[Browser Session/BiDi ACL] Bind current lifecycle authority to presentation command planning

[seonghobae]

Gap

PR #313 establishes the Browser Session aggregate and non-aliasing disposable isolation identity, but originweave-bidi still has no safe consuming path for its private WebDriverBidiPresentationOwnership / WebDriverBidiScreenAreaOwnership witnesses. Adding a public constructor or converting an arbitrary PresentationMutationAuthority snapshot would reopen the authority gap: a token retained across epoch advance, destruction, transport loss, or session end could be planned after it is stale.

This issue owns the narrow ACL between Browser Session domain authority and the version-pinned standard-BiDi command planner. Browser Session remains lifecycle/policy authority; WebDriver BiDi remains an adapter. It does not own browser transport, sandboxing, Keyverse, EgressWeave, contextual-orchestrator, Wardnet, or real-browser acceptance.

Required invariant

A BiDi presentation witness may be produced only from authority that the live BrowserSession aggregate has revalidated as current at the point of adapter use. The validation proof must be non-caller-constructible and lifetime-bound so the session cannot be mutably advanced/destroyed while the adapter derives command intent from it. Raw BrowserSessionId, BrowsingContextId, DisposableIsolationId, or a retained PresentationMutationAuthority alone is insufficient.

Test-first acceptance

• RED: retain an authority token, advance the same context epoch, and prove the old token cannot be converted into a BiDi presentation witness or command plan.
• RED: destroy the context, record transport loss, or end the session and prove no adapter witness can be derived from stale authority.
• RED: authority from another aggregate with reused external session/context/epoch but distinct isolation must fail before any adapter command/transport path.
• GREEN: a current authority validated by the owning aggregate can be projected through a narrow ACL into the exact browsing-context-bound BiDi presentation witness and can plan viewport/DPR/timezone commands; screen-area witness remains separate and must not imply complete Screen admission.
• Keep Browser Session independent of WebDriver BiDi/CDP/MCP. The adapter crate may depend outward on the Browser Session proof type, not vice versa.
• Owned production rustdoc and function/line/region/branch coverage remain 100%.

Real Chromium transport/post-condition/destruction remains later evidence under #292/#299. The OriginWeave runtime-qualified WebDriver BiDi revision remains 2026-09-03 until separate compatibility requalification; the latest-published W3C WebDriver BiDi Working Draft is dated 9 September 2026 (WD-webdriver-bidi-20260909) and is standards-freshness evidence only. Publication freshness does not silently repin the runtime-qualified protocol/browser revision.

[seonghobae]

Writer lease ACTIVE — source scope is a new stacked successor from #313 exact 6486e916dceb4ab5f33f7b390cd76fd4673d6007 only. Do not mutate #313/#229 source or PR state. Sequence: hostile stale-authority RED → minimum Browser Session lifetime-bound current-authority proof → originweave-bidi ACL bridge → exact-head GREEN. No transport implementation, workflow/ruleset/secret change, public witness constructor, force update/rebase, self-approval, merge, sandbox weakening, provider/model pin, tag, or release.

[seonghobae]

Additional ACL invariant from the live types: originweave-core::BrowsingContextId is a domain u64 identity, while originweave-bidi::WebDriverBidiBrowsingContext is the remote end's validated opaque string. The bridge must not stringify/coerce the domain id or accept an unrelated remote string from the caller. The exact BiDi browsing-context address must originate from the same reviewed lifecycle adapter mapping that produced the DisposableIsolationId/DisposableContextHandle, and the lifetime-bound current-authority proof must bind that mapping before command planning. Otherwise the ACL could be current in the domain aggregate yet target a different remote context.

[seonghobae]

Writer lease RELEASED — no source branch or PR was created. #314 remains the next ACL/buyer-gap contract, but #313's newly verified partial-creation cleanup uncertainty is a Browser Session foundation prerequisite and must be repaired first. The exact prerequisite remains 6486e916dceb4ab5f33f7b390cd76fd4673d6007 until a normal successor/integration changes it.

[seonghobae]

Prerequisite refinement from #315 exact 98a28db0ac95972419906f229badf35c4f5fa0d6: do not open the Browser Session→BiDi witness projection until the recovery-evidence gap in review 5164398667 is repaired and normally inherited into #313. RecoveryRequired is necessary but not sufficient if an uncertain partial create or duplicate adapter output discards the exact DisposableIsolationId/returned handle needed to reconcile remote state. The ACL must consume only current, normally owned authority; it must not create a workaround that reconstructs missing recovery identity from raw browser session/context ids. #315 also still has the separate exact-head repository-contract RED (DisposableContextDestroyError / cleanup unproven wording mismatch), so no predecessor GREEN transfers.

[seonghobae]

Prerequisite refinement from #315 review 5165103727: do not open the Browser Session→BiDi ACL while record_transport_loss() drops a first real transport-loss event merely because ownership is already RecoveryRequired. The ACL must not derive a current presentation witness or reconciliation command from a proof whose aggregate has unresolved ownership and a subsequently lost browser transport. #312/#315 must first preserve ownership-recovery and transport-liveness as distinct facts (or an explicit combined state/evidence), with a hostile RecoveryRequired → transport loss RED and fresh exact-head GREEN. Keep the lossless recovery identity required by review 5164398667; do not overwrite it by collapsing the state to plain TransportLost.

[seonghobae]

ACL prerequisite refinement from #315 review 5165358933: the future Browser Session→BiDi projection must reject stale authority across sequential aggregate reincarnation, not just epoch changes inside one aggregate or concurrently distinct isolation ids. If A is destroyed/ended and B later reproduces the same external session id, remote user-context/isolation string, browsing-context id and local epoch, A's retained token must still be non-current and must not project to a BiDi witness. #312/#315 therefore need a non-reusable lifecycle/browser-generation proof carried through the authority and the reviewed remote-context/isolation mapping before #314 opens a consuming path. Do not treat the WebDriver BiDi user-context string alone as a durable generation capability, and do not reconstruct freshness from raw ids.

[seonghobae]

Prerequisite status update: #315 exact 0c6ed89c09ad16b5e170fd80604c29b16ce4f212 is repository GREEN in CI 34475535820, including exact production function/line/region/branch enforcement and Rust contracts/tests/Clippy/rustdoc. The Browser Session child now carries lossless recovery evidence, orthogonal transport-loss fact, incarnation/ABA protection through lifecycle I/O, destroy-failure quarantine, and fail-closed epoch overflow. It remains Draft solely because current-head qualifying independent review has not yet been obtained; current-head CodeRabbit review was requested.

Do not open the ACL implementation by copying these mutable child internals. First require normal #315 adoption into #313 and fresh GREEN on the resulting #313 exact head. Then #314 may consume the Browser Session authority through the intended dependency direction and prove live revalidation immediately before deriving the private BiDi presentation witness. Raw IDs or retained authority tokens remain insufficient.

[seonghobae]

Writer lease ACTIVE — foundation prerequisite is now normally inherited into #229 exact 6d87dff5dc572fbd74d06309d574a998f23cf02f: #315 was ordinary-merged into #313, #313 exact bab489ab244e0edfdb309692ee1f9ecd2e7adde0 produced fresh CI GREEN, its resolved lifecycle thread was verified on parent source, and #313 was ordinary-merged into #229. This lease owns only a new stacked #314 successor from current #229; do not mutate #229/main or canonical workflow/sandbox/model-owner source. Sequence: inspect exact lifecycle↔remote-context mapping → hostile stale/mismatched-address RED → minimum lifetime-bound ACL proof → exact-head GREEN. No raw-id coercion, public witness constructor, force/destructive restack, self-approval, bypass, sandbox weakening, provider/model pin, tag or release.

[seonghobae]

Read-only reviewer handoff for #316 exact b1c1648127defb89723606207033f5da5826c3ca; active #314 source writer remains authoritative and I did not mutate its branch.

Current hosted CI 34489022703 is terminal RED. Rust contracts 102911146862 fails the documentation fitness contract because ADR 0115 is not yet present in both canonical ADR/documentation indexes. Production coverage 102911147207 completes measurement and uploads artifact 10157093093 (sha256:b6708e9c9f5c8368a761b48c2a69a8aced246e0556d7f2e98ee6bc7b39a36494) but exact enforcement fails at lines=5804/5807, regions=7107/7108. Predecessor GREEN therefore does not transfer.

More importantly, exact-head source still has a recovery-boundary defect. WebDriverBidiLifecycleAdapter::create_disposable_context receives a complete WebDriverBidiCreatedContext, but duplicate-remote rejection reduces it to CreateFailedUncertain(Some(isolation)), losing known domain browsing-context and opaque BiDi remote-context identity. Also, the adapter commits a normal binding before Browser Session can reject isolation-only or domain-context-only aliasing. That can leave bindings containing a protocol target for a handle Browser Session never adopted, while the complete tuple needed for safe reconciliation is lost. This is already acknowledged in ADR 0115 as an open follow-up, but because ambiguous cleanup must never guess ownership it should be closed before #316 adoption.

I left COMMENT review 5168460322 with required hostile REDs: isolation-only alias, domain-context-only alias, and duplicate-remote alias must preserve the complete known created tuple in an adapter-local non-authorizing quarantine/recovery store distinct from accepted bindings; authorization must never consult quarantine and ambiguous tuples must not be auto-destroyed. Keep BiDi protocol strings out of Browser Session domain types. Then repair both canonical ADR indexes and restore fresh exact-head function/line/region/branch 100% plus repository contracts before ordinary adoption.

[seonghobae]

Additional exact-head blocker from #316 review 5168479840: the ACL currently protects presentation-plan projection but not the lifecycle port itself. WebDriverBidiLifecycleAdapter publicly implements DisposableContextPort, whose create/destroy methods accept raw BrowserSessionId + public BrowserSessionIncarnation (+ DisposableContextHandle for destroy). Downstream code with &mut adapter can therefore bypass the Browser Session aggregate: direct create can allocate untracked browser state; direct destroy can remove a mapped remote boundary while Browser Session still believes the context is Active. A retained PresentationMutationAuthority exposes enough identity to reconstruct the destroy key, and DisposableContextHandle::new is public.

Before real BiDi lifecycle backend wiring, require a hostile compile/runtime contract proving downstream code cannot cause remote create/destroy without a fresh non-constructible Browser Session-issued lifecycle request/capability. Adapter should consume that opaque request; raw ids/equality/docs/module convention are insufficient. Keep Browser Session as lifecycle authority and BiDi as adapter.

[seonghobae]

Exact-head reviewer refinement for #316 b1c1648127defb89723606207033f5da5826c3ca: review 5168832953 found that adapter-local alias checks cannot by themselves close the rejected-create recovery gap because one BrowserSession may call create_disposable_context with different DisposableContextPort instances on successive calls. Adapter A can own (U,C1,R1) while fresh adapter B has no local knowledge and successfully creates/inserts (U,C2,R2) or (U2,C1,R2); only after B has committed its normal binding does the Browser Session aggregate reject the duplicate and enter RecoveryRequired.

Required hostile RED: same Browser Session, two distinct lifecycle adapters; adopt via A, then force isolation-only and domain-context-only aliases via B. The B result must never become an authorizing normal binding, and the complete protocol tuple must remain only as non-authorizing recovery evidence.

This means the fix needs an aggregate↔adapter transaction boundary rather than another local map scan. Prefer a pending create candidate plus Browser Session-issued non-constructible accept/reject completion: adapter keeps protocol identity private/pending, aggregate validates the domain handle, only accepted completion promotes to normal binding, rejected completion quarantines it. Combine this with the non-forgeable lifecycle attempt/destroy capability required by review 5168479840; raw IDs must not be sufficient for attempt, commit, or destroy. Do not move BiDi remote strings into the Browser Session domain.

[seonghobae]

Read-only handoff while source lease 5618765115 remains ACTIVE; I did not mutate feat/browser-session-bidi-acl or PR state. #316 is still exact b1c1648127defb89723606207033f5da5826c3ca, Ready, and hosted CI 34489022703 remains terminal RED.

New review 5169424548 makes the lifecycle-port side door concrete as a presentation-target redirect: after Browser Session legitimately adopts (S,I,U,C)->R1 through adapter A, ordinary downstream code can seed a separate adapter B through the public DisposableContextPort using the same visible (S,I,U,C) but remote R2; B can then revalidate the real current authority against Browser Session and resolve its own exact-key map to R2. This defeats the ACL even without forging PresentationMutationAuthority.

Please fold this into the existing side-door/cross-adapter repair: non-constructible lifecycle attempt/accept/destroy requests must also be bound to the same aggregate-approved lifecycle-port/adapter ownership identity, so an acceptance/capability cannot be replayed across arbitrary adapter instances. Required hostile RED is A-normal-adoption → B-direct-port seed with same lifecycle tuple/different remote → B authorization must fail before R2 is projected. Keep the remote string adapter-local and preserve rejected tuples only as non-authorizing quarantine evidence.

[seonghobae]

Read-only handoff while source lease 5618765115 remains ACTIVE; I did not mutate feat/browser-session-bidi-acl or PR state. #316 remains exact b1c1648127defb89723606207033f5da5826c3ca; hosted CI 34489022703 is still terminal RED.

New review 5170088843 found a separate DDD/API-boundary defect: lifecycle_acl.rs currently introduces parallel WebDriverBidiPresentationOperation / AuthorizedWebDriverBidiPresentationAction / AuthorizedWebDriverBidiPresentationPlan semantics instead of safely connecting Browser Session authority to the canonical presentation_capabilities.rs contract (WebDriverBidiPresentationOwnership, WebDriverBidiPresentationCommand, plan_standard_presentation_commands, cleanup planner). #314 explicitly owns the missing safe consuming path for that private witness, so leaving two command vocabularies would preserve the original disconnected path and create transport/schema drift.

Please repair this together with the active lifecycle-port work: keep ownership mint non-public and lifetime-bound, but route the ACL through one canonical presentation command representation/planner. If cloneability/lifetime of the existing command type prevents that, repair the canonical ownership type boundary or wrap it without exposing a stale cloneable capability; do not duplicate SetViewport/SetTimezone/Reset* payload schemas. Add a contract that standard apply/reset operations have one canonical representation. Existing cross-adapter/side-door/quarantine findings remain prerequisites.

[seonghobae]

Read-only handoff while source lease 5618765115 remains the latest ACTIVE lease; I did not mutate feat/browser-session-bidi-acl or PR state. #316 remains exact b1c1648127defb89723606207033f5da5826c3ca, and CI 34489022703 is still terminal RED.

New review 5170615905 tightens the canonical-command repair from 5170088843: do not solve the duplicate command vocabulary by minting WebDriverBidiPresentationOwnership and returning bare existing WebDriverBidiPresentationCommands. The canonical ownership witness and command are currently owned/Clone, and the planners clone the witness into returned commands. A command produced after a valid Browser Session check could therefore be retained while the ACL borrow ends, then submitted after epoch advance, destruction, transport loss, or session end unless the execution boundary performs a fresh revalidation.

Acceptance: keep one canonical command payload vocabulary, but make mutation authority ephemeral. A retained canonical intent must not be executable after lifecycle change without fresh Browser Session + lifecycle-adapter revalidation immediately before remote I/O. Prefer a non-cloneable/lifetime-bound authorized execution wrapper or equivalent live borrow through transport submission; do not expose a public witness constructor or rely on caller discipline. Existing lifecycle-port side door, cross-adapter target redirect, pending/accepted/quarantine transaction, and complete recovery-tuple findings remain prerequisites.

[seonghobae]

Read-only/source-safe handoff from #316 exact b1c1648127defb89723606207033f5da5826c3ca: new review 5171179154 adds a remote-liveness prerequisite that the current lifetime-bound ACL does not cover. The &BrowserSession / &adapter borrow prevents local Rust lifecycle mutation, but it cannot freeze the external browser. W3C WebDriver BiDi 2026-09-09 defines browsingContext.contextDestroyed, session cleanup closes the WebSocket, and empty non-default user contexts may be removed by the implementation. Therefore an authorized plan can remain type-valid while its remote context/session has already disappeared.

Acceptance for the eventual transport boundary: subscribe/reconcile remote lifecycle events so contextDestroyed or session loss becomes adapter evidence and updates Browser Session recovery/transport-liveness before further mutation; immediately before browser I/O revalidate both current domain authority and adapter-observed remote membership. Do not silently recreate/rebind a destroyed remote target or use borrow lifetime/command ACK as lifecycle proof. Keep protocol event identities inside the BiDi ACL. Existing non-forgeable lifecycle request, adapter-ownership, pending/accepted/quarantine, canonical-command, and stale-intent findings remain prerequisites.

I repaired the current PR-state mismatch by converting #316 to Draft because exact-head CI is still RED and unresolved security findings remain. No source branch, workflow, ruleset, sandbox, secret, provider/model, merge, tag, or release mutation was made.