test(policy): separate extension proposal grant from action policy

[seonghobae]

Partial implementation of #27.

Buyer/security gap

OriginWeave already has an extension-access decision for ExtensionAgentCapability::ProposeTypedAction and a separate core action-policy evaluator. There is not yet a production adapter that converts an extension proposal into an ActionRequest. This lane therefore proves the currently implemented boundary without implying a nonexistent composition path: the exact extension/session/context grant can independently authorize proposal permission, while ordinary user-sourced action requests remain independently fail-closed under mutation, execution-mode/purpose, crawler/robots, non-delegable-action, and Human-mode policy.

Exact scope

This branch is based directly on protected main 67af7c87589edc2039545af335c95064d9b8391c. Current exact head is 0d492564aa61c9094f1315ee4e234b46a1e63a6c.

The tests explicitly keep the two implemented evaluators separate:

• evaluate_extension_access proves only that the exact extension/session/context grant allows ProposeTypedAction;
• a user-sourced Submit request remains denied as CrossOriginMutation when source and target origins differ;
• a same-origin Submit request remains denied as OriginNotWritable without target write authority;
• Crawler/PublicCrawl mutation remains denied as CrawlerMutation;
• AgentTask/PublicCrawl mismatch remains denied as ModePurposeMismatch;
• read-only crawler observations remain fail-closed for RobotsDisallowed, RobotsUnknown, and RobotsNotApplicable;
• LegalConsent remains denied as ForbiddenRisk; and
• Human mode remains denied as HumanModeNotAgentControlled.

No production extension-proposal adapter, action source transformation, execution API, or new authority is added. When a real adapter later exists, its composed extension-proposal -> typed-action path must receive a separate integration regression rather than inheriting this independent-boundary evidence.

Review finding and correction

CodeRabbit reviewed predecessor head ac8b27ee69229070c382ca2199eaf9ec8b1b12db and correctly identified that the prior test naming implied a composition path that does not exist: evaluate_extension_access evaluates ExtensionAgentGrant, while the test-created InstructionSource::User ActionRequest is independent. Current head 0d492564aa61c9094f1315ee4e234b46a1e63a6c addresses that exact finding by renaming the helper/tests and adding a module-level truth-boundary explanation. No predecessor review or check is transferred to the moved head.

Exact-current evidence

For exact head 0d492564aa61c9094f1315ee4e234b46a1e63a6c against unchanged protected main 67af7c87589edc2039545af335c95064d9b8391c:

• CI run 31464388199: success;
• Security Scan run 31464388200: success;
• SAST Semgrep run 31464388210: success;
• GitHub reports the PR mergeable and Ready for review;
• the returned formal review is the predecessor-head CodeRabbit COMMENTED review described above; no later review is transferred or synthesized; and
• no predecessor-head check is used as current proof.

Truth boundary

A Chrome/extension permission remains extension-access permission only. This branch does not prove that a real extension proposal flows through OriginWeave action policy, because that adapter does not yet exist. It does prove that the extension grant evaluator and ordinary action policy independently preserve their documented fail-closed decisions. This test-only PR does not close #27 and does not establish real Chromium extension-to-Agent composition.

[coderabbitai]

📝 Walkthrough

Walkthrough

확장 프로그램에 ProposeTypedAction 권한이 있어도 정책 격리 규칙을 우회할 수 없음을 검증하는 테스트를 추가했다. 출처, 실행 모드, 로봇 정책, 위험 동작, 인간 모드 제어 경계를 확인한다.

Changes

확장 프로그램 변경 격리

Layer / File(s)	Summary
테스트 컨텍스트 및 제안 권한 설정 crates/originweave-policy/tests/extension_mutation_isolation.rs	정책 타입과 식별자를 가져온다. 유효한 확장 프로그램 권한 부여와 제안 허용 여부를 검증하는 공통 헬퍼를 추가한다.
출처 및 실행 모드 격리 crates/originweave-policy/tests/extension_mutation_isolation.rs	제안 권한이 있어도 교차 출처 변경을 CrossOriginMutation으로 거부한다. 쓰기 불가 출처 변경을 OriginNotWritable로 거부한다. 크롤러 모드와 모드·실행 목적 불일치도 각각 CrawlerMutation 및 ModePurposeMismatch로 거부한다.
로봇 정책 및 제어 경계 crates/originweave-policy/tests/extension_mutation_isolation.rs	Disallowed, Unknown, NotApplicable 로봇 정책을 각각 해당 DenialReason으로 거부한다. LegalConsent 동작을 ForbiddenRisk로 거부한다. 인간 모드의 Navigate 요청을 HumanModeNotAgentControlled로 거부한다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• ContextualWisdomLab/OriginWeave#62: ProposeTypedAction과 에이전트 권한 경계에 대한 확장 프로그램 정책 격리 테스트를 확장한다.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	확장 권한 격리 테스트는 충족하지만, 이슈 #27의 Chromium 호환성, 운영 코드 집행, 문서화 및 릴리스 게이트 요구사항은 충족하지 않습니다.	MV3 Chromium fixture suite, 운영 코드의 권한 격리, 지원 capability matrix, 전용 ADR 및 회귀 릴리스 게이트를 추가해야 합니다.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	변경 사항은 이슈 #27의 확장 권한 격리와 권한 확대 거부를 검증하는 테스트에 한정되며, 관련 없는 코드 변경은 없습니다.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 확장 프로그램 제안 권한과 Agent 정책을 분리하는 회귀 테스트 추가라는 변경의 핵심을 정확하고 간결하게 설명합니다.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/extension-mutation-authority-main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

crates/originweave-policy/tests/extension_mutation_isolation.rs (1)

122-145: 🔒 Security & Privacy | 🔵 Trivial | 🏗️ Heavy lift

확장 제안 테스트를 실제 경계와 일치시키십시오.

evaluate_extension_access는 ExtensionAgentGrant만 평가하며 ActionRequest를 생성하지 않습니다. 현재 확장 제안 어댑터도 없습니다. 따라서 assert_extension_can_propose(&grant)와 InstructionSource::User 요청은 서로 독립적입니다. 실제 어댑터가 추가되면 해당 경로로 정책 결과를 검증하고, 그렇지 않으면 테스트 이름과 설명을 독립된 권한 및 정책 테스트에 맞게 수정하십시오.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/originweave-policy/tests/extension_mutation_isolation.rs` around lines
122 - 145, Update the test around assert_extension_can_propose and the
InstructionSource::User ActionRequest so it matches the implemented boundary:
evaluate_extension_access only evaluates ExtensionAgentGrant and no extension
proposal adapter creates ActionRequest values. Until such an adapter exists,
separate or rename the assertions to represent independent grant authorization
and policy evaluation; if an adapter is introduced, verify the policy result
through that adapter instead.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/originweave-policy/tests/extension_mutation_isolation.rs`:
- Around line 122-145: Update the test around assert_extension_can_propose and
the InstructionSource::User ActionRequest so it matches the implemented
boundary: evaluate_extension_access only evaluates ExtensionAgentGrant and no
extension proposal adapter creates ActionRequest values. Until such an adapter
exists, separate or rename the assertions to represent independent grant
authorization and policy evaluation; if an adapter is introduced, verify the
policy result through that adapter instead.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6096f5d0-719c-4310-81fb-6cfe34f5b117

📥 Commits

Reviewing files that changed from the base of the PR and between 2403344 and ac8b27e.

📒 Files selected for processing (1)

• crates/originweave-policy/tests/extension_mutation_isolation.rs