feat: add privacy-preserving presentation identity kernel - #229
feat: add privacy-preserving presentation identity kernel#229seonghobae wants to merge 204 commits into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthrough명시적 브라우저 프레젠테이션 프로필과 제한된 fingerprint 표면을 검증하는 Rust 커널을 추가했습니다. 버전 고정 WebDriver BiDi 명령 계획과 화면 영역 소유권 경계를 추가했습니다. 관련 아키텍처, 정책, ADR, 제품 문서 및 계약 테스트를 갱신했습니다. Changes프레젠테이션 정체성 및 WebDriver BiDi 경계
Estimated code review effort: 5 (Critical) | ~120 minutes Sequence Diagram(s)sequenceDiagram
participant Caller
participant PresentationProfile
participant WebDriverBidiPlanner
participant BrowserTransport
Caller->>PresentationProfile: 명시적 프로필 값 검증
PresentationProfile-->>Caller: 검증된 presentation 값 반환
Caller->>WebDriverBidiPlanner: viewport, DPR, timezone 전달
WebDriverBidiPlanner-->>Caller: apply 및 cleanup 명령 계획 반환
Caller->>BrowserTransport: 계획된 명령 전달
BrowserTransport-->>Caller: transport와 page-observed 증거를 별도 처리
Merge Risk: 🟡 Moderate · up to The new presentation planner can overwrite and then clear existing viewport, DPR, or timezone overrides in a reused browser context, potentially altering another workflow’s browser state. Require ownership or predecessor restoration before merge. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Review follow-up on exact head eae6ccd: format_ratio now exhaustively matches DevicePixelRatio, and explicit replay accepts only the enumerated language classes. I did not add the suggested set_size == 0 return: returning index 0 would still panic when derive indexes the empty eligible vector, so it is not a valid fail-closed fix. The private derivation sets retain a regression that proves every screen admits at least one enumerated viewport width and height. Full workspace tests, strict Clippy, rustdoc, 144 documentation tests, and 100% production function/line/region/branch coverage pass locally. |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…recovery-required fix: quarantine uncertain Browser Session creation
|
Writer handoff / stale-lease recovery — prior source lease Scope for this handoff is only ordinary adoption of #313 exact |
…-lifecycle-authority feat: add Browser Session lifecycle authority
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
AGENTS.md— repository behaviorARCHITECTURE.md— repository behaviorCHANGELOG.md— repository behaviorCLAUDE.md— repository behaviorCargo.lock— Rust workspace or package manifestCargo.toml— Rust workspace or package manifestREADME.md— repository behaviorcrates/originweave-bidi/Cargo.toml— Rust workspace crate API and testscrates/originweave-bidi/src/lib.rs— Rust workspace crate API and testscrates/originweave-bidi/src/presentation_capabilities.rs— Rust workspace crate API and testscrates/originweave-browser-session/Cargo.toml— Rust workspace crate API and testscrates/originweave-browser-session/src/lib.rs— Rust workspace crate API and testscrates/originweave-browser-session/tests/destroy_failure_requires_recovery.rs— Rust workspace crate API and testscrates/originweave-browser-session/tests/sequential_incarnation_reuse.rs— Rust workspace crate API and testscrates/originweave-fingerprint/Cargo.toml— Rust workspace crate API and testscrates/originweave-fingerprint/src/lib.rs— Rust workspace crate API and testscrates/originweave-fingerprint/src/stealth.rs— Rust workspace crate API and testscrates/originweave-fingerprint/src/ua_hints.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/kernel_contract.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/presentation.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/replay_digest.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/stealth_noise_surface.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/surface_admission.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/ua_client_hints_surface.rs— Rust workspace crate API and testsdocs/PRD.md— operator or user guidancedocs/README.md— operator or user guidancedocs/TRD.md— operator or user guidancedocs/adr/0107-browser-protocol-adapter-strategy.md— operator or user guidancedocs/adr/0108-crawler-policy.md— operator or user guidancedocs/adr/0110-privacy-preserving-presentation-identity.md— operator or user guidancedocs/adr/0111-bounded-stealth-normalization-surfaces.md— operator or user guidancedocs/adr/0112-bounded-user-agent-client-hints.md— operator or user guidancedocs/adr/0113-webdriver-bidi-screen-area-ownership.md— operator or user guidancedocs/adr/0114-browser-session-disposable-context-authority.md— operator or user guidancedocs/adr/README.md— operator or user guidancedocs/doctoring.md— operator or user guidancedocs/doctoring/webdriver-bidi-screen-area.md— operator or user guidancedocs/product-roadmap.md— operator or user guidancedocs/product-technical-gap-baseline.md— operator or user guidancedocs/traceability/browser-session-lifecycle-authority.md— operator or user guidancedocs/traceability/webdriver-bidi-publication-current.md— operator or user guidancedocs/traceability/webdriver-bidi-screen-area-planning.md— operator or user guidancedocs/uml/browser-session-lifecycle-authority.md— operator or user guidancetests/test_adr_index_provenance.py— regression suitetests/test_bidi_media_authority_contract.py— regression suitetests/test_browser_session_lifecycle_contract.py— regression suitetests/test_fingerprint_dependency_pin_contract.py— regression suitetests/test_presentation_identity_documentation_contract.py— regression suitetests/test_presentation_selection_contract.py— regression suitetests/test_repository_contract.py— regression suitetests/test_webdriver_bidi_docs_currentness_contract.py— regression suitetests/test_webdriver_bidi_presentation_adapter_contract.py— regression suitetests/test_webdriver_bidi_screen_settings_contract.py— regression suite
Changed behavior
classDiagram
class WebDriverBidiCommandError
class WebDriverBidiBrowsingContext
class new
class as_str
class WebDriverBidiPresentationOwnership
class WebDriverBidiScreenArea
class WebDriverBidiScreenAreaOwnership
class WebDriverBidiPresentationCommand
Changed API
WebDriverBidiCommandErrorWebDriverBidiBrowsingContextnewas_strWebDriverBidiPresentationOwnershipWebDriverBidiScreenAreaWebDriverBidiScreenAreaOwnershipWebDriverBidiPresentationCommandplan_standard_presentation_commandsplan_standard_presentation_cleanuprequire_complete_presentation_profileBrowserSessionStateBrowserSessionErrorDisposableContextCreateErrorDisposableContextDestroyErrorDisposableIsolationIdErrorDisposableIsolationIdparseBrowserSessionIncarnationDisposableContextHandleisolationBrowserSessionRecoveryEvidenceDisposableContextPortBrowserContextEpochPresentationMutationAuthorityBrowserSessionstartrecovery_evidencecreate_disposable_contextpresentation_authorityadvance_context_epochdestroy_disposable_contextrecord_transport_lossendPresentationErrorPresentationSurfacerequire_presentation_surfacesScreenMetricsViewportBoundsDevicePixelRatiofrom_ratioPresentationPlatformPresentationTimeZonePresentationDigestPresentationProfilereplaylanguagesdigestStealthSurfacerequire_stealth_surfacesStealthErrorCanvasNoiseWebGlRendererTokencanonicalWebAudioRatenormalizeWebRtcInterfaceexposes_candidatesClientHintsErrorUaBrandnameversionHintsArchitecturefrom_tokenHintsBitnessHintsPlatformUaClientHintsmodelbrands
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
6d87dff5dc572fbd74d06309d574a998f23cf02f - Workflow run: 34477214979
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
classDiagram
class WebDriverBidiCommandError
class WebDriverBidiBrowsingContext
class new
class as_str
class WebDriverBidiPresentationOwnership
class WebDriverBidiScreenArea
class WebDriverBidiScreenAreaOwnership
class WebDriverBidiPresentationCommand
2 participants
Buyer-visible boundary
This PR owns the pure Rust presentation-identity kernel and its versioned standard-WebDriver-BiDi capability/planning boundary. It validates explicit browser-visible profiles and bounded presentation/fingerprint surfaces. The
originweave-bidislice plans typed presentation command intent; it does not itself send protocol commands or prove page-observed state.This is active-PR evidence, not protected-main shipment. It does not inspect the host, patch Chromium, bypass access controls, treat command acknowledgement as success, or absorb #148/#212/#292/#299 browser-startup, sandbox, or real-browser acceptance authority.
Current lineage
Protected
mainis exact87c4daa1830bac5a5228b6036752ad5633232085. Exact current head iscfb58600a2253b6f1751f5252f4aabfbec6e9cc1onfeat/privacy-presentation-identity.2d97c12e393f64eb965806ede3c6c2cf27a0a55f, merge commita517eb43082173817186624997c252f3ec0c061c.af59acb08af802bba8d51bc23bd762c08f8ce481completed native CI34424716839GREEN and was then normally merged into this parent, producing current parent headcfb58600a2253b6f1751f5252f4aabfbec6e9cc1.43377c2de00865d0e92126c455ca6390297c9cf7, whose ownership-witness repair completed repository CI34423927553GREEN. These child checks are lineage evidence only; they do not substitute for current-parent exact-head verification.No predecessor was simple-closed to reduce PR count, and no force push or destructive rebase was used for these integrations.
Standards and screen-area authority
The standards-freshness lineage keeps publication tracking separate from runtime qualification: the OriginWeave standard-BiDi adapter remains runtime-qualified against the immutable 3 September 2026 revision recorded in its source/contracts. A newer publication alone does not silently repin runtime behavior; advancing the runtime pin requires dedicated schema/semantics/conformance and pinned-Chromium requalification.
The inherited screen-area repair keeps the reusable profile-derived planner limited to viewport/DPR plus timezone.
emulation.setScreenSettingsOverrideremains a separately typed partial capability because onescreenArearectangle also controls page-visible available-screen geometry that the current presentation profile does not model, while color depth is also uncontrolled. CompletePresentationSurface::Screentherefore remains fail closed.Screen-area Set/Reset command vocabulary now carries opaque
WebDriverBidiScreenAreaOwnership. A raw browsing-context identifier is addressability, not mutation authority: no public screen-area planner exists until the Browser Session bounded context supplies a reviewed ownership/disposable-lifecycle mint transition and consuming path together. This prevents generic cleanup from clearing another owner's predecessor override. Proposed ADR 0113 and focused doctoring/traceability are inherited with that boundary.Current exact-head verification
The current parent head
cfb58600a2253b6f1751f5252f4aabfbec6e9cc1has a fresh post-integration workflow generation; no earlier GREEN or RED is transferred.At the latest read:
34426254120: queued.34426254122: queued.34426254144: queued.34426254109: queued.The predecessor #229 exact
6f95808ce1166254c6c5dea33a1015d9405ee03fhad native CI/Security/Semgrep GREEN but required CodeQL terminal RED in the canonical exact-job wake path. That result is historical after this parent advance. Fresh central-owner search now shows the later.githubwake lineage has moved beyond #2040: #2051 centralizes wake responsibility after the complete scan matrix, and Ready successor #2056 exact69ae472562c93cc17674af5e2085a58947d3fab8additionally requires the authenticated job binding to equal the run's complete failed-job set before onererun-failed-jobscall. These are proposed central-owner repairs, not immutable consumer dependencies. The leaf must not pin either mutable PR, add a CodeQL shim, synthesize status, make an empty/no-op retrigger, copy workflows, or weaken the gate. A protected central integration/release and a new OriginWeave exact-head generation remain required.Keep this PR unmerged until the current exact head passes repository checks, required central workflows, review-thread requirements, and a qualifying independent approval under the live protected-main ruleset.
Browser acceptance remains open
The real-browser evidence lane remains #299. Its previously verified repository head is GREEN, but pinned Chrome/ChromeDriver
150.0.7871.129Agent Task evidence remains 0/3 pre-navigation RED with boundedWebDriverSessionNotCreatedError; no browser pass or presentation surface was reached. Therefore presentation apply, page-observed target, browser-computed semantics, native interaction/outcome, reset, original-baseline re-observation, and session/profile cleanup are not browser GREEN.Issue #292 remains buyer acceptance owner; #212/.github owns Chromium workflow/sandbox mechanics; #148 owns bounded ChromeDriver startup diagnosis. This PR consumes those authorities without copying or weakening them.
No self-approval, protection bypass, workflow/ruleset/secret mutation, runtime silent repin, sandbox weakening,
--no-sandbox, browser trial reduction, protected-main merge, tag, or release is part of this integration.Summary by CodeRabbit
새 기능
문서
테스트