feat(core): separate Chrome permissions from Agent authority

[cursor]

Buyer/security gap

Partial implementation of #27. Chrome extension compatibility evidence must never become OriginWeave Agent authority. Reviewed Manifest V3 permissions may prove a stock Chromium compatibility surface, but cannot mint an Agent capability, filesystem authority, browser action, secret authority, approval, or any other OriginWeave permission.

Implemented boundary

originweave-core::chrome_permission_authorizes_agent_action is fail-closed: reviewed compatibility permissions, including downloads and nativeMessaging, return CompatibilitySurfaceOnly; malformed, case-shifted, control-bearing, whitespace-tailed, and unreviewed tokens return UnrecognizedPermission; and no ActionKind can make the function return success.

Chrome compatibility evidence therefore remains separate from explicit OriginWeave extension grants and Agent policy authority.

Fresh protected-main adoption

Protected main is exact c789b802fc98a8d7fd8c09d9327f36828054d2a1. The prior exact head 0ecfa765020154f2130ffd78af3694423d8764d7 already contained old main@542ca1e9c0a863595b8b6697790005d2471f5413 as a merge parent. The two protected-main commits after that revision have no net file delta.

Commit b05460f1faa30f5a8c7cde76e6de1919da5e3388 adopts current protected main as an additional parent while preserving the predecessor tree exactly. The branch moved by normal non-force fast-forward. This repaired the live content merge state from pre-repair non-mergeable metadata to open, Draft, content-mergeable without force-push or destructive rebase.

Fresh compare is 20 ahead / 0 behind with merge base exactly current protected main. The semantic delta is six paths: changelog, core Cargo lib-path declaration, the Chrome-permission authority module, the current crate root, removal of the superseded root wrapper, and the focused authority regression. No .github/**, dependency version, browser launch, native-host transport, provider/model, secret, ruleset, or coverage-denominator change is introduced.

Exact-current evidence

Current exact head is b05460f1faa30f5a8c7cde76e6de1919da5e3388; GitHub reports this PR open, Draft, and content-mergeable. Predecessor exact 0ecfa765... had Rust/coverage/MV3/OpenCode and broad security checks successful while Strix failed closed on provider infrastructure, but none of those results transfer to this new head.

Fresh workflows for b05460f1... are non-terminal:

• CI 33776758401: queued;
• Manifest V3 Compatibility 33776758261: queued;
• SAST Semgrep 33776758357: queued;
• Security Scan 33776758416: queued;
• OSV-Scanner PR 33776759202: queued;
• Scorecard PR 33776758637: queued; and
• one-shot Materialize Rust nightly refresh once 33776758427: completed as skipped and is not product evidence.

No exact-current GREEN or independent approval is claimed. Keep Draft until repository contracts, strict Rust checks/rustdoc, exact 100% owned-production function/line/region/branch coverage, pinned-Chromium/MV3 evidence, applicable security/review verdicts, and live governance execute on the unchanged head.

Scope boundary

This does not implement native-messaging transport, native-host allow-listing, host-process isolation, extension installation, Chrome message parsing, browser launch/control, filesystem authority, secret brokerage, or the full #27 runtime matrix. Compatibility permission remains evidence only, never authority.

Protected-main AGENTS.md and live governance remain authoritative. This scheduled writer does not merge, self-approve, bypass, force-push, destructively rebase, alter workflows/rulesets/secrets, weaken checks, tag, release, or publish.

[cursor]

Stale comment

Review — exact head f6c089b8faae015c5b8845296af7cdc3ddcd0c65

chrome_permission_authorizes_agent_action is fail-closed: a Chrome downloads token, and every other reviewed compatibility permission, cannot authorize Agent Download or any other ActionKind. Case, empty, and control-bearing tokens stay UnrecognizedPermission. That is the correct adapter check for ADR 0013 rule 4.

Next action: keep this primitive independent of MV3 runner PRs #43/#176. Do not treat a passing Chrome fixture as Agent filesystem authority. Wire adapters to call this boundary before policy, and add commands and windows to the reviewed-token list when those protected-main surfaces should be classified as CompatibilitySurfaceOnly instead of UnrecognizedPermission. Both paths already refuse the action.

Rust contracts, production coverage, and the pinned Chrome MV3 fixture succeeded on this head at review time. Remaining SAST/security/Strix/review workflows were still queued and are not promoted. This review is not an approval.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Review — exact head f6c089b8faae015c5b8845296af7cdc3ddcd0c65

The isolation primitive is sound and independent of the #43/#176 downloads runner. chrome_permission_authorizes_agent_action never returns Ok. Reviewed Chrome tokens including downloads become CompatibilitySurfaceOnly. Empty, case-shifted, newline-injected, and unrecognized tokens become UnrecognizedPermission. The ActionKind argument is intentionally unused so a Chrome permission cannot mint Download or any other Agent action.

is_exact_chrome_permission_token correctly admits mixed-case Chrome names such as sidePanel and declarativeNetRequest while rejecting DOWNLOADS and host-permission punctuation.

Residual, non-blocking

Protected-main MV3 evidence also exercises windows and commands. Those names are not in REVIEWED_CHROME_COMPATIBILITY_PERMISSIONS, so they currently classify as UnrecognizedPermission rather than CompatibilitySurfaceOnly. Both arms still refuse Agent authority. Add them only if an adapter needs the clearer diagnostic; do not treat the omission as a capability leak.

Stay draft until exact-head required checks are green. Do not fold this into the downloads runner, HTTP #37, or reserved MV3 drafts #49/#56/#59/#60/#61.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

Exact-head review found one current documentation-truth defect that must be fixed before approval. docs/traceability/extension-authority-security.md adds chrome_permission_authorizes_agent_action under the heading “Protected main already provides:”, but protected main is still 0c376acf059be9ddddddfbde1d0189e4f39ef014 and does not contain this PR-only function. That promotes active-PR behavior to shipped truth and violates the repository’s protected-main-vs-active-PR documentation contract. Keep the existing protected-main bullets unchanged and move/label this function as active/non-shipped PR #175 evidence (and make the docs/traceability/README.md wording equally explicit if needed). The Rust fail-closed implementation itself looks coherent on this head; exact-head CI, MV3, SAST, and Security are green. Please repair the truth-status wording without widening scope, then re-run exact-head evidence.

Superseded by current exact head db724d4. The current-main reconstruction removed the stale traceability-document changes entirely; fresh compare against protected main 0841d2a contains only CHANGELOG plus the bounded core module/Cargo/test slice. This dismissal is stale review-state cleanup only, not approval; current-head required checks and independent/latest-push approval remain required.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

Fresh current-source review found one additional issue-#27 compatibility taxonomy gap at exact head 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac: Chrome’s current official chrome.management reference requires the manifest permission management for the management API, and that API includes extension enable/disable and uninstall lifecycle operations. Issue #27 explicitly covers install/disable-enable/update-restart behavior. At this boundary, management should therefore be a reviewed compatibility-only permission, never Agent authority.

Owner action on this same canonical branch: add management to chrome_compatibility_permissions_never_mint_agent_authority first and observe the expected RED classification; then add only "management" to REVIEWED_CHROME_COMPATIBILITY_PERMISSIONS. Preserve the existing no-Ok contract and exact-token rejection. No browser-management capability, install authority, OriginWeave grant, or policy authority is widened.

Primary references: https://developer.chrome.com/docs/extensions/reference/api/management and https://developer.chrome.com/docs/extensions/reference/permissions-list . The attempted ref mutation for this test-first repair was blocked before the branch changed, so the exact PR head remains unchanged and no passing evidence is claimed for this gap.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac.

• Head SHA: 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac

• Workflow run: 32185290142

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (5 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (5 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac
• Workflow run: 32185290142
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac.

• Head SHA: 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac

• Workflow run: 32185290142

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (5 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (5 files)"]
  R1 --> V1["required checks"]

Loading

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Current-head update: merged protected main 542ca1e into the stale branch and pushed merge commit 0ecfa76 via fast-forward from 7e5fcf5. Current PR base/head are 542ca1e -> 0ecfa76. Local Rust 1.97.1 verification passed: cargo test --workspace --all-features, cargo fmt --all -- --check, cargo clippy --workspace --all-targets --all-features -- -D warnings, RUSTDOCFLAGS="-D warnings" cargo doc --workspace --all-features --no-deps, and git diff --check. Hosted checks have restarted and are pending; mergeable_state=blocked and no counted approval is present.