test(mv3): prove bounded bookmark mutation compatibility

[seonghobae]

Partial implementation of #27, stacked on live PR #43.

Buyer-visible gap

The pinned real-Chromium MV3 lane previously proved bookmark API visibility without proving a controlled mutation lifecycle. A defensible compatibility claim also needs one synthetic create/read/delete bookmark cycle, bounded stage diagnostics, and residue cleanup without touching an ambient human profile.

Fresh live stack

Current exact prerequisite PR #43 head is 28e79febd47361c5fd41e45db7e1429b179afdd1 (test/mv3-downloads). Current exact child head is 03f8e37909d417548717dc50223d778b103945e1 (test/mv3-bookmark-mutation).

Fresh exact comparison #43 → #56 reports ahead 26 / behind 0, with merge base exactly the live prerequisite. The current child-owned semantic delta is exactly five files:

• scripts/ci/run_mv3_compatibility.py;
• tests/fixtures/mv3_basic/content_script.js;
• tests/fixtures/mv3_basic/service_worker.js;
• tests/test_mv3_bookmark_mutation_contract.py; and
• tests/test_mv3_bookmarks_history_contract.py.

The previously documented parent/head pair ecaac90f... / 70c2c364... and three-file delta are predecessor narrative only. No prerequisite/predecessor check or review transfers.

Implemented boundary

The controlled fixture:

• accepts only a parseable http://127.0.0.1/.../page.html sender with no embedded credentials;
• creates one deterministic compatibility bookmark;
• requires a non-empty returned bookmark identifier;
• reads the exact bookmark back and verifies identifier, title, and source URL;
• removes the bookmark in finally cleanup and fails compatibility evidence if cleanup fails;
• emits bounded bookmarksDiagnostic stage tokens for source rejection, create/get/id/title/url mismatch, remove failure, success, or not-evaluated state;
• allow-lists those bookmark diagnostic tokens in the runner and reduces unreviewed values to unexpected before evidence publication;
• retains separate history compatibility evidence;
• inherits the current test(mv3): prove real downloads compatibility #43 ChromeDriver status/executable/diagnostic/cleanup/startup-output hardening through exact stack ancestry; and
• emits only bounded readiness/stage evidence, never exception text or ambient bookmark contents.

The process proves Chromium compatibility only. It does not convert extension permission into OriginWeave Agent bookmark authority.

Exact-current evidence

On unchanged exact child head 03f8e37909d417548717dc50223d778b103945e1 against unchanged exact prerequisite 28e79febd47361c5fd41e45db7e1429b179afdd1:

• ancestry: ahead 26 / behind 0, merge base exactly the live prerequisite;
• semantic child delta: exactly the five files listed above;
• CI run 33201021332: success;
• Manifest V3 Compatibility run 33201021375: success;
• current formal reviews are comments on predecessor heads, not qualifying approval;
• all current review threads are resolved; and
• GitHub reports the PR Draft and mergeable.

Feature-base organization security/review workflows not executed for this exact head are absent evidence, not passing. No prerequisite, predecessor, queued, skipped, cancelled, synthetic, status-only, or model-only result is promoted as current proof.

Scope / governance

This is compatibility evidence only. It does not grant OriginWeave Agent bookmark authority, expose a general bookmark tool, mutate a human profile, add model calls, create persistence ownership, or complete the full issue #27 extension matrix. Chromium permission and browser compatibility remain separate from OriginWeave Agent capability/policy authority.

Keep Draft while #43 remains active. #43 itself is materially diverged from protected main and contains a workflow-authority delta owned by issue #212, so this child must not be treated as integrated-main evidence. Protected-main AGENTS.md forbids this scheduled actor from merging, self-approving, altering workflows, adding secrets, weakening checks, tagging, or publishing.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cursor]

Stale comment

Review — PR #56 bookmark mutation

Verdict: the create → get → remove lifecycle is the right compatibility slice, and the pinned-Chromium MV3 fixture job on 82403ec already succeeded. This draft is still not merge-ready as an operator-actionable close.

What is sound

• Mutation is bound to http://127.0.0.1/page.html without userinfo.
• finally always attempts chrome.bookmarks.remove.
• Raw _error.message is not retained.
• Chrome bookmarks permission is not treated as an OriginWeave Agent grant.
• Stacked draft on #43 / test/mv3-downloads is the correct dependency order.

What still blocks a buyer-visible close

Bookmark failures collapse to bookmarks: missing with no classified stage. Downloads already emit allow-listed tokens (download-source-rejected, download-complete-ready, …). Without the same contract here, an operator cannot tell source rejection from create failure, get mismatch, or leftover residue after remove fails.

The unique commit also omits the current chrome.bookmarks APA 7th primary citation that the downloads lane already requires.

Next action

Do not merge this draft while #43 is still the prerequisite and while bookmark failures stay unclassified. The diagnostic close is on cursor/bc-62f8754b-f579-4115-9089-cace87f78155-206a (054708a): allow-listed bookmark stage tokens, runner sanitization, and the current Bookmarks API citation. Keep #59/#60/#61 stacked behind that close. Compatibility success remains evidence only — not Agent bookmark authority.

Cannot approve: this identity authored the head. Formal approval stays with an eligible non-author reviewer if current rules require one; solo-maintainer independent-review remains on hold.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Review — exact head cea76b9e129d02a093ae237804e47ee3a4a08a6c

The new commit only realigns this draft with the downloads transport-protocol classification. The buyer-visible diagnostic gap is unchanged: exerciseBookmarkMutation still returns a boolean, so create failure, get mismatch, and leftover residue after remove all collapse to bookmarks: missing.

Prior threads remain not addressed on this head:

• allow-listed bookmark stage tokens (bookmark-source-rejected … bookmark-complete-ready)
• runner sanitization of bookmarksDiagnostic (raw Chrome errors / fixture titles → unexpected)
• current chrome.bookmarks APA 7th primary citation

Pinned Chrome for Testing MV3 fixture already succeeded on this head. Rust contracts and Production coverage were still in progress at review time and are not treated as passing.

Next action

Do not merge this draft. Keep #43 as the downloads prerequisite. The diagnostic close is #178 44cbfc2 (test(mv3): require bounded bookmark mutation diagnostics). Do not open a third bookmark-diagnostic pull request. Keep #59/#60/#61 stacked behind that close. Compatibility success is not OriginWeave Agent bookmark authority.

Cannot approve: this identity authored the head. Formal approval stays with an eligible non-author reviewer if current rules require one; solo-maintainer independent-review remains on hold.

  

_{Sent by Cursor Automation: Fix Issues}