fix(mv3): redact browser-derived evidence diagnostics

[seonghobae]

Repair finding

#281 and #43 were previously parallel direct-main writers of the same Manifest V3/WebDriver evidence runner. That topology was repaired by making #43 the foundation and this PR the dependent diagnostic-evidence contract. This remains a single-writer/wrong-base repair finding, not a reason to close either PR.

Current non-destructive stack

Live base is now test/mv3-downloads@6f3134d18d3118aab33d28048671dc71a5f47b77; current #281 head is adaca6427d68f550b39293a69b7c733430d1c385, open, Draft, mergeable, and 0 behind the declared base. The current merge commit adopted the moved #43 branch non-destructively; no force-push or destructive rebase was used.

Fresh exact base→head compare remains clean: the child semantic delta is only two files — tests/test_mv3_fixture_evidence_redaction_contract.py (+175) and docs/doctoring/mv3-compatibility.md (+5/-1). There is no child .github/**, production-source, Chromium launch-option, policy-authority, ruleset, provider/model, or secret delta. #43's browser/runtime implementation is inherited rather than copied.

Parent ownership blocker

The moved #43 base now contains commit 6f3134d18d3118aab33d28048671dc71a5f47b77, which adds the correct sandbox-helper mechanics (root:root, mode 4755, CHROME_DEVEL_SANDBOX) directly to .github/workflows/mv3-compatibility.yml. Those three lines match the earlier hosted RED but currently live in the leaf product branch instead of the authorized workflow-owner path required by protected-main AGENTS.md and issue #212.

That parent delta is a valid candidate that must be preserved, not discarded. #43 review 5112764360 and issue #212 comment 5540222475 record the required repair: canonical workflow owner adopts the three-line sandbox fix or an equivalent reviewed implementation; #43 then restacks non-destructively onto that canonical generation; #281 follows the repaired #43 generation without gaining independent workflow ownership.

Child contract

This PR retains the dedicated hostile-diagnostic regressions: page-/browser-/WebDriver-controlled text must not become published evidence; known diagnostic classes are reduced to locally owned or explicitly allow-listed values. It does not authorize browser actions, alter browser policy, or own the MV3 workflow.

Exact-current evidence

Current #281 exact-head runs are terminal on unchanged head adaca6427d68f550b39293a69b7c733430d1c385:

• Manifest V3 Compatibility 33866958819: success;
• CI 33866958820: success;
  • Rust contracts: success;
  • Production coverage: success.

There are 0 unresolved review threads. The PR remains Draft because the canonical #43 workflow-ownership repair is still a prerequisite.

No predecessor, source-inspection-only, queued, skipped, model-only, successful sibling job, or failure artifact is treated as GREEN, approval, protected-main shipment, or release. Keep Draft until the canonical #43 workflow ownership repair lands and both parent and child have independent exact-head verification.

Related: #27, #43, #70, #212, #238.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head maintenance review for 107d96eb1b484730cef3e45f0df6c297c486aaaa: the initial source/test-only delta had a documentation-completeness defect under live AGENTS.md. That repair is now present on the same canonical branch: 08cc9a7f... adds the W3C WebDriver diagnostic trust boundary to MV3 doctoring and 107d96eb... records the security change in CHANGELOG.md. The versioned 2026-07-02 WebDriver Working Draft defines remote message/stacktrace as implementation-defined and optional data can contain page-originated prompt text, so raw remote diagnostics are not audit-safe evidence. This is a COMMENT/evidence record, not approval. Exact-head CI/MV3/security remains non-terminal; CI 33748334671 has Rust contracts 100625904691 and Production coverage 100625905221 queued with steps=[] and no runner assignment, so keep Draft and do not promote local/predecessor evidence to repository-wide GREEN.

[seonghobae]

Current-head follow-up finding: the HTTP/protocol redaction is valid, but the same CI/audit evidence boundary still retains browser/page-controlled values elsewhere in run_mv3_compatibility.py. _wait_for_extension_evidence raises with observed={latest!r}, where latest is derived from WebDriver-executed DOM dataset values; _exercise_real_click raises with the actual returned element text. A controlled fixture narrows input today but does not make those remote/page values audit-safe, and the new doctoring explicitly treats browser-controlled diagnostics as untrusted evidence input. Add the smallest focused regressions that inject a token/path/URL into these two values, observe the failure, then replace raw echoes with fixed or allow-listed local classifications only. Keep this separate from the MV3 --no-sandbox compatibility condition and from #70's Agent Task sandbox lane; no workflow or browser-policy change is required.

[seonghobae]

Current-head recheck of review 5101657360: repaired. ca9386a... makes both page/DOM value-retention paths explicit; 3ed5d7e8... removes raw values while retaining only fixed/allow-listed local diagnostic classifications. The test-only → fix compare changes only scripts/ci/run_mv3_compatibility.py (+10/-2), and focused pre-fix RED / repaired GREEN reconstruction was observed for both injected token/path/URL cases. This is not an approval and not repository-wide GREEN: exact-head CI, MV3, SAST, Security, OSV, and Scorecard remain queued, so keep Draft.

[seonghobae]

Current-head security review found two remaining browser-derived diagnostic echoes in the same MV3 evidence boundary. _wait_for_driver stores a caught WebDriver/startup exception and interpolates its full text into the terminal timeout, so remote/control-plane text can reach CI evidence. _run_browser_pass also interpolates the WebDriver-reported browserVersion capability value on a pin mismatch. Both values are outside OriginWeave's locally owned diagnostic vocabulary and contradict this PR's documented fail-closed evidence-redaction boundary. Add realistic token/path/URL regressions first, then replace both echoes with fixed/local classifications while preserving startup/version enforcement semantics.

[seonghobae]

Exact-head follow-up for review 5106799956: test-only 8ab0c84643a4c761f873e193d65e39efd6a9fc28 adds representative token/path/URL regressions for startup-timeout exception text and WebDriver browserVersion mismatch diagnostics. Causal source repair 967990b6810f1a0aec2e9b5cba597e8456d5744f removes the stored/echoed startup exception and replaces the reported capability value with the locally owned pinned-version classification; compare from test-only to repair is one source file, +5/-7. Documentation head e5f10800a3a486aaeae8a29a37c0a79cc59c6b7e records the complete boundary. Focused reconstruction of the pre-fix expressions retains all injected markers; repaired expressions retain none. Repository-wide GREEN is not claimed: exact-head CI/MV3/security workflows are newly queued. No browser behavior, launch arguments, policy authority, workflow, ruleset, provider/model, or secret handling changed.

[seonghobae]

Fresh exact-head recheck: the only delta after review 5106824308 is the doctoring review-date refresh; implementation/test tree is unchanged from e5f10800.... Protected-main → current-head remains five files with no .github/**, and inline review-thread count is zero. The startup-exception and capability-value redaction finding remains repaired at source level, but exact-head CI, MV3, SAST, Security, OSV and Scorecard are still queued, so this is COMMENT-only and the PR remains Draft/non-GREEN.

[seonghobae]

Current-head repair review after canonical MV3 stack reconciliation. #43 exact e5db34c57d7b1de61d613a196117ca2cce296bec is the stronger downloads/sandbox/runtime foundation: it already sanitizes raw WebDriver HTTP/parser data, retains only allow-listed protocol codes and local failure kinds, maps hostile fixture values through _safe_surface_value, keeps click mismatch fixed, classifies startup failures without raw exception text, reports only the expected pinned browser version, and launches Chromium without --no-sandbox. Keeping #281 as a parallel direct-main writer would therefore duplicate the canonical runner and risk regressing the stronger sandbox/startup/cleanup boundary. Non-force two-parent restack 2111837d401d6c022135f19c963ce998be6d45ad preserved the full old #281 ancestry while adopting #43's tree; PR #281 was retargeted to test/mv3-downloads. Current exact 0b1ddf37aa7ff017ef0974b5304cd0ba30630231 differs from #43 by only two files: the dedicated hostile-diagnostic regression contract (+176) and current WebDriver doctoring (+5/-1). The four injected token/path/URL cases are satisfied by the inherited #43 source boundary on inspection; no production source, Chromium launch option, .github/**, ruleset, provider/model, or browser-policy authority is changed in this child. Hosted GREEN is not claimed: CI 33812293913 has Rust contracts 100836643402 and Production coverage 100836643541 queued with no steps, and MV3 run 33812293893 / job 100836642924 is queued. Keep Draft and parent-first: #43 exact-head browser/repository evidence must complete before #281 can be promoted. This is COMMENT only, not approval.