feat(network): bind committed navigation origin

[seonghobae]

Partial implementation of #28. This Draft derives a canonical HTTP(S) origin before registry mutation, advances only the caller-captured document epoch, and binds the observed origin to the new document. It does not authenticate the observation, prove click causation, authorize a destination, or create reusable Agent authority.

Pointer receipt parent adoption

Exact head ba100fbc39e1ac4f10ee4faade38418551bb8298 adopts #260 3807aabeb22f9622610c3c8d504d1c686d25d896 by ordinary merge 80cfa186, preserving all history.

Canonical replay c03e0dcc reproduced the replacement-connection defect (0 passed, 1 failed). The adopted parent repairs pointer response provenance and preserves original-connection recovery. Parent receipt safeguards, tests and navigation fixture are byte-identical. Child origin production, three integration tests and doctoring.md remain unchanged from 572fc422: invalid origins fail before mutation, and stale epochs retain the intervening origin.

Exact-head local verification passed all 21 focused tests, Rust 1.97.1 format/check/workspace-test/strict-Clippy/rustdoc gates, 142 Python tests, compileall, CodeGraph sync and diff checks. Pinned-nightly numerical production coverage is 100%: 1,173 functions, 12,110 lines, 15,515 regions and 1,334 branches. Artifact SHA-256: e031834a531210caf8ce650a6a11ca184c83a7dc80ad2250e88ab54a3e0e3a8e. The unstable branch-instrumentation warning remains visible; this is not warning-free instrumentation evidence.

Independent read-only preservation review found no actionable findings, not a counted GitHub approval. Fresh hosted checks remain separate and predecessor successes do not transfer. Actual Edge screenshot inspection verified readable head/base, regression lineage, coverage and acceptance limits without observed clipping or overlap. This verifies GitHub presentation only, not browser-runtime acceptance.

Keep Draft and parent-first integration. No workflow, secret, ruleset, approval, merge, tag or release change.

Historical adoption evidence

Partial implementation of #28. This Draft derives the canonical HTTP(S) origin from an accepted committed-navigation observation before registry mutation, advances only the caller-captured document epoch, and binds the observed origin only to the new document. It does not authenticate the browser observation, prove click causation, authorize a destination, or create reusable Agent authority.

Current non-force stack adoption

Current exact head is 572fc4224ddc09c010bd9ccf100764076899495a, a tree-identical ordinary two-parent adoption over predecessor 934eb7d37568b439c442ffe1d1f6a9c8f8ed58a0 and current #260 e5228396be8d9faade44a30aed704cacbeb91b46. No source, tests, docs, workflow, dependency, gate or authority changed; the safe #255 successor topology is carried forward without rewriting history.

Predecessor CI 33967462582 and predecessor local numeric coverage 1,173 functions / 12,104 lines / 15,511 regions / 1,334 branches = 100% belong only to 934eb7d.... Fresh exact-head CI 34003334868 completed success on 572fc4224ddc09c010bd9ccf100764076899495a. This validates repository quality for this exact adopted tree only; it does not authenticate the browser observation, prove click causality, authorize a destination, establish protected-main integration, central review/security acceptance, or release readiness.

Origin validation, stale-epoch rejection and registry mutation order are unchanged. Keep Draft and parent-first protected integration. No workflow/ruleset/secret mutation, self-approval, bypass, force update, destructive rebase, merge, tag, release or publication was performed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh current-head source review found a valid Rust quality-contract violation that must be repaired during the required current-parent reconstruction, not by churning this stale child.

AGENTS.md forbids unwrap and expect in first-party production libraries. Exact #261 head 127e02503e48938e29a9a07410574c7e72fc661a currently violates that contract in two production paths introduced/changed by this branch:

1. webdriver_bidi_command_correlation.rs: the Success branch calls .expect("validated WebDriver BiDi success envelopes always carry a command id"). The parser invariant is real, but encoding it through a panic-capable API contradicts the repository contract.
2. webdriver_bidi_navigation_document_origin.rs: remainder.find(['/', '?', '#']).unwrap_or(remainder.len()) is also prohibited production unwrap usage, even though the fallback is deterministic.

The parent #260 exact current head 56600a6fd982cfafd784f4b7bb659d918113ca90 does not contain the expect; its correlation path still uses the older fail-closed Some/None branch. #261 is already behind that parent by one commit, so do not source-fix this stale lineage or force-rebase it.

Repair acceptance for the post-#260 reconstruction:

• preserve the validated-envelope invariant without expect, unwrap, panic, coverage exclusion, source rewriting, or a generic correlation shim; prefer making the success command id structurally non-optional at the private envelope/correlation boundary so the impossible state is not represented rather than reintroducing an unreachable recovery branch;
• replace the navigation-origin delimiter fallback with a non-unwrap expression while preserving exact URL/origin semantics and hostile-input coverage;
• retain 100% owned production function/line/region/branch coverage and strict rustdoc/Clippy/repository contracts on the reconstructed exact head;
• preserve #261's unique origin-binding delta and #260's typed-correlation repair, then regenerate current-parent exact-head evidence.

This is a source-backed repair finding, not an approval, merge authority, or reason to weaken the queue/coverage gates.

[seonghobae]

Correction to my earlier review 5093907798 after checking the actual protected-main quality contract and workspace lint configuration.

The .expect(...) finding in webdriver_bidi_command_correlation.rs remains valid: protected-main AGENTS.md forbids production expect, and [workspace.lints.clippy] expect_used = "deny" enforces it.

The second finding was over-broad. remainder.find(...).unwrap_or(remainder.len()) in webdriver_bidi_navigation_document_origin.rs is not the panic-capable Option::unwrap() operation targeted by clippy::unwrap_used; protected main itself contains deliberate unwrap_or(...) uses in first-party crates. Treating every method whose name begins with unwrap as prohibited would misstate the current repository contract. No source change is required solely to replace this deterministic unwrap_or fallback.

Revised repair acceptance for the post-#260 reconstruction: preserve #261's unique origin-binding delta and #260's typed-correlation repair; remove the production .expect(...) while preserving the validated-success-envelope invariant without panic, generic compatibility shims, coverage exclusions, or source rewriting; then regenerate exact-current 100% function/line/region/branch coverage, strict rustdoc/Clippy/repository contracts, reviews, and security evidence. The stale-parent ordering remains unchanged.

[seonghobae]

Exact-head CI RCA for 84195ec7f46d1228158d10edc5cbc32cd6d06cc7:

• Hosted run 33875521522 failed only at cargo fmt --all --check in webdriver_bidi_command_correlation.rs; production coverage passed on the prior head.
• The formatting failure reproduced locally exactly.
• Applied the pinned formatter with no semantic change (one import-group reorder).
• Local verification passed: cargo fmt --all --check, strict workspace/all-target/all-feature Clippy, and all workspace/all-target/all-feature tests.

The parent head remained exactly d1f3a4f0f44f15b6dcdba8b8ce555af0bed89d0a before the non-force push. Hosted checks on the new exact head remain authoritative. This PR remains draft and stacked on #260.

[seonghobae]

Parent synchronization: exact head 7cecf402da665bd280447461d1015d6bcd0aad07 now includes #260 exact head 065f79223f6643bbc3a102400704b41ef2a51767. This was ancestry-only; cargo fmt --all --check remained green before the non-force push. Hosted checks on the new exact head remain authoritative.

[seonghobae]

Parent synchronization: exact head c1f877b770c1b2a52d76a062b09b996fc5653e1e now includes #260 exact head af9fd38e0302d66e40444ea2559042fd613f0910. Strict Clippy and the complete workspace/all-target/all-feature test suite passed before the non-force push; hosted checks remain authoritative.

[seonghobae]

Restacked onto exact parent PR #260 head 35d12949bde5e5cbc801fdfb433f4a9914bd4fb0; new exact head is 95f7548bf07cbba76ab8b40577a11d1b6c99acb5.

Review result: the implementation reuses the existing canonical Origin parser and document-advance boundary; invalid or credential-bearing observed URLs fail before registry mutation, stale epochs fail before origin binding, and the result grants neither destination nor action authority. Added the missing scoped CHANGELOG entry; no new abstraction or dependency was introduced.

Local exact-head evidence: focused navigation-origin tests passed; documentation contracts passed (22 tests, 177 subtests); full workspace tests passed; Clippy and rustdoc with -D warnings passed; production functions, lines, regions, and branches are each 100% covered. Exact-head GitHub checks are queued; PR remains draft and has no counted approval on this head.

[seonghobae]

Non-force restacked on PR #260 exact head 9b6c6038de8c1ed7872b513f113c6392987a8217; PR #261 is now exact head 7388e6a893b34e87ba965f061aaa26bf4d155b61. Verification: rustfmt, all-feature/all-target check, strict Clippy, rustdoc, 141 Python contracts, and CI-equivalent pinned-nightly production function/line/region/branch coverage at 100%. Fresh hosted exact-head checks and ordered parent integration remain required.

[seonghobae]

Non-force restacked on PR #260 exact head 3a651967c421f77088fe25e86a63faae295390b3; PR #261 is now exact head 323ac9e147691e9f6572711f5a748e13f1036624. The first coverage run hit the known macOS timeout-cleanup race; the exact focused retry and complete CI-equivalent coverage rerun passed at 100%. Rustfmt, all-feature/all-target check, strict Clippy, rustdoc, and 141 Python contracts also pass. Fresh hosted exact-head checks and ordered parent integration remain required.

[seonghobae]

Writer lease RELEASED — root task 01a06c0f-b427-7830-b654-9addcdfe7aff. Published #261 ba100fb over #2603807aabeb22f9622610c3c8d504d1c686d25d896 by non-force push. Actual canonical regression RED0/1, then21focused tests and full Rust gates/142Python contracts passed; numerical production function/line/region/branch coverage100%, unstable branch warning retained. Parent safeguards and child origin module/tests/doctoring preserved. Independent read-only review found no actionable findings. Actual Edge screenshot inspected: evidence readable without clipping/overlap. Hosted checks remain separate; no merge or release. Source writer no longer active.