feat(network): transport typed text-value postcondition observations

[seonghobae]

Current parent adoption and sender repair — 2026-09-07

Published head: 8eda96915dbbe4cc617f834267c7464689c2844d. Independently resolved parent #269: 3df2a631bacd7109b3982fdd7ac599d0bd92a589. Ordinary merge preserves both histories.

Real loopback RED tests proved foreign-session dispatch, invalid-deadline pending registration, and reused-mask pending registration before the repair. The sender now reuses canonical session, deadline, connection-generation, and lifetime command-ID guards. Proven zero-write rejection retires only that request; ambiguous writes remain pending. Fixed observation source and child authority tests remain intact; result/value verification remains #271 work.

Local exact-head verification: 11 focused tests, 147 Python tests and compileall, formatting, workspace/all-target check, full Rust tests and compile-fail docs, strict Clippy, rustdoc, and exact production coverage: 1,346/1,346 functions; 14,113/14,113 lines; 17,928/17,928 regions; 1,464/1,464 branches. Coverage artifact SHA-256: 7748d42c541140314995ffa2087b3aca87d52875f98a6ffa36614a0453b30260. CodeGraph is healthy. Independent read-only review found no actionable findings; it is not formal approval.

Actual Edge screenshot inspection of generated API documentation verified readable guard descriptions and no clipping/overlap. This is documentation evidence, not browser-agent runtime acceptance.

Exact-head CI run 34076117534 is now terminal success on unchanged 8eda96915dbbe4cc617f834267c7464689c2844d. This repository-native GREEN validates only this exact active-PR tree. It does not transfer to #271, establish an independent approval, prove real-browser post-conditions, or establish protected-main/release acceptance.

Active ruleset requirements and the still-open parent stack remain separate gates. Keep Draft; no merge, self-approval, gate bypass, tag or release is claimed.

Historical dossier — preserved verbatim, superseded where noted

The following describes earlier heads. In particular, its blanket frame-write pending-retention statement is superseded by the proven-zero-write versus ambiguous-write distinction above.

Partial implementation of #28, stacked directly on PR #269 branch feat/webdriver-bidi-type-text-postcondition-command exact head 7854394266d3f292e779193c01413a34f6798d7c.

Buyer-visible boundary

This Draft transports the fixed product-owned WebDriver BiDi script.callFunction text-value observation command across the reviewed direct WebDriver BiDi/RFC 6455 boundary. The public send API consumes an exact WebDriverBiDi + SemanticObservation protocol-use proof, reconstructs the command from live admitted-node authority immediately before dispatch, registers the command id before the first possible remote side effect, and emits one bounded masked WebSocket text frame.

Wrong protocol family or capability, stale/wrong browser-context authority, duplicate correlation, and invalid frame deadlines fail closed. A frame-write failure after registration deliberately leaves the command id outstanding because partial or complete remote execution is ambiguous; it is never silently reused. The transport does not retry, reconnect, select an alternate destination, accept caller-supplied script source/sandbox, grant browser/policy/destination/secret authority, or infer text-entry success.

Test-first lineage

Exact RED head 3ba1d61e48a2542c835f41d79ebc7913673ef38c added a realistic loopback TCP → RFC 6455 integration regression requiring send_webdriver_bidi_text_value_observation before that production boundary existed. CI run 33459143984, Rust contracts job 99705411429, failed at workspace compilation on that RED head. No failed predecessor evidence is promoted to the implementation head.

The canonical branch then added the typed send error, immediate-use authority reconstruction, semantic-observation capability enforcement, command correlation, bounded frame write, public export, and hostile/failure regressions for wrong capability, wrong protocol family, wrong external context, duplicate correlation, and invalid frame deadline.

Historical exact-head evidence

Historical head 191a14535219ea8033777fa4c970efb281b62418 against base 7854394266d3f292e779193c01413a34f6798d7c passed local Rust/Python/coverage checks; predecessor native CI 33459335836 was terminal success on still earlier 480d411011120b40d88beec3942aee049541b71d. These are lineage evidence only and do not replace the current exact-head success above.

Stack / authority boundary

Keep Draft while #269 and its ancestors remain Draft. #271 owns correlated result admission and intended-text post-condition verification; dispatch and protocol acknowledgement alone are not success. Protected-main AGENTS.md and live GitHub governance remain authoritative. No workflow/ruleset/secret, force-history, approval, merge, tag, release or publication mutation belongs to this PR.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

RCA and exact-head repair: predecessor e5b44e8470df5befa0bb26eb9f893e7106347f3d failed Rust contracts only on rustfmt and failed exact coverage at webdriver_bidi_command_correlation.rs:244 (1433/1434 branches; 13353/13354 lines; 17129/17130 regions). The uncovered fallback was unreachable because the envelope parser already rejects a success response without a protocol-range id. Current head 64722daac0cbcbaf01375736b5f418838aa88c70 reuses that parser-proven success-id invariant without inventing an invalid wire case, applies canonical formatting, and adds changelog/doctoring evidence for command-family isolation. Local evidence: 139 Python contracts pass; full workspace tests, strict Clippy, rustdoc, and rustfmt pass; exact LLVM coverage reports 100% functions/lines/regions/branches. Remote exact-head checks are newly materializing; local results are not a merge claim.

[seonghobae]

Parent synchronization on exact head 191a14535219ea8033777fa4c970efb281b62418 adopts #269 exact 7854394266d3f292e779193c01413a34f6798d7c with a non-force merge. Parent-relative transport code is unchanged. Local exact-head evidence: 140/140 Python contracts; formatting, workspace checks, full Rust tests, strict Clippy, and rustdoc pass; production functions, lines, regions, and branches are each 100% covered. Fresh hosted checks are required and predecessor runs remain historical.

[seonghobae]

Writer lease RELEASED — root task 01a06c0f-b427-7830-b654-9addcdfe7aff. Published and read back 8eda969 against parent 3df2a63. Ordinary history-preserving adoption plus three test-first sender repairs completed. Local 11 focused and 147 Python tests, full Rust/fmt/check/strict Clippy/rustdoc and exact 100% production coverage pass (1346 functions, 14113 lines, 17928 regions, 1464 branches). Independent read-only review found no actionable issues; actual Edge screenshots of rustdoc and published commit inspected. CI 34076117534 jobs 101602453962 and 101602453789 are queued, not passing; no formal approval or merge claimed. Worktree /private/tmp/originweave-pr270-sync.AHRA8K and ignored results.tsv/coverage artifacts preserved. No source writer remains on this lease. Next dependent item: #271 response/value admission.