feat(extension): bound Agent Task managed extension admission

[seonghobae]

Partial implementation of #27, stacked on PR #83.

Buyer/security gap

Issue #27 requires Agent Task mode to default to no extensions or an explicit managed allow-list. Existing work separates Chromium extension permissions, OriginWeave Agent grants, native-messaging host authority, and attached-tab assurance, but there was no production policy primitive that answered the narrower question: may this exact extension identity be present in an isolated Agent Task profile under the managed extension admission policy?

Dependency and exact stack state

This Draft now targets exact current PR #83 head 204cedb1bee54a40a6d6bc0b97719afd309c3f71; this PR is exact head e836e833be920da8764d3dd72e058e02cd9ed72b.

After #83 was aligned non-destructively to current #82, this branch became topologically stale even though the prerequisite merge changed no tree content. A second non-destructive merge-topology commit added current #83 as the parent while preserving the existing #85 tree. Fresh compare now reports #85 ahead of current #83 with behind_by=0 and merge base exactly 204cedb1bee54a40a6d6bc0b97719afd309c3f71. No prerequisite review/check is transferred.

TDD / RCA sequence

1. Exact original test-only head 23f128fc84b2d2b5b4c188211575ef69c5c5d070 established the intended production-boundary RED. CI run 31490857300, Rust contracts job 93776779728, passed repository contracts and formatting then failed at the workspace check with E0432 because the managed Agent Task admission API did not exist.
2. RCA found the deterministic admission evaluator belongs to originweave-policy, not originweave-core: core owns stable extension identity/grant value contracts, while policy owns fail-closed decisions. The test was therefore moved to the policy crate rather than widening the core authority surface.
3. Production adds AgentTaskExtensionPolicy, AgentTaskExtensionDecision, and evaluate_agent_task_extension. An empty policy denies all; only exact canonical ExtensionId membership is admitted; duplicate entries collapse without widening authority; and policy admission never mints ExtensionAgentGrant capability.
4. The existing implementation/changelog tree was preserved exactly through the dependency-alignment merge described above.

Exact-head verification

For exact current head e836e833be920da8764d3dd72e058e02cd9ed72b:

• CI run 31536909167: success;
• Rust contracts job 93930058899: success, including repository contracts, formatting, locked workspace/all-target check, full tests, strict Clippy and rustdoc;
• Production coverage job 93930058924: success, including exact owned production function/line/region/branch enforcement;
• GitHub reports this Draft mergeable against exact current feat(extension): identify reduced-assurance attached tabs #83 with no dependency lag; and
• no formal reviews or inline review threads are currently returned for this exact head.

No predecessor-head check, review, mergeability result, or synthetic status is transferred to this current head.

Truth boundary

This policy primitive does not read Chrome enterprise policy, install/enable/disable extensions, verify signatures or update provenance, mutate a browser profile, launch Chromium, persist policy, authenticate an administrator, authorize native messaging, or grant any OriginWeave Agent capability/action. A future trusted profile/enterprise-policy adapter must derive the exact managed extension set from independently authenticated policy and compose it with Chromium startup/install state.

Keep Draft while #83/#82 remain active. This PR does not close #27.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 6b90679c-d4f6-4508-9304-9436d0fafa70

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}