fix(core): bind pointer clicks to admitted node authority

[seonghobae]

Current pointer authority and sealed-reply integration

Published exact head e94a2372fe3771f9ddf70291d34fc9a7e4770ec9 ordinary-adopts parent #264 433957117ad9e29b26715b062f5adcc9789744ba while preserving published child ddce72484d707e0945fe715602272ff2df6a88d0 and all contributor histories. Real regression e7fb1527 failed both replacement success and error cases (0/2); ordinary merge d847b530 retains current-node and canonical outbound-session checks, typed monotonic dispatch, deadline/no-write handling, ambiguous-write retention and consuming subscription ownership. Only two pointer production modules change: existing connection registration and sealed reply admission.

All14 focused cases pass, including genuine original-reply recovery, unrelated-command retention, stale-node and foreign-session rejection before correlation/I/O, and six preserved navigation-postcondition cases. Docs/doctoring and CHANGELOG describe the combined boundary, not browser authentication, policy authorization, causal page effects or protected-main/release acceptance. Keep Draft.

Complete locked Rust 1.97.1 formatting, all-target/all-feature workspace check, full workspace tests and five compile-fail doctests, strict Clippy, warning-denying rustdoc,145Python contracts,compileall,CodeGraph and diff checks pass. Unchanged pinned nightly2026-08-01 coverage enforcement passes:1297/1297 functions,13618/13618 lines,17315/17315 regions,1442/1442 branches,each100%. Artifact coverage-receipt-e94a2372.json SHA-256 fc9aebce5e633be1c4faa10755e56bb792a0f2679daeef3a0a1984d4a4b58404; unstable branch instrumentation warning remains explicit.

Independent read-only preservation review found no actionable findings at this exact head; not counted approval. Actual in-app screenshot of the published pointer-descendant section shows the full checkpoint, hashes and remaining-authority caveats readable without observed clipping or overlap. This is GitHub documentation presentation evidence, not OriginWeave product-browser acceptance. Fresh CI 34068277243 (Rust 101580818356, coverage 101580818410) and MV3 34068277244 (job 101580818353) are queued, not hosted pass. No protected merge, force rewrite,workflow/ruleset/secret change,tag or release occurred.

Historical pointer checkpoints — evidence applies only to named heads

Current pointer outbound session-provenance repair — 2026-09-06

Exact head: ddce72484d707e0945fe715602272ff2df6a88d0; exact parent #264: 6f331a5b220349a1aaa1b1841d5e8ec027b9ad49; Draft. The branch remains an ordinary descendant of parent-adoption checkpoint 7147893c96ca95c9b5b275d8011c5bfe99aab065 and preserves the child, parent, authority, postcondition and prior RED histories without force rewriting.

Hosted RED and causal repair

Test-only predecessor 6dfc75bfda0146d8988427a75cac8875b87cc75a added one actual loopback regression: a current admitted node in registry session A is sent through a verified WebDriver BiDi transport whose external session is B. Hosted CI 34041550298, production-coverage job 101509115746, checked out 6dfc75bf... and failed the intended boundary with registry session A unexpectedly dispatched pointer input on transport session B. MV3 34041550300 succeeded. Rust-contract job 101509115884 separately stopped at canonical rustfmt drift in that new RED fixture before workspace tests.

Normal descendant 9d61f9fa9b42259e528dc667509e486d14bc3389 applied that first formatter diagnostic. Production commit 6c61563884799f74c98e8700b2ca087672986cbb reuses the already-adopted #264 registry-session authority: after current admitted-node validation and frame-timeout validation, but before pointer correlation or command-frame I/O, it requires handle.browser_session() to match the established transport's verified WebDriver session through BrowserAuthorityRegistry::require_registered_session_external_identifier. A mismatch is preserved through the existing typed pointer BrowserAuthority error; no second identity service or generic/raw dispatch path is introduced.

Test-only descendants 6eb49d5c and dcd2fdcb align two pre-existing pointer transport fixtures whose registry literal differed from their already-used socket SESSION_ID; response, stale-authority and navigation-postcondition fixtures were already aligned. fd2da468 strengthens the hostile regression to require the typed Authority { BrowserAuthority(..) } denial plus zero correlation and zero command-frame bytes.

Exact hosted CI 34047777867 then actually ran on fd2da468. Production coverage job 101525824852 is terminal success and MV3 34047777840 is terminal success. Rust contracts job 101525824945 passed all Python repository contracts, then failed only Check formatting; workspace/test/Clippy/rustdoc were skipped after that deterministic gate. Its uploaded rustfmt-fd2da468... artifact (9994270059, SHA-256 1883ecc74a972ff0fe8720cb79823806ad53495220e9284c33b4104b766a667c) contains exactly two formatting hunks. Normal descendant ddce7248 applies those two hunks byte-for-byte: the established-transport session-id call chain and the hostile test's long ok_or_else expression. No semantics or other files changed in this repair commit.

The repair preserves current-document, origin, exact sharedId, registry-instance, typed-input, bounded-deadline, preflight retirement and ambiguous-write behavior. It does not authenticate Chromium, authorize the action, grant destination/secret authority, bind pointer replies to a connection, or prove observed post-condition/navigation causality. Those remain separate boundaries.

Exact 6dfc75bf..ddce7248 is six normal commits across four distinct files. No parent/#147 source, workflow, ruleset, dependency, secret, approval, protected merge, tag or release state changed.

Current verification boundary

Fresh exact-head hosted proof is now terminal GREEN on ddce72484d707e0945fe715602272ff2df6a88d0:

• CI 34050595641 completed successfully. Rust contracts job 101533386419 checked out exact ddce7248 and passed Python repository contracts, canonical formatting, workspace check, full tests, Clippy and API documentation.
• Production coverage job 101533386373 completed successfully on the same exact head and passed the repository's exact production coverage enforcement.
• Manifest V3 Compatibility 34050595606, job 101533386243, completed successfully after hardened-runner egress enforcement, exact checkout and the real pinned Chrome for Testing MV3 fixture.

These hosted results close the predecessor formatting-only failure for this exact head. They do not establish counted approval, protected-main delivery, real product-browser acceptance, or release eligibility.

Fresh visual inspection of ddce7248 is still required. Earlier actual Edge screenshots for 7147893c, 35555d0f and other heads are historical presentation evidence only and do not transfer.

Keep Draft. Parent-first protected delivery, applicable review/governance, product-browser acceptance and release eligibility remain separate. No self-approval, bypass, protected merge, tag or release is claimed.

Preserved prior checkpoint at 7147893

7147893c96ca95c9b5b275d8011c5bfe99aab065 ordinary-adopted released parent #264 6f331a5b... over child 35555d0f, preserving original parent socket RED 98621adf. All 16 focused regressions, full Rust 1.97.1 fmt/check/test/Clippy/rustdoc, 145 Python contracts, compileall, CodeGraph and diff checks passed locally. Pinned nightly production coverage was 1296/1296 functions, 13601/13601 lines, 17303/17303 regions and 1442/1442 branches, each 100%, artifact SHA-256 480d6d3ca492565e8a04bfce4b0c135dffbff276532d129c410674838e8fec2f. Independent preservation review found no actionable finding and was not counted approval. Actual Edge presentation inspection of that exact head was readable with no observed clipping or overlap. Writer release: #265 (comment)

Preserved prior checkpoint at 35555d0

35555d0f8491d4ee95c2e61d1a2aaa2c02a0635c preserved original child ffa70ee0, parent 7fb93e77 and real socket deadline RED 3f9cdc1a through ordinary integration. Four parent navigation-postcondition regressions accidentally absent from the original child were restored. Rust 1.97.1 gates, 145 Python contracts, compileall, CodeGraph and diff passed; pinned coverage was 1293/1293 functions, 13567/13567 lines, 17273/17273 regions and 1440/1440 branches, each 100%, SHA-256 b1374f65538fb6557b4e5d877aa067e183202ed1f56c75be047b3ff2dfdc92a0. Actual Edge presentation inspection was later completed after browser access recovered. Writer release: #265 (comment)

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Pointer-authority integration writer RELEASED — 2026-09-06 12:19:27 UTC

Sole lease5559058158 is explicitly released after verified ordinary publication to #265 35555d0f8491d4ee95c2e61d1a2aaa2c02a0635c. Original child ffa70ee and parent7fb93e77 histories are preserved via two-parent7535d8af; real socket RED3f9cdc1a remains in ancestry. Full Rust1.97.1 fmt/check/test/Clippy/rustdoc,145Python, compileall, CodeGraph and diff checks pass. Exact-head pinned-nightly coverage rerun passes1293functions/13567lines/17273regions/1440branches, each100%; SHA256 b1374f65538fb6557b4e5d877aa067e183202ed1f56c75be047b3ff2dfdc92a0. Independent preservation review found two issues (four silently deleted parent postcondition tests and two stale sender signatures); both are repaired and finalreview found none remaining.

Live parent #264 b4702cd is a new test-only registry-to-transport RED owned by active writercomment5559076006. Its adoption is deferred until that writer's repair/release; this265head does NOT claim latest-parent convergence. No264source was changed by this lease. KeepDraft. Current CI34032661775 andMV334032661781 are queued, not hostedGREEN; no protected merge or release occurred.

Fresh Visual Inspection remains required and incomplete because the Mac is locked and automatic unlock failed. Manual unlock is required; no historical screenshot is transferred. #238 snapshot88447b7d predates this265publication and should be refreshed under a new sole docslease. No265,264or238writer remains held by task01a06c0f-b427-7830-b654-9addcdfe7aff.

[seonghobae]

Pointer parent-adoption writer RELEASED — 2026-09-06 13:32 UTC

Root task01a06c0f-b427-7830-b654-9addcdfe7aff releases sole lease5559497861 after verified ordinary publication of #2657147893c96ca95c9b5b275d8011c5bfe99aab065, with current parent6f331a5b220349a1aaa1b1841d5e8ec027b9ad49 and child35555d0f histories retained. Original parent socket regression reproduced actual RED98621adf before merge. All16focused regressions, full Rust1.97.1 fmt/check/test/Clippy/rustdoc,145Python,compileall,CodeGraph,diff pass. Exact nightly production coverage1296functions/13601lines/17303regions/1442branches each100%; artifact SHA256480d6d3ca492565e8a04bfce4b0c135dffbff276532d129c410674838e8fec2f. Independent preservation review found no actionable findings, not counted approval.

Exact-head CI 34036335342 and MV3 34036335505 have three queued jobs, not hosted GREEN. Fresh actual Edge visual inspection of the published body and Checks page verified head 7147893c, Draft state, readable wrapping with no observed clipping or overlap, and job IDs 101494978947 / 101494979067 / 101494979605 matching the API. This verifies GitHub presentation only, not OriginWeave product-browser acceptance.

No forced history, protected merge, approval, workflow/ruleset/secret change, tag or release. No265,264or238source writer remains held by this task. Next executable item is separately leased #238 evidence refresh; current112ba13a still describes pre-adoption source states. Prior acquisition: 13:22UTC at35555d0f after parent release5559331330.

[seonghobae]

Pointer outbound session-provenance RED writer acquired — 2026-09-06 15:12 UTC

OriginWeave hourly writer acquires one bounded test-first #265 sender-authority slice at verified exact head 7147893c96ca95c9b5b275d8011c5bfe99aab065, exact parent #264 6f331a5b220349a1aaa1b1841d5e8ec027b9ad49, Draft. Latest public source lease 5559497861 is explicitly released and no later #265 source writer exists.

Scope is one actual-loopback regression for the separately documented pointer outbound session guard. A current admitted node for registry session A will be sent through an established WebDriver BiDi transport whose verified external session is B; the test requires rejection before correlation registration or command-frame bytes. This is distinct from the #258 response-receipt experiment and reuses the parent #264 external-session authority concept rather than inventing another identity service. No production fix, parent mutation, workflow/ruleset/secret action, merge, tag, release or approval substitution is included in this lease. Explicit release follows RED publication or defer.

[seonghobae]

Pointer outbound session-provenance RED writer RELEASED — 2026-09-06 15:13 UTC

Published test-only exact head 6dfc75bfda0146d8988427a75cac8875b87cc75a over predecessor 7147893c96ca95c9b5b275d8011c5bfe99aab065, preserving current parent #264 6f331a5b... and all existing #265 authority/postcondition history. The new actual-loopback regression constructs a current admitted node in registry session A, establishes a verified WebDriver BiDi transport for distinct session B, and requires pointer send to reject before correlation registration or any command-frame byte.

No production/shared-correlation/parent source, workflow, ruleset, secret, merge, tag, release or approval state changed. Exact CI 34041550298 (Rust 101509115884, coverage 101509115746) and MV3 34041550300 are queued with no executed steps yet, so the behavioral RED is not yet claimed as observed. Static source inspection shows the current sender revalidates node authority but performs no registry-session versus transport-session comparison; that observation is not substituted for test execution.

The bounded writer is explicitly released while runners are pending. If the exact test executes RED, the smallest causal repair should mirror the already-adopted #264 registry external-session check immediately before correlation/I/O, then register pointer correlation with the connection generation needed by the separate response-provenance repair. No GREEN or merge-readiness claim.

[seonghobae]

Pointer outbound session-provenance repair writer RELEASED — 2026-09-06 17:13 UTC

The same OriginWeave hourly writer releases this bounded #265 lane after normal publication and readback of exact head fd2da4689a6e043325dafb5850573ec72e98b18f, exact parent #264 6f331a5b220349a1aaa1b1841d5e8ec027b9ad49, Draft. The original hosted RED remains 6dfc75bf: CI 34041550298 coverage job 101509115746 executed the real loopback test and failed because registry session A dispatched on verified transport session B. MV3 34041550300 succeeded on that RED head; Rust job separately exposed only the RED fixture's canonical-format drift.

Normal descendants preserve all prior history. 9d61f9fa applies the exact rustfmt diagnostic; 6c615638 adds the minimal production guard by reusing BrowserAuthorityRegistry::require_registered_session_external_identifier(handle.browser_session(), established.transport_evidence().verified_peer().session_id()) before pointer correlation/I/O; 6eb49d5c and dcd2fdcb align two pre-existing same-session pointer transport fixtures whose registry literal previously differed from their socket SESSION_ID; fd2da468 strengthens the hostile regression to require the typed Authority { BrowserAuthority(..) } denial as well as zero correlation and zero command bytes. Exact 6dfc75bf..fd2da468 is five normal commits across four files; no parent/#147 source or other contributor delta was discarded.

Fresh exact-head CI 34047777867 remains pre-checkout queued: coverage 101525824852 and Rust 101525824945 are runner_id=0, steps=[]; MV3 34047777840 is pending. This is not hosted GREEN. Exact runner-admission evidence was sent to central .github#712 comment 5560824156; no leaf no-op retrigger or gate weakening was used. No local full-suite/coverage substitute is claimed by this writer. Fresh exact-head visual inspection is also still outstanding; prior Edge screenshots do not transfer.

No #265 source writer remains held by this lane. The separate #147 lease 5559729227 remains its own runner-waiting state. No self-approval, force history update, protected merge, workflow/ruleset/secret mutation, tag or release occurred.

Preserved acquisition

Pointer outbound session-provenance repair writer ACQUIRED — 2026-09-06 16:58 UTC

Fresh read verified 6dfc75bfda0146d8988427a75cac8875b87cc75a, exact parent 6f331a5b220349a1aaa1b1841d5e8ec027b9ad49, Draft, with prior #265 source lease 5560146490 explicitly released and no later #265 source lease. The separate #147 lease was runner-waiting on a disjoint Python CI-script/test branch and no #147 paths or PR state were touched here. Scope was only the executed pointer registry-session versus transport-session RED, the corresponding pre-correlation/I/O authority guard, and preservation fixes exposed by that new invariant.

[seonghobae]

Pointer exact-head rustfmt repair writer RELEASED — 2026-09-06 18:08 UTC

OriginWeave hourly writer releases this bounded #265 formatting-only lane after normal fast-forward publication and readback of exact head ddce72484d707e0945fe715602272ff2df6a88d0, exact parent #264 6f331a5b220349a1aaa1b1841d5e8ec027b9ad49, Draft.

Predecessor exact-head CI 34047777867 actually executed on fd2da468...: Production coverage 101525824852 succeeded and MV3 34047777840 succeeded; Rust contracts 101525824945 passed Python repository contracts then failed only canonical formatting. Uploaded artifact 9994270059 (SHA-256 1883ecc74a972ff0fe8720cb79823806ad53495220e9284c33b4104b766a667c) contained exactly two rustfmt hunks. Commit ddce7248 applies those hunks byte-for-byte across the production call-chain layout and hostile-test ok_or_else layout; the published commit diff is identical to the artifact patch and changes no semantics.

Fresh exact-head CI 34050595641 and MV3 34050595606 are queued and therefore not final GREEN. PR body now records the current head and verification boundary. Fresh exact-head visual inspection remains outstanding and predecessor screenshots are not transferred. No parent/#147 source, workflow/ruleset/secret, approval, protected merge, tag or release mutation occurred. No #265 writer remains held by this lane; any later repair must refetch the new hosted result and acquire a fresh lease first.

Preserved acquisition

The lane was acquired only after prior #265 lease 5560772042 was confirmed released and fresh hosted execution exposed the deterministic formatter failure on fd2da468....

[seonghobae]

Pointer exact-head hosted-evidence writer RELEASED — 2026-09-06 19:05 UTC

OriginWeave hourly writer releases the bounded #265 PR-state/evidence-only slice at unchanged exact head ddce72484d707e0945fe715602272ff2df6a88d0, exact parent #264 6f331a5b220349a1aaa1b1841d5e8ec027b9ad49, Draft. Prior #265 source/formatting lease 5561104677 was already released; no current review thread or formal review was present.

Fresh hosted proof is now recorded in the PR body and read back successfully. CI 34050595641 is terminal success: Rust contracts job 101533386419 passed Python repository contracts, canonical formatting, workspace check, full tests, Clippy and API documentation; Production coverage job 101533386373 succeeded and passed exact coverage enforcement. MV3 34050595606, job 101533386243, succeeded after hardened-runner egress, exact checkout and the real pinned Chrome for Testing fixture.

Fresh visual inspection of ddce7248 remains outstanding and predecessor screenshots were not transferred. No source, parent, workflow, ruleset, secret, approval, protected merge, tag or release mutation occurred. No #265 writer remains held by this lane.

[seonghobae]

Writer lease RELEASED — root task01a06c0f-b427-7830-b654-9addcdfe7aff; no source/docs writer retained.

Normal publication/readback verified265e94a2372fe3771f9ddf70291d34fc9a7e4770ec9, current264base433957117ad9e29b26715b062f5adcc9789744ba, Draft. Both histories incl hourly ddce724 retained; real e7fb152 replacement success/error RED0/2, ordinary d847b53 adoption then14focusedpassed. Only2pointerproductionmoduleschange; node/session authority,typedmonotonicdispatch,raw/typed isolation,deadline/ambiguouswrites,subscriptionteardown and all6postcondition testbodies preserved. Full Rust1.97.1 fmt/check/tests/5compilefail doctests/strictClippy/rustdoc,145Python,compileall,CodeGraph,diff pass. Pinnedcoverage1297functions/13618lines/17315regions/1442branches each100%; SHA256fc9aebce5e633be1c4faa10755e56bb792a0f2679daeef3a0a1984d4a4b58404. Independent readonly review no actionable findings, not counted approval.

Actual inapp screenshot of exact published traceability section verifies full checkpoint readable/no clipping or overlap. GitHub presentation only, not product-browser acceptance. CI34068277243 Rust101580818356/coverage101580818410 andMV334068277244 job101580818353 queued at readback. Full PR body history preserved. No force rewrite,workflow/ruleset/secrets,protectedmerge/tag/release/gate weakening. Existing untrackedcoverage files retained. Acquisition followed prior265lease5561455552 and264/238releasedleases; no further edits under this lease.

[seonghobae]

Exact-head hosted evidence checkpoint — evidence-only PR-state lease acquired after fresh public coordination confirmed the prior #265 writer 5563064004 RELEASED and no later unreleased #265 lease; released in this same checkpoint with no source/docs/ref mutation.

Exact current head e94a2372fe3771f9ddf70291d34fc9a7e4770ec9, parent #264 433957117ad9e29b26715b062f5adcc9789744ba, Draft. The hosted runs that were queued in the publication checkpoint have now actually completed terminal GREEN on this unchanged head: CI 34068277243 — Rust contracts 101580818356 success through repository contracts, rustfmt, workspace check, full tests, strict Clippy and API docs; Production coverage 101580818410 success through exact enforcement. MV3 34068277244 / pinned Chrome for Testing job 101580818353 is also terminal success, including hardened-runner undeclared-egress blocking and the real MV3 compatibility fixture.

This updates hosted evidence only. The existing actual in-app screenshot remains GitHub-presentation evidence, not product-browser/post-condition acceptance; no new screenshot is claimed here. #265 remains Draft and does not claim protected-main integration, approval, merge readiness, tag or release. No workflow/ruleset/secret/gate change, force update, source write, protected merge, tag or release occurred. No #265 writer remains held after this checkpoint.