feat(core): bind semantic node targets to business actions

[seonghobae]

Partial implementation of #28, stacked on PR #58.

Buyer/security gap

PR #58 binds one node-local action to the exact observed browser authority, but deliberately leaves business intent/risk policy separate. The next runtime boundary still needs to prevent a stale or cross-document semantic node from being paired with an ActionRequest whose source origin belongs to a different document. Without an explicit composition value, a future adapter could validate node authority and business policy independently, then accidentally dispatch them as if they referred to the same source document.

Dependency

This Draft is stacked on unchanged exact PR #58 head efe440c7a609cac187faacfa03a4df904a99386f and must remain Draft while #58/#57/#52/#40 are active. No prerequisite check or review is transferred.

TDD / RCA sequence

1. Test-only head cd784b660a0268cc95725d847bf895edb4b3d5fb introduced the composition contract but CI run 31533977907 stopped first at canonical rustfmt. That setup failure is not counted as the intended RED.
2. Formatting-only head 33fd6ae933e1c5de36058e3adb28ea3d88905f06 reached the intended production boundary. CI run 31534466686, Rust contracts job 93922150601, passed repository contracts and canonical formatting, then cargo check --locked --workspace --all-targets failed with E0432 because public SemanticNodeActionBinding and SemanticNodeActionBindingError did not exist. This is the valid RED.
3. Exact production head c150e2daa0c890c8e2797ebb4c88a6220be13019 adds the narrow binding value and public export. Construction now requires the semantic node handle origin to equal ActionRequest::source_origin, while leaving the request target origin independent so legitimate cross-origin navigation remains a separately governed destination.
4. The binding retains the exact SemanticNodeActionTarget and ActionRequest separately and delegates session/context/origin/document-epoch revalidation through the existing target immediately before later dispatch.

Exact-head proof

On unchanged exact head c150e2daa0c890c8e2797ebb4c88a6220be13019 against unchanged exact prerequisite #58 head efe440c7a609cac187faacfa03a4df904a99386f:

• CI run 31534945009: success;
• Rust contracts job 93923706143: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy and rustdoc all success;
• Production coverage job 93923705979: exact owned production function/line/region/branch enforcement success;
• Manifest V3 Compatibility run 31534945000: success;
• CodeRabbit exact-head commit status: success;
• GitHub reports the Draft mergeable against the unchanged prerequisite base; and
• no inline review threads are currently returned for this exact head.

No predecessor-head check, review, mergeability result, or synthetic status is transferred to the current head.

Implemented contract

SemanticNodeActionBinding now:

• retains the exact authority-bound SemanticNodeActionTarget and independently classified business ActionRequest;
• rejects a source-origin mismatch as stable credential-free SourceOriginMismatch;
• deliberately does not require ActionRequest::target_origin to equal the source node origin;
• preserves the target and request as read-only inputs for later policy/dispatch composition; and
• exposes immediate-use browser authority revalidation without minting capability or approval.

Truth boundary

This slice does not map NodeActionKind to business-risk ActionKind, authorize policy, grant capability, execute browser input, prove a post-condition, authorize a destination, resolve secrets, authenticate a browser adapter, or claim the Chromium vertical slice complete. A node-local Click remains descriptive execution input; the exact business action/risk/purpose/approval remains explicit in the independently constructed ActionRequest and downstream policy boundary.

Keep this PR Draft while #58/#57/#52/#40 remain active. Any prerequisite or current-head movement requires fresh exact-head/live-base validation.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2685955a-e97b-4eb8-bf45-cc868ca199e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}