feat(network): assemble bounded WebDriver BiDi text messages

[seonghobae]

Boundary

Adds bounded RFC 6455 text-message assembly above PR #243 and preserves the JSON-envelope delta previously integrated from PR #247. The frame layer owns wire validation; the assembler owns fragmentation and bounded UTF-8 text; JSON envelopes remain protocol data, not received-connection provenance or browser authority.

Implemented contract

• Reassemble split UTF-8 only after the final text/continuation frame, retaining interleaved Ping/Pong control frames.
• Fail closed on Close, binary data, orphan continuation, interrupted fragmentation, invalid UTF-8, unsupported opcodes and aggregate messages above the 1 MiB ceiling; rejected state remains poisoned.
• Keep debug representations free of text/control payloads.
• Preserve existing bounded JSON command/response/event classification without granting command-dispatch authority.

Current exact-head integration and evidence — 2026-09-08

Current head 585791f3641fbe757c3bd9fd36d5316adcc78d63 is an ordinary, non-force merge of frame parent 97fab641ed9d76e6c515eadcef0629edfc8064a3 into predecessor b87191bcb6a95dfd7e0ed234e600639a1093c43a. The message/JSON source and test blobs are unchanged. Inherited opening-exchange fixture lifetimes match their verified owner repair.

Hosted CI 33953247053 is now terminal success on this unchanged exact head. Rust contracts job 101271826592 passed Python repository contracts, canonical formatting, workspace check, full tests, strict Clippy and warnings-denied API documentation. Production coverage job 101271826759 passed measurement, diagnostics upload and exact production coverage enforcement. The older body statement that fresh hosted checks still had to finish was stale and is superseded by this evidence.

This remains repository-quality evidence for the bounded message/JSON slice only. It does not establish received-connection provenance, browser-process authentication, action post-condition evidence, protected-main integration or release acceptance. Earlier CI 33272665984 remains historical evidence for c3165309... only.

Stack and authority

Draft on PR #243 at 97fab641ed9d76e6c515eadcef0629edfc8064a3; prerequisite and exact-head policy gates remain mandatory. No DNS, reconnect, proxy, TLS, browser, origin, policy, secret, model, unrestricted JavaScript or workflow authority is added. No force push, self-approval, workflow/ruleset weakening, tagging, publication or release is part of this integration.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}