while remaining active/non-shipped and dependency-gated where stacked. No predecessor-head success is transferable. ## Interpretation rules From 098c56a1f9bc01b8e1f8a776dc39e67bf889bc72 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 11:27:16 +0900 Subject: [PATCH 115/130] docs: track sensitive reservation recheck lane --- .../2026-08-11-active-pr-maturity-delta.md | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md index 79ea6abb..212b8044 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-delta.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -12,17 +12,18 @@ Protected `main` remains the only shipped-code authority. Active pull requests, |---|---|---|---| | #67 | Browser-task interruption and recovery evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `9d9ebffee234ed4ab662dab7850bd08450ec365b` is stacked on unchanged #64 head `2c45411ed9aa0eecca2d06c85659db9f4bb85e4d`. CI run `31448465680` is successful, including exact owned production function/line/region/branch coverage. The value contract distinguishes an interruption proven before external effect from an effect that may have committed and requires browser-context closure, task-resource reclamation, and evidence finalization before `SafeToRetry`. It does **not** detect Chromium crashes, prove caller-supplied cleanup facts, reconcile external mutations, restart Chromium, dispatch a retry, persist checkpoints, or complete issue #28's real-browser vertical slice. | | #68 | Identity-bound settlement of failed sensitive-handle reservations | **IMPLEMENTED_ON_ACTIVE_PR** | The lane is stacked on exact #55 head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8`. Exact predecessor head `add3599bee784c58dfaa4275d17c477eaed781a9` passed repository contracts, formatting, workspace tests, strict Clippy and rustdoc but failed exact coverage at `branches=495/496`, `lines=3666/3667`, `regions=4575/4576`. The uncovered production `next_reservation_sequence == None` branch was synthetic/private-test-only, so the production design was replaced rather than weakening the gate. Exact head `17bc00790e75424afd97c8a73800d9b16c766300` replaced the finite sequence with an allocation-bound, non-copyable in-process reservation identity and passed CI `31451682170`. Current exact head `aa46d982b2bf786fe297744ac99f88b6c4c5f4cf` additionally proves a reservation token from one state instance cannot commit or compensate another identical-scope state. Fresh CI run `31451963178` succeeds: repository contracts, formatting, locked workspace/all-target checks, full tests, strict Clippy, rustdoc, and exact owned production function/line/region/branch coverage are green; CodeRabbit exact-head status is also success. The lane still provides no authenticated workload identity, protected-value resolution, durable/cross-process transaction, KMS, persistence, or proof that compensation is truthful. | +| #69 | Immediate pre-disclosure recheck of an exact tracked reservation | **PARTIAL** | This Draft is stacked on exact #68 head `aa46d982b2bf786fe297744ac99f88b6c4c5f4cf`. Test-only head `5a96d2931225e133768878c68d09e1a36b5ca0f6` established the intended RED in CI run `31452226594`: repository contracts and formatting passed, then the locked workspace check failed because `SensitiveHandleUseState::recheck_reservation` and `HandleUseDecision::ReservationNotOutstanding` did not yet exist. Current exact head `02678764a1860c6847d1e9d882e0fb40e89ff88a` adds the smallest in-process policy boundary: revocation-first, exact outstanding reservation identity, authority/audience/expiry revalidation, no second use consumption, and no settlement mutation. Fresh exact-head CI has not yet completed at this evidence refresh, so the lane remains `PARTIAL`. The recheck still trusts the future broker to provide authenticated audience, trusted time, exact current authority, transactional serialization and the protected-value disclosure boundary. | ## Documentation-fitness reconciliation -The addition of #67 and #68 does **not** require another ADR, a new deployed component, or a physical ERD entity at this stage. +The addition of #67, #68 and #69 does **not** require another ADR, a new deployed component, or a physical ERD entity at this stage. -- **ADR:** #67 refines the existing evidence/recovery architecture without changing a trust-domain or persistence-owner decision. #68 refines the in-process sensitive-handle lifecycle governed by Accepted ADR 0007; it remains short of the trusted broker required by issue #10. Existing ADR breadth remains sufficient. -- **PRD/TRD:** current requirements already separate verified post-condition/recovery evidence from browser dispatch and separate purpose-bound sensitive policy from the future trusted broker. Both lanes are active/non-shipped evidence and must not be described as `Implemented` on protected main. -- **Architecture/UML:** neither lane introduces a new deployed service or browser-protocol boundary. Detailed real-Chromium crash/retry sequencing remains legitimately deferred until issue #28 has an executable adapter path whose recovery facts can be authoritative rather than caller-supplied. -- **ERD/data model:** #67 is an immutable evidence value and #68 is explicitly in-process policy state. Neither creates an OriginWeave-owned durable persistence schema. The conceptual ERD remains the truthful artifact; manufacturing tables would overstate the implementation. -- **Security/privacy:** #67 remains credential-free and quarantines ambiguous-effect/incomplete-cleanup states. #68 narrows settlement to exact in-process reservation identity while preserving the rule that only a trusted broker may decide that compensation is valid before disclosure. -- **Test/release/traceability:** #67 and #68 both have fresh exact-head green CI/coverage evidence while remaining active/non-shipped and dependency-gated where stacked. No predecessor-head success is transferable. +- **ADR:** #67 refines the existing evidence/recovery architecture without changing a trust-domain or persistence-owner decision. #68/#69 refine the in-process sensitive-handle lifecycle governed by Accepted ADR 0007; they remain short of the trusted broker required by issue #10. Existing ADR breadth remains sufficient. +- **PRD/TRD:** current requirements already separate verified post-condition/recovery evidence from browser dispatch and separate purpose-bound sensitive policy from the future trusted broker. These lanes are active/non-shipped evidence and must not be described as `Implemented` on protected main. +- **Architecture/UML:** none of these lanes introduces a new deployed service or browser-protocol boundary. #69 narrows reserve/recheck/disclose/settle ordering only inside the future broker contract; it does not create that broker runtime. Detailed real-Chromium crash/retry sequencing remains legitimately deferred until issue #28 has an executable adapter path whose recovery facts can be authoritative rather than caller-supplied. +- **ERD/data model:** #67 is an immutable evidence value and #68/#69 are explicitly in-process policy state. None creates an OriginWeave-owned durable persistence schema. The conceptual ERD remains the truthful artifact; manufacturing tables would overstate the implementation. +- **Security/privacy:** #67 remains credential-free and quarantines ambiguous-effect/incomplete-cleanup states. #68 narrows settlement to exact in-process reservation identity; #69 revalidates that exact outstanding reservation immediately before disclosure without consuming a second use. Both preserve the rule that only a trusted broker may decide that inputs and compensation facts are authoritative. +- **Test/release/traceability:** #67 and #68 have fresh exact-head green CI/coverage evidence. #69 remains `PARTIAL` until its unchanged exact current head proves all fresh gates. No predecessor-head success is transferable. ## Interpretation rules From 091556977a6dc84e3ba18509ec734fed8029aaef Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 12:04:02 +0900 Subject: [PATCH 116/130] docs: track pinned Agent Task semantic evidence lanes --- .../2026-08-11-active-pr-maturity-delta.md | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md index 212b8044..ff1ddc6f 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-delta.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -12,18 +12,20 @@ Protected `main` remains the only shipped-code authority. Active pull requests, |---|---|---|---| | #67 | Browser-task interruption and recovery evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `9d9ebffee234ed4ab662dab7850bd08450ec365b` is stacked on unchanged #64 head `2c45411ed9aa0eecca2d06c85659db9f4bb85e4d`. CI run `31448465680` is successful, including exact owned production function/line/region/branch coverage. The value contract distinguishes an interruption proven before external effect from an effect that may have committed and requires browser-context closure, task-resource reclamation, and evidence finalization before `SafeToRetry`. It does **not** detect Chromium crashes, prove caller-supplied cleanup facts, reconcile external mutations, restart Chromium, dispatch a retry, persist checkpoints, or complete issue #28's real-browser vertical slice. | | #68 | Identity-bound settlement of failed sensitive-handle reservations | **IMPLEMENTED_ON_ACTIVE_PR** | The lane is stacked on exact #55 head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8`. Exact predecessor head `add3599bee784c58dfaa4275d17c477eaed781a9` passed repository contracts, formatting, workspace tests, strict Clippy and rustdoc but failed exact coverage at `branches=495/496`, `lines=3666/3667`, `regions=4575/4576`. The uncovered production `next_reservation_sequence == None` branch was synthetic/private-test-only, so the production design was replaced rather than weakening the gate. Exact head `17bc00790e75424afd97c8a73800d9b16c766300` replaced the finite sequence with an allocation-bound, non-copyable in-process reservation identity and passed CI `31451682170`. Current exact head `aa46d982b2bf786fe297744ac99f88b6c4c5f4cf` additionally proves a reservation token from one state instance cannot commit or compensate another identical-scope state. Fresh CI run `31451963178` succeeds: repository contracts, formatting, locked workspace/all-target checks, full tests, strict Clippy, rustdoc, and exact owned production function/line/region/branch coverage are green; CodeRabbit exact-head status is also success. The lane still provides no authenticated workload identity, protected-value resolution, durable/cross-process transaction, KMS, persistence, or proof that compensation is truthful. | -| #69 | Immediate pre-disclosure recheck of an exact tracked reservation | **PARTIAL** | This Draft is stacked on exact #68 head `aa46d982b2bf786fe297744ac99f88b6c4c5f4cf`. Test-only head `5a96d2931225e133768878c68d09e1a36b5ca0f6` established the intended RED in CI run `31452226594`: repository contracts and formatting passed, then the locked workspace check failed because `SensitiveHandleUseState::recheck_reservation` and `HandleUseDecision::ReservationNotOutstanding` did not yet exist. Current exact head `02678764a1860c6847d1e9d882e0fb40e89ff88a` adds the smallest in-process policy boundary: revocation-first, exact outstanding reservation identity, authority/audience/expiry revalidation, no second use consumption, and no settlement mutation. Fresh exact-head CI has not yet completed at this evidence refresh, so the lane remains `PARTIAL`. The recheck still trusts the future broker to provide authenticated audience, trusted time, exact current authority, transactional serialization and the protected-value disclosure boundary. | +| #69 | Immediate pre-disclosure recheck of an exact tracked reservation | **IMPLEMENTED_ON_ACTIVE_PR** | This Draft is stacked on exact #68 head `aa46d982b2bf786fe297744ac99f88b6c4c5f4cf`. Test-only head `5a96d2931225e133768878c68d09e1a36b5ca0f6` established the intended missing-API RED. Production then exposed a real coverage defect in short-circuit recheck branches; focused malformed caller authority/audience cases were added, and two duplicate unreachable immutable-state checks were removed rather than manufacturing private-only coverage. Current exact head `de79d85e6be5131036db119efab767f0eb76a816` passes CI run `31453149013`, including exact owned production function/line/region/branch coverage, and CodeRabbit exact-head status is successful. The boundary rechecks the same still-outstanding reservation immediately before disclosure without consuming another use, but still trusts the future broker to supply authenticated workload audience, trusted time, exact current authority, transactional serialization and the protected-value disclosure boundary. | +| #70 | Controlled Agent Task execution on pinned stock Chromium | **IMPLEMENTED_ON_ACTIVE_PR** | This Draft is stacked on exact #65 head `0888fe3a6ef6da547a37fd075733cc73dc52b2ab`. Test-only head `197ce14a5e407d61ac35b38b45c0cd042dd6278c` established the intended missing-runner RED. Current exact head `f9917cdd8050c9fdf0aefa669f4d981af85479d6` passes CI run `31453647157` and pinned real-browser run `31453647201` against Chrome for Testing `150.0.7871.129` / revision `r1639810`. The controlled Agent Task completes `3/3` trials with real WebDriver clear/type/click operations, exact same-document post-condition verification, extensions disabled, and per-trial profile cleanup. This is reproducible browser execution evidence, not the product browser adapter: fixture CSS locators are test-harness locators, no semantic role/name query authority is claimed, and OriginWeave semantic observation/policy/node-handle composition remains incomplete. | +| #71 | Computed semantic role/name evidence before controlled browser action | **PARTIAL** | This Draft is stacked on exact #70 head `f9917cdd8050c9fdf0aefa669f4d981af85479d6`. Exact test-only head `977d2682dc191ca6b26b9de631a3642680abdbc0` requires a bounded real-browser semantic-evidence boundary using W3C WebDriver computed-role and computed-label endpoints for the controlled `textbox` / `Task text` field and `button` / `Submit task` control, with credential-free evidence propagation. Production implementation and exact-head green acceptance are intentionally absent at this evidence refresh; the lane must remain `PARTIAL` until the test-first failure is observed and the smallest implementation passes the full applicable gates. Even after success, CSS remains a controlled harness locator and this slice will not itself become a semantic query engine or product adapter. | ## Documentation-fitness reconciliation -The addition of #67, #68 and #69 does **not** require another ADR, a new deployed component, or a physical ERD entity at this stage. +The addition of #67 through #71 does **not** require another ADR, a new deployed component, or a physical ERD entity at this stage. -- **ADR:** #67 refines the existing evidence/recovery architecture without changing a trust-domain or persistence-owner decision. #68/#69 refine the in-process sensitive-handle lifecycle governed by Accepted ADR 0007; they remain short of the trusted broker required by issue #10. Existing ADR breadth remains sufficient. -- **PRD/TRD:** current requirements already separate verified post-condition/recovery evidence from browser dispatch and separate purpose-bound sensitive policy from the future trusted broker. These lanes are active/non-shipped evidence and must not be described as `Implemented` on protected main. -- **Architecture/UML:** none of these lanes introduces a new deployed service or browser-protocol boundary. #69 narrows reserve/recheck/disclose/settle ordering only inside the future broker contract; it does not create that broker runtime. Detailed real-Chromium crash/retry sequencing remains legitimately deferred until issue #28 has an executable adapter path whose recovery facts can be authoritative rather than caller-supplied. -- **ERD/data model:** #67 is an immutable evidence value and #68/#69 are explicitly in-process policy state. None creates an OriginWeave-owned durable persistence schema. The conceptual ERD remains the truthful artifact; manufacturing tables would overstate the implementation. -- **Security/privacy:** #67 remains credential-free and quarantines ambiguous-effect/incomplete-cleanup states. #68 narrows settlement to exact in-process reservation identity; #69 revalidates that exact outstanding reservation immediately before disclosure without consuming a second use. Both preserve the rule that only a trusted broker may decide that inputs and compensation facts are authoritative. -- **Test/release/traceability:** #67 and #68 have fresh exact-head green CI/coverage evidence. #69 remains `PARTIAL` until its unchanged exact current head proves all fresh gates. No predecessor-head success is transferable. +- **ADR:** #67 refines the existing evidence/recovery architecture. #68/#69 refine the in-process sensitive-handle lifecycle governed by Accepted ADR 0007. #70/#71 add executable compatibility/runtime evidence inside the already planned browser-adapter boundary. None changes a trust domain, persistence owner, deployment boundary, or binding protocol decision; existing ADR breadth remains sufficient. +- **PRD/TRD:** current requirements already distinguish post-condition evidence from browser dispatch, semantic observation from action authority, and purpose-bound sensitive policy from the future trusted broker. #67–#71 remain active/non-shipped evidence and must not be described as `Implemented` on protected main. +- **Architecture/UML:** #70 materially strengthens executable proof that stock pinned Chromium can perform the controlled task, and #71 starts binding the controlled targets to browser-computed semantic evidence. Neither creates the versioned WebDriver BiDi/CDP product adapter or composes the existing OriginWeave semantic-node/policy/evidence primitives end to end. The current high-level authority diagrams remain truthful; a detailed adapter → semantic observation → typed policy/action → post-condition sequence becomes mandatory when that production composition boundary stabilizes rather than while the evidence runner remains the execution owner. +- **ERD/data model:** #67 is an immutable evidence value, #68/#69 are explicitly in-process policy state, and #70/#71 are ephemeral CI/browser evidence. None creates an OriginWeave-owned durable persistence schema. The conceptual ERD remains the truthful artifact; manufacturing physical tables would overstate the implementation. +- **Security/privacy:** #67 quarantines ambiguous-effect/incomplete-cleanup states. #68/#69 preserve exact reservation identity and immediate pre-disclosure recheck without exposing protected values. #70 uses synthetic local data, disables extensions in the Agent Task profile, and proves profile cleanup. #71 is intentionally limited to bounded role/name evidence and does not elevate page content into instruction or capability authority. +- **Test/release/traceability:** #67–#70 have fresh exact-head green evidence at this refresh. #71 is intentionally test-first and `PARTIAL` until its current head produces observed RED followed by exact-head GREEN. No predecessor-head success transfers across any moved head, and none of these active lanes is release evidence for protected `main` yet. ## Interpretation rules @@ -31,5 +33,6 @@ The addition of #67, #68 and #69 does **not** require another ADR, a new deploye 2. Exact-head CI/coverage evidence becomes stale immediately when that head moves. 3. A stacked PR cannot be independently integrated before its exact prerequisite lineage. 4. An active implementation refinement does not manufacture a new ADR merely to mirror every PR; create or supersede an ADR only when the governing architecture decision changes. -5. In-memory identities, immutable evidence values, controlled fixtures, and bounded samplers do not justify physical ERD entities without a real durable ownership boundary. -6. After any of these lanes integrates, re-evaluate PRD/TRD/Architecture/UML/ERD/traceability from the new protected-main head before changing maturity claims. +5. In-memory identities, immutable evidence values, controlled fixtures, bounded samplers, and ephemeral compatibility evidence do not justify physical ERD entities without a real durable ownership boundary. +6. A real browser test harness is not the same authority as the production browser adapter. Promote browser/runtime maturity only when the protected-main product path owns session/context/origin/document identity, semantic observation, typed policy/action dispatch, post-condition verification, recovery, and evidence composition. +7. After any of these lanes integrates, re-evaluate PRD/TRD/Architecture/UML/ERD/traceability from the new protected-main head before changing maturity claims. From 79215ba6ce5328b161c04e17e24bdcf80f37c3ba Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 12:10:26 +0900 Subject: [PATCH 117/130] docs: record green semantic browser evidence --- docs/evidence/2026-08-11-active-pr-maturity-delta.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md index ff1ddc6f..5b5a1a9c 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-delta.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -14,7 +14,7 @@ Protected `main` remains the only shipped-code authority. Active pull requests, | #68 | Identity-bound settlement of failed sensitive-handle reservations | **IMPLEMENTED_ON_ACTIVE_PR** | The lane is stacked on exact #55 head `8d3ccf0a3b99fd9789210dd9798b422431fab7d8`. Exact predecessor head `add3599bee784c58dfaa4275d17c477eaed781a9` passed repository contracts, formatting, workspace tests, strict Clippy and rustdoc but failed exact coverage at `branches=495/496`, `lines=3666/3667`, `regions=4575/4576`. The uncovered production `next_reservation_sequence == None` branch was synthetic/private-test-only, so the production design was replaced rather than weakening the gate. Exact head `17bc00790e75424afd97c8a73800d9b16c766300` replaced the finite sequence with an allocation-bound, non-copyable in-process reservation identity and passed CI `31451682170`. Current exact head `aa46d982b2bf786fe297744ac99f88b6c4c5f4cf` additionally proves a reservation token from one state instance cannot commit or compensate another identical-scope state. Fresh CI run `31451963178` succeeds: repository contracts, formatting, locked workspace/all-target checks, full tests, strict Clippy, rustdoc, and exact owned production function/line/region/branch coverage are green; CodeRabbit exact-head status is also success. The lane still provides no authenticated workload identity, protected-value resolution, durable/cross-process transaction, KMS, persistence, or proof that compensation is truthful. | | #69 | Immediate pre-disclosure recheck of an exact tracked reservation | **IMPLEMENTED_ON_ACTIVE_PR** | This Draft is stacked on exact #68 head `aa46d982b2bf786fe297744ac99f88b6c4c5f4cf`. Test-only head `5a96d2931225e133768878c68d09e1a36b5ca0f6` established the intended missing-API RED. Production then exposed a real coverage defect in short-circuit recheck branches; focused malformed caller authority/audience cases were added, and two duplicate unreachable immutable-state checks were removed rather than manufacturing private-only coverage. Current exact head `de79d85e6be5131036db119efab767f0eb76a816` passes CI run `31453149013`, including exact owned production function/line/region/branch coverage, and CodeRabbit exact-head status is successful. The boundary rechecks the same still-outstanding reservation immediately before disclosure without consuming another use, but still trusts the future broker to supply authenticated workload audience, trusted time, exact current authority, transactional serialization and the protected-value disclosure boundary. | | #70 | Controlled Agent Task execution on pinned stock Chromium | **IMPLEMENTED_ON_ACTIVE_PR** | This Draft is stacked on exact #65 head `0888fe3a6ef6da547a37fd075733cc73dc52b2ab`. Test-only head `197ce14a5e407d61ac35b38b45c0cd042dd6278c` established the intended missing-runner RED. Current exact head `f9917cdd8050c9fdf0aefa669f4d981af85479d6` passes CI run `31453647157` and pinned real-browser run `31453647201` against Chrome for Testing `150.0.7871.129` / revision `r1639810`. The controlled Agent Task completes `3/3` trials with real WebDriver clear/type/click operations, exact same-document post-condition verification, extensions disabled, and per-trial profile cleanup. This is reproducible browser execution evidence, not the product browser adapter: fixture CSS locators are test-harness locators, no semantic role/name query authority is claimed, and OriginWeave semantic observation/policy/node-handle composition remains incomplete. | -| #71 | Computed semantic role/name evidence before controlled browser action | **PARTIAL** | This Draft is stacked on exact #70 head `f9917cdd8050c9fdf0aefa669f4d981af85479d6`. Exact test-only head `977d2682dc191ca6b26b9de631a3642680abdbc0` requires a bounded real-browser semantic-evidence boundary using W3C WebDriver computed-role and computed-label endpoints for the controlled `textbox` / `Task text` field and `button` / `Submit task` control, with credential-free evidence propagation. Production implementation and exact-head green acceptance are intentionally absent at this evidence refresh; the lane must remain `PARTIAL` until the test-first failure is observed and the smallest implementation passes the full applicable gates. Even after success, CSS remains a controlled harness locator and this slice will not itself become a semantic query engine or product adapter. | +| #71 | Computed semantic role/name evidence before controlled browser action | **IMPLEMENTED_ON_ACTIVE_PR** | This Draft is stacked on unchanged exact #70 head `f9917cdd8050c9fdf0aefa669f4d981af85479d6`. Exact test-only head `977d2682dc191ca6b26b9de631a3642680abdbc0` produced the intended RED in CI run `31454219111`, Rust contracts job `93664601520`, because the runner had no `_get_element_semantics` boundary. Current exact head `5f1f972f3e9888faa44af184fd54a466d20b6ddb` adds the smallest bounded W3C WebDriver computed-role/computed-label verification before the controlled input and submit actions. CI run `31454448709` succeeds, including exact owned production function/line/region/branch coverage, and pinned real-browser run `31454448710` succeeds on Chrome for Testing `150.0.7871.129` / revision `r1639810`: all `3/3` Agent Task trials report browser-computed `textbox` / `Task text` and `button` / `Submit task` verification, exact post-condition and input echo, extensions disabled, and profile cleanup. CodeRabbit exact-head status is successful. CSS remains a controlled harness locator; this evidence does not itself implement semantic role/name search, a versioned product adapter, OriginWeave node registration/observation composition, policy dispatch, source provenance or real-site compatibility. | ## Documentation-fitness reconciliation @@ -22,10 +22,10 @@ The addition of #67 through #71 does **not** require another ADR, a new deployed - **ADR:** #67 refines the existing evidence/recovery architecture. #68/#69 refine the in-process sensitive-handle lifecycle governed by Accepted ADR 0007. #70/#71 add executable compatibility/runtime evidence inside the already planned browser-adapter boundary. None changes a trust domain, persistence owner, deployment boundary, or binding protocol decision; existing ADR breadth remains sufficient. - **PRD/TRD:** current requirements already distinguish post-condition evidence from browser dispatch, semantic observation from action authority, and purpose-bound sensitive policy from the future trusted broker. #67–#71 remain active/non-shipped evidence and must not be described as `Implemented` on protected main. -- **Architecture/UML:** #70 materially strengthens executable proof that stock pinned Chromium can perform the controlled task, and #71 starts binding the controlled targets to browser-computed semantic evidence. Neither creates the versioned WebDriver BiDi/CDP product adapter or composes the existing OriginWeave semantic-node/policy/evidence primitives end to end. The current high-level authority diagrams remain truthful; a detailed adapter → semantic observation → typed policy/action → post-condition sequence becomes mandatory when that production composition boundary stabilizes rather than while the evidence runner remains the execution owner. +- **Architecture/UML:** #70 materially strengthens executable proof that stock pinned Chromium can perform the controlled task, and #71 binds the controlled targets to browser-computed semantic evidence before action. Neither creates the versioned WebDriver BiDi/CDP product adapter or composes the existing OriginWeave semantic-node/policy/evidence primitives end to end. The current high-level authority diagrams remain truthful; a detailed adapter → semantic observation → typed policy/action → post-condition sequence becomes mandatory when that production composition boundary stabilizes rather than while the evidence runner remains the execution owner. - **ERD/data model:** #67 is an immutable evidence value, #68/#69 are explicitly in-process policy state, and #70/#71 are ephemeral CI/browser evidence. None creates an OriginWeave-owned durable persistence schema. The conceptual ERD remains the truthful artifact; manufacturing physical tables would overstate the implementation. -- **Security/privacy:** #67 quarantines ambiguous-effect/incomplete-cleanup states. #68/#69 preserve exact reservation identity and immediate pre-disclosure recheck without exposing protected values. #70 uses synthetic local data, disables extensions in the Agent Task profile, and proves profile cleanup. #71 is intentionally limited to bounded role/name evidence and does not elevate page content into instruction or capability authority. -- **Test/release/traceability:** #67–#70 have fresh exact-head green evidence at this refresh. #71 is intentionally test-first and `PARTIAL` until its current head produces observed RED followed by exact-head GREEN. No predecessor-head success transfers across any moved head, and none of these active lanes is release evidence for protected `main` yet. +- **Security/privacy:** #67 quarantines ambiguous-effect/incomplete-cleanup states. #68/#69 preserve exact reservation identity and immediate pre-disclosure recheck without exposing protected values. #70 uses synthetic local data, disables extensions in the Agent Task profile, and proves profile cleanup. #71 is intentionally limited to bounded browser-computed role/name evidence and does not elevate page content into instruction or capability authority. +- **Test/release/traceability:** #67–#71 have fresh exact-head green evidence at this refresh. #71 preserves its observed test-first RED in the PR evidence before the current exact-head GREEN. No predecessor-head success transfers across any moved head, and none of these active lanes is release evidence for protected `main` yet. ## Interpretation rules From 53137b11a5ac818ff53d1d08443dcf8c5644b451 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 12:19:50 +0900 Subject: [PATCH 118/130] docs: record green Agent Task resource evidence --- .../2026-08-11-active-pr-maturity-delta.md | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md index 5b5a1a9c..d9ac1916 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-delta.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -15,17 +15,18 @@ Protected `main` remains the only shipped-code authority. Active pull requests, | #69 | Immediate pre-disclosure recheck of an exact tracked reservation | **IMPLEMENTED_ON_ACTIVE_PR** | This Draft is stacked on exact #68 head `aa46d982b2bf786fe297744ac99f88b6c4c5f4cf`. Test-only head `5a96d2931225e133768878c68d09e1a36b5ca0f6` established the intended missing-API RED. Production then exposed a real coverage defect in short-circuit recheck branches; focused malformed caller authority/audience cases were added, and two duplicate unreachable immutable-state checks were removed rather than manufacturing private-only coverage. Current exact head `de79d85e6be5131036db119efab767f0eb76a816` passes CI run `31453149013`, including exact owned production function/line/region/branch coverage, and CodeRabbit exact-head status is successful. The boundary rechecks the same still-outstanding reservation immediately before disclosure without consuming another use, but still trusts the future broker to supply authenticated workload audience, trusted time, exact current authority, transactional serialization and the protected-value disclosure boundary. | | #70 | Controlled Agent Task execution on pinned stock Chromium | **IMPLEMENTED_ON_ACTIVE_PR** | This Draft is stacked on exact #65 head `0888fe3a6ef6da547a37fd075733cc73dc52b2ab`. Test-only head `197ce14a5e407d61ac35b38b45c0cd042dd6278c` established the intended missing-runner RED. Current exact head `f9917cdd8050c9fdf0aefa669f4d981af85479d6` passes CI run `31453647157` and pinned real-browser run `31453647201` against Chrome for Testing `150.0.7871.129` / revision `r1639810`. The controlled Agent Task completes `3/3` trials with real WebDriver clear/type/click operations, exact same-document post-condition verification, extensions disabled, and per-trial profile cleanup. This is reproducible browser execution evidence, not the product browser adapter: fixture CSS locators are test-harness locators, no semantic role/name query authority is claimed, and OriginWeave semantic observation/policy/node-handle composition remains incomplete. | | #71 | Computed semantic role/name evidence before controlled browser action | **IMPLEMENTED_ON_ACTIVE_PR** | This Draft is stacked on unchanged exact #70 head `f9917cdd8050c9fdf0aefa669f4d981af85479d6`. Exact test-only head `977d2682dc191ca6b26b9de631a3642680abdbc0` produced the intended RED in CI run `31454219111`, Rust contracts job `93664601520`, because the runner had no `_get_element_semantics` boundary. Current exact head `5f1f972f3e9888faa44af184fd54a466d20b6ddb` adds the smallest bounded W3C WebDriver computed-role/computed-label verification before the controlled input and submit actions. CI run `31454448709` succeeds, including exact owned production function/line/region/branch coverage, and pinned real-browser run `31454448710` succeeds on Chrome for Testing `150.0.7871.129` / revision `r1639810`: all `3/3` Agent Task trials report browser-computed `textbox` / `Task text` and `button` / `Submit task` verification, exact post-condition and input echo, extensions disabled, and profile cleanup. CodeRabbit exact-head status is successful. CSS remains a controlled harness locator; this evidence does not itself implement semantic role/name search, a versioned product adapter, OriginWeave node registration/observation composition, policy dispatch, source provenance or real-site compatibility. | +| #72 | Controlled Agent Task runtime resource evidence | **IMPLEMENTED_ON_ACTIVE_PR** | This Draft is stacked on unchanged exact #71 head `5f1f972f3e9888faa44af184fd54a466d20b6ddb`. Exact test-only head `a9402a13c9ed429b8f3be2c623b994a0dfda3bb4` produced the intended RED in CI run `31454745237`, Rust contracts job `93666110420`, because strict Linux RSS parsing/sampling was absent. Current exact head `1a7186085abe926c1d0e5b22c36760965d6e237b` adds bounded `/proc//status` sampling for the ChromeDriver-issued browser PID, exact serialized semantic-observation bytes, monotonic action latency, and task duration. CI run `31454903615` succeeds, including exact owned production function/line/region/branch coverage, and pinned real-browser run `31454903620`, job `93666566904`, succeeds on Chrome for Testing `150.0.7871.129` / revision `r1639810`. All `3/3` trials pass with browser-process RSS `215326720`, `214568960`, and `213716992` bytes; semantic observation size `95` bytes each; action latency `133.282`, `130.186`, and `110.554` ms; and task duration `1144.545`, `957.991`, and `906.982` ms. Artifact ID `9087662526` has uploaded-artifact SHA-256 `a7f8ec5ae716ed723e9dd7ec84eeac3478c30fddd6eb7c9bf0d411f1a8990ee5`; CodeRabbit exact-head status is successful. The RSS metric intentionally covers only the ChromeDriver-reported browser process, not renderer/GPU/utility descendants or whole-task attribution; full trusted process-set composition remains pending the product adapter and #51/#66 contracts. | ## Documentation-fitness reconciliation -The addition of #67 through #71 does **not** require another ADR, a new deployed component, or a physical ERD entity at this stage. +The addition of #67 through #72 does **not** require another ADR, a new deployed component, or a physical ERD entity at this stage. -- **ADR:** #67 refines the existing evidence/recovery architecture. #68/#69 refine the in-process sensitive-handle lifecycle governed by Accepted ADR 0007. #70/#71 add executable compatibility/runtime evidence inside the already planned browser-adapter boundary. None changes a trust domain, persistence owner, deployment boundary, or binding protocol decision; existing ADR breadth remains sufficient. -- **PRD/TRD:** current requirements already distinguish post-condition evidence from browser dispatch, semantic observation from action authority, and purpose-bound sensitive policy from the future trusted broker. #67–#71 remain active/non-shipped evidence and must not be described as `Implemented` on protected main. -- **Architecture/UML:** #70 materially strengthens executable proof that stock pinned Chromium can perform the controlled task, and #71 binds the controlled targets to browser-computed semantic evidence before action. Neither creates the versioned WebDriver BiDi/CDP product adapter or composes the existing OriginWeave semantic-node/policy/evidence primitives end to end. The current high-level authority diagrams remain truthful; a detailed adapter → semantic observation → typed policy/action → post-condition sequence becomes mandatory when that production composition boundary stabilizes rather than while the evidence runner remains the execution owner. -- **ERD/data model:** #67 is an immutable evidence value, #68/#69 are explicitly in-process policy state, and #70/#71 are ephemeral CI/browser evidence. None creates an OriginWeave-owned durable persistence schema. The conceptual ERD remains the truthful artifact; manufacturing physical tables would overstate the implementation. -- **Security/privacy:** #67 quarantines ambiguous-effect/incomplete-cleanup states. #68/#69 preserve exact reservation identity and immediate pre-disclosure recheck without exposing protected values. #70 uses synthetic local data, disables extensions in the Agent Task profile, and proves profile cleanup. #71 is intentionally limited to bounded browser-computed role/name evidence and does not elevate page content into instruction or capability authority. -- **Test/release/traceability:** #67–#71 have fresh exact-head green evidence at this refresh. #71 preserves its observed test-first RED in the PR evidence before the current exact-head GREEN. No predecessor-head success transfers across any moved head, and none of these active lanes is release evidence for protected `main` yet. +- **ADR:** #67 refines the existing evidence/recovery architecture. #68/#69 refine the in-process sensitive-handle lifecycle governed by Accepted ADR 0007. #70–#72 add executable compatibility/runtime evidence inside the already planned browser-adapter and resource-evidence boundaries. None changes a trust domain, persistence owner, deployment boundary, or binding protocol decision; existing ADR breadth remains sufficient. +- **PRD/TRD:** current requirements already distinguish post-condition evidence from browser dispatch, semantic observation from action authority, resource evidence from trusted process attribution, and purpose-bound sensitive policy from the future trusted broker. #67–#72 remain active/non-shipped evidence and must not be described as `Implemented` on protected main. +- **Architecture/UML:** #70 materially strengthens executable proof that stock pinned Chromium can perform the controlled task, #71 binds the controlled targets to browser-computed semantic evidence before action, and #72 adds measured resource evidence for that controlled browser execution. None creates the versioned WebDriver BiDi/CDP product adapter or composes the existing OriginWeave semantic-node/policy/evidence/resource primitives end to end. The current high-level authority diagrams remain truthful; a detailed adapter → semantic observation → typed policy/action → post-condition/recovery/resource-evidence sequence becomes mandatory when that production composition boundary stabilizes rather than while the evidence runner remains the execution owner. +- **ERD/data model:** #67 is an immutable evidence value, #68/#69 are explicitly in-process policy state, and #70–#72 are ephemeral CI/browser evidence. None creates an OriginWeave-owned durable persistence schema. The conceptual ERD remains the truthful artifact; manufacturing physical tables would overstate the implementation. +- **Security/privacy:** #67 quarantines ambiguous-effect/incomplete-cleanup states. #68/#69 preserve exact reservation identity and immediate pre-disclosure recheck without exposing protected values. #70 uses synthetic local data, disables extensions in the Agent Task profile, and proves profile cleanup. #71 is intentionally limited to bounded browser-computed role/name evidence and does not elevate page content into instruction or capability authority. #72 reads only bounded Linux process status for a ChromeDriver-issued PID and emits resource measurements without credentials or page values. +- **Test/release/traceability:** #67–#72 have fresh exact-head green evidence at this refresh. #71/#72 preserve their observed test-first RED before exact-head GREEN. No predecessor-head success transfers across any moved head, and none of these active lanes is release evidence for protected `main` yet. ## Interpretation rules @@ -33,6 +34,7 @@ The addition of #67 through #71 does **not** require another ADR, a new deployed 2. Exact-head CI/coverage evidence becomes stale immediately when that head moves. 3. A stacked PR cannot be independently integrated before its exact prerequisite lineage. 4. An active implementation refinement does not manufacture a new ADR merely to mirror every PR; create or supersede an ADR only when the governing architecture decision changes. -5. In-memory identities, immutable evidence values, controlled fixtures, bounded samplers, and ephemeral compatibility evidence do not justify physical ERD entities without a real durable ownership boundary. +5. In-memory identities, immutable evidence values, controlled fixtures, bounded samplers, and ephemeral compatibility/resource evidence do not justify physical ERD entities without a real durable ownership boundary. 6. A real browser test harness is not the same authority as the production browser adapter. Promote browser/runtime maturity only when the protected-main product path owns session/context/origin/document identity, semantic observation, typed policy/action dispatch, post-condition verification, recovery, and evidence composition. -7. After any of these lanes integrates, re-evaluate PRD/TRD/Architecture/UML/ERD/traceability from the new protected-main head before changing maturity claims. +7. A single ChromeDriver-reported browser PID is not equivalent to trusted Chromium process-set or task attribution. Whole-browser/task RSS claims require an adapter-owned process set and the existing bounded aggregation contracts. +8. After any of these lanes integrates, re-evaluate PRD/TRD/Architecture/UML/ERD/traceability from the new protected-main head before changing maturity claims. From 7aebfd7134b75aa33a28ea2b3cf4ab52fdd426e9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 13:33:33 +0900 Subject: [PATCH 119/130] docs: track process-set and extension mutation evidence --- .../2026-08-11-active-pr-maturity-delta.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md index d9ac1916..62a93a9d 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-delta.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -38,3 +38,20 @@ The addition of #67 through #72 does **not** require another ADR, a new deployed 6. A real browser test harness is not the same authority as the production browser adapter. Promote browser/runtime maturity only when the protected-main product path owns session/context/origin/document identity, semantic observation, typed policy/action dispatch, post-condition verification, recovery, and evidence composition. 7. A single ChromeDriver-reported browser PID is not equivalent to trusted Chromium process-set or task attribution. Whole-browser/task RSS claims require an adapter-owned process set and the existing bounded aggregation contracts. 8. After any of these lanes integrates, re-evaluate PRD/TRD/Architecture/UML/ERD/traceability from the new protected-main head before changing maturity claims. + +## Subsequent active lanes observed in this refresh + +| PR | Scope | Maturity | Exact evidence / authority boundary | +|---|---|---|---| +| #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **PARTIAL** | At this refresh the exact head is `ec5a34ad7ef453879847182e357380dfb8e1312a`, stacked on exact #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`. CI run `31458268539` succeeds, but Manifest V3 Compatibility run `31458268547` fails on the same checkout revision: only `1/3` Agent Task trials pass and trials 2–3 terminate with `ValueError`. Trial 1 reports `chromium_process_count=9` and `chromium_process_set_rss_bytes=1030836224`, which proves the new metric can be produced but does not satisfy repeatability. The branch therefore remains non-passing active evidence, not gate-clean implementation evidence. Its `/proc` lineage snapshot remains a controlled Linux CI approximation and does not establish trusted product process ownership, per-tab/task attribution, GPU/VRAM attribution, cgroup ownership, cross-platform semantics, or release evidence. | +| #74 | Extension proposal permission cannot widen Agent mutation authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `2403344abf4b9ec8d36b58f48f3ab2abe591cff4` is based directly on protected main. CI run `31458616229` succeeds: Rust contracts and exact production function/line/region/branch coverage are green. Security Scan run `31458616236`, SAST Semgrep run `31458616241`, and the CodeRabbit exact-head commit status are successful; GitHub reports the PR mergeable and Ready for review. The two integration regressions first prove that the exact extension/session/context grant permits `ProposeTypedAction`, then prove that ordinary Agent policy still denies a cross-origin `Submit` as `CrossOriginMutation` and a same-origin `Submit` without write authority as `OriginNotWritable`. This adds no production API or extension authority and does not claim a real Chromium extension adapter exists. | + +## Reconciliation for #73 and #74 + +The canonical verdict remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. + +- **ADR:** neither lane creates a new governing decision. #73 refines controlled evidence inside the existing resource/browser-adapter direction; #74 verifies the already documented separation between extension proposal permission and Agent action/origin authority. No new ADR number should be allocated solely to mirror either PR. +- **PRD/TRD/Architecture:** the current contracts already require browser resource evidence to remain distinct from trusted attribution and require extension access not to imply Agent capability/origin authority. #73's non-passing exact head must not be promoted to implemented evidence, while #74 remains active-PR test evidence only. +- **UML:** the existing extension-authority view remains sufficient for #74 because no new actor, trust boundary, or execution edge is introduced. #73 remains an ephemeral CI evidence path and does not justify presenting `/proc` process lineage as a product deployment/authority relationship. +- **ERD/data model:** neither lane introduces durable OriginWeave-owned persistence, ownership, cardinality, or migration semantics. The conceptual ERD remains the truthful current artifact. +- **Security/test/release:** #74 strengthens regression evidence without widening authority. #73 demonstrates why repeatability is part of acceptance: one successful process-set sample cannot substitute for the required `3/3` controlled-browser gate. Neither lane is protected-main release evidence. From 61773a4fa6653cba0057bcc4b6eb7b68ee720f71 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 13:40:32 +0900 Subject: [PATCH 120/130] docs: refresh exact extension isolation evidence --- docs/evidence/2026-08-11-active-pr-maturity-delta.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md index 62a93a9d..ca6b02de 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-delta.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -43,15 +43,15 @@ The addition of #67 through #72 does **not** require another ADR, a new deployed | PR | Scope | Maturity | Exact evidence / authority boundary | |---|---|---|---| -| #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **PARTIAL** | At this refresh the exact head is `ec5a34ad7ef453879847182e357380dfb8e1312a`, stacked on exact #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`. CI run `31458268539` succeeds, but Manifest V3 Compatibility run `31458268547` fails on the same checkout revision: only `1/3` Agent Task trials pass and trials 2–3 terminate with `ValueError`. Trial 1 reports `chromium_process_count=9` and `chromium_process_set_rss_bytes=1030836224`, which proves the new metric can be produced but does not satisfy repeatability. The branch therefore remains non-passing active evidence, not gate-clean implementation evidence. Its `/proc` lineage snapshot remains a controlled Linux CI approximation and does not establish trusted product process ownership, per-tab/task attribution, GPU/VRAM attribution, cgroup ownership, cross-platform semantics, or release evidence. | -| #74 | Extension proposal permission cannot widen Agent mutation authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `2403344abf4b9ec8d36b58f48f3ab2abe591cff4` is based directly on protected main. CI run `31458616229` succeeds: Rust contracts and exact production function/line/region/branch coverage are green. Security Scan run `31458616236`, SAST Semgrep run `31458616241`, and the CodeRabbit exact-head commit status are successful; GitHub reports the PR mergeable and Ready for review. The two integration regressions first prove that the exact extension/session/context grant permits `ProposeTypedAction`, then prove that ordinary Agent policy still denies a cross-origin `Submit` as `CrossOriginMutation` and a same-origin `Submit` without write authority as `OriginNotWritable`. This adds no production API or extension authority and does not claim a real Chromium extension adapter exists. | +| #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **PARTIAL** | At this refresh the exact head is `ec5a34ad7ef453879847182e357380dfb8e1312a`, stacked on exact #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`. CI run `31458268539` succeeds, but Manifest V3 Compatibility run `31458268547` fails on the same checkout revision: only `1/3` Agent Task trials pass and trials 2–3 terminate with `ValueError`. Trial 1 reports `chromium_process_count=9` and `chromium_process_set_rss_bytes=1030836224`, which proves the new metric can be produced but does not satisfy repeatability. The current failure evidence preserves only the exception type, so the exact `ValueError` branch cannot be distinguished from the artifact alone; the lane needs a credential-free bounded diagnostic or another exact reproducer before a root-cause-changing fix can be proven. The branch therefore remains non-passing active evidence, not gate-clean implementation evidence. Its `/proc` lineage snapshot remains a controlled Linux CI approximation and does not establish trusted product process ownership, per-tab/task attribution, GPU/VRAM attribution, cgroup ownership, cross-platform semantics, or release evidence. | +| #74 | Extension proposal permission cannot widen Agent mutation or non-delegable action authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `fda8ece43f131db3f30431039079c7896e7c8479` is based directly on protected main. CI run `31458956927` succeeds; Rust contracts job `93678456147` passes repository contracts, canonical formatting, locked workspace/all-target checks, full tests, strict Clippy and rustdoc, while Production coverage job `93678456184` passes exact owned production function/line/region/branch enforcement. Security Scan run `31458956919`, SAST Semgrep run `31458956940`, and the CodeRabbit exact-head commit status are successful; GitHub reports the PR mergeable and Ready for review with no inline review threads. Four integration regressions first prove that the exact extension/session/context grant permits `ProposeTypedAction`, then prove that ordinary Agent policy still denies cross-origin `Submit` as `CrossOriginMutation`, same-origin `Submit` without write authority as `OriginNotWritable`, Crawler/PublicCrawl mutation as `CrawlerMutation`, and R5 `LegalConsent` as `ForbiddenRisk`. This adds no production API or extension authority and does not claim a real Chromium extension adapter exists. | ## Reconciliation for #73 and #74 The canonical verdict remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. -- **ADR:** neither lane creates a new governing decision. #73 refines controlled evidence inside the existing resource/browser-adapter direction; #74 verifies the already documented separation between extension proposal permission and Agent action/origin authority. No new ADR number should be allocated solely to mirror either PR. -- **PRD/TRD/Architecture:** the current contracts already require browser resource evidence to remain distinct from trusted attribution and require extension access not to imply Agent capability/origin authority. #73's non-passing exact head must not be promoted to implemented evidence, while #74 remains active-PR test evidence only. +- **ADR:** neither lane creates a new governing decision. #73 refines controlled evidence inside the existing resource/browser-adapter direction; #74 verifies the already documented separation between extension proposal permission and Agent action/origin/risk authority. No new ADR number should be allocated solely to mirror either PR. +- **PRD/TRD/Architecture:** the current contracts already require browser resource evidence to remain distinct from trusted attribution and require extension access not to imply Agent capability/origin/risk authority. #73's non-passing exact head must not be promoted to implemented evidence, while #74 remains active-PR test evidence only. - **UML:** the existing extension-authority view remains sufficient for #74 because no new actor, trust boundary, or execution edge is introduced. #73 remains an ephemeral CI evidence path and does not justify presenting `/proc` process lineage as a product deployment/authority relationship. - **ERD/data model:** neither lane introduces durable OriginWeave-owned persistence, ownership, cardinality, or migration semantics. The conceptual ERD remains the truthful current artifact. - **Security/test/release:** #74 strengthens regression evidence without widening authority. #73 demonstrates why repeatability is part of acceptance: one successful process-set sample cannot substitute for the required `3/3` controlled-browser gate. Neither lane is protected-main release evidence. From f454deab90224d309cbbc4f2fcef3c105bc3b3c7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 14:14:26 +0900 Subject: [PATCH 121/130] docs: refresh active PR 73 and 74 evidence --- docs/evidence/2026-08-11-active-pr-maturity-delta.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md index ca6b02de..49df4954 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-delta.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -43,15 +43,15 @@ The addition of #67 through #72 does **not** require another ADR, a new deployed | PR | Scope | Maturity | Exact evidence / authority boundary | |---|---|---|---| -| #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **PARTIAL** | At this refresh the exact head is `ec5a34ad7ef453879847182e357380dfb8e1312a`, stacked on exact #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`. CI run `31458268539` succeeds, but Manifest V3 Compatibility run `31458268547` fails on the same checkout revision: only `1/3` Agent Task trials pass and trials 2–3 terminate with `ValueError`. Trial 1 reports `chromium_process_count=9` and `chromium_process_set_rss_bytes=1030836224`, which proves the new metric can be produced but does not satisfy repeatability. The current failure evidence preserves only the exception type, so the exact `ValueError` branch cannot be distinguished from the artifact alone; the lane needs a credential-free bounded diagnostic or another exact reproducer before a root-cause-changing fix can be proven. The branch therefore remains non-passing active evidence, not gate-clean implementation evidence. Its `/proc` lineage snapshot remains a controlled Linux CI approximation and does not establish trusted product process ownership, per-tab/task attribution, GPU/VRAM attribution, cgroup ownership, cross-platform semantics, or release evidence. | -| #74 | Extension proposal permission cannot widen Agent mutation or non-delegable action authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `fda8ece43f131db3f30431039079c7896e7c8479` is based directly on protected main. CI run `31458956927` succeeds; Rust contracts job `93678456147` passes repository contracts, canonical formatting, locked workspace/all-target checks, full tests, strict Clippy and rustdoc, while Production coverage job `93678456184` passes exact owned production function/line/region/branch enforcement. Security Scan run `31458956919`, SAST Semgrep run `31458956940`, and the CodeRabbit exact-head commit status are successful; GitHub reports the PR mergeable and Ready for review with no inline review threads. Four integration regressions first prove that the exact extension/session/context grant permits `ProposeTypedAction`, then prove that ordinary Agent policy still denies cross-origin `Submit` as `CrossOriginMutation`, same-origin `Submit` without write authority as `OriginNotWritable`, Crawler/PublicCrawl mutation as `CrawlerMutation`, and R5 `LegalConsent` as `ForbiddenRisk`. This adds no production API or extension authority and does not claim a real Chromium extension adapter exists. | +| #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **IMPLEMENTED_ON_ACTIVE_PR** | This Draft remains stacked on unchanged exact #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`. Exact predecessor head `ec5a34ad7ef453879847182e357380dfb8e1312a` passed CI but failed Manifest V3 Compatibility run `31458268547`: only `1/3` Agent Task trials passed and trials 2–3 surfaced caught `ValueError`. Exact test-only head `85df93827e187865a136facb6a2fe37e265d4df2` then produced the intended RED in CI run `31460350048`, Rust contracts job `93682461842`: a sampled descendant with no resident `VmRSS` made `_sample_linux_process_set_rss_bytes` fail although the same snapshot contract intentionally retained that PID in process-tree membership. Current exact head `cbf922fccc83782d3e114ed65afbeb6d84ef5ce6` keeps such a sampled nonresident descendant in the process count but contributes zero resident bytes, while unknown PIDs, duplicate/invalid identifiers, malformed positive RSS, process-set overflow, and u64 aggregate overflow still fail closed. CI run `31460664866` succeeds; Rust contracts job `93683356604` passes repository contracts, formatting, locked workspace/all-target checks, full tests, strict Clippy and rustdoc; Production coverage job `93683356579` passes exact owned production function/line/region/branch enforcement. Manifest V3 Compatibility run `31460664984`, job `93683357061`, succeeds on Chrome for Testing `150.0.7871.129` / revision `r1639810`: Agent Task trials pass `3/3`, process counts are `9`, `10`, `10`, bounded sampled Chromium process-set RSS is `1021128704`, `1017016320`, `1032015872` bytes, and browser-root RSS is `215502848`, `215404544`, `212795392` bytes. Evidence artifact ID `9089676641` has SHA-256 `6164bd4cf173ea8c7665bb6c48430b2dc23eac78e6a3a51618ec4e4707b691c7`; CodeRabbit exact-head status is successful. This is still one controlled Linux `/proc` snapshot under the ChromeDriver-issued root, not trusted product process ownership, per-tab/task attribution, cgroup ownership, GPU/VRAM attribution, cross-platform semantics, or protected-main release evidence. | +| #74 | Extension proposal permission cannot widen Agent mutation, non-delegable action, or control-mode authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `8133bc91a80105f132aa41b58c4fcff79a91ecb5` is based directly on protected main. CI run `31459662572` succeeds; Rust contracts job `93680484111` passes repository contracts, canonical formatting, locked workspace/all-target checks, full tests, strict Clippy and rustdoc; Production coverage job `93680484065` passes exact owned production function/line/region/branch enforcement. Security Scan run `31459662581`, SAST Semgrep run `31459662601`, and CodeRabbit exact-head status are successful; GitHub reports the PR mergeable and Ready for review with no formal reviews or inline review threads. Five integration regressions first prove that the exact extension/session/context grant permits `ProposeTypedAction`, then prove ordinary Agent policy still denies cross-origin `Submit` as `CrossOriginMutation`, same-origin `Submit` without target write authority as `OriginNotWritable`, Crawler/PublicCrawl mutation as `CrawlerMutation`, R5 `LegalConsent` as `ForbiddenRisk`, and Human mode as `HumanModeNotAgentControlled`. This adds no production API or extension authority and does not claim a real Chromium extension adapter exists. | ## Reconciliation for #73 and #74 The canonical verdict remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. -- **ADR:** neither lane creates a new governing decision. #73 refines controlled evidence inside the existing resource/browser-adapter direction; #74 verifies the already documented separation between extension proposal permission and Agent action/origin/risk authority. No new ADR number should be allocated solely to mirror either PR. -- **PRD/TRD/Architecture:** the current contracts already require browser resource evidence to remain distinct from trusted attribution and require extension access not to imply Agent capability/origin/risk authority. #73's non-passing exact head must not be promoted to implemented evidence, while #74 remains active-PR test evidence only. +- **ADR:** neither lane creates a new governing decision. #73 refines controlled evidence inside the existing resource/browser-adapter direction; #74 verifies the already documented separation between extension proposal permission and Agent action/origin/risk/control authority. No new ADR number should be allocated solely to mirror either PR. +- **PRD/TRD/Architecture:** the current contracts already require browser resource evidence to remain distinct from trusted attribution and require extension access not to imply Agent capability/origin/risk/control authority. #73 is now gate-clean `IMPLEMENTED_ON_ACTIVE_PR` evidence rather than a non-passing partial lane, while #74 remains gate-clean active-PR test evidence only. Neither is protected-main implementation. - **UML:** the existing extension-authority view remains sufficient for #74 because no new actor, trust boundary, or execution edge is introduced. #73 remains an ephemeral CI evidence path and does not justify presenting `/proc` process lineage as a product deployment/authority relationship. - **ERD/data model:** neither lane introduces durable OriginWeave-owned persistence, ownership, cardinality, or migration semantics. The conceptual ERD remains the truthful current artifact. -- **Security/test/release:** #74 strengthens regression evidence without widening authority. #73 demonstrates why repeatability is part of acceptance: one successful process-set sample cannot substitute for the required `3/3` controlled-browser gate. Neither lane is protected-main release evidence. +- **Security/test/release:** #73 now preserves a real RED→GREEN chain and repeatable `3/3` controlled-browser proof without weakening the stricter product resource-attribution contract tracked by #51/#66. #74 strengthens regression evidence without widening authority. Neither lane is protected-main release evidence. From 070f1c40cb36bb31e25e769b467fc4fa7aa4a94e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 14:51:31 +0900 Subject: [PATCH 122/130] docs: reconcile moved active-PR evidence --- docs/evidence/2026-08-11-active-pr-maturity-delta.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-delta.md b/docs/evidence/2026-08-11-active-pr-maturity-delta.md index 49df4954..703cb6ed 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-delta.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-delta.md @@ -43,15 +43,15 @@ The addition of #67 through #72 does **not** require another ADR, a new deployed | PR | Scope | Maturity | Exact evidence / authority boundary | |---|---|---|---| -| #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **IMPLEMENTED_ON_ACTIVE_PR** | This Draft remains stacked on unchanged exact #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`. Exact predecessor head `ec5a34ad7ef453879847182e357380dfb8e1312a` passed CI but failed Manifest V3 Compatibility run `31458268547`: only `1/3` Agent Task trials passed and trials 2–3 surfaced caught `ValueError`. Exact test-only head `85df93827e187865a136facb6a2fe37e265d4df2` then produced the intended RED in CI run `31460350048`, Rust contracts job `93682461842`: a sampled descendant with no resident `VmRSS` made `_sample_linux_process_set_rss_bytes` fail although the same snapshot contract intentionally retained that PID in process-tree membership. Current exact head `cbf922fccc83782d3e114ed65afbeb6d84ef5ce6` keeps such a sampled nonresident descendant in the process count but contributes zero resident bytes, while unknown PIDs, duplicate/invalid identifiers, malformed positive RSS, process-set overflow, and u64 aggregate overflow still fail closed. CI run `31460664866` succeeds; Rust contracts job `93683356604` passes repository contracts, formatting, locked workspace/all-target checks, full tests, strict Clippy and rustdoc; Production coverage job `93683356579` passes exact owned production function/line/region/branch enforcement. Manifest V3 Compatibility run `31460664984`, job `93683357061`, succeeds on Chrome for Testing `150.0.7871.129` / revision `r1639810`: Agent Task trials pass `3/3`, process counts are `9`, `10`, `10`, bounded sampled Chromium process-set RSS is `1021128704`, `1017016320`, `1032015872` bytes, and browser-root RSS is `215502848`, `215404544`, `212795392` bytes. Evidence artifact ID `9089676641` has SHA-256 `6164bd4cf173ea8c7665bb6c48430b2dc23eac78e6a3a51618ec4e4707b691c7`; CodeRabbit exact-head status is successful. This is still one controlled Linux `/proc` snapshot under the ChromeDriver-issued root, not trusted product process ownership, per-tab/task attribution, cgroup ownership, GPU/VRAM attribution, cross-platform semantics, or protected-main release evidence. | -| #74 | Extension proposal permission cannot widen Agent mutation, non-delegable action, or control-mode authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `8133bc91a80105f132aa41b58c4fcff79a91ecb5` is based directly on protected main. CI run `31459662572` succeeds; Rust contracts job `93680484111` passes repository contracts, canonical formatting, locked workspace/all-target checks, full tests, strict Clippy and rustdoc; Production coverage job `93680484065` passes exact owned production function/line/region/branch enforcement. Security Scan run `31459662581`, SAST Semgrep run `31459662601`, and CodeRabbit exact-head status are successful; GitHub reports the PR mergeable and Ready for review with no formal reviews or inline review threads. Five integration regressions first prove that the exact extension/session/context grant permits `ProposeTypedAction`, then prove ordinary Agent policy still denies cross-origin `Submit` as `CrossOriginMutation`, same-origin `Submit` without target write authority as `OriginNotWritable`, Crawler/PublicCrawl mutation as `CrawlerMutation`, R5 `LegalConsent` as `ForbiddenRisk`, and Human mode as `HumanModeNotAgentControlled`. This adds no production API or extension authority and does not claim a real Chromium extension adapter exists. | +| #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **PARTIAL** | This Draft remains stacked on unchanged exact #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`. Earlier exact head `cbf922fccc83782d3e114ed65afbeb6d84ef5ce6` repaired nondeterministic handling of a sampled descendant with no resident `VmRSS` and passed exact CI/coverage plus pinned-browser repeatability, but a subsequent integrity audit found a narrower fail-open ambiguity: `_snapshot_linux_process_evidence` currently catches the strict parser's `exactly one VmRSS` failure and converts it to `None`, so duplicate/ambiguous `VmRSS` records can be normalized to the same absence state as a legitimately nonresident process. Exact test-only head `015e4a5f79c0abee40c6807b481d3afce613c6c4` required a dedicated optional-RSS parser in which absent/zero `VmRSS` yields `None`, exactly one positive field yields bounded bytes, and duplicate/malformed evidence fails closed. CI run `31462156163`, Rust contracts job `93687687157`, checked out that exact test head and produced the intended RED at the missing helper boundary with `KeyError`. Current exact head `ef6f23365f225b825505a58556d6917aeef505a2` removes only the temporary RED probe so the prerequisite stack is not intentionally left failing: CI run `31462292887`, Rust contracts job `93688085184`, Production coverage job `93688085247`, and Manifest V3 Compatibility run `31462292914` are successful. Those green results do not erase the integrity finding. This lane remains **PARTIAL** and must stay Draft until the snapshot source distinguishes legitimate absent/nonresident RSS from duplicate/malformed evidence, the focused regression is restored, and the exact corrected head passes both repository and real-browser gates. It is still controlled Linux `/proc` evidence, not trusted product process ownership, cgroup/per-tab/task attribution, GPU/VRAM attribution, or cross-platform semantics. | +| #74 | Extension proposal permission cannot widen Agent mutation, execution-mode/purpose, crawler/robots, non-delegable-action, or Human-mode authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `ac8b27ee69229070c382ca2199eaf9ec8b1b12db` is based directly on protected main. CI run `31462551154` succeeds and SAST Semgrep run `31462551097` succeeds; Security Scan run `31462551096` is still non-terminal and is **not** counted as passing. Nine integration regressions first prove that the exact extension/session/context grant permits `ProposeTypedAction`, then prove ordinary Agent policy still denies cross-origin `Submit` as `CrossOriginMutation`, same-origin `Submit` without write authority as `OriginNotWritable`, Crawler/PublicCrawl mutation as `CrawlerMutation`, AgentTask/PublicCrawl as `ModePurposeMismatch`, crawler observations with disallowed/unknown/not-applicable robots evidence as `RobotsDisallowed`/`RobotsUnknown`/`RobotsNotApplicable`, R5 `LegalConsent` as `ForbiddenRisk`, and Human mode as `HumanModeNotAgentControlled`. GitHub reports the PR mergeable and no inline review threads are currently returned. This adds no production API or extension authority and does not claim a real Chromium extension adapter exists; exact-current security acceptance remains pending until every required gate is terminal-success. | ## Reconciliation for #73 and #74 The canonical verdict remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. - **ADR:** neither lane creates a new governing decision. #73 refines controlled evidence inside the existing resource/browser-adapter direction; #74 verifies the already documented separation between extension proposal permission and Agent action/origin/risk/control authority. No new ADR number should be allocated solely to mirror either PR. -- **PRD/TRD/Architecture:** the current contracts already require browser resource evidence to remain distinct from trusted attribution and require extension access not to imply Agent capability/origin/risk/control authority. #73 is now gate-clean `IMPLEMENTED_ON_ACTIVE_PR` evidence rather than a non-passing partial lane, while #74 remains gate-clean active-PR test evidence only. Neither is protected-main implementation. +- **PRD/TRD/Architecture:** the current contracts already require browser resource evidence to remain distinct from trusted attribution and require extension access not to imply Agent capability/origin/risk/control authority. #73 is now **PARTIAL** because exact RED evidence demonstrates an unresolved snapshot-integrity ambiguity even though the restored branch is green. #74 remains `IMPLEMENTED_ON_ACTIVE_PR` test evidence, but exact-current security acceptance is not complete until all required security gates are terminal-success. Neither is protected-main implementation. - **UML:** the existing extension-authority view remains sufficient for #74 because no new actor, trust boundary, or execution edge is introduced. #73 remains an ephemeral CI evidence path and does not justify presenting `/proc` process lineage as a product deployment/authority relationship. - **ERD/data model:** neither lane introduces durable OriginWeave-owned persistence, ownership, cardinality, or migration semantics. The conceptual ERD remains the truthful current artifact. -- **Security/test/release:** #73 now preserves a real RED→GREEN chain and repeatable `3/3` controlled-browser proof without weakening the stricter product resource-attribution contract tracked by #51/#66. #74 strengthens regression evidence without widening authority. Neither lane is protected-main release evidence. +- **Security/test/release:** #73 preserves both its earlier functional RED→GREEN chain and the newer exact RED proving the evidence-integrity gap; the current green restoration is not a substitute for the source correction. #74 strengthens policy-composition regression evidence without widening authority, while its current security gate set remains incomplete. Neither lane is protected-main release evidence. From 685a3eb3b65e4c3a0983436621e08a4e519fe02e Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 15:22:33 +0900 Subject: [PATCH 123/130] docs: reconcile exact PR 73 and 74 maturity --- .../2026-08-11-active-pr-maturity-closure.md | 29 +++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 docs/evidence/2026-08-11-active-pr-maturity-closure.md diff --git a/docs/evidence/2026-08-11-active-pr-maturity-closure.md b/docs/evidence/2026-08-11-active-pr-maturity-closure.md new file mode 100644 index 00000000..def6d94f --- /dev/null +++ b/docs/evidence/2026-08-11-active-pr-maturity-closure.md @@ -0,0 +1,29 @@ +# Active pull-request maturity evidence — 2026-08-11 closure + +- **Protected-main anchor:** `67af7c87589edc2039545af335c95064d9b8391c` +- **Canonical documentation verdict:** **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL** +- **Scope:** exact-current reconciliation for PR #73 and PR #74 after their 2026-08-11 defect/review corrections + +Protected `main` remains the only shipped-code authority. This appendix records volatile exact-head evidence for active work and must never be read as protected-main implementation or release evidence. + +## Exact-current active lanes + +| PR | Scope | Maturity | Exact evidence / authority boundary | +|---|---|---|---| +| #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `e5fabfd57387ec7d2db692961eda93c95cf8d886`, stacked on unchanged #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`, restores the focused optional-RSS regression and implements `_parse_linux_proc_status_optional_rss_bytes`. Absent or zero `VmRSS` remains representable as nonresident sampled evidence; one positive field becomes bounded bytes; duplicate, malformed, or overflowed evidence fails closed rather than being normalized to absence. CI run `31464241922` succeeds, including Rust contracts job `93693702956` with exact-head checkout and Production coverage job `93693703022`; Manifest V3 Compatibility run `31464241924` also succeeds on the exact head. The PR remains Draft because #72/#71/#70/#65 are active prerequisites. This is controlled Linux CI evidence, not product task/process attribution, cgroup authority, per-tab ownership, GPU/VRAM attribution, or cross-platform resource telemetry. | +| #74 | Separation of extension proposal-grant evaluation from ordinary Agent action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0d492564aa61c9094f1315ee4e234b46a1e63a6c` is based directly on protected main. A predecessor-head CodeRabbit review correctly identified that no production adapter currently converts an extension proposal into an `ActionRequest`; the former naming therefore implied a composition path that did not exist. The exact current head renames and documents the tests as independent boundaries: `evaluate_extension_access` may authorize the exact extension/session/context `ProposeTypedAction` grant while ordinary user-sourced requests remain independently fail-closed for cross-origin mutation, missing write authority, crawler mutation, execution-mode/purpose mismatch, robots evidence, non-delegable R5 consent, and Human mode. CI run `31464388199`, Security Scan run `31464388200`, and SAST Semgrep run `31464388210` all succeed on this exact head. The branch adds no extension-proposal adapter, action-source transformation, execution API, or new authority and therefore does not prove a real extension → Agent action composition path or close issue #27. | + +## Documentation-fitness reconciliation + +The repository-wide documentation verdict remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. + +- **ADR:** no additional ADR is warranted by these corrections. #73 is an evidence-integrity refinement inside existing browser/resource contracts. #74 corrects a test/evidence overclaim and reinforces the already documented separation between extension permission and Agent authority. Proposed ADR 0013 remains Proposed and is not promoted by branch presence, tests, or CI. +- **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution and require browser/extension permission not to mint Agent capability, origin, approval, secret, or execution authority. The new exact heads strengthen evidence without changing the governing architecture. +- **UML:** the existing extension-authority view remains sufficient because #74 introduces no new actor, adapter, trust boundary, or execution edge. A detailed production adapter → semantic observation → typed policy/action → post-condition/recovery/resource sequence remains deferred until the production Chromium composition boundary exists; #73's CI `/proc` sampler is not that product boundary. +- **ERD/data model:** neither lane introduces OriginWeave-owned durable persistence, ownership/cardinality changes, migrations, or rollback state. The conceptual ERD remains the truthful artifact; physical process-sample or extension-policy tables would be invented architecture. +- **Security/test/release:** #73 now fails closed on ambiguous Linux RSS evidence and has exact-current repository/coverage/pinned-browser GREEN proof. #74 removes a semantic overclaim exposed by review and has exact-current CI/Security/SAST GREEN proof. Neither active branch is protected-main or release evidence. +- **Traceability:** the earlier #73 `PARTIAL` classification and #74 predecessor-head wording are superseded by this dated appendix only for their exact-current active-PR state. If either head moves, this evidence becomes historical immediately. + +## Truth boundary + +`IMPLEMENTED_ON_ACTIVE_PR` means the exact branch contains the stated behavior and exact-current proof; it does not mean shipped. A controlled Chromium runner is not the product browser adapter. A sampled Chromium process tree is not trusted whole-task ownership. An extension proposal grant is not an Agent action grant, and no current production adapter composes the two evaluators. Protected-main maturity changes only after dependency-ordered integration and fresh protected-main acceptance. From 0fcb613e136a03ada9762c2013a896d30935f261 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 15:23:06 +0900 Subject: [PATCH 124/130] docs: index exact maturity closure evidence --- docs/README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/README.md b/docs/README.md index 659e34f7..c7837bf9 100644 --- a/docs/README.md +++ b/docs/README.md @@ -14,6 +14,7 @@ - [Documentation fitness assessment](DOCUMENTATION_FITNESS.md) - [Dated active-PR maturity evidence (2026-08-10)](evidence/2026-08-10-active-pr-maturity.md) - [Active-PR maturity delta (2026-08-11)](evidence/2026-08-11-active-pr-maturity-delta.md) +- [Active-PR maturity closure (2026-08-11)](evidence/2026-08-11-active-pr-maturity-closure.md) - [Threat model](THREAT_MODEL.md) - [Product-wide test strategy](TEST_STRATEGY.md) - [Operability and incident-response baseline](OPERABILITY.md) From 8640e5e3ae50dae83638fa2fea6aca479915ac87 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 16:06:33 +0900 Subject: [PATCH 125/130] docs: reconcile model-route active maturity --- .../2026-08-11-active-pr-maturity-closure.md | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-closure.md b/docs/evidence/2026-08-11-active-pr-maturity-closure.md index def6d94f..1c50bcb6 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-closure.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-closure.md @@ -2,7 +2,7 @@ - **Protected-main anchor:** `67af7c87589edc2039545af335c95064d9b8391c` - **Canonical documentation verdict:** **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL** -- **Scope:** exact-current reconciliation for PR #73 and PR #74 after their 2026-08-11 defect/review corrections +- **Scope:** exact-current reconciliation for PR #73, PR #74, and PR #75 after their 2026-08-11 defect/review corrections Protected `main` remains the only shipped-code authority. This appendix records volatile exact-head evidence for active work and must never be read as protected-main implementation or release evidence. @@ -12,18 +12,19 @@ Protected `main` remains the only shipped-code authority. This appendix records |---|---|---|---| | #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `e5fabfd57387ec7d2db692961eda93c95cf8d886`, stacked on unchanged #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`, restores the focused optional-RSS regression and implements `_parse_linux_proc_status_optional_rss_bytes`. Absent or zero `VmRSS` remains representable as nonresident sampled evidence; one positive field becomes bounded bytes; duplicate, malformed, or overflowed evidence fails closed rather than being normalized to absence. CI run `31464241922` succeeds, including Rust contracts job `93693702956` with exact-head checkout and Production coverage job `93693703022`; Manifest V3 Compatibility run `31464241924` also succeeds on the exact head. The PR remains Draft because #72/#71/#70/#65 are active prerequisites. This is controlled Linux CI evidence, not product task/process attribution, cgroup authority, per-tab ownership, GPU/VRAM attribution, or cross-platform resource telemetry. | | #74 | Separation of extension proposal-grant evaluation from ordinary Agent action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0d492564aa61c9094f1315ee4e234b46a1e63a6c` is based directly on protected main. A predecessor-head CodeRabbit review correctly identified that no production adapter currently converts an extension proposal into an `ActionRequest`; the former naming therefore implied a composition path that did not exist. The exact current head renames and documents the tests as independent boundaries: `evaluate_extension_access` may authorize the exact extension/session/context `ProposeTypedAction` grant while ordinary user-sourced requests remain independently fail-closed for cross-origin mutation, missing write authority, crawler mutation, execution-mode/purpose mismatch, robots evidence, non-delegable R5 consent, and Human mode. CI run `31464388199`, Security Scan run `31464388200`, and SAST Semgrep run `31464388210` all succeed on this exact head. The branch adds no extension-proposal adapter, action-source transformation, execution API, or new authority and therefore does not prove a real extension → Agent action composition path or close issue #27. | +| #75 | Exact sensitive-data provider/model/region/retention route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3e04503e51fe89d4ee9a465de2516069b426e24d`, stacked on unchanged #69 head `de79d85e6be5131036db119efab767f0eb76a816`, adds `ModelRouteRequest`, `ModelRouteScope`, `ModelRouteDecision`, and `evaluate_model_route` without duplicating the existing tenant/task/field/purpose/destination/classification authority. Request and policy-scope route identifiers are bounded policy tokens and every provider/model/region/retention mismatch fails closed. Predecessor head `c33e258ebad8933e74d376e21d66bbb071eed1be` exposed four uncovered policy-scope short-circuit branches because the malformed-scope regression also supplied a malformed matching request; exact coverage artifact `9091731067` localized that defect. The current test keeps the request valid while independently exercising malformed provider, model, region, and retention-policy scope values. CI run `31467326423` succeeds, including Rust contracts job `93702897788` and exact Production coverage job `93702897798`. The PR remains Draft because #69/#68/#55/#53/#46 are active prerequisites. Route admission is not raw-value disclosure, provider authentication, model invocation, real-region attestation, prompt/token-budget policy, output validation, fallback selection, persistence, or the complete trusted broker. | ## Documentation-fitness reconciliation The repository-wide documentation verdict remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. -- **ADR:** no additional ADR is warranted by these corrections. #73 is an evidence-integrity refinement inside existing browser/resource contracts. #74 corrects a test/evidence overclaim and reinforces the already documented separation between extension permission and Agent authority. Proposed ADR 0013 remains Proposed and is not promoted by branch presence, tests, or CI. -- **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution and require browser/extension permission not to mint Agent capability, origin, approval, secret, or execution authority. The new exact heads strengthen evidence without changing the governing architecture. -- **UML:** the existing extension-authority view remains sufficient because #74 introduces no new actor, adapter, trust boundary, or execution edge. A detailed production adapter → semantic observation → typed policy/action → post-condition/recovery/resource sequence remains deferred until the production Chromium composition boundary exists; #73's CI `/proc` sampler is not that product boundary. -- **ERD/data model:** neither lane introduces OriginWeave-owned durable persistence, ownership/cardinality changes, migrations, or rollback state. The conceptual ERD remains the truthful artifact; physical process-sample or extension-policy tables would be invented architecture. -- **Security/test/release:** #73 now fails closed on ambiguous Linux RSS evidence and has exact-current repository/coverage/pinned-browser GREEN proof. #74 removes a semantic overclaim exposed by review and has exact-current CI/Security/SAST GREEN proof. Neither active branch is protected-main or release evidence. -- **Traceability:** the earlier #73 `PARTIAL` classification and #74 predecessor-head wording are superseded by this dated appendix only for their exact-current active-PR state. If either head moves, this evidence becomes historical immediately. +- **ADR:** no additional ADR is warranted by these corrections. #73 is an evidence-integrity refinement inside existing browser/resource contracts. #74 corrects a test/evidence overclaim and reinforces the already documented separation between extension permission and Agent authority. #75 implements a bounded provider/model/region/retention discriminator already required by the sensitive-data authority and model-disclosure architecture; it adds no new trust domain, deployed component, persistence owner, external protocol, fallback rule, or raw-value disclosure path. Proposed ADR 0013 remains Proposed and is not promoted by branch presence, tests, or CI; the existing sensitive-data/secret authority decisions remain the relevant design authority for #75. +- **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution, require browser/extension permission not to mint Agent capability/origin/approval/secret/execution authority, and require AI disclosure policy to bind model/provider/region/retention independently from protected-value disclosure. The new exact heads strengthen executable evidence without changing the governing product topology. +- **UML:** the existing extension-authority, sensitive-data/secret-fill, and product-wide authority views remain sufficient because #74/#75 introduce no new actor, deployed broker, browser adapter, trust boundary, or execution edge. A detailed production adapter → semantic observation → typed policy/action → post-condition/recovery/resource sequence remains deferred until the production Chromium composition boundary exists; #73's CI `/proc` sampler is not that product boundary, and #75 is a pure policy primitive rather than a model/provider transport path. +- **ERD/data model:** none of #73–#75 introduces OriginWeave-owned durable persistence, ownership/cardinality changes, migrations, or rollback state. The conceptual ERD remains the truthful artifact; physical process-sample, extension-policy, model-route, broker, or provider-policy tables would be invented architecture until a real persistence owner is accepted and implemented. +- **Security/test/release:** #73 now fails closed on ambiguous Linux RSS evidence and has exact-current repository/coverage/pinned-browser GREEN proof. #74 removes a semantic overclaim exposed by review and has exact-current CI/Security/SAST GREEN proof. #75 fails closed on malformed policy-side route authority as well as request-side authority and has exact-current repository/rustdoc/exact-coverage GREEN proof. None of these active branches is protected-main or release evidence. +- **Traceability:** the earlier #73 `PARTIAL` classification and #74 predecessor-head wording are superseded by this dated appendix only for their exact-current active-PR state; #75 is added as exact-current non-shipped sensitive-data route-policy evidence. If any recorded head moves, its evidence becomes historical immediately. ## Truth boundary -`IMPLEMENTED_ON_ACTIVE_PR` means the exact branch contains the stated behavior and exact-current proof; it does not mean shipped. A controlled Chromium runner is not the product browser adapter. A sampled Chromium process tree is not trusted whole-task ownership. An extension proposal grant is not an Agent action grant, and no current production adapter composes the two evaluators. Protected-main maturity changes only after dependency-ordered integration and fresh protected-main acceptance. +`IMPLEMENTED_ON_ACTIVE_PR` means the exact branch contains the stated behavior and exact-current proof; it does not mean shipped. A controlled Chromium runner is not the product browser adapter. A sampled Chromium process tree is not trusted whole-task ownership. An extension proposal grant is not an Agent action grant, and no current production adapter composes the two evaluators. A model-route admission decision is not authorization to disclose a protected value and does not authenticate a provider, attest a region, invoke a model, validate output, or authorize fallback. Protected-main maturity changes only after dependency-ordered integration and fresh protected-main acceptance. From 6bca1cf8288e0bfb3b856f8d8569cc9c04da1a25 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 17:51:40 +0900 Subject: [PATCH 126/130] docs: reconcile export and extension composition maturity --- .../2026-08-11-active-pr-maturity-closure.md | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-closure.md b/docs/evidence/2026-08-11-active-pr-maturity-closure.md index 1c50bcb6..0e3b4505 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-closure.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-closure.md @@ -2,7 +2,7 @@ - **Protected-main anchor:** `67af7c87589edc2039545af335c95064d9b8391c` - **Canonical documentation verdict:** **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL** -- **Scope:** exact-current reconciliation for PR #73, PR #74, and PR #75 after their 2026-08-11 defect/review corrections +- **Scope:** exact-current reconciliation for PR #73, PR #74, PR #75, and PR #76 after their 2026-08-11 defect/review corrections Protected `main` remains the only shipped-code authority. This appendix records volatile exact-head evidence for active work and must never be read as protected-main implementation or release evidence. @@ -12,19 +12,20 @@ Protected `main` remains the only shipped-code authority. This appendix records |---|---|---|---| | #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `e5fabfd57387ec7d2db692961eda93c95cf8d886`, stacked on unchanged #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`, restores the focused optional-RSS regression and implements `_parse_linux_proc_status_optional_rss_bytes`. Absent or zero `VmRSS` remains representable as nonresident sampled evidence; one positive field becomes bounded bytes; duplicate, malformed, or overflowed evidence fails closed rather than being normalized to absence. CI run `31464241922` succeeds, including Rust contracts job `93693702956` with exact-head checkout and Production coverage job `93693703022`; Manifest V3 Compatibility run `31464241924` also succeeds on the exact head. The PR remains Draft because #72/#71/#70/#65 are active prerequisites. This is controlled Linux CI evidence, not product task/process attribution, cgroup authority, per-tab ownership, GPU/VRAM attribution, or cross-platform resource telemetry. | | #74 | Separation of extension proposal-grant evaluation from ordinary Agent action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0d492564aa61c9094f1315ee4e234b46a1e63a6c` is based directly on protected main. A predecessor-head CodeRabbit review correctly identified that no production adapter currently converts an extension proposal into an `ActionRequest`; the former naming therefore implied a composition path that did not exist. The exact current head renames and documents the tests as independent boundaries: `evaluate_extension_access` may authorize the exact extension/session/context `ProposeTypedAction` grant while ordinary user-sourced requests remain independently fail-closed for cross-origin mutation, missing write authority, crawler mutation, execution-mode/purpose mismatch, robots evidence, non-delegable R5 consent, and Human mode. CI run `31464388199`, Security Scan run `31464388200`, and SAST Semgrep run `31464388210` all succeed on this exact head. The branch adds no extension-proposal adapter, action-source transformation, execution API, or new authority and therefore does not prove a real extension → Agent action composition path or close issue #27. | -| #75 | Exact sensitive-data provider/model/region/retention route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3e04503e51fe89d4ee9a465de2516069b426e24d`, stacked on unchanged #69 head `de79d85e6be5131036db119efab767f0eb76a816`, adds `ModelRouteRequest`, `ModelRouteScope`, `ModelRouteDecision`, and `evaluate_model_route` without duplicating the existing tenant/task/field/purpose/destination/classification authority. Request and policy-scope route identifiers are bounded policy tokens and every provider/model/region/retention mismatch fails closed. Predecessor head `c33e258ebad8933e74d376e21d66bbb071eed1be` exposed four uncovered policy-scope short-circuit branches because the malformed-scope regression also supplied a malformed matching request; exact coverage artifact `9091731067` localized that defect. The current test keeps the request valid while independently exercising malformed provider, model, region, and retention-policy scope values. CI run `31467326423` succeeds, including Rust contracts job `93702897788` and exact Production coverage job `93702897798`. The PR remains Draft because #69/#68/#55/#53/#46 are active prerequisites. Route admission is not raw-value disclosure, provider authentication, model invocation, real-region attestation, prompt/token-budget policy, output validation, fallback selection, persistence, or the complete trusted broker. | +| #75 | Exact sensitive-data provider/model/region/retention/training/reviewed-subprocessor/export route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact current head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, stacked on unchanged #69 head `de79d85e6be5131036db119efab767f0eb76a816`, extends the existing model-route authority with an explicit export-policy dimension while preserving the complete tenant/task/field/purpose/destination/classification authority. The ordinary constructor defaults to `no-export`; callers may select another bounded export-policy token through `with_export_policy`, but matching route metadata still does not authorize protected-value disclosure or perform export. Test-only head `90bde2dba675be10abb34a5c2a8bf03bb34abcdf` established the intended RED in CI run `31474208345`, Rust contracts job `93724057066`: repository contracts and formatting passed before `cargo check` failed with E0599 because export-policy APIs did not exist. Production head `88b1fd46b6d2e83411682f97aa17de95aca90789` made the tests GREEN but strict Clippy correctly rejected two eight-argument constructors; the API was then narrowed to the builder-style export selector rather than weakening lint policy. The current head contains that correction, the adjusted regressions, and the truthful changelog entry. Exact-current CI run `31474904239` is in progress at this evidence refresh; its predecessor-head results are not transferred. The PR remains Draft because #69/#68/#55/#53/#46 are active prerequisites. Route admission is not raw-value disclosure, export execution, provider authentication, model invocation, real-region attestation, prompt/token-budget policy, output validation, fallback selection, persistence, or the complete trusted broker. | +| #76 | Production policy composition of extension proposal authority with ordinary typed-action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e`, stacked on unchanged #74 head `0d492564aa61c9094f1315ee4e234b46a1e63a6c`, adds `evaluate_extension_action_proposal` and `ExtensionProposalDecision`. The helper constructs the exact extension/session/context `ProposeTypedAction` access request and, only after that grant succeeds, evaluates the caller-supplied `ActionRequest` unchanged through ordinary Agent policy. It therefore preserves instruction-source, capability, origin, secret-delivery, risk, approval, execution-mode, purpose, and crawler controls instead of minting them from extension transport. CI run `31472688287` succeeds, including Rust contracts job `93719296349` and exact Production coverage job `93719296436`; no formal or inline review finding is returned for the exact head. The PR remains Draft while #74 is active. This is a pure policy-composition prerequisite: it does not parse or authenticate extension messages, create trusted instruction provenance, execute Chromium actions, disclose secrets, verify post-conditions, persist policy, alter managed-extension configuration, or close issue #27. | ## Documentation-fitness reconciliation The repository-wide documentation verdict remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. -- **ADR:** no additional ADR is warranted by these corrections. #73 is an evidence-integrity refinement inside existing browser/resource contracts. #74 corrects a test/evidence overclaim and reinforces the already documented separation between extension permission and Agent authority. #75 implements a bounded provider/model/region/retention discriminator already required by the sensitive-data authority and model-disclosure architecture; it adds no new trust domain, deployed component, persistence owner, external protocol, fallback rule, or raw-value disclosure path. Proposed ADR 0013 remains Proposed and is not promoted by branch presence, tests, or CI; the existing sensitive-data/secret authority decisions remain the relevant design authority for #75. -- **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution, require browser/extension permission not to mint Agent capability/origin/approval/secret/execution authority, and require AI disclosure policy to bind model/provider/region/retention independently from protected-value disclosure. The new exact heads strengthen executable evidence without changing the governing product topology. -- **UML:** the existing extension-authority, sensitive-data/secret-fill, and product-wide authority views remain sufficient because #74/#75 introduce no new actor, deployed broker, browser adapter, trust boundary, or execution edge. A detailed production adapter → semantic observation → typed policy/action → post-condition/recovery/resource sequence remains deferred until the production Chromium composition boundary exists; #73's CI `/proc` sampler is not that product boundary, and #75 is a pure policy primitive rather than a model/provider transport path. -- **ERD/data model:** none of #73–#75 introduces OriginWeave-owned durable persistence, ownership/cardinality changes, migrations, or rollback state. The conceptual ERD remains the truthful artifact; physical process-sample, extension-policy, model-route, broker, or provider-policy tables would be invented architecture until a real persistence owner is accepted and implemented. -- **Security/test/release:** #73 now fails closed on ambiguous Linux RSS evidence and has exact-current repository/coverage/pinned-browser GREEN proof. #74 removes a semantic overclaim exposed by review and has exact-current CI/Security/SAST GREEN proof. #75 fails closed on malformed policy-side route authority as well as request-side authority and has exact-current repository/rustdoc/exact-coverage GREEN proof. None of these active branches is protected-main or release evidence. -- **Traceability:** the earlier #73 `PARTIAL` classification and #74 predecessor-head wording are superseded by this dated appendix only for their exact-current active-PR state; #75 is added as exact-current non-shipped sensitive-data route-policy evidence. If any recorded head moves, its evidence becomes historical immediately. +- **ADR:** no additional ADR is warranted by these corrections. #73 is an evidence-integrity refinement inside existing browser/resource contracts. #74 corrects a test/evidence overclaim and reinforces the already documented separation between extension permission and Agent authority. #75 adds the explicit export dimension already required by the sensitive-data/model-disclosure architecture without creating a new trust domain, deployed component, persistence owner, external protocol, fallback rule, or protected-value disclosure path. #76 implements the policy-composition prerequisite inside Proposed ADR 0013's existing extension-authority boundary and likewise adds no trust domain, deployed component, persistence owner, or binding transport protocol. Proposed ADR 0013 remains Proposed and is not promoted by branch presence, tests, CI, or policy-helper implementation. +- **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution, require browser/extension permission not to mint Agent capability/origin/approval/secret/execution authority, and require AI disclosure policy to bind model/provider/region/retention/export independently from protected-value disclosure. #76 supplies a bounded production policy-composition helper but does not change the topology because the real Chromium extension transport/adapter remains absent. The new exact heads therefore strengthen executable evidence without changing the governing product architecture. +- **UML:** the existing extension-authority, sensitive-data/secret-fill, and product-wide authority views remain sufficient for the current material boundaries. #76 means the documentation must distinguish a real production policy-composition helper from a nonexistent Chromium extension transport adapter; no new actor or deployment edge exists yet. A detailed production adapter → semantic observation → typed policy/action → post-condition/recovery/resource sequence remains mandatory when that real browser-adapter composition boundary stabilizes. #73's CI `/proc` sampler is not that product boundary, and #75 is a pure policy primitive rather than a model/provider transport path. +- **ERD/data model:** none of #73–#76 introduces OriginWeave-owned durable persistence, ownership/cardinality changes, migrations, or rollback state. The conceptual ERD remains the truthful artifact; physical process-sample, extension-policy, model-route, broker, provider-policy, or export-policy tables would be invented architecture until a real persistence owner is accepted and implemented. +- **Security/test/release:** #73 fails closed on ambiguous Linux RSS evidence and has exact-current repository/coverage/pinned-browser GREEN proof. #74 removes a semantic overclaim exposed by review and has exact-current CI/Security/SAST GREEN proof. #75 now has a realistic RED for the missing export dimension and a Clippy-driven API correction without weakening gates; its exact-current CI is still running and therefore is not represented as passing evidence here. #76 has exact-current Rust contracts and exact owned-production coverage GREEN proof for the policy-composition boundary. None of these active branches is protected-main or release evidence. +- **Traceability:** the earlier #73 `PARTIAL` classification and #74 predecessor-head wording are superseded by this dated appendix only for their exact-current active-PR state. #75 is tracked as exact-current non-shipped sensitive-data route/export-policy evidence, including its RED and strict-Clippy correction. #76 is tracked as exact-current non-shipped extension-policy composition evidence. If any recorded head moves, its evidence becomes historical immediately. ## Truth boundary -`IMPLEMENTED_ON_ACTIVE_PR` means the exact branch contains the stated behavior and exact-current proof; it does not mean shipped. A controlled Chromium runner is not the product browser adapter. A sampled Chromium process tree is not trusted whole-task ownership. An extension proposal grant is not an Agent action grant, and no current production adapter composes the two evaluators. A model-route admission decision is not authorization to disclose a protected value and does not authenticate a provider, attest a region, invoke a model, validate output, or authorize fallback. Protected-main maturity changes only after dependency-ordered integration and fresh protected-main acceptance. +`IMPLEMENTED_ON_ACTIVE_PR` means the exact branch contains the stated behavior; it does not mean shipped, and a pending exact-head check is never treated as passing. A controlled Chromium runner is not the product browser adapter. A sampled Chromium process tree is not trusted whole-task ownership. An extension proposal grant is not an Agent action grant. Active PR #76 now contains a production helper that composes those two policy evaluations, but no current Chromium extension transport adapter constructs trusted `ActionRequest` provenance or executes that proposal. A model-route admission decision is not authorization to disclose a protected value, execute an export, authenticate a provider, attest a region, invoke a model, validate output, or authorize fallback. Protected-main maturity changes only after dependency-ordered integration and fresh protected-main acceptance. From 724342b8c14bb48c1294b6adbc987640f43e4c85 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 17:55:19 +0900 Subject: [PATCH 127/130] docs: record exact green export-route evidence --- docs/evidence/2026-08-11-active-pr-maturity-closure.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-closure.md b/docs/evidence/2026-08-11-active-pr-maturity-closure.md index 0e3b4505..1dcf679f 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-closure.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-closure.md @@ -12,7 +12,7 @@ Protected `main` remains the only shipped-code authority. This appendix records |---|---|---|---| | #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `e5fabfd57387ec7d2db692961eda93c95cf8d886`, stacked on unchanged #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`, restores the focused optional-RSS regression and implements `_parse_linux_proc_status_optional_rss_bytes`. Absent or zero `VmRSS` remains representable as nonresident sampled evidence; one positive field becomes bounded bytes; duplicate, malformed, or overflowed evidence fails closed rather than being normalized to absence. CI run `31464241922` succeeds, including Rust contracts job `93693702956` with exact-head checkout and Production coverage job `93693703022`; Manifest V3 Compatibility run `31464241924` also succeeds on the exact head. The PR remains Draft because #72/#71/#70/#65 are active prerequisites. This is controlled Linux CI evidence, not product task/process attribution, cgroup authority, per-tab ownership, GPU/VRAM attribution, or cross-platform resource telemetry. | | #74 | Separation of extension proposal-grant evaluation from ordinary Agent action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0d492564aa61c9094f1315ee4e234b46a1e63a6c` is based directly on protected main. A predecessor-head CodeRabbit review correctly identified that no production adapter currently converts an extension proposal into an `ActionRequest`; the former naming therefore implied a composition path that did not exist. The exact current head renames and documents the tests as independent boundaries: `evaluate_extension_access` may authorize the exact extension/session/context `ProposeTypedAction` grant while ordinary user-sourced requests remain independently fail-closed for cross-origin mutation, missing write authority, crawler mutation, execution-mode/purpose mismatch, robots evidence, non-delegable R5 consent, and Human mode. CI run `31464388199`, Security Scan run `31464388200`, and SAST Semgrep run `31464388210` all succeed on this exact head. The branch adds no extension-proposal adapter, action-source transformation, execution API, or new authority and therefore does not prove a real extension → Agent action composition path or close issue #27. | -| #75 | Exact sensitive-data provider/model/region/retention/training/reviewed-subprocessor/export route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact current head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, stacked on unchanged #69 head `de79d85e6be5131036db119efab767f0eb76a816`, extends the existing model-route authority with an explicit export-policy dimension while preserving the complete tenant/task/field/purpose/destination/classification authority. The ordinary constructor defaults to `no-export`; callers may select another bounded export-policy token through `with_export_policy`, but matching route metadata still does not authorize protected-value disclosure or perform export. Test-only head `90bde2dba675be10abb34a5c2a8bf03bb34abcdf` established the intended RED in CI run `31474208345`, Rust contracts job `93724057066`: repository contracts and formatting passed before `cargo check` failed with E0599 because export-policy APIs did not exist. Production head `88b1fd46b6d2e83411682f97aa17de95aca90789` made the tests GREEN but strict Clippy correctly rejected two eight-argument constructors; the API was then narrowed to the builder-style export selector rather than weakening lint policy. The current head contains that correction, the adjusted regressions, and the truthful changelog entry. Exact-current CI run `31474904239` is in progress at this evidence refresh; its predecessor-head results are not transferred. The PR remains Draft because #69/#68/#55/#53/#46 are active prerequisites. Route admission is not raw-value disclosure, export execution, provider authentication, model invocation, real-region attestation, prompt/token-budget policy, output validation, fallback selection, persistence, or the complete trusted broker. | +| #75 | Exact sensitive-data provider/model/region/retention/training/reviewed-subprocessor/export route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact current head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, stacked on unchanged #69 head `de79d85e6be5131036db119efab767f0eb76a816`, extends the existing model-route authority with an explicit export-policy dimension while preserving the complete tenant/task/field/purpose/destination/classification authority. The ordinary constructor defaults to `no-export`; callers may select another bounded export-policy token through `with_export_policy`, but matching route metadata still does not authorize protected-value disclosure or perform export. Test-only head `90bde2dba675be10abb34a5c2a8bf03bb34abcdf` established the intended RED in CI run `31474208345`, Rust contracts job `93724057066`: repository contracts and formatting passed before `cargo check` failed with E0599 because export-policy APIs did not exist. Production head `88b1fd46b6d2e83411682f97aa17de95aca90789` made the tests GREEN but strict Clippy correctly rejected two eight-argument constructors; the API was then narrowed to the builder-style export selector rather than weakening lint policy. The current head contains that correction, adjusted realistic regressions, and the truthful changelog entry. Exact-current CI run `31474904239` succeeds, including Rust contracts job `93726313815` (repository contracts, formatting, locked workspace/all-target check, full tests, strict Clippy and rustdoc) and Production coverage job `93726313914` with exact owned production function/line/region/branch enforcement. No formal or inline review finding is returned for this exact head. The PR remains Draft because #69/#68/#55/#53/#46 are active prerequisites. Route admission is not raw-value disclosure, export execution, provider authentication, model invocation, real-region attestation, prompt/token-budget policy, output validation, fallback selection, persistence, or the complete trusted broker. | | #76 | Production policy composition of extension proposal authority with ordinary typed-action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e`, stacked on unchanged #74 head `0d492564aa61c9094f1315ee4e234b46a1e63a6c`, adds `evaluate_extension_action_proposal` and `ExtensionProposalDecision`. The helper constructs the exact extension/session/context `ProposeTypedAction` access request and, only after that grant succeeds, evaluates the caller-supplied `ActionRequest` unchanged through ordinary Agent policy. It therefore preserves instruction-source, capability, origin, secret-delivery, risk, approval, execution-mode, purpose, and crawler controls instead of minting them from extension transport. CI run `31472688287` succeeds, including Rust contracts job `93719296349` and exact Production coverage job `93719296436`; no formal or inline review finding is returned for the exact head. The PR remains Draft while #74 is active. This is a pure policy-composition prerequisite: it does not parse or authenticate extension messages, create trusted instruction provenance, execute Chromium actions, disclose secrets, verify post-conditions, persist policy, alter managed-extension configuration, or close issue #27. | ## Documentation-fitness reconciliation @@ -23,8 +23,8 @@ The repository-wide documentation verdict remains **DESIGN-SUFFICIENT / PROTECTE - **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution, require browser/extension permission not to mint Agent capability/origin/approval/secret/execution authority, and require AI disclosure policy to bind model/provider/region/retention/export independently from protected-value disclosure. #76 supplies a bounded production policy-composition helper but does not change the topology because the real Chromium extension transport/adapter remains absent. The new exact heads therefore strengthen executable evidence without changing the governing product architecture. - **UML:** the existing extension-authority, sensitive-data/secret-fill, and product-wide authority views remain sufficient for the current material boundaries. #76 means the documentation must distinguish a real production policy-composition helper from a nonexistent Chromium extension transport adapter; no new actor or deployment edge exists yet. A detailed production adapter → semantic observation → typed policy/action → post-condition/recovery/resource sequence remains mandatory when that real browser-adapter composition boundary stabilizes. #73's CI `/proc` sampler is not that product boundary, and #75 is a pure policy primitive rather than a model/provider transport path. - **ERD/data model:** none of #73–#76 introduces OriginWeave-owned durable persistence, ownership/cardinality changes, migrations, or rollback state. The conceptual ERD remains the truthful artifact; physical process-sample, extension-policy, model-route, broker, provider-policy, or export-policy tables would be invented architecture until a real persistence owner is accepted and implemented. -- **Security/test/release:** #73 fails closed on ambiguous Linux RSS evidence and has exact-current repository/coverage/pinned-browser GREEN proof. #74 removes a semantic overclaim exposed by review and has exact-current CI/Security/SAST GREEN proof. #75 now has a realistic RED for the missing export dimension and a Clippy-driven API correction without weakening gates; its exact-current CI is still running and therefore is not represented as passing evidence here. #76 has exact-current Rust contracts and exact owned-production coverage GREEN proof for the policy-composition boundary. None of these active branches is protected-main or release evidence. -- **Traceability:** the earlier #73 `PARTIAL` classification and #74 predecessor-head wording are superseded by this dated appendix only for their exact-current active-PR state. #75 is tracked as exact-current non-shipped sensitive-data route/export-policy evidence, including its RED and strict-Clippy correction. #76 is tracked as exact-current non-shipped extension-policy composition evidence. If any recorded head moves, its evidence becomes historical immediately. +- **Security/test/release:** #73 fails closed on ambiguous Linux RSS evidence and has exact-current repository/coverage/pinned-browser GREEN proof. #74 removes a semantic overclaim exposed by review and has exact-current CI/Security/SAST GREEN proof. #75 has a realistic RED for the missing export dimension, a strict-Clippy-driven API correction without weakening gates, and exact-current Rust contracts plus exact owned-production coverage GREEN proof. #76 has exact-current Rust contracts and exact owned-production coverage GREEN proof for the policy-composition boundary. None of these active branches is protected-main or release evidence. +- **Traceability:** the earlier #73 `PARTIAL` classification and #74 predecessor-head wording are superseded by this dated appendix only for their exact-current active-PR state. #75 is tracked as exact-current non-shipped sensitive-data route/export-policy evidence, including its RED, strict-Clippy correction, and exact-current GREEN proof. #76 is tracked as exact-current non-shipped extension-policy composition evidence. If any recorded head moves, its evidence becomes historical immediately. ## Truth boundary From 8eb48f39ae7cfa6befce5fc605fc8b1efeb6d790 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 19:13:13 +0900 Subject: [PATCH 128/130] docs(evidence): reconcile active authority through PR 79 --- .../2026-08-11-active-pr-maturity-closure.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-closure.md b/docs/evidence/2026-08-11-active-pr-maturity-closure.md index 1dcf679f..6a752955 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-closure.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-closure.md @@ -2,7 +2,7 @@ - **Protected-main anchor:** `67af7c87589edc2039545af335c95064d9b8391c` - **Canonical documentation verdict:** **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL** -- **Scope:** exact-current reconciliation for PR #73, PR #74, PR #75, and PR #76 after their 2026-08-11 defect/review corrections +- **Scope:** exact-current reconciliation for PR #73 through PR #79 after their 2026-08-11 defect, review, policy-composition, and sensitive-model authority corrections Protected `main` remains the only shipped-code authority. This appendix records volatile exact-head evidence for active work and must never be read as protected-main implementation or release evidence. @@ -14,18 +14,21 @@ Protected `main` remains the only shipped-code authority. This appendix records | #74 | Separation of extension proposal-grant evaluation from ordinary Agent action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0d492564aa61c9094f1315ee4e234b46a1e63a6c` is based directly on protected main. A predecessor-head CodeRabbit review correctly identified that no production adapter currently converts an extension proposal into an `ActionRequest`; the former naming therefore implied a composition path that did not exist. The exact current head renames and documents the tests as independent boundaries: `evaluate_extension_access` may authorize the exact extension/session/context `ProposeTypedAction` grant while ordinary user-sourced requests remain independently fail-closed for cross-origin mutation, missing write authority, crawler mutation, execution-mode/purpose mismatch, robots evidence, non-delegable R5 consent, and Human mode. CI run `31464388199`, Security Scan run `31464388200`, and SAST Semgrep run `31464388210` all succeed on this exact head. The branch adds no extension-proposal adapter, action-source transformation, execution API, or new authority and therefore does not prove a real extension → Agent action composition path or close issue #27. | | #75 | Exact sensitive-data provider/model/region/retention/training/reviewed-subprocessor/export route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact current head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, stacked on unchanged #69 head `de79d85e6be5131036db119efab767f0eb76a816`, extends the existing model-route authority with an explicit export-policy dimension while preserving the complete tenant/task/field/purpose/destination/classification authority. The ordinary constructor defaults to `no-export`; callers may select another bounded export-policy token through `with_export_policy`, but matching route metadata still does not authorize protected-value disclosure or perform export. Test-only head `90bde2dba675be10abb34a5c2a8bf03bb34abcdf` established the intended RED in CI run `31474208345`, Rust contracts job `93724057066`: repository contracts and formatting passed before `cargo check` failed with E0599 because export-policy APIs did not exist. Production head `88b1fd46b6d2e83411682f97aa17de95aca90789` made the tests GREEN but strict Clippy correctly rejected two eight-argument constructors; the API was then narrowed to the builder-style export selector rather than weakening lint policy. The current head contains that correction, adjusted realistic regressions, and the truthful changelog entry. Exact-current CI run `31474904239` succeeds, including Rust contracts job `93726313815` (repository contracts, formatting, locked workspace/all-target check, full tests, strict Clippy and rustdoc) and Production coverage job `93726313914` with exact owned production function/line/region/branch enforcement. No formal or inline review finding is returned for this exact head. The PR remains Draft because #69/#68/#55/#53/#46 are active prerequisites. Route admission is not raw-value disclosure, export execution, provider authentication, model invocation, real-region attestation, prompt/token-budget policy, output validation, fallback selection, persistence, or the complete trusted broker. | | #76 | Production policy composition of extension proposal authority with ordinary typed-action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e`, stacked on unchanged #74 head `0d492564aa61c9094f1315ee4e234b46a1e63a6c`, adds `evaluate_extension_action_proposal` and `ExtensionProposalDecision`. The helper constructs the exact extension/session/context `ProposeTypedAction` access request and, only after that grant succeeds, evaluates the caller-supplied `ActionRequest` unchanged through ordinary Agent policy. It therefore preserves instruction-source, capability, origin, secret-delivery, risk, approval, execution-mode, purpose, and crawler controls instead of minting them from extension transport. CI run `31472688287` succeeds, including Rust contracts job `93719296349` and exact Production coverage job `93719296436`; no formal or inline review finding is returned for the exact head. The PR remains Draft while #74 is active. This is a pure policy-composition prerequisite: it does not parse or authenticate extension messages, create trusted instruction provenance, execute Chromium actions, disclose secrets, verify post-conditions, persist policy, alter managed-extension configuration, or close issue #27. | +| #77 | Reviewed prompt/output-schema and token-budget policy composed after exact sensitive-model route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `adb67f8de3e4828db14dfa0e2950b672b60709c5`, stacked on unchanged #75 head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, implements `ModelInvocationRequest`, `ModelInvocationScope`, `ModelInvocationDecision`, and `evaluate_model_invocation`. Exact route denial remains a distinct prerequisite; bounded prompt-contract/output-schema identifiers must match; requested and reviewed input/output token budgets must be nonzero; and requested budgets may not exceed reviewed maxima. Exact-head CI run `31477512549` succeeds, and no formal or inline review finding is currently returned for that head. The PR remains Draft because #75 and the sensitive-handle prerequisites remain active. This metadata admission does not disclose a protected value, authenticate or invoke a provider, validate model output, enforce retention, isolate unrelated history, authorize fallback/export, or provide invocation-policy expiry. | +| #78 | Raw extension-message action proposals are forced into untrusted content provenance before ordinary Agent policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3fd7d563d814a895e20d04fc6bd37371e548a875`, stacked on unchanged #76 head `3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e`, implements `ExtensionMessageActionProposal` and `evaluate_extension_message_action_proposal`. The raw proposal type exposes no instruction-source selector; after exact extension/session/context proposal permission succeeds, production constructs the ordinary `ActionRequest` internally with `InstructionSource::WebContent`. Exact-head CI run `31477648663` succeeds. No formal or inline review finding is returned for the head; CodeRabbit's Draft skip is explicitly not review approval. The branch does not parse Chromium messages, establish transport sender authenticity beyond the existing grant tuple, execute browser input, resolve secrets, verify post-conditions, persist managed-extension policy, or close issue #27. | +| #79 | Exclusive freshness/expiry for reviewed sensitive-model invocation metadata | **IMPLEMENTED_ON_ACTIVE_PR; exact-current CI pending** | Test-only head `eb7daf465f35b314b175a592cdb9d74962b64800`, stacked on exact #77 head `adb67f8de3e4828db14dfa0e2950b672b60709c5`, established the intended missing-boundary RED in CI run `31480649072`: repository contracts and formatting passed before Rust compilation failed because the production scope lacked `valid_until`, the evaluator lacked caller-supplied trusted time, and `InvocationExpired` did not exist. Production head `39ec1659541b10785fcd85a9531bdd8d823578e3` added a nonzero exclusive `valid_until`, caller-supplied `trusted_time`, and typed `InvocationExpired`; route denial remains first, malformed static invocation policy remains `InvocationPolicyMismatch`, and authorization requires `trusted_time < valid_until`. CI run `31480876883` succeeds on that exact production head, including Rust contracts and exact Production coverage. Current head `2ad7a2162b4842fe57f74f69f08b258f4f6a9c07` adds only the truthful changelog entry; CI run `31481128812` is currently in progress and therefore is not counted as passing exact-current evidence. The policy function reads no wall clock and does not attest clock provenance; the trusted broker/orchestrator must supply time from the same authoritative domain that issued expiry. This remains metadata freshness only, not protected-value disclosure, provider invocation, output validation, unrelated-history isolation, retention enforcement, fallback/export execution, or complete issue #10 closure. | ## Documentation-fitness reconciliation The repository-wide documentation verdict remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. -- **ADR:** no additional ADR is warranted by these corrections. #73 is an evidence-integrity refinement inside existing browser/resource contracts. #74 corrects a test/evidence overclaim and reinforces the already documented separation between extension permission and Agent authority. #75 adds the explicit export dimension already required by the sensitive-data/model-disclosure architecture without creating a new trust domain, deployed component, persistence owner, external protocol, fallback rule, or protected-value disclosure path. #76 implements the policy-composition prerequisite inside Proposed ADR 0013's existing extension-authority boundary and likewise adds no trust domain, deployed component, persistence owner, or binding transport protocol. Proposed ADR 0013 remains Proposed and is not promoted by branch presence, tests, CI, or policy-helper implementation. -- **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution, require browser/extension permission not to mint Agent capability/origin/approval/secret/execution authority, and require AI disclosure policy to bind model/provider/region/retention/export independently from protected-value disclosure. #76 supplies a bounded production policy-composition helper but does not change the topology because the real Chromium extension transport/adapter remains absent. The new exact heads therefore strengthen executable evidence without changing the governing product architecture. -- **UML:** the existing extension-authority, sensitive-data/secret-fill, and product-wide authority views remain sufficient for the current material boundaries. #76 means the documentation must distinguish a real production policy-composition helper from a nonexistent Chromium extension transport adapter; no new actor or deployment edge exists yet. A detailed production adapter → semantic observation → typed policy/action → post-condition/recovery/resource sequence remains mandatory when that real browser-adapter composition boundary stabilizes. #73's CI `/proc` sampler is not that product boundary, and #75 is a pure policy primitive rather than a model/provider transport path. -- **ERD/data model:** none of #73–#76 introduces OriginWeave-owned durable persistence, ownership/cardinality changes, migrations, or rollback state. The conceptual ERD remains the truthful artifact; physical process-sample, extension-policy, model-route, broker, provider-policy, or export-policy tables would be invented architecture until a real persistence owner is accepted and implemented. -- **Security/test/release:** #73 fails closed on ambiguous Linux RSS evidence and has exact-current repository/coverage/pinned-browser GREEN proof. #74 removes a semantic overclaim exposed by review and has exact-current CI/Security/SAST GREEN proof. #75 has a realistic RED for the missing export dimension, a strict-Clippy-driven API correction without weakening gates, and exact-current Rust contracts plus exact owned-production coverage GREEN proof. #76 has exact-current Rust contracts and exact owned-production coverage GREEN proof for the policy-composition boundary. None of these active branches is protected-main or release evidence. -- **Traceability:** the earlier #73 `PARTIAL` classification and #74 predecessor-head wording are superseded by this dated appendix only for their exact-current active-PR state. #75 is tracked as exact-current non-shipped sensitive-data route/export-policy evidence, including its RED, strict-Clippy correction, and exact-current GREEN proof. #76 is tracked as exact-current non-shipped extension-policy composition evidence. If any recorded head moves, its evidence becomes historical immediately. +- **ADR:** no additional ADR is warranted by these corrections. #73 is an evidence-integrity refinement inside existing browser/resource contracts. #74 corrects a test/evidence overclaim and reinforces the already documented separation between extension permission and Agent authority. #75 adds the explicit export dimension already required by the sensitive-data/model-disclosure architecture without creating a new trust domain, deployed component, persistence owner, external protocol, fallback rule, or protected-value disclosure path. #76 and #78 implement policy-composition/provenance prerequisites inside Proposed ADR 0013's existing extension-authority boundary and likewise add no trust domain, deployed component, persistence owner, or binding transport protocol. #77 and #79 make the already-required selective-model-disclosure metadata contract executable by binding prompt/schema/token limits and invocation-policy expiry after exact route admission; neither creates the trusted broker, provider transport, clock authority, storage owner, or model-output lifecycle. Proposed ADR 0013 remains Proposed and is not promoted by branch presence, tests, CI, or policy-helper implementation. +- **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution, require browser/extension permission not to mint Agent capability/origin/approval/secret/execution authority, and require AI disclosure policy to bind model/provider/region/retention/export, bounded prompt/schema/tokens, expiry, and unrelated-history isolation independently from protected-value disclosure. #76 supplies a bounded production policy-composition helper and #78 forces raw extension proposal content into untrusted `WebContent` provenance, but neither changes topology because the real Chromium extension transport/adapter remains absent. #77/#79 strengthen deterministic model-invocation metadata admission without adding a provider/model transport or clock source. +- **UML:** the existing extension-authority, sensitive-data/secret-fill, and product-wide authority views remain sufficient for the current material boundaries. #76/#78 mean the documentation must distinguish production policy helpers from a nonexistent Chromium extension transport adapter. #77/#79 remain pure policy primitives: there is no new runtime actor or deployment edge until a trusted broker/orchestrator actually discloses values and invokes a provider. A detailed production adapter → semantic observation → typed policy/action → post-condition/recovery/resource sequence remains mandatory when that real browser-adapter composition boundary stabilizes. +- **ERD/data model:** none of #73–#79 introduces OriginWeave-owned durable persistence, ownership/cardinality changes, migrations, or rollback state. The conceptual ERD remains the truthful artifact; physical process-sample, extension-policy, model-route, model-invocation, broker, provider-policy, export-policy, or clock-authority tables would be invented architecture until a real persistence owner is accepted and implemented. +- **Security/test/release:** #73 fails closed on ambiguous Linux RSS evidence and has exact-current repository/coverage/pinned-browser GREEN proof. #74 removes a semantic overclaim exposed by review and has exact-current CI/Security/SAST GREEN proof. #75 has a realistic RED for the missing export dimension, a strict-Clippy-driven API correction without weakening gates, and exact-current Rust contracts plus exact owned-production coverage GREEN proof. #76, #77 and #78 have exact production Rust-contract/coverage proof on their stated exact heads. #79 has a realistic API-missing RED and a production GREEN on `39ec1659541b10785fcd85a9531bdd8d823578e3`; its changelog-only current head remains pending and is therefore not yet exact-current green evidence. None of these active branches is protected-main or release evidence. +- **Traceability:** the earlier #73 `PARTIAL` classification and #74 predecessor-head wording are superseded by this dated appendix only for their exact-current active-PR state. #75–#79 are tracked as exact-current non-shipped sensitive-data/model and extension-authority evidence with their explicit dependency boundaries and no transfer of predecessor-head success. If any recorded head moves, its evidence becomes historical immediately. ## Truth boundary -`IMPLEMENTED_ON_ACTIVE_PR` means the exact branch contains the stated behavior; it does not mean shipped, and a pending exact-head check is never treated as passing. A controlled Chromium runner is not the product browser adapter. A sampled Chromium process tree is not trusted whole-task ownership. An extension proposal grant is not an Agent action grant. Active PR #76 now contains a production helper that composes those two policy evaluations, but no current Chromium extension transport adapter constructs trusted `ActionRequest` provenance or executes that proposal. A model-route admission decision is not authorization to disclose a protected value, execute an export, authenticate a provider, attest a region, invoke a model, validate output, or authorize fallback. Protected-main maturity changes only after dependency-ordered integration and fresh protected-main acceptance. +`IMPLEMENTED_ON_ACTIVE_PR` means the exact branch contains the stated behavior; it does not mean shipped, and a pending exact-head check is never treated as passing. A controlled Chromium runner is not the product browser adapter. A sampled Chromium process tree is not trusted whole-task ownership. An extension proposal grant is not an Agent action grant. Active PR #76 composes extension proposal authority with ordinary Agent policy, and active PR #78 prevents the raw extension-message proposal object from selecting trusted instruction provenance, but no current Chromium extension transport adapter authenticates message provenance, executes the action, or supplies protected values. A model-route or model-invocation admission decision is not authorization to disclose a protected value, execute an export, authenticate or invoke a provider, attest a region or clock, validate output, retain data, isolate unrelated conversation history, or authorize fallback. Protected-main maturity changes only after dependency-ordered integration and fresh protected-main acceptance. From 0efbf36154ed6d9d5e54d9edccc59d2f6200e7eb Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 11 Aug 2026 21:16:56 +0900 Subject: [PATCH 129/130] docs: reconcile active maturity through PR 84 --- .../2026-08-11-active-pr-maturity-closure.md | 31 +++++++++++-------- 1 file changed, 18 insertions(+), 13 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-closure.md b/docs/evidence/2026-08-11-active-pr-maturity-closure.md index 6a752955..66091471 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-closure.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-closure.md @@ -2,7 +2,7 @@ - **Protected-main anchor:** `67af7c87589edc2039545af335c95064d9b8391c` - **Canonical documentation verdict:** **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL** -- **Scope:** exact-current reconciliation for PR #73 through PR #79 after their 2026-08-11 defect, review, policy-composition, and sensitive-model authority corrections +- **Scope:** exact-current reconciliation for PR #73 through PR #84 after their 2026-08-11 defect, review, policy-composition, browser-assurance, and sensitive-model authority corrections Protected `main` remains the only shipped-code authority. This appendix records volatile exact-head evidence for active work and must never be read as protected-main implementation or release evidence. @@ -12,23 +12,28 @@ Protected `main` remains the only shipped-code authority. This appendix records |---|---|---|---| | #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `e5fabfd57387ec7d2db692961eda93c95cf8d886`, stacked on unchanged #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`, restores the focused optional-RSS regression and implements `_parse_linux_proc_status_optional_rss_bytes`. Absent or zero `VmRSS` remains representable as nonresident sampled evidence; one positive field becomes bounded bytes; duplicate, malformed, or overflowed evidence fails closed rather than being normalized to absence. CI run `31464241922` succeeds, including Rust contracts job `93693702956` with exact-head checkout and Production coverage job `93693703022`; Manifest V3 Compatibility run `31464241924` also succeeds on the exact head. The PR remains Draft because #72/#71/#70/#65 are active prerequisites. This is controlled Linux CI evidence, not product task/process attribution, cgroup authority, per-tab ownership, GPU/VRAM attribution, or cross-platform resource telemetry. | | #74 | Separation of extension proposal-grant evaluation from ordinary Agent action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0d492564aa61c9094f1315ee4e234b46a1e63a6c` is based directly on protected main. A predecessor-head CodeRabbit review correctly identified that no production adapter currently converts an extension proposal into an `ActionRequest`; the former naming therefore implied a composition path that did not exist. The exact current head renames and documents the tests as independent boundaries: `evaluate_extension_access` may authorize the exact extension/session/context `ProposeTypedAction` grant while ordinary user-sourced requests remain independently fail-closed for cross-origin mutation, missing write authority, crawler mutation, execution-mode/purpose mismatch, robots evidence, non-delegable R5 consent, and Human mode. CI run `31464388199`, Security Scan run `31464388200`, and SAST Semgrep run `31464388210` all succeed on this exact head. The branch adds no extension-proposal adapter, action-source transformation, execution API, or new authority and therefore does not prove a real extension → Agent action composition path or close issue #27. | -| #75 | Exact sensitive-data provider/model/region/retention/training/reviewed-subprocessor/export route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact current head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, stacked on unchanged #69 head `de79d85e6be5131036db119efab767f0eb76a816`, extends the existing model-route authority with an explicit export-policy dimension while preserving the complete tenant/task/field/purpose/destination/classification authority. The ordinary constructor defaults to `no-export`; callers may select another bounded export-policy token through `with_export_policy`, but matching route metadata still does not authorize protected-value disclosure or perform export. Test-only head `90bde2dba675be10abb34a5c2a8bf03bb34abcdf` established the intended RED in CI run `31474208345`, Rust contracts job `93724057066`: repository contracts and formatting passed before `cargo check` failed with E0599 because export-policy APIs did not exist. Production head `88b1fd46b6d2e83411682f97aa17de95aca90789` made the tests GREEN but strict Clippy correctly rejected two eight-argument constructors; the API was then narrowed to the builder-style export selector rather than weakening lint policy. The current head contains that correction, adjusted realistic regressions, and the truthful changelog entry. Exact-current CI run `31474904239` succeeds, including Rust contracts job `93726313815` (repository contracts, formatting, locked workspace/all-target check, full tests, strict Clippy and rustdoc) and Production coverage job `93726313914` with exact owned production function/line/region/branch enforcement. No formal or inline review finding is returned for this exact head. The PR remains Draft because #69/#68/#55/#53/#46 are active prerequisites. Route admission is not raw-value disclosure, export execution, provider authentication, model invocation, real-region attestation, prompt/token-budget policy, output validation, fallback selection, persistence, or the complete trusted broker. | -| #76 | Production policy composition of extension proposal authority with ordinary typed-action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e`, stacked on unchanged #74 head `0d492564aa61c9094f1315ee4e234b46a1e63a6c`, adds `evaluate_extension_action_proposal` and `ExtensionProposalDecision`. The helper constructs the exact extension/session/context `ProposeTypedAction` access request and, only after that grant succeeds, evaluates the caller-supplied `ActionRequest` unchanged through ordinary Agent policy. It therefore preserves instruction-source, capability, origin, secret-delivery, risk, approval, execution-mode, purpose, and crawler controls instead of minting them from extension transport. CI run `31472688287` succeeds, including Rust contracts job `93719296349` and exact Production coverage job `93719296436`; no formal or inline review finding is returned for the exact head. The PR remains Draft while #74 is active. This is a pure policy-composition prerequisite: it does not parse or authenticate extension messages, create trusted instruction provenance, execute Chromium actions, disclose secrets, verify post-conditions, persist policy, alter managed-extension configuration, or close issue #27. | -| #77 | Reviewed prompt/output-schema and token-budget policy composed after exact sensitive-model route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `adb67f8de3e4828db14dfa0e2950b672b60709c5`, stacked on unchanged #75 head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, implements `ModelInvocationRequest`, `ModelInvocationScope`, `ModelInvocationDecision`, and `evaluate_model_invocation`. Exact route denial remains a distinct prerequisite; bounded prompt-contract/output-schema identifiers must match; requested and reviewed input/output token budgets must be nonzero; and requested budgets may not exceed reviewed maxima. Exact-head CI run `31477512549` succeeds, and no formal or inline review finding is currently returned for that head. The PR remains Draft because #75 and the sensitive-handle prerequisites remain active. This metadata admission does not disclose a protected value, authenticate or invoke a provider, validate model output, enforce retention, isolate unrelated history, authorize fallback/export, or provide invocation-policy expiry. | -| #78 | Raw extension-message action proposals are forced into untrusted content provenance before ordinary Agent policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3fd7d563d814a895e20d04fc6bd37371e548a875`, stacked on unchanged #76 head `3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e`, implements `ExtensionMessageActionProposal` and `evaluate_extension_message_action_proposal`. The raw proposal type exposes no instruction-source selector; after exact extension/session/context proposal permission succeeds, production constructs the ordinary `ActionRequest` internally with `InstructionSource::WebContent`. Exact-head CI run `31477648663` succeeds. No formal or inline review finding is returned for the head; CodeRabbit's Draft skip is explicitly not review approval. The branch does not parse Chromium messages, establish transport sender authenticity beyond the existing grant tuple, execute browser input, resolve secrets, verify post-conditions, persist managed-extension policy, or close issue #27. | -| #79 | Exclusive freshness/expiry for reviewed sensitive-model invocation metadata | **IMPLEMENTED_ON_ACTIVE_PR; exact-current CI pending** | Test-only head `eb7daf465f35b314b175a592cdb9d74962b64800`, stacked on exact #77 head `adb67f8de3e4828db14dfa0e2950b672b60709c5`, established the intended missing-boundary RED in CI run `31480649072`: repository contracts and formatting passed before Rust compilation failed because the production scope lacked `valid_until`, the evaluator lacked caller-supplied trusted time, and `InvocationExpired` did not exist. Production head `39ec1659541b10785fcd85a9531bdd8d823578e3` added a nonzero exclusive `valid_until`, caller-supplied `trusted_time`, and typed `InvocationExpired`; route denial remains first, malformed static invocation policy remains `InvocationPolicyMismatch`, and authorization requires `trusted_time < valid_until`. CI run `31480876883` succeeds on that exact production head, including Rust contracts and exact Production coverage. Current head `2ad7a2162b4842fe57f74f69f08b258f4f6a9c07` adds only the truthful changelog entry; CI run `31481128812` is currently in progress and therefore is not counted as passing exact-current evidence. The policy function reads no wall clock and does not attest clock provenance; the trusted broker/orchestrator must supply time from the same authoritative domain that issued expiry. This remains metadata freshness only, not protected-value disclosure, provider invocation, output validation, unrelated-history isolation, retention enforcement, fallback/export execution, or complete issue #10 closure. | +| #75 | Exact sensitive-data provider/model/region/retention/training/reviewed-subprocessor/export route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact current head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, stacked on unchanged #69 head `de79d85e6be5131036db119efab767f0eb76a816`, extends the existing model-route authority with an explicit export-policy dimension while preserving the complete tenant/task/field/purpose/destination/classification authority. The ordinary constructor defaults to `no-export`; callers may select another bounded export-policy token through `with_export_policy`, but matching route metadata still does not authorize protected-value disclosure or perform export. Test-only head `90bde2dba675be10abb34a5c2a8bf03bb34abcdf` established the intended RED in CI run `31474208345`, Rust contracts job `93724057066`: repository contracts and formatting passed before `cargo check` failed with E0599 because export-policy APIs did not exist. Production head `88b1fd46b6d2e83411682f97aa17de95aca90789` made the tests GREEN but strict Clippy correctly rejected two eight-argument constructors; the API was then narrowed to the builder-style export selector rather than weakening lint policy. The current head contains that correction, adjusted realistic regressions, and the truthful changelog entry. Exact-current CI run `31474904239` succeeds, including Rust contracts job `93726313815` and Production coverage job `93726313914` with exact owned production function/line/region/branch enforcement. The PR remains Draft because #69/#68/#55/#53/#46 are active prerequisites. Route admission is not raw-value disclosure, export execution, provider authentication, model invocation, real-region attestation, prompt/token-budget policy, output validation, fallback selection, persistence, or the complete trusted broker. | +| #76 | Production policy composition of extension proposal authority with ordinary typed-action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e`, stacked on unchanged #74 head `0d492564aa61c9094f1315ee4e234b46a1e63a6c`, adds `evaluate_extension_action_proposal` and `ExtensionProposalDecision`. The helper constructs the exact extension/session/context `ProposeTypedAction` access request and, only after that grant succeeds, evaluates the caller-supplied `ActionRequest` unchanged through ordinary Agent policy. It therefore preserves instruction-source, capability, origin, secret-delivery, risk, approval, execution-mode, purpose, and crawler controls instead of minting them from extension transport. CI run `31472688287` succeeds, including Rust contracts job `93719296349` and exact Production coverage job `93719296436`. The PR remains Draft while #74 is active. This is a pure policy-composition prerequisite: it does not parse or authenticate extension messages, create trusted instruction provenance, execute Chromium actions, disclose secrets, verify post-conditions, persist policy, alter managed-extension configuration, or close issue #27. | +| #77 | Reviewed prompt/output-schema and token-budget policy composed after exact sensitive-model route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `adb67f8de3e4828db14dfa0e2950b672b60709c5`, stacked on unchanged #75 head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, implements `ModelInvocationRequest`, `ModelInvocationScope`, `ModelInvocationDecision`, and `evaluate_model_invocation`. Exact route denial remains a distinct prerequisite; bounded prompt-contract/output-schema identifiers must match; requested and reviewed input/output token budgets must be nonzero; and requested budgets may not exceed reviewed maxima. Exact-head CI run `31477512549` succeeds. The PR remains Draft because #75 and the sensitive-handle prerequisites remain active. This metadata admission does not disclose a protected value, authenticate or invoke a provider, validate model output, enforce retention, isolate unrelated history, authorize fallback/export, or provide invocation-policy expiry. | +| #78 | Raw extension-message action proposals are forced into untrusted content provenance before ordinary Agent policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3fd7d563d814a895e20d04fc6bd37371e548a875`, stacked on unchanged #76 head `3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e`, implements `ExtensionMessageActionProposal` and `evaluate_extension_message_action_proposal`. The raw proposal type exposes no instruction-source selector; after exact extension/session/context proposal permission succeeds, production constructs the ordinary `ActionRequest` internally with `InstructionSource::WebContent`. Exact-head CI run `31477648663` succeeds. CodeRabbit's Draft skip is explicitly not review approval. The branch does not parse Chromium messages, establish transport sender authenticity beyond the existing grant tuple, execute browser input, resolve secrets, verify post-conditions, persist managed-extension policy, or close issue #27. | +| #79 | Exclusive freshness/expiry for reviewed sensitive-model invocation metadata | **IMPLEMENTED_ON_ACTIVE_PR** | Test-only head `eb7daf465f35b314b175a592cdb9d74962b64800`, stacked on exact #77 head `adb67f8de3e4828db14dfa0e2950b672b60709c5`, established the intended missing-boundary RED in CI run `31480649072`: repository contracts and formatting passed before Rust compilation failed because the production scope lacked `valid_until`, the evaluator lacked caller-supplied trusted time, and `InvocationExpired` did not exist. Production head `39ec1659541b10785fcd85a9531bdd8d823578e3` added a nonzero exclusive `valid_until`, caller-supplied `trusted_time`, and typed `InvocationExpired`; route denial remains first, malformed static invocation policy remains `InvocationPolicyMismatch`, and authorization requires `trusted_time < valid_until`. Exact current head `2ad7a2162b4842fe57f74f69f08b258f4f6a9c07` adds only the truthful changelog entry, and CI run `31481128812` is now completed successfully on that exact head. The policy function reads no wall clock and does not attest clock provenance; the trusted broker/orchestrator must supply time from the same authoritative domain that issued expiry. This remains metadata freshness only, not protected-value disclosure, provider invocation, output validation, unrelated-history isolation, retention enforcement, fallback/export execution, or complete issue #10 closure. | +| #80 | Origin-binding for node-state post-condition evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `55b1421e25c5b68ca5f3b05fab37db8f4f1e22be`, stacked on unchanged #64 head `2c45411ed9aa0eecca2d06c85659db9f4bb85e4d`, retains canonical source origin in provenance and rejects `NodeStateChanged` evidence from an origin other than the governed action target with `PostConditionOriginMismatch`; canonical-equivalent origins remain accepted. CI run `31485218503` succeeds. The PR remains Draft while #64 is active. This does not prove browser dispatch, frame/node identity, trusted-clock provenance, a real post-condition observer, redirect authority, or network attribution. | +| #81 | Fail-closed unrelated-conversation-history metadata for sensitive model invocation | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0ec604deb1c0293008560e0fcd4af7ccb65d93ad`, stacked on exact #79 head `2ad7a2162b4842fe57f74f69f08b258f4f6a9c07`, adds broker-derived `unrelated_history_items` to `ModelInvocationRequest`; only zero can be admitted after exact route admission and any positive count returns `UnrelatedConversationHistoryDenied`. CI run `31484982600` succeeds. The trusted broker must derive this fact from the bounded outgoing message set; a caller-provided zero is not proof of isolation. The branch does not inspect message payloads, classify relevance, disclose protected values, invoke a provider, validate output, enforce retention, or complete issue #10. | +| #82 | Explicit extension-ID + native-messaging-host allow-list authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `28593cf991cc552968da54b722a887252a3695e7` is directly based on protected main. It adds Chromium-compatible native-host-name validation, exact extension/host grants, typed missing-grant and identity-mismatch denial, and proves that native-messaging permission does not mint OriginWeave Agent capability. CI run `31484721598`, Manifest V3 Compatibility run `31484721575`, Security Scan run `31484721547`, and SAST Semgrep run `31484721542` all succeed. The PR is Ready for review but this scheduled actor cannot merge or self-approve it. The primitive does not launch/locate a native process, parse manifests/messages, communicate over stdio, expose secrets, or grant Agent actions. | +| #83 | Reduced-assurance classification for attached human tabs with known extension influence | **IMPLEMENTED_ON_ACTIVE_PR; exact-current CI pending** | The prior exact production head `231996f6db978c586207bd38596ebfc352dd54b2` implemented the narrow classifier but named the no-positive-evidence variant `NoExtensionInfluence`, which overstated the documented truth boundary. Test-only correction head `292736fc8a697292e4ec49224b4c43f673ac1de9` requires `NoKnownExtensionInfluence`; CI run `31489921146` observed the intended RED at the Rust workspace check while repository contracts and formatting passed. Exact current production head `f6d57f86e2cbea70144f3b7504bc929e20d60233` renames the public variant and explicitly documents that absence of known influence is not proof of extension absence or inability to interfere. Current CI run `31490346830` and Manifest V3 Compatibility run `31490346837` are queued and therefore are not counted as passing. The live base branch #82 has advanced to `28593cf991cc552968da54b722a887252a3695e7`; ancestry diverges from the older stack point because #82 added a coverage-only native-host test correction that #83 already contains content-equivalently, so dependency integration still requires fresh exact-base verification. This lane does not detect installed extensions, inspect managed policy, prove extension absence, attach to a browser, execute actions, or grant Agent authority. | +| #84 | Separate validated model-output and retention-policy admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `62f69cadbe0b4011fec67f9e482b04c4cacf181b`, stacked on unchanged #81 head `0ec604deb1c0293008560e0fcd4af7ccb65d93ad`, requires exact reviewed output-schema and retention-policy identifiers plus a trusted validation result before output authorization. Test-only head `32af45f2525f17fa1dbae50f59e4641999a50695` established the missing-API RED; a production attempt then exposed one uncovered identifier-validation branch, and the focused punctuation-only regression restored exact production branch coverage. Exact-head CI run `31487969844` succeeds, including Rust contracts job `93767614892` and Production coverage job `93767614791`. This is deterministic metadata policy only: it does not inspect output bytes, perform schema validation, authenticate/invoke a provider, persist output, enforce deletion/retention, authorize invocation, disclose protected values, select fallback, or attest validator identity. | ## Documentation-fitness reconciliation The repository-wide documentation verdict remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. -- **ADR:** no additional ADR is warranted by these corrections. #73 is an evidence-integrity refinement inside existing browser/resource contracts. #74 corrects a test/evidence overclaim and reinforces the already documented separation between extension permission and Agent authority. #75 adds the explicit export dimension already required by the sensitive-data/model-disclosure architecture without creating a new trust domain, deployed component, persistence owner, external protocol, fallback rule, or protected-value disclosure path. #76 and #78 implement policy-composition/provenance prerequisites inside Proposed ADR 0013's existing extension-authority boundary and likewise add no trust domain, deployed component, persistence owner, or binding transport protocol. #77 and #79 make the already-required selective-model-disclosure metadata contract executable by binding prompt/schema/token limits and invocation-policy expiry after exact route admission; neither creates the trusted broker, provider transport, clock authority, storage owner, or model-output lifecycle. Proposed ADR 0013 remains Proposed and is not promoted by branch presence, tests, CI, or policy-helper implementation. -- **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution, require browser/extension permission not to mint Agent capability/origin/approval/secret/execution authority, and require AI disclosure policy to bind model/provider/region/retention/export, bounded prompt/schema/tokens, expiry, and unrelated-history isolation independently from protected-value disclosure. #76 supplies a bounded production policy-composition helper and #78 forces raw extension proposal content into untrusted `WebContent` provenance, but neither changes topology because the real Chromium extension transport/adapter remains absent. #77/#79 strengthen deterministic model-invocation metadata admission without adding a provider/model transport or clock source. -- **UML:** the existing extension-authority, sensitive-data/secret-fill, and product-wide authority views remain sufficient for the current material boundaries. #76/#78 mean the documentation must distinguish production policy helpers from a nonexistent Chromium extension transport adapter. #77/#79 remain pure policy primitives: there is no new runtime actor or deployment edge until a trusted broker/orchestrator actually discloses values and invokes a provider. A detailed production adapter → semantic observation → typed policy/action → post-condition/recovery/resource sequence remains mandatory when that real browser-adapter composition boundary stabilizes. -- **ERD/data model:** none of #73–#79 introduces OriginWeave-owned durable persistence, ownership/cardinality changes, migrations, or rollback state. The conceptual ERD remains the truthful artifact; physical process-sample, extension-policy, model-route, model-invocation, broker, provider-policy, export-policy, or clock-authority tables would be invented architecture until a real persistence owner is accepted and implemented. -- **Security/test/release:** #73 fails closed on ambiguous Linux RSS evidence and has exact-current repository/coverage/pinned-browser GREEN proof. #74 removes a semantic overclaim exposed by review and has exact-current CI/Security/SAST GREEN proof. #75 has a realistic RED for the missing export dimension, a strict-Clippy-driven API correction without weakening gates, and exact-current Rust contracts plus exact owned-production coverage GREEN proof. #76, #77 and #78 have exact production Rust-contract/coverage proof on their stated exact heads. #79 has a realistic API-missing RED and a production GREEN on `39ec1659541b10785fcd85a9531bdd8d823578e3`; its changelog-only current head remains pending and is therefore not yet exact-current green evidence. None of these active branches is protected-main or release evidence. -- **Traceability:** the earlier #73 `PARTIAL` classification and #74 predecessor-head wording are superseded by this dated appendix only for their exact-current active-PR state. #75–#79 are tracked as exact-current non-shipped sensitive-data/model and extension-authority evidence with their explicit dependency boundaries and no transfer of predecessor-head success. If any recorded head moves, its evidence becomes historical immediately. +- **ADR:** no additional ADR is warranted by #73–#84. #73/#80 refine evidence integrity inside existing browser contracts. #74/#76/#78/#82/#83 refine Proposed ADR 0013's extension/Agent authority separation without creating a new trust domain, deployed component, persistence owner, or binding transport protocol. #75/#77/#79/#81/#84 make existing selective-model-disclosure architecture more executable while leaving the trusted broker, provider transport, authenticated runtime identities, validator, retention owner, storage, and clock authority outside these pure policy primitives. Proposed ADR 0013 remains Proposed and is not promoted by branch presence, tests, CI, or policy-helper implementation. +- **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution, browser/extension permission not to mint Agent capability/origin/approval/secret/execution authority, attached human-tab extension influence to reduce assurance without turning absence of known evidence into a high-assurance claim, and AI disclosure policy to bind route, prompt/schema/tokens, expiry, unrelated-history isolation, output validation and retention independently from protected-value disclosure. These active branches strengthen those boundaries without changing deployed topology. +- **UML:** existing extension-authority, sensitive-data/secret-fill, evidence, and product-wide authority views remain sufficient for the current material boundaries. No current branch adds a real Chromium extension transport/native-host adapter or a trusted sensitive-data broker/provider/validator/retention service. A detailed production adapter → semantic observation → typed policy/action → post-condition/recovery/resource sequence remains mandatory when that real browser-adapter composition boundary stabilizes. +- **ERD/data model:** none of #73–#84 introduces OriginWeave-owned durable persistence, ownership/cardinality changes, migrations, or rollback state. The conceptual ERD remains the truthful artifact; physical process-sample, extension-policy, native-host, assurance, model-route, invocation, output-policy, broker, provider, validator, retention, or clock tables would be invented architecture until a real persistence owner is accepted and implemented. +- **Security/test/release:** #73–#82 and #84 have exact-current GREEN evidence on the heads stated above. #83 has a realistic exact RED proving the uncertainty-safe API name was missing and a narrow production correction on current head `f6d57f86e2cbea70144f3b7504bc929e20d60233`; its current checks are pending and therefore are not passing evidence. None of these active branches is protected-main or release evidence, and no predecessor-head success transfers after a head or live base moves. +- **Traceability:** this appendix supersedes its earlier #79 pending-CI wording and extends exact-current non-shipped evidence through #84. If any recorded head or dependency moves, that evidence becomes historical immediately and must be refetched before use. ## Truth boundary -`IMPLEMENTED_ON_ACTIVE_PR` means the exact branch contains the stated behavior; it does not mean shipped, and a pending exact-head check is never treated as passing. A controlled Chromium runner is not the product browser adapter. A sampled Chromium process tree is not trusted whole-task ownership. An extension proposal grant is not an Agent action grant. Active PR #76 composes extension proposal authority with ordinary Agent policy, and active PR #78 prevents the raw extension-message proposal object from selecting trusted instruction provenance, but no current Chromium extension transport adapter authenticates message provenance, executes the action, or supplies protected values. A model-route or model-invocation admission decision is not authorization to disclose a protected value, execute an export, authenticate or invoke a provider, attest a region or clock, validate output, retain data, isolate unrelated conversation history, or authorize fallback. Protected-main maturity changes only after dependency-ordered integration and fresh protected-main acceptance. +`IMPLEMENTED_ON_ACTIVE_PR` means the exact branch contains the stated behavior; it does not mean shipped, and a pending exact-head check is never treated as passing. A controlled Chromium runner is not the product browser adapter. A sampled Chromium process tree is not trusted whole-task ownership. An extension proposal or native-host grant is not an Agent action grant. A no-known-influence result is not proof that extensions are absent or unable to affect page state. A model-route, invocation, context-isolation, or output-policy admission decision is not authorization to disclose a protected value, execute an export, authenticate or invoke a provider, attest a region or clock, inspect/validate output bytes, retain/delete data, prove unrelated-history isolation, or authorize fallback. Protected-main maturity changes only after dependency-ordered integration and fresh protected-main acceptance. From edbc20a9dcb9c3e278da87a9f77aa5d0bc774bd9 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 12 Aug 2026 04:09:33 +0900 Subject: [PATCH 130/130] docs: reconcile active PR maturity through 92 --- .../2026-08-11-active-pr-maturity-closure.md | 51 +++++++++++-------- 1 file changed, 30 insertions(+), 21 deletions(-) diff --git a/docs/evidence/2026-08-11-active-pr-maturity-closure.md b/docs/evidence/2026-08-11-active-pr-maturity-closure.md index 66091471..afbb92ba 100644 --- a/docs/evidence/2026-08-11-active-pr-maturity-closure.md +++ b/docs/evidence/2026-08-11-active-pr-maturity-closure.md @@ -2,38 +2,47 @@ - **Protected-main anchor:** `67af7c87589edc2039545af335c95064d9b8391c` - **Canonical documentation verdict:** **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL** -- **Scope:** exact-current reconciliation for PR #73 through PR #84 after their 2026-08-11 defect, review, policy-composition, browser-assurance, and sensitive-model authority corrections +- **Last exact-current reconciliation:** 2026-08-12 +- **Scope:** volatile active-PR evidence for PR #73 through PR #92, preserving protected-main truth separately from branch-local implementation evidence -Protected `main` remains the only shipped-code authority. This appendix records volatile exact-head evidence for active work and must never be read as protected-main implementation or release evidence. +Protected `main` remains the only shipped-code authority. This appendix records volatile exact-head evidence for active work and must never be read as protected-main implementation, approval, merge, or release evidence. A moved head or prerequisite invalidates the corresponding exact evidence until refetched. ## Exact-current active lanes | PR | Scope | Maturity | Exact evidence / authority boundary | |---|---|---|---| -| #73 | Bounded Chromium root-plus-descendant RSS evidence in the controlled pinned-browser fixture | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `e5fabfd57387ec7d2db692961eda93c95cf8d886`, stacked on unchanged #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`, restores the focused optional-RSS regression and implements `_parse_linux_proc_status_optional_rss_bytes`. Absent or zero `VmRSS` remains representable as nonresident sampled evidence; one positive field becomes bounded bytes; duplicate, malformed, or overflowed evidence fails closed rather than being normalized to absence. CI run `31464241922` succeeds, including Rust contracts job `93693702956` with exact-head checkout and Production coverage job `93693703022`; Manifest V3 Compatibility run `31464241924` also succeeds on the exact head. The PR remains Draft because #72/#71/#70/#65 are active prerequisites. This is controlled Linux CI evidence, not product task/process attribution, cgroup authority, per-tab ownership, GPU/VRAM attribution, or cross-platform resource telemetry. | -| #74 | Separation of extension proposal-grant evaluation from ordinary Agent action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0d492564aa61c9094f1315ee4e234b46a1e63a6c` is based directly on protected main. A predecessor-head CodeRabbit review correctly identified that no production adapter currently converts an extension proposal into an `ActionRequest`; the former naming therefore implied a composition path that did not exist. The exact current head renames and documents the tests as independent boundaries: `evaluate_extension_access` may authorize the exact extension/session/context `ProposeTypedAction` grant while ordinary user-sourced requests remain independently fail-closed for cross-origin mutation, missing write authority, crawler mutation, execution-mode/purpose mismatch, robots evidence, non-delegable R5 consent, and Human mode. CI run `31464388199`, Security Scan run `31464388200`, and SAST Semgrep run `31464388210` all succeed on this exact head. The branch adds no extension-proposal adapter, action-source transformation, execution API, or new authority and therefore does not prove a real extension → Agent action composition path or close issue #27. | -| #75 | Exact sensitive-data provider/model/region/retention/training/reviewed-subprocessor/export route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact current head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, stacked on unchanged #69 head `de79d85e6be5131036db119efab767f0eb76a816`, extends the existing model-route authority with an explicit export-policy dimension while preserving the complete tenant/task/field/purpose/destination/classification authority. The ordinary constructor defaults to `no-export`; callers may select another bounded export-policy token through `with_export_policy`, but matching route metadata still does not authorize protected-value disclosure or perform export. Test-only head `90bde2dba675be10abb34a5c2a8bf03bb34abcdf` established the intended RED in CI run `31474208345`, Rust contracts job `93724057066`: repository contracts and formatting passed before `cargo check` failed with E0599 because export-policy APIs did not exist. Production head `88b1fd46b6d2e83411682f97aa17de95aca90789` made the tests GREEN but strict Clippy correctly rejected two eight-argument constructors; the API was then narrowed to the builder-style export selector rather than weakening lint policy. The current head contains that correction, adjusted realistic regressions, and the truthful changelog entry. Exact-current CI run `31474904239` succeeds, including Rust contracts job `93726313815` and Production coverage job `93726313914` with exact owned production function/line/region/branch enforcement. The PR remains Draft because #69/#68/#55/#53/#46 are active prerequisites. Route admission is not raw-value disclosure, export execution, provider authentication, model invocation, real-region attestation, prompt/token-budget policy, output validation, fallback selection, persistence, or the complete trusted broker. | -| #76 | Production policy composition of extension proposal authority with ordinary typed-action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e`, stacked on unchanged #74 head `0d492564aa61c9094f1315ee4e234b46a1e63a6c`, adds `evaluate_extension_action_proposal` and `ExtensionProposalDecision`. The helper constructs the exact extension/session/context `ProposeTypedAction` access request and, only after that grant succeeds, evaluates the caller-supplied `ActionRequest` unchanged through ordinary Agent policy. It therefore preserves instruction-source, capability, origin, secret-delivery, risk, approval, execution-mode, purpose, and crawler controls instead of minting them from extension transport. CI run `31472688287` succeeds, including Rust contracts job `93719296349` and exact Production coverage job `93719296436`. The PR remains Draft while #74 is active. This is a pure policy-composition prerequisite: it does not parse or authenticate extension messages, create trusted instruction provenance, execute Chromium actions, disclose secrets, verify post-conditions, persist policy, alter managed-extension configuration, or close issue #27. | -| #77 | Reviewed prompt/output-schema and token-budget policy composed after exact sensitive-model route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `adb67f8de3e4828db14dfa0e2950b672b60709c5`, stacked on unchanged #75 head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, implements `ModelInvocationRequest`, `ModelInvocationScope`, `ModelInvocationDecision`, and `evaluate_model_invocation`. Exact route denial remains a distinct prerequisite; bounded prompt-contract/output-schema identifiers must match; requested and reviewed input/output token budgets must be nonzero; and requested budgets may not exceed reviewed maxima. Exact-head CI run `31477512549` succeeds. The PR remains Draft because #75 and the sensitive-handle prerequisites remain active. This metadata admission does not disclose a protected value, authenticate or invoke a provider, validate model output, enforce retention, isolate unrelated history, authorize fallback/export, or provide invocation-policy expiry. | -| #78 | Raw extension-message action proposals are forced into untrusted content provenance before ordinary Agent policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3fd7d563d814a895e20d04fc6bd37371e548a875`, stacked on unchanged #76 head `3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e`, implements `ExtensionMessageActionProposal` and `evaluate_extension_message_action_proposal`. The raw proposal type exposes no instruction-source selector; after exact extension/session/context proposal permission succeeds, production constructs the ordinary `ActionRequest` internally with `InstructionSource::WebContent`. Exact-head CI run `31477648663` succeeds. CodeRabbit's Draft skip is explicitly not review approval. The branch does not parse Chromium messages, establish transport sender authenticity beyond the existing grant tuple, execute browser input, resolve secrets, verify post-conditions, persist managed-extension policy, or close issue #27. | -| #79 | Exclusive freshness/expiry for reviewed sensitive-model invocation metadata | **IMPLEMENTED_ON_ACTIVE_PR** | Test-only head `eb7daf465f35b314b175a592cdb9d74962b64800`, stacked on exact #77 head `adb67f8de3e4828db14dfa0e2950b672b60709c5`, established the intended missing-boundary RED in CI run `31480649072`: repository contracts and formatting passed before Rust compilation failed because the production scope lacked `valid_until`, the evaluator lacked caller-supplied trusted time, and `InvocationExpired` did not exist. Production head `39ec1659541b10785fcd85a9531bdd8d823578e3` added a nonzero exclusive `valid_until`, caller-supplied `trusted_time`, and typed `InvocationExpired`; route denial remains first, malformed static invocation policy remains `InvocationPolicyMismatch`, and authorization requires `trusted_time < valid_until`. Exact current head `2ad7a2162b4842fe57f74f69f08b258f4f6a9c07` adds only the truthful changelog entry, and CI run `31481128812` is now completed successfully on that exact head. The policy function reads no wall clock and does not attest clock provenance; the trusted broker/orchestrator must supply time from the same authoritative domain that issued expiry. This remains metadata freshness only, not protected-value disclosure, provider invocation, output validation, unrelated-history isolation, retention enforcement, fallback/export execution, or complete issue #10 closure. | -| #80 | Origin-binding for node-state post-condition evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `55b1421e25c5b68ca5f3b05fab37db8f4f1e22be`, stacked on unchanged #64 head `2c45411ed9aa0eecca2d06c85659db9f4bb85e4d`, retains canonical source origin in provenance and rejects `NodeStateChanged` evidence from an origin other than the governed action target with `PostConditionOriginMismatch`; canonical-equivalent origins remain accepted. CI run `31485218503` succeeds. The PR remains Draft while #64 is active. This does not prove browser dispatch, frame/node identity, trusted-clock provenance, a real post-condition observer, redirect authority, or network attribution. | -| #81 | Fail-closed unrelated-conversation-history metadata for sensitive model invocation | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0ec604deb1c0293008560e0fcd4af7ccb65d93ad`, stacked on exact #79 head `2ad7a2162b4842fe57f74f69f08b258f4f6a9c07`, adds broker-derived `unrelated_history_items` to `ModelInvocationRequest`; only zero can be admitted after exact route admission and any positive count returns `UnrelatedConversationHistoryDenied`. CI run `31484982600` succeeds. The trusted broker must derive this fact from the bounded outgoing message set; a caller-provided zero is not proof of isolation. The branch does not inspect message payloads, classify relevance, disclose protected values, invoke a provider, validate output, enforce retention, or complete issue #10. | -| #82 | Explicit extension-ID + native-messaging-host allow-list authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `28593cf991cc552968da54b722a887252a3695e7` is directly based on protected main. It adds Chromium-compatible native-host-name validation, exact extension/host grants, typed missing-grant and identity-mismatch denial, and proves that native-messaging permission does not mint OriginWeave Agent capability. CI run `31484721598`, Manifest V3 Compatibility run `31484721575`, Security Scan run `31484721547`, and SAST Semgrep run `31484721542` all succeed. The PR is Ready for review but this scheduled actor cannot merge or self-approve it. The primitive does not launch/locate a native process, parse manifests/messages, communicate over stdio, expose secrets, or grant Agent actions. | -| #83 | Reduced-assurance classification for attached human tabs with known extension influence | **IMPLEMENTED_ON_ACTIVE_PR; exact-current CI pending** | The prior exact production head `231996f6db978c586207bd38596ebfc352dd54b2` implemented the narrow classifier but named the no-positive-evidence variant `NoExtensionInfluence`, which overstated the documented truth boundary. Test-only correction head `292736fc8a697292e4ec49224b4c43f673ac1de9` requires `NoKnownExtensionInfluence`; CI run `31489921146` observed the intended RED at the Rust workspace check while repository contracts and formatting passed. Exact current production head `f6d57f86e2cbea70144f3b7504bc929e20d60233` renames the public variant and explicitly documents that absence of known influence is not proof of extension absence or inability to interfere. Current CI run `31490346830` and Manifest V3 Compatibility run `31490346837` are queued and therefore are not counted as passing. The live base branch #82 has advanced to `28593cf991cc552968da54b722a887252a3695e7`; ancestry diverges from the older stack point because #82 added a coverage-only native-host test correction that #83 already contains content-equivalently, so dependency integration still requires fresh exact-base verification. This lane does not detect installed extensions, inspect managed policy, prove extension absence, attach to a browser, execute actions, or grant Agent authority. | -| #84 | Separate validated model-output and retention-policy admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `62f69cadbe0b4011fec67f9e482b04c4cacf181b`, stacked on unchanged #81 head `0ec604deb1c0293008560e0fcd4af7ccb65d93ad`, requires exact reviewed output-schema and retention-policy identifiers plus a trusted validation result before output authorization. Test-only head `32af45f2525f17fa1dbae50f59e4641999a50695` established the missing-API RED; a production attempt then exposed one uncovered identifier-validation branch, and the focused punctuation-only regression restored exact production branch coverage. Exact-head CI run `31487969844` succeeds, including Rust contracts job `93767614892` and Production coverage job `93767614791`. This is deterministic metadata policy only: it does not inspect output bytes, perform schema validation, authenticate/invoke a provider, persist output, enforce deletion/retention, authorize invocation, disclose protected values, select fallback, or attest validator identity. | +| #73 | Bounded Chromium process-tree RSS evidence in the controlled pinned-browser fixture | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `e5fabfd57387ec7d2db692961eda93c95cf8d886`, stacked on #72 head `1a7186085abe926c1d0e5b22c36760965d6e237b`; CI `31464241922` and Manifest V3 Compatibility `31464241924` succeeded. Optional/nonresident `VmRSS` remains representable while malformed/ambiguous evidence fails closed. This is controlled Linux CI evidence, not trusted whole-task process attribution, cgroup authority, GPU/VRAM ownership, or cross-platform telemetry. | +| #74 | Separation of extension proposal-grant evaluation from ordinary Agent action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0d492564aa61c9094f1315ee4e234b46a1e63a6c`, directly based on protected main; CI `31464388199`, Security Scan `31464388200`, and SAST Semgrep `31464388210` succeeded. The branch proves independent fail-closed evaluators and does not claim a real extension-message → `ActionRequest` adapter. | +| #75 | Exact sensitive-model route admission across provider/model/region/retention/training/subprocessor/export policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `286f92aae9e298ab7dff1fd81c7850aabd5692ce`, stacked on #69; CI `31474904239` succeeded with exact owned production coverage. Route admission remains metadata policy only and does not disclose protected values, authenticate/invoke a provider, attest runtime region, or execute export. | +| #76 | Extension proposal authority composed with ordinary typed-action policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e`, stacked on #74; CI `31472688287` succeeded. `evaluate_extension_action_proposal` preserves ordinary instruction-source, capability, origin, secret-delivery, risk, approval, mode, purpose, and crawler policy instead of minting them from extension transport. No Chromium message adapter or browser execution is claimed. | +| #77 | Reviewed prompt/output-schema and token-budget policy after exact model-route admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `adb67f8de3e4828db14dfa0e2950b672b60709c5`, stacked on #75; CI `31477512549` succeeded. This is invocation metadata admission, not protected-value disclosure, provider execution, output validation, retention enforcement, fallback, or export. | +| #78 | Raw extension-message action proposals forced into untrusted content provenance | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3fd7d563d814a895e20d04fc6bd37371e548a875`, stacked on #76; CI `31477648663` succeeded. The raw proposal exposes no instruction-source selector and is internally classified as `InstructionSource::WebContent`; no transport parsing/authentication or browser execution is claimed. | +| #79 | Exclusive freshness for reviewed model-invocation policy | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `2ad7a2162b4842fe57f74f69f08b258f4f6a9c07`, stacked on #77; CI `31481128812` succeeded. Authorization requires caller-supplied trusted time before the exclusive `valid_until` deadline; this pure policy layer does not read or attest a clock. | +| #80 | Origin-binding for node-state post-condition evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `55b1421e25c5b68ca5f3b05fab37db8f4f1e22be`, stacked on #64; CI `31485218503` succeeded. `NodeStateChanged` provenance must match the governed target origin. This does not prove browser dispatch, node/frame identity, trusted clock provenance, or a real observer. | +| #81 | Fail-closed unrelated-conversation-history metadata for sensitive model invocation | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `0ec604deb1c0293008560e0fcd4af7ccb65d93ad`, stacked on #79; CI `31484982600` succeeded. Any positive `unrelated_history_items` count is denied. The trusted broker must derive this from the actual bounded outgoing message set; a supplied zero is not proof of isolation. | +| #82 | Exact extension-ID + native-messaging-host allow-list authority | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `28593cf991cc552968da54b722a887252a3695e7`, directly based on protected main; CI `31484721598`, Manifest V3 Compatibility `31484721575`, Security Scan `31484721547`, and SAST Semgrep `31484721542` succeeded. The primitive does not launch a process, parse native-host manifests/messages, communicate over stdio, expose secrets, or grant Agent actions. | +| #83 | Reduced-assurance classification for attached human tabs with known extension influence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `f6d57f86e2cbea70144f3b7504bc929e20d60233`; CI `31490346830` and Manifest V3 Compatibility `31490346837` succeeded. `NoKnownExtensionInfluence` is explicitly uncertainty-safe and is not proof that extensions are absent or unable to interfere. The PR remains stacked on active #82 and does not detect installed extensions or attach to a browser. | +| #84 | Separate model-output validation and retention-policy admission | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `62f69cadbe0b4011fec67f9e482b04c4cacf181b`, stacked on #81; CI `31487969844` succeeded with exact owned production coverage. This is deterministic metadata policy only; it does not inspect output bytes, execute schema validation, persist output, enforce deletion/retention, or attest validator identity. | +| #85 | Managed extension admission for isolated Agent Task profiles | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `a0d767377a737b656ca8d095057b39be76b98a6a`, stacked on #83; CI `31492800416` succeeded with exact owned production coverage. `AgentTaskExtensionPolicy` admits only exact canonical extension IDs and an empty policy denies all. Admission does not install/enable an extension, read enterprise policy, verify signatures/update provenance, mutate a profile, or mint any Agent capability. | +| #86 | Fail-closed sensitive-model fallback selection | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `a2c391a5e038dc9e3d6978885d9bdd943487294f`, stacked on #84; CI `31495714541` succeeded with exact owned production coverage. Primary route-policy mismatch and unknown/unreviewed fallback fail closed; only a separately reviewed exact fallback route can be selected. This does not probe provider health, invoke models, or execute retries. | +| #87 | Freshness lifetime for model-route availability evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `b1273d7bc34fffee262be4bd2da24c24520d11db`, stacked on #86; CI `31500975874` succeeded with exact owned production coverage. Availability uses an exclusive validity horizon and caller-supplied trusted time; stale or invalid availability cannot drive fallback. The policy does not establish collection time or clock/provider-health provenance. | +| #88 | Exact route binding for fallback availability evidence | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `121d9d70d6c5592b9dff06d7ba09ee563958bfef`, stacked on #87; CI `31505770116` succeeded. Availability evidence retains the exact provider/model/region/retention/training/subprocessor/export route it describes; cross-route replay fails closed before freshness/state can influence fallback. Runtime route authenticity remains a trusted-adapter responsibility. | +| #89 | Full-field sensitive-model disclosure authority composition | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `f2fbcae3f07cad722f43580aa5be0b4e691d2a9c`, stacked on #88; CI `31510796392` succeeded with exact owned production coverage. Only explicit `FullFieldDisclosure` plus the same complete sensitive-data authority and independently authorized model invocation can yield metadata-level authorization. No protected bytes are carried or released by this primitive. | +| #90 | Explicit necessity gate for full-field model disclosure | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `166d68bc8e42f41fcd21965609af222e69fd3d4c`, stacked on #89; CI `31517056344` succeeded with exact owned production coverage. `LowerDisclosurePathAvailable` fails closed for handle/deterministic/local-rule/structured-tool/derived-value alternatives. A caller-supplied necessity value is not proof; a trusted broker must derive necessity immediately before protected-value resolution. | +| #91 | Credential-free sensitive-model disclosure audit metadata | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `3a33f83af7398038a2581e2e132fabf7183b17af`, stacked on #45; CI `31522457974` succeeded and CodeRabbit exact-head status is successful. Evidence records only bounded reviewed provider/model/region/retention/training/subprocessor/export identifiers linked to sensitive-data request/decision IDs. It does not authorize disclosure, prove runtime behavior, or provide durable/tamper-evident audit sequencing. | +| #92 | Fresh resolution authority required for redirect authorization | **IMPLEMENTED_ON_ACTIVE_PR** | Exact head `b796564d059f7bcbd8177617b6fd46c6edc7dda1`, stacked on #47; CI `31524574783` succeeded with exact owned production coverage. `RedirectGuard::authorize_redirect` requires `FreshResolutionSnapshot` plus caller-supplied trusted monotonic time and rejects pre-approval/expired authority before redirect-chain mutation. It performs no DNS lookup, socket I/O, HTTP redirect following, or clock attestation. | ## Documentation-fitness reconciliation The repository-wide documentation verdict remains **DESIGN-SUFFICIENT / PROTECTED-MAIN-PARTIAL**. -- **ADR:** no additional ADR is warranted by #73–#84. #73/#80 refine evidence integrity inside existing browser contracts. #74/#76/#78/#82/#83 refine Proposed ADR 0013's extension/Agent authority separation without creating a new trust domain, deployed component, persistence owner, or binding transport protocol. #75/#77/#79/#81/#84 make existing selective-model-disclosure architecture more executable while leaving the trusted broker, provider transport, authenticated runtime identities, validator, retention owner, storage, and clock authority outside these pure policy primitives. Proposed ADR 0013 remains Proposed and is not promoted by branch presence, tests, CI, or policy-helper implementation. -- **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution, browser/extension permission not to mint Agent capability/origin/approval/secret/execution authority, attached human-tab extension influence to reduce assurance without turning absence of known evidence into a high-assurance claim, and AI disclosure policy to bind route, prompt/schema/tokens, expiry, unrelated-history isolation, output validation and retention independently from protected-value disclosure. These active branches strengthen those boundaries without changing deployed topology. -- **UML:** existing extension-authority, sensitive-data/secret-fill, evidence, and product-wide authority views remain sufficient for the current material boundaries. No current branch adds a real Chromium extension transport/native-host adapter or a trusted sensitive-data broker/provider/validator/retention service. A detailed production adapter → semantic observation → typed policy/action → post-condition/recovery/resource sequence remains mandatory when that real browser-adapter composition boundary stabilizes. -- **ERD/data model:** none of #73–#84 introduces OriginWeave-owned durable persistence, ownership/cardinality changes, migrations, or rollback state. The conceptual ERD remains the truthful artifact; physical process-sample, extension-policy, native-host, assurance, model-route, invocation, output-policy, broker, provider, validator, retention, or clock tables would be invented architecture until a real persistence owner is accepted and implemented. -- **Security/test/release:** #73–#82 and #84 have exact-current GREEN evidence on the heads stated above. #83 has a realistic exact RED proving the uncertainty-safe API name was missing and a narrow production correction on current head `f6d57f86e2cbea70144f3b7504bc929e20d60233`; its current checks are pending and therefore are not passing evidence. None of these active branches is protected-main or release evidence, and no predecessor-head success transfers after a head or live base moves. -- **Traceability:** this appendix supersedes its earlier #79 pending-CI wording and extends exact-current non-shipped evidence through #84. If any recorded head or dependency moves, that evidence becomes historical immediately and must be refetched before use. +- **ADR:** no additional ADR is warranted solely by #73–#92. The browser/extension slices refine the authority separation already represented by Proposed ADR 0013; the sensitive-model slices make existing selective-disclosure architecture more executable without introducing a deployed broker/provider/validator/retention service, persistence owner, or new binding protocol. Proposed ADR 0013 remains Proposed; branch presence, CI, and policy helpers do not promote it. Proposed ADR 0014 likewise remains Proposed until an explicit lifecycle transition is recorded under repository governance. +- **PRD/TRD/Architecture:** current contracts already require resource evidence to remain distinct from trusted attribution; extension/browser permission not to mint Agent capability, origin, approval, secret, execution, or native-host authority; attached-tab extension influence to reduce assurance without converting absence of known evidence into high assurance; resolution freshness immediately before network/redirect use; and AI disclosure to bind necessity, authority, exact route, prompt/schema/tokens, expiry, conversation isolation, fallback availability/route, output validation, retention, and credential-free audit metadata independently from protected-value disclosure. #73–#92 refine these boundaries without changing deployed topology. +- **UML:** existing browser/extension authority, sensitive-data/secret-fill, evidence, destination/network, and product-wide authority views remain sufficient for these policy/value primitives. A detailed production Chromium adapter → semantic observation → typed policy/action → post-condition/recovery/resource-evidence sequence remains mandatory when that executable adapter boundary stabilizes. A trusted sensitive-data broker/provider/validator/retention sequence likewise remains future work until those deployed authorities exist. +- **ERD/data model:** none of #73–#92 introduces OriginWeave-owned durable persistence, migrations, physical ownership/cardinality changes, or rollback state. The conceptual ERD remains truthful. Physical process-sample, extension-policy, native-host, assurance, model-route/invocation/fallback/output/audit, broker, provider, validator, retention, clock, or redirect tables would be invented architecture until an actual persistence owner is accepted and implemented. +- **Security/test/release:** the exact active heads above have current GREEN evidence as stated, but none is protected-main or release evidence. Stacked Drafts remain dependency-blocked even when their exact branch checks are green. CodeRabbit success or a skipped Draft review is not independent approval, and predecessor-head success never transfers after head/base movement. +- **Traceability:** this appendix supersedes earlier pending wording for #83 and extends exact-current non-shipped evidence through #92. Every active-PR statement remains subordinate to protected-main code/contracts and becomes historical immediately when its recorded head or prerequisite moves. ## Truth boundary -`IMPLEMENTED_ON_ACTIVE_PR` means the exact branch contains the stated behavior; it does not mean shipped, and a pending exact-head check is never treated as passing. A controlled Chromium runner is not the product browser adapter. A sampled Chromium process tree is not trusted whole-task ownership. An extension proposal or native-host grant is not an Agent action grant. A no-known-influence result is not proof that extensions are absent or unable to affect page state. A model-route, invocation, context-isolation, or output-policy admission decision is not authorization to disclose a protected value, execute an export, authenticate or invoke a provider, attest a region or clock, inspect/validate output bytes, retain/delete data, prove unrelated-history isolation, or authorize fallback. Protected-main maturity changes only after dependency-ordered integration and fresh protected-main acceptance. +`IMPLEMENTED_ON_ACTIVE_PR` means only that the exact branch contains the stated behavior with the recorded branch-local evidence; it does not mean shipped. A controlled Chromium runner is not the product browser adapter. A sampled process tree is not trusted whole-task ownership. Extension admission, proposal permission, attached-tab assurance, or native-host grant is not Agent action authority. A fresh resolution value is not proof that DNS or the clock is trusted. Model route, invocation, necessity, availability, fallback, output-policy, and audit-metadata decisions are not protected-value disclosure, provider authentication/execution, runtime region attestation, output-byte validation, retention/deletion enforcement, or durable audit storage. Protected-main maturity changes only after dependency-ordered integration and fresh protected-main acceptance.