feat(policy): revalidate semantic-node authority at dispatch boundary

[seonghobae]

Partial implementation of #28, stacked on PR #95.

Buyer/security gap

PR #95 makes deterministic policy allow a typed prerequisite, but callers could still call validate_current and perform adapter dispatch later as two independent operations. The first real Chromium vertical slice needs a narrow same-call boundary that revalidates exact browser session/context/origin/document epoch immediately before handing the already policy-authorized binding to adapter dispatch logic.

Dependency

This Draft is stacked on unchanged exact PR #95 head e26a2d07ae731ff35271299036fa1f43c8550039, transitively on #93/#58/#57/#52/#40. Keep Draft while prerequisites remain active. No prerequisite check, review, status, or mergeability result is transferred.

TDD / RCA sequence

1. Test-only head bad2a3d83a85cb95e7d364221a5bc9bc90489093 introduced the same-call dispatch-revalidation contract. CI run 31545503148 did not yet establish the intended production RED because canonical formatting failed first; no later workspace/test result from that head is promoted.
2. The branch was formatted and production support was added narrowly as PolicyAuthorizedSemanticNodeAction::dispatch_if_current: current browser session/context/origin/document epoch are revalidated, and only then is one caller-supplied dispatch callback invoked with the exact policy-authorized binding. Adapter callback return values remain separate from browser-authority validation.
3. Exact production head a897cd19f3f5e2d7c8669af39d8c4c958c4c6d94 passed repository contracts, formatting, workspace tests, strict Clippy and rustdoc in CI run 31545914486, but exact production coverage failed at 4266/4267 lines and 5569/5570 regions. The uploaded exact-coverage artifact localized the miss to one generic dispatch_if_current monomorphization: the stale-authority callback type exercised the ? error path but never the post-validation dispatch region.
4. Current exact head c93b90a316b83a160cf80008cc25c78aa32302f9 repairs only that coverage evidence. The stale-authority regression now drives both current and stale document epochs through one shared callback call site, so the same generic instantiation exercises both the successful dispatch region and the fail-before-dispatch path without weakening production code or the coverage gate.

Implemented boundary

PolicyAuthorizedSemanticNodeAction::dispatch_if_current now:

• retains the exact policy-authorized SemanticNodeActionBinding from feat(policy): gate semantic-node actions on deterministic policy #95;
• revalidates browser session, browsing context, canonical origin and document epoch immediately before callback dispatch;
• never invokes the callback when authority is stale or mismatched;
• passes the exact authorized binding to the callback only after successful revalidation; and
• leaves adapter failures/return values distinct from NodeHandleError authority failure.

The focused tests prove exact-current callback execution, stale-document fail-before-dispatch behavior, and independent adapter failure propagation.

Exact-head proof

On unchanged exact head c93b90a316b83a160cf80008cc25c78aa32302f9 against unchanged exact prerequisite #95 head e26a2d07ae731ff35271299036fa1f43c8550039:

• CI run 31549013124: success;
• Rust contracts job 93967418886: success, including repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy and rustdoc;
• Production coverage job 93967418865: success, including exact owned production function/line/region/branch enforcement;
• GitHub reports the Draft mergeable against its unchanged prerequisite base.

No predecessor-head result, prerequisite result, synthetic merge result, or skipped job is transferred to this exact head.

Truth boundary

This slice does not authenticate a browser adapter, execute Chromium input by itself, infer business ActionKind from NodeActionKind, authorize destination/network/TLS/HTTP, mint approval, resolve secrets, prove a post-condition, or claim #28 complete. The callback boundary is useful only when its current browser-authority inputs come directly from the trusted adapter immediately before the side effect. Keep this PR Draft while #95/#93/#58/#57/#52/#40 remain active.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: b379a7d4-68d7-412c-8e08-bd329daeeb12

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}