test(browser): stage controlled Agent Task without workflow mutation

[seonghobae]

Why this split exists

PR #70 contains valid controlled Agent Task browser work and a leaf .github/workflows/mv3-compatibility.yml mutation. Protected-main AGENTS.md reserves workflow changes for the authorized workflow-owner path, so #288 retains browser/test/documentation work while #212 owns workflow/sandbox activation. Raw WebDriver/ChromeDriver protocol diagnostics remain #148 authority.

Exact lineage

• protected base: main@87c4daa1830bac5a5228b6036752ad5633232085;
• page-derived diagnostic repair lineage through 88abfe308def92ef88fde54f4200b56149e36854;
• extension requested-vs-observed repair through 46f90e941c03dd12b6f0a25a3503d404426f013a;
• initial causal-transition repair through e1dd50999cd3a52977179047e8d5d77a2e85aef9;
• immediate pre-click causal RED: 07540f0cdb3178998d305382d9176cccaeabce57;
• production repair: 942e4c1a44119384d01ee4c7ec4168e6c5ab38b5;
• successful evidence-double alignment: 3d3166ec1e3a7c5aaee1f2dae92f09a7acc294f4 and efca7d69c3bbc459bc218b9142a6dd4e58828076;
• traceability: f82eb097035b6dc4819345f2f827466283f906cf;
• current TEST_STRATEGY checkpoint: 81b7869dbfaa9927a7cea0c02698c8544d0ea056.

The branch remains Draft and mergeable. This lineage does not modify .github/**, workflow/ruleset/secrets, browser version, trial denominator, sandbox configuration, provider/model authority, base, release state, or #148 protocol diagnostics.

Buyer-visible browser evidence boundary

The controlled Agent Task fixture uses pinned Chrome for Testing / ChromeDriver, browser-computed textbox/button role and accessible name, native WebDriver clear/type/click, browser-observed page state, exact synthetic input echo, URL stability, session cleanup, and profile deletion. WebDriver command acknowledgement is not task success. Page-derived values remain untrusted observation and are not policy or instruction authority.

--disable-extensions is launch intent only and remains extensions_disabled_requested; it is not counted as verified extension isolation without independent browser observation.

Click-causal transition repair

The first causal repair observed #task-result as exact data-state="idle" plus rendered idle before clear/type/click and required pre_action_baseline_verified. That closes a fixture already pre-fired at navigation time, but it did not prove the submit click caused the final transition: a regression could change the result while the WebDriver value command was typing and leave submitted plus the expected echo already satisfied before click.

07540f0c... adds the test-first contract for a second closed baseline after "/value" and before "/click". 942e4c1a... minimally repairs production by re-reading the existing result element after typing and submit-target semantic verification, immediately before click, and reusing _validate_agent_task_pre_action_state. Successful evidence now records pre_click_baseline_verified: true; _agent_task_surfaces_complete requires both baseline witnesses. 3d3166ec... and efca7d69... update successful test doubles rather than weakening that predicate.

The accepted sequence is therefore idle before input → native clear/type → idle immediately before click → native click → page-observed submitted + exact synthetic echo → URL stability → cleanup. Unexpected page-controlled baseline values remain locally compared and are not serialized into CI diagnostics.

Review 5147463445 records the test-first finding on 07540f0c...; current-head COMMENT review 5147534162 records the minimal repair and documentation alignment. Neither is approval or executable browser GREEN.

docs/traceability/agent-task-action-transition-evidence.md and docs/TEST_STRATEGY.md are code-current for the two-baseline causal rule and retain the W3C WebDriver 2 Working Draft (2 July 2026) provenance. The stronger causality requirement is an OriginWeave evidence invariant above WebDriver command completion.

Exact-head verification state

For exact 81b7869dbfaa9927a7cea0c02698c8544d0ea056 at the latest read:

• CI 34284661457: terminal skipped because this PR is Draft;
• Manifest V3 Compatibility 34284661449: terminal skipped for the same Draft policy;
• CodeQL PR 34284661463: pending;
• SAST Semgrep 34284661408: queued;
• Security Scan 34284661384: queued;
• Devin Review and CodeRabbit commit statuses are success, but those statuses do not substitute for executable repository/browser gates.

The new regression is test-first/source-semantic evidence, not claimed hosted RED. Draft-policy skips and predecessor runs are not exact-head GREEN. Full Python repository contracts, rustfmt/workspace tests, strict Clippy, rustdoc, exact owned-production 100% coverage, current-head security/governance verdicts, and sandbox-enabled pinned-Chromium execution remain required.

Remaining owner path

#212 owns the current-generation least-privilege chrome_sandbox workflow activation. The exact 81b7869d... consumer handoff is recorded in #212 comment 5592582108. Once authorized, replay the exact successor lineage on Chrome/ChromeDriver 150.0.7871.129 for three independent trials and require the full two-baseline action transition plus URL stability and session/profile cleanup.

Command ACK, launch-argument intent, mock output, cleanup alone, skipped jobs, or another head's browser result are insufficient. Keep Draft until exact consumer evidence and the active ruleset are satisfied. Do not restore --no-sandbox, disable Ubuntu security restrictions runner-wide, reduce trials, copy #148 source, force-push, destructively rebase, self-approve, bypass, weaken workflows/rulesets/secrets, mark Ready, merge, tag, release, or close predecessor work before every valid delta is fully adopted by an authorized owner.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head review on e051a3d06a613233781272ffdc0e564023ba52b0: this successor is directly based on protected main@87c4daa1830bac5a5228b6036752ad5633232085, 1 ahead / 0 behind with merge base exactly main, and contains the nine reviewed non-workflow #70 blobs only. No .github/** delta is present. CI 33931732869 and MV3 33931733072 completed skipped because this PR is intentionally Draft under #286; that is expected admission behavior, not GREEN. Security 33931732996, Semgrep 33931732911, and CodeQL 33931732899 remain queued. Product acceptance is still a hosted sandboxed pinned-Chromium execution proving semantic observation → native action → page-observed post-condition → cleanup; ACK-only success and --no-sandbox remain rejected. #212 owns the missing workflow activation/setup.

[seonghobae]

Exact-head local review on e051a3d06a613233781272ffdc0e564023ba52b0: the focused Agent Task runner/cleanup suite yields 20 passing tests plus 26 subtests and one intentional workflow-owner RED, test_pinned_chrome_installs_its_linux_sandbox_helper, because protected-main mv3-compatibility.yml still lacks the authorized chrome_sandbox ownership/mode setup. The workflow-free split correctly leaves that failure visible; I did not weaken the test or add a leaf .github/** mutation. Code inspection confirms the product path uses semantic role/name checks, native clear/type/click commands, observed state/input/URL postconditions, bounded failure evidence, session cleanup, and observed profile deletion. Keep Draft until #212 supplies the workflow-owned setup and exact hosted pinned-Chromium execution.

[seonghobae]

정확한 head 39e36256에서 workflow-free 경계를 바로잡았습니다. PR 자체에는 .github/** 변경이 없는데 sandbox-helper 설치를 현재 워크플로에 요구하던 계약이 전체 Python 검증을 실패시켰습니다. 해당 assertion을 제거하고 문서/CHANGELOG를 #212의 별도 workflow activation 전제로 수정했습니다. python3 -m unittest discover -s tests -p "test_*.py" 172개 통과, git diff --check 통과. 이 결과는 runner source contract GREEN이며 hosted sandbox-enabled Chrome 실행 증거는 아닙니다; Draft 유지가 맞습니다.

[seonghobae]

Exact-head security finding: the new tests/test_mv3_browser_sandbox_contract.py is intentionally RED on this generation. _run_agent_task_browser_pass is sandbox-preserving, but ordinary _run_browser_pass still contains "--no-sandbox". This reintroduces a security/evidence behavior already causally repaired in #43 by a45c83e4d8988fe89920ecb6a9eac469815f5b9b, whose minimal production change was removal of that one launch override. Do not import #43's broader runner/download delta and do not mutate .github/** from this scheduled product lane. Repair only the ordinary launch argument, preserve the new two-path regression, then require complete current-head Python GREEN plus #212-owned sandbox-helper workflow setup and fresh pinned-Chromium execution. Draft/skipped hosted jobs are not GREEN.

[seonghobae]

Current-head review: doctoring now records the Chromium primary-source security boundary and exact owner path, but this generation is intentionally still RED. tests/test_mv3_browser_sandbox_contract.py requires both real-browser launch paths to omit --no-sandbox; ordinary _run_browser_pass has not yet adopted the reviewed #43 one-line causal repair. Do not call this head GREEN. The safe next product mutation is the narrow runner-line removal only; #212 remains responsible for .github/** sandbox-helper setup and hosted sandboxed Chrome evidence.

[seonghobae]

Exact-head repair verification: the test-first sandbox contract is now source-level GREEN. Current ordinary MV3 Chrome options and Agent Task Chrome options both omit --no-sandbox. The two repair commits after doctoring have one net semantic line of delta versus 99fea898...: deletion of the ordinary launch override; the intermediate accidental diagnostic wording change was immediately restored by 0f434bc.... This adopts #43's causal invariant without importing its unrelated downloads/diagnostic tree. Keep Draft: protected #286 skips native CI/MV3 for Drafts, and #212 still owns the hosted chrome_sandbox setup needed for real pinned-Chromium GREEN. Skipped/absent hosted evidence is not acceptance.

[seonghobae]

Fresh RCA for the exact-head CodeQL failures: jobs 101353184730/101353184743/101353184772 in run 33976968519 are not reporting a discovered OriginWeave source finding. Each successfully dispatched the central CodeQL request, then deliberately failed with VERDICT_STATE=pending and the message that the dispatch workflow would publish a terminal verdict and rerun the exact job. The current head fd589cd693946ef1ce2c9270c2dfb6a1087bdfb9 still has no authenticated codeql-dispatch/<language> terminal commit status.

Canonical owner is ContextualWisdomLab/.github#1929, which already records the remaining cross-repository terminal-status publication proof/403 repair. Keep this Draft and fail closed; do not mutate OriginWeave source, add a leaf CodeQL shim, mark the pending dispatch as success, or transfer another head's scan. After #1929 produces an immutable central GREEN contract, rerun/re-materialize CodeQL on this unchanged exact head before interpreting any remaining result as a product finding.

[seonghobae]

Writer lease ACTIVE — exact fd589cd693946ef1ce2c9270c2dfb6a1087bdfb9, bounded to credential-safe WebDriver failure evidence in the workflow-free controlled Agent Task runner. Fresh source review found _json_request still embeds raw HTTP response bodies / value.message in RuntimeError, and post-condition failure paths can echo page-derived text. Scope: test-first require closed-vocabulary WebDriver protocol errors and no raw remote/page diagnostic retention, then make the minimum runner repair if the RED is reproduced. Preserve sandbox-enabled launch, controlled native action/post-condition semantics, 3-trial evidence, main@87c4daa... base, Draft state, and #212 workflow authority. No .github/**, workflow/ruleset/secret, Ready, merge, tag, release, force update, or destructive rebase.

[seonghobae]

Exact-head security RED on a71af97982b5e25cefc9f828501e610be636a875: the controlled Agent Task lane already treats page content as untrusted, but the ordinary MV3 evidence path still serializes page-derived values into CI exceptions. _exercise_real_click raises real click post-condition failed: {text!r}, and _wait_for_extension_evidence raises with observed={latest!r}. Those values originate from WebDriver/page observations and therefore may decide pass/fail but must not become diagnostic payload. Commit a71af979... adds behavioral regressions that inject a hostile marker and require stable closed diagnostics (real click post-condition failed, MV3 fixture did not converge) with no marker retention. This is intentionally test-first; current production is expected to fail both contracts. Minimal causal fix is to keep the observed values only in the local comparison state, emit no raw observed/page text on mismatch/timeout, and preserve the existing real-browser post-condition, 3-trial denominators, sandbox-enabled launch and cleanup semantics. This finding is separate from #148's ChromeDriver process/protocol diagnostic lane and does not authorize copying its active source or touching .github/**.

[seonghobae]

Writer lease RELEASED — exact a71af97982b5e25cefc9f828501e610be636a875. The bounded page-derived diagnostic security RED is published as tests/test_mv3_page_diagnostic_redaction_contract.py; exact source still leaks mismatched click text and the latest MV3 page/extension dataset into exception strings, so no GREEN is claimed. Review 5145940009 and the PR body record the minimal source repair: keep observations for local comparison only and emit stable closed diagnostic messages. CI 34267147100 and MV3 34267147050 are skipped under Draft policy; security workflows remain independent evidence. No .github/**, source production, workflow/ruleset/secret, Ready, merge, tag, release, force update, or destructive rebase mutation was made in this slice. No source/docs/PR-state authority is retained.

[seonghobae]

PR-state lease ACTIVE — exact a71af97982b5e25cefc9f828501e610be636a875, status-only refresh. Security Scan 34267147052 and Semgrep 34267147066 have now completed success; CodeQL 34267147014 remains queued; CI/MV3 remain Draft-policy skipped. Scope is only to make the PR evidence paragraph current. No source/docs/workflow/base/Ready/merge mutation.

[seonghobae]

Exact-head follow-up on c4ed05d94ad29621265c38a2458eee8e1cdcc59d: the extension-isolation evidence finding is repaired without manufacturing a browser observation. Test-first 380aa4899846730415f729d4796330e5ca693c42 requires the Agent Task launch request to be named separately from verified surfaces; e2230f6ee90e4b40b14439c186cdf035321bdd9a keeps --disable-extensions but records it as extensions_disabled_requested metadata and removes it from _agent_task_surfaces_complete; 922e8ba38c507fe8b48049b21ec3a5b414fd5ed9 makes the non-transitive semantics explicit; c4ed05d94ad29621265c38a2458eee8e1cdcc59d aligns CHANGELOG. The actual observed acceptance surfaces remain semantic role/name, native action outcome, exact synthetic echo, URL stability, and profile cleanup. Draft-policy CI/MV3 skips are not executable GREEN, so keep Draft until #212 supplies the authorized sandbox-helper workflow and a fresh pinned-Chromium run.

[seonghobae]

Current-head readback on 46f90e941c03dd12b6f0a25a3503d404426f013a: the requested-vs-observed extension-isolation repair remains intact, and the two pre-existing test doubles now use extensions_disabled_requested rather than the retired verified-surface spelling. This child changes tests only; it does not add browser observation, workflow authority, or executable GREEN. Verified Agent Task completeness still depends only on browser-computed semantics, native action/post-condition, exact synthetic echo, URL stability, and profile cleanup. Keep Draft until the authorized #212 workflow path supplies sandbox-helper activation and a fresh exact-head pinned-Chromium 3-trial run.

[seonghobae]

Writer lease RELEASED — exact 46f90e941c03dd12b6f0a25a3503d404426f013a. The requested-vs-observed extension-isolation evidence repair is code/test/docs/PR-state current: test-first 380aa489..., production e2230f6e..., non-transitive regression 922e8ba3..., CHANGELOG c4ed05d9..., Documentation Fitness c6d2126e..., and legacy test-double alignment 46f90e94.... Exact reviews 5146523294 and 5146578456 are recorded. CI/MV3 remain Draft-policy skipped; Semgrep/Security are success; CodeQL 34273724504 is the existing central dispatch/verdict-materialization failure handed to .github#712 comment 5591319733. #212 owns workflow/sandbox activation. No .github/**, workflow/ruleset/secret, base, Ready, merge, tag, release, force update or destructive rebase authority is retained.

[seonghobae]

Writer lease ACTIVE — exact 46f90e941c03dd12b6f0a25a3503d404426f013a, source/tests/docs/PR-state bounded to the next controlled Agent Task evidence-validity finding. Fresh exact-source review shows the runner verifies data-state=submitted and the exact synthetic echo only after the native click, but does not prove those post-condition surfaces were false before the action. A fixture regression or pre-fired script could therefore make an action lane pass without establishing action→state transition causality. Scope: test-first require a browser-observed pre-action baseline (data-state not submitted and result text not already equal to the synthetic input), then minimally preserve the existing native clear/type/click and post-action checks while recording the causal-transition evidence. Preserve sandbox-enabled launch, 3-trial denominators, page-derived diagnostic redaction, #148 WebDriver protocol-diagnostic authority, #212 workflow/sandbox authority, protected main@87c4daa1830bac5a5228b6036752ad5633232085 base and Draft state. Intervening commits will be adopted. No .github/**, workflow/ruleset/secret, Ready, merge, tag, release, force update or destructive rebase.

[seonghobae]

Exact-head finding on b9707975a605347b573b992cfe178150feda6a95: the controlled Agent Task lane proves a page-observed submitted state and exact synthetic echo after the native click, but it never proves those success surfaces were false before the action. A pre-fired fixture or regression can therefore satisfy the post-action assertions without establishing that the WebDriver action caused the state transition. Test-first tests/test_agent_task_action_transition_evidence_contract.py now requires a closed, non-echoing pre-action validator, baseline observation before "/click", and a pre_action_baseline_verified surface that is mandatory for _agent_task_surfaces_complete. Minimal repair: observe #task-result before typing/clicking, fail closed if data-state is already submitted or result text already equals the synthetic task input, then keep the existing semantic checks, native clear/type/click, URL-stability check, submitted-state check, exact echo, cleanup and 3-trial denominator unchanged. Do not treat command ACK as success, do not serialize page-controlled baseline values into diagnostics, and do not move this into #148 protocol diagnostics or #212 workflow/sandbox authority. This is a source-semantic/test-first RED; Draft policy skipped CI/MV3 on this exact head, so no hosted RED or browser GREEN is claimed.

[seonghobae]

Current-head review on 2e1ca45266bfc64e17e6d40e0a4b5bb2aa587a2e: the causal post-condition ambiguity identified in review 5147216471 is minimally repaired in source commit 8b7aa28ecf7acb1e3f3b2dcadd4cb3cbf59ea01f. The runner now observes the controlled #task-result baseline (data-state=idle, rendered text idle) before clear/type/click, rejects any unexpected/pre-fired state with one closed diagnostic that does not echo page data, preserves the native action and existing URL/submitted/exact-echo checks, and propagates pre_action_baseline_verified: true into per-trial evidence. Compare 4d61c2f...8b7aa28 changes only scripts/ci/run_mv3_compatibility.py by 25 added lines; no workflow, trial denominator, sandbox flag, protocol-diagnostic owner, or post-condition criterion changed. docs/traceability/agent-task-action-transition-evidence.md pins the repair and the W3C WebDriver 2 Working Draft dated 2026-07-02. This is not approval or browser GREEN: current CI/MV3 are Draft-policy skipped and current security/CodeQL lanes are still pending at this read. Fresh sandbox-enabled pinned-Chromium 3-trial execution remains required through #212.

[seonghobae]

Current-head follow-up on ec131617a2d90657911c6b072982b079c4a79fc2: the original causal-evidence finding is now closed at the acceptance predicate, not merely at evidence emission. Test-first 42a9a129... requires _agent_task_surfaces_complete to reject a successful-looking post-condition record that lacks the pre-action witness; ed6af6eb... updates the existing successful-trial doubles with pre_action_baseline_verified: true; production commit e1dd5099... adds exactly one acceptance line requiring that witness in every successful trial. Compare ed6af6eb...e1dd5099 changes only scripts/ci/run_mv3_compatibility.py by +1 line. The browser pass still proves the controlled idle/idle baseline before native clear/type/click and preserves URL, submitted-state, exact-echo, cleanup, trial denominator, sandbox, workflow, and #148 diagnostic boundaries. Traceability ec131617... records the stronger gate and W3C WebDriver 2 2026-07-02 provenance. No approval/browser GREEN is claimed: CI/MV3 are Draft-policy skipped and current security lanes are pending at this read.

[seonghobae]

Writer lease ACTIVE — exact 3dad88fb0c05ba9ec9950a7d4fc99857a6c829df, source/tests/docs/PR-state bounded to a causal browser-evidence finding. Fresh exact-source review shows the current baseline is observed before clear/type, while the claimed submit transition is accepted only after click. A fixture regression could therefore mutate #task-result during typing and still let the later click lane satisfy the same post-condition without proving click→submitted causality. Scope: test-first require an immediate browser-observed pre-click idle baseline after typing and semantic target verification, then minimally reuse the closed non-echoing baseline validator and make that witness mandatory in Agent Task surface completeness. Preserve native clear/type/click, exact echo, URL stability, cleanup, 3-trial denominator, page-derived diagnostic redaction, #148 protocol-diagnostic authority, #212 workflow/sandbox authority, protected main@87c4daa1830bac5a5228b6036752ad5633232085 base and Draft state. Intervening commits will be adopted. No .github/**, workflow/ruleset/secret, Ready, merge, tag, release, force update or destructive rebase.

[seonghobae]

Exact-head test-first RED on 07540f0cdb3178998d305382d9176cccaeabce57: the current runner observes the idle result before clear/type/click, but never re-observes that result after typing and immediately before the submit click. A fixture regression can therefore transition #task-result during input and leave the later click with an already-satisfied submitted/echo post-condition. tests/test_agent_task_action_transition_evidence_contract.py now requires a second closed baseline after "/value" and before "/click", plus a mandatory pre_click_baseline_verified witness in _agent_task_surfaces_complete. Minimal repair is to reuse the existing non-echoing idle validator on a fresh browser observation immediately before click, thread that boolean through trial evidence, and keep the existing semantic target, native click, submitted/exact-echo post-condition, URL stability, cleanup, 3-trial denominator, Draft state, and #212/#148 authority boundaries unchanged. This is source-semantic/test-first RED unless hosted checks execute it; Draft-policy skips are not RED execution evidence.

[seonghobae]

Exact-head follow-up on 81b7869dbfaa9927a7cea0c02698c8544d0ea056: the immediate pre-click causal-evidence RED from 07540f0cdb3178998d305382d9176cccaeabce57 is minimally repaired. Production 942e4c1a44119384d01ee4c7ec4168e6c5ab38b5 re-observes the existing #task-result after WebDriver typing and submit-target semantic verification, immediately before click, reuses the closed/non-echoing idle validator, carries pre_click_baseline_verified, and makes it mandatory in _agent_task_surfaces_complete. 3d3166ec... and efca7d69... align successful evidence doubles instead of weakening the new predicate. Traceability f82eb097... and TEST_STRATEGY 81b7869d... make the stronger sequence explicit: idle before input → idle immediately before click → native click → observed submitted/exact echo. No browser version, trial denominator, URL/post-condition, cleanup, extension-isolation semantics, sandbox/workflow, or #148 protocol-diagnostic authority changed. This is not approval or executable browser GREEN: exact CI/MV3 are Draft-policy skipped, and sandbox-enabled pinned-Chromium 3-trial evidence remains #212-dependent.

[seonghobae]

Writer lease RELEASED — exact 81b7869dbfaa9927a7cea0c02698c8544d0ea056. Bounded causal slice complete: test-first 07540f0c... requires the second browser-observed idle baseline after typing and immediately before native click; production 942e4c1a... implements it with the existing closed/non-echoing validator; 3d3166ec... / efca7d69... align successful evidence doubles; f82eb097... and 81b7869d... keep traceability/TEST_STRATEGY code-current. PR body and current-head review 5147534162 reflect the exact lineage. Executable repository/browser GREEN is not claimed because CI/MV3 are Draft-policy skipped and security/CodeQL lanes are still queued at last read. #212 has exact consumer handoff 5592582108 for authorized current-generation sandbox/helper activation and pinned-Chromium 3-trial replay. No source/docs/PR-state ownership retained after this comment.