feat(extension): expire managed Agent Task policy

[seonghobae]

Partial implementation of #27, stacked on PR #85.

Buyer/security gap

PR #85 makes Agent Task extension admission an exact managed allow-list but deliberately carries no policy freshness. A previously valid managed-extension set must not remain replayable indefinitely after enterprise policy changes.

TDD and implementation

Exact test-only head f4521bacf98f052f275fc87d0f75c108f6e096e9 established the missing freshness boundary before production changed. The tests require one explicit half-open validity window, caller-supplied trusted evaluation time, fail-closed invalid/reversed windows, not-yet-valid and expired decisions, exact-boundary expiry, u64::MAX safety, exact extension identity matching, and preservation of the separate Agent capability boundary.

Production now carries the smallest deterministic implementation: AgentTaskExtensionPolicy stores valid_from and valid_until; evaluate_agent_task_extension receives the trusted evaluation time; invalid windows, not-yet-valid policy and expired policy have separate typed denials; and membership is evaluated only after the freshness checks. The implementation does not read or attest a clock, so all three time values remain in one caller-attested time domain.

Dependency and exact stack state

This Draft targets exact current PR #85 head e836e833be920da8764d3dd72e058e02cd9ed72b. Exact current #94 head is 66dbc574518740b8c09a558f7b54e7f5629256fe, GitHub reports it mergeable against that prerequisite, and CI run 31538015144 completed successfully on that exact head. No formal review or inline review thread is currently returned for the exact head. No prerequisite check or review is transferred.

Keep Draft while #85/#83/#82 remain active.

Truth boundary

This slice governs only deterministic policy validity time. It does not authenticate an administrator, read Chrome enterprise policy, attest a clock, install/enable/disable extensions, verify extension signatures/update provenance, mutate profiles, grant Agent capability, authorize native messaging, persist policy, or claim managed enterprise extension support complete.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c4260cb-180a-493f-bc1e-79a6721b9fc4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}