feat(policy): compose extension proposals with action policy

[seonghobae]

Partial implementation of #27, stacked on PR #74.

Buyer/security gap

PR #74 proves that exact ProposeTypedAction extension authority and ordinary typed-action policy are separate fail-closed boundaries. It also identifies the remaining production-composition gap: without one narrow composition API, a future trusted extension adapter could accidentally check only extension access or only Agent action policy.

Dependency

This Draft is stacked on unchanged exact PR #74 head 0d492564aa61c9094f1315ee4e234b46a1e63a6c and must remain Draft while #74 is active. It is not independently integrable before that prerequisite.

TDD / RCA sequence

1. Initial test-only head 5c0e5be959fabe53367315a574840bdb1c4d175c exposed only canonical rustfmt drift, so it was not counted as the intended RED.
2. Formatted test-only head af629d3aebadb67041ba28b97dfab0cc01dcf283 established the real production-boundary RED in CI run 31471940073, Rust contracts job 93717027443: repository contracts and rustfmt passed, then cargo check --locked --workspace --all-targets failed because public ExtensionProposalDecision and evaluate_extension_action_proposal did not exist.
3. Production head dfb411c219a8d935cf0a99dab3f9585e2400e3d8 added the smallest composition boundary; CI then exposed only canonical import wrapping in originweave-policy/src/lib.rs.
4. Head c65a7c14036e052dee26b7fa6298a7d4e8353dbc applied exactly that rustfmt delta and passed full Rust contracts plus exact owned production coverage in CI run 31472397247.
5. Current exact head 3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e adds only the truthful Unreleased changelog entry. Fresh CI run 31472688287 succeeds on this exact head.

Implemented boundary

evaluate_extension_action_proposal now:

• constructs the exact ExtensionAccessRequest for the supplied extension, browser session, browsing context and ExtensionAgentCapability::ProposeTypedAction;
• stops before action policy when the grant is missing, mismatched or lacks proposal capability;
• when proposal access is allowed, evaluates the caller-supplied ActionRequest unchanged through the existing deterministic Agent policy;
• therefore preserves the request's instruction-source, capability, origin, secret-delivery, risk and approval requirements instead of minting any from extension transport; and
• returns an explicit ExtensionProposalDecision distinguishing extension-access denial from the ordinary action-policy result.

Focused integration regressions prove missing grant denial, non-proposal-capability denial, exact proposal-grant success into ordinary policy, preservation of WebContent as untrusted instruction, and preservation of the independent R3 approval requirement for broker-handle secret fill.

Exact-current proof

On exact head 3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e against unchanged exact prerequisite #74 head 0d492564aa61c9094f1315ee4e234b46a1e63a6c:

• CI run 31472688287: success;
• Rust contracts job 93719296349: success, including repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy and rustdoc;
• Production coverage job 93719296436: success, including exact owned production function/line/region/branch enforcement;
• GitHub reports this Draft mergeable against its exact prerequisite base; and
• no formal or inline review findings are currently returned for this exact head.

No predecessor-head check or review is transferred to the current head.

Truth boundary

This is a pure policy-composition prerequisite, not a Chromium extension adapter. It does not parse extension messages, authenticate user/enterprise instruction provenance, transform arbitrary extension/page data into an ActionRequest, execute browser input, resolve or disclose secrets, verify a post-condition, persist policy, alter managed-extension configuration, or close issue #27. A later trusted adapter must construct the typed request and its instruction-source classification from independently trusted context; extension-provided content/messages remain untrusted and cannot choose their own trust class. Chrome permission, extension proposal permission, Agent capability/origin authority, high-risk approval, secret authority, browser execution and verified success remain separate authorities.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ea2a2453-bb8f-4f2f-a1e3-bc6c5a3999d6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}