test(browser): execute controlled Agent Task on pinned Chrome

[seonghobae]

Buyer-visible boundary

This Draft established the controlled Agent Task browser lane through pinned Chrome for Testing / ChromeDriver: semantic textbox/button discovery, native clear/type/click, same-document submitted post-condition, exact input echo and URL stability, followed by observed temporary-profile cleanup. A WebDriver command ACK alone is never success evidence. The lane deliberately does not pass --no-sandbox.

Executed browser RED

Hosted Manifest V3 run 33887386759, job 101070423144, used pinned Chrome for Testing / ChromeDriver 150.0.7871.129 on Ubuntu 24.04. The ordinary MV3 fixture remained 3/3 successful; the sandbox-enabled Agent Task browser failed WebDriver session creation in all 3 trials (AgentTaskSessionStartError, 0/3), so the repeatability gate failed. That is valid causal RED, not a reason to disable the sandbox or weaken the trial/post-condition contract.

The source repair at exact branch head 77eb0f2ee71783e06171784b7173c0b4cd530e61 installs the archive's chrome_sandbox with root ownership and mode 4755 and adds focused sandbox contracts. Chromium sandbox guidance and the owner-path rationale remain routed through #212.

Live ancestry and ownership split

Protected main has advanced to 87c4daa1830bac5a5228b6036752ad5633232085 through #286. This historical branch is now 39 ahead / 1 behind current main, with merge base 4ed08bfa7c063fc7f2ef9278ee8d281887b8296b; it is therefore not a current-main integration candidate as-is.

More importantly, this branch mixes a valid nine-path product/test/documentation delta with .github/workflows/mv3-compatibility.yml, which this scheduled product writer is not authorized to own. That repair has now been split non-destructively:

• workflow-free product successor: Draft test(browser): stage controlled Agent Task without workflow mutation #288 exact e051a3d06a613233781272ffdc0e564023ba52b0;
• test(browser): stage controlled Agent Task without workflow mutation #288 base: current protected main@87c4daa..., 1 ahead / 0 behind, merge base exact main;
• test(browser): stage controlled Agent Task without workflow mutation #288 carries the reviewed CHANGELOG.md, documentation/traceability, scripts/ci/run_mv3_compatibility.py, Agent Task sandbox/post-condition contracts, and cleanup contract as nine exact source blobs;
• test(browser): stage controlled Agent Task without workflow mutation #288 carries **no .github/** mutation; and
• [Governance] Repair MV3 workflow ownership and sandbox contract #212 remains canonical owner for the remaining workflow trigger/sandbox-helper admission needed to execute the Agent Task lane in hosted MV3 CI.

PR #70 therefore remains open only because the workflow-authority delta has not yet been fully adopted by an authorized successor. Do not simply Close it: first verify that #288 preserves all nine non-workflow paths and that #212's eventual workflow successor preserves the remaining .github/workflows/mv3-compatibility.yml semantics and produces fresh hosted browser evidence.

Verification truth

The earlier exact 77eb0f2e... current-generation runs are historical to #70 and cannot be transferred to #288. #288 was intentionally opened Draft, so its initial native CI/MV3 runs are expected to be skipped under #286; skipped is not GREEN. Security/SAST/CodeQL evidence and, after owner workflow activation, real pinned-Chromium execution must be evaluated on the exact successor generation.

The acceptance behavior is unchanged: sandboxed session starts, semantic observation identifies the intended controls, native actions execute, the page-observed post-condition and input echo/URL invariants hold, and temporary browser state is cleaned up after both success and failure. --no-sandbox, disabling Ubuntu's restriction globally, reducing the three-trial gate, or treating an ACK as task success are rejected repairs.

MCP, policy, secret, quarantine/isolation-runtime, outbound-network authority, and release/publication remain outside this runner. Protected-main AGENTS.md and live GitHub governance remain authoritative; no merge, self-approval, bypass, force-push, destructive rebase, workflow/ruleset/secret weakening, tag, release, or publication is authorized here.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: ebc12fb3-d830-4d81-8be7-fb9173692e57

📥 Commits

Reviewing files that changed from the base of the PR and between f7caa9f and 0dcf9f2.

📒 Files selected for processing (2)

• scripts/ci/run_mv3_compatibility.py
• tests/test_webdriver_session_cleanup_contract.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

pinned Chrome과 실제 WebDriver로 Agent Task fixture를 실행하는 CI 경로를 추가했습니다. 입력, browser-computed role/name, post-condition, URL 유지, 프로필 정리와 반복성 결과를 검증합니다. truncated response와 cleanup 실패를 bounded evidence로 기록합니다.

Changes

Agent Task pinned Chrome 실행

Layer / File(s)	Summary
WebDriver 정리 및 명령 계약 scripts/ci/run_mv3_compatibility.py, tests/test_webdriver_session_cleanup_contract.py, tests/test_agent_task_pinned_chrome_contract.py	요소 조회와 요소 명령 경로를 중앙화했습니다. 세션 cleanup 오류는 기본 브라우저 오류의 원인을 보존합니다. WebDriver 세션 삭제 요청의 본문 계약을 검증합니다.
Agent Task 브라우저 trial 흐름 scripts/ci/run_mv3_compatibility.py, tests/test_agent_task_pinned_chrome_contract.py	격리된 프로필과 확장 비활성화 환경에서 browser-computed role/name을 확인한 뒤 입력과 제출을 수행합니다. submitted 상태, 입력 echo, URL 유지와 프로필 제거를 검증합니다.
Runner 오케스트레이션 및 evidence scripts/ci/run_mv3_compatibility.py, tests/test_agent_task_pinned_chrome_contract.py	두 fixture 서버의 시작·종료 순서를 관리합니다. MV3 및 Agent Task trial 결과, pass rate, surface completeness와 실패 trial을 evidence와 gate에 반영합니다.
계약 테스트 및 추적 문서 tests/test_agent_task_pinned_chrome_contract.py, tests/test_webdriver_session_cleanup_contract.py, CHANGELOG.md, docs/...	cleanup 실패, truncated response, 반복성 실패, 서버 정리 순서와 pinned Chrome 실행 계약을 테스트합니다. changelog, 테스트 전략, documentation fitness와 traceability 문서를 갱신합니다.

Estimated code review effort: 4 (Complex) | ~45 minutes

Merge Risk: ⚪ Minimal · up to 0dcf9

The controlled Chrome fixture now exercises Agent Task input, submission, semantic checks, and fail-closed cleanup with a bodyless WebDriver session deletion. No actionable current-head merge risk remains.

Sequence Diagram(s)

sequenceDiagram
  participant CI_Runner
  participant ChromeDriver
  participant pinned_Chrome
  participant Agent_Task_fixture
  CI_Runner->>ChromeDriver: Agent Task 세션 시작
  ChromeDriver->>pinned_Chrome: 확장 비활성화와 임시 프로필로 실행
  pinned_Chrome->>Agent_Task_fixture: fixture URL 로드
  CI_Runner->>ChromeDriver: role/name 조회
  CI_Runner->>ChromeDriver: 입력 clear, type, click 수행
  Agent_Task_fixture-->>CI_Runner: submitted 상태와 입력 echo 반환
  CI_Runner->>ChromeDriver: 세션 cleanup
  CI_Runner->>CI_Runner: 프로필 정리와 trial evidence 기록

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 72.22% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 54 functions across 3 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 pinned Chrome에서 제어된 Agent Task를 실행하는 핵심 변경을 정확하고 간결하게 설명합니다.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch test/agent-task-pinned-chrome-execution

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Security/realism finding on the exact current head: both _run_browser_pass and _run_agent_task_browser_pass launch pinned Chrome with --no-sandbox. That disables Chromium's process sandbox in the very lane being used as real-browser compatibility / Agent Task evidence. The controlled fixture reduces content risk, but it does not make sandbox-disabled execution equivalent to production browser isolation, and it cannot support a security-realism claim for the governed-browser runtime. Chromium's sandbox is a security boundary, not a cosmetic launch option.

Repair this rather than closing/suppressing the lane: add a focused contract/real-browser RED that forbids --no-sandbox for the Agent Task/security evidence path, then run pinned Chrome with its sandbox enabled. If the current CI host genuinely cannot start sandboxed Chrome, keep the existing lane explicitly compatibility-only and add a separate sandbox-capable runner/evidence lane; do not silently treat sandbox-disabled success as production-security evidence. Preserve the existing semantic observation → native input/click → same-document post-condition → exact echo/URL → cleanup checks. Also reconcile the branch with protected main@c789b802fc98a8d7fd8c09d9327f36828054d2a1 only through an authorized non-destructive path because #280 changed the workflow tree and this scheduled product writer does not mutate .github/**.

[seonghobae]

Current-head verification of review 5098613778: the production evidence runner is unchanged and still passes --no-sandbox to _run_agent_task_browser_pass. Commit 6b70c9d55a1e18a36af6385a788586d5d728a4b0 adds only tests/test_agent_task_chromium_sandbox_contract.py, which requires that exact function not disable Chromium's process sandbox. Because the new exact head has not yet executed on a runner, this is a test-first candidate RED, not an observed hosted RED and not GREEN. Keep the PR Draft. After the test actually fails on the exact head, remove the launch flag as the smallest causal product-test repair and require the pinned real-browser job to execute sandboxed before promotion. If the host cannot support Chromium sandboxing, split compatibility-only evidence from sandbox-capable security evidence rather than weakening the assertion.

[seonghobae]

Sandbox repair verification on exact head c631ec7f376836c482f2dc833dd80c09721ac208:

• The existing test-first contract in tests/test_agent_task_chromium_sandbox_contract.py rejects --no-sandbox inside _run_agent_task_browser_pass.
• The unchanged pre-repair source at 5040250e... reproduces that focused contract as RED because the Agent Task Chrome args contained --no-sandbox.
• Causal production repair 60b697095be510a129cfb61a3fd97790cf7a0679 removes exactly one line from scripts/ci/run_mv3_compatibility.py; compare is one file, 0 additions / 1 deletion. The separate _run_browser_pass MV3 compatibility lane remains unchanged, so this does not overclaim that lane's security evidence.
• Current Agent Task source no longer contains --no-sandbox, so the focused source contract is GREEN. docs/traceability/action-postcondition-evidence.md now records this boundary and keeps the PR Draft.
• This is not repository-wide or browser-E2E GREEN yet. Current exact-head CI/MV3/security workflows are queued, and sandbox-enabled pinned-Chromium execution must succeed before this finding can be considered closed for browser security evidence.

Do not reinterpret predecessor sandbox-disabled browser success as current security evidence, and do not weaken the contract if the hosted environment cannot start sandboxed Chrome; in that case the compatibility-only lane and a sandbox-capable security-evidence lane must remain distinct.

[seonghobae]

Current-head verification after the production repair and documentation reconciliation:

• Exact head: ba8926eed5a6d783f781684f30c900919eecd52b.
• Test-first Agent Task sandbox contract had a focused RED against the unchanged pre-repair source because _run_agent_task_browser_pass contained --no-sandbox.
• Causal source repair 60b697095be510a129cfb61a3fd97790cf7a0679 is exactly one deletion in scripts/ci/run_mv3_compatibility.py; current Agent Task launch preserves Chromium sandboxing while the distinct MV3 compatibility launch remains unchanged.
• Focused source contract is GREEN after that repair.
• docs/traceability/action-postcondition-evidence.md, docs/doctoring/mv3-compatibility.md, and CHANGELOG.md now state the compatibility/security distinction and cite Chromium's sandbox/debugging guidance rather than promoting predecessor sandbox-disabled runs.
• Browser-E2E/repository-wide GREEN is still not established: Manifest V3 33738452556, CI 33738452619, Security 33738452633, OSV 33738453024, Scorecard 33738452535 are queued; SAST 33738452541 is pending but its only returned job is still queued with no steps.

Keep Draft. The finding is closed at source-contract level only after a sandbox-enabled pinned-Chromium exact-head run proves semantic observation → native input/click → post-condition → exact echo/URL → cleanup under the repaired launch.

[seonghobae]

Fresh exact-head integration finding: the Agent Task source repair is internally correct (_run_agent_task_browser_pass no longer passes --no-sandbox), but the current protected-main MV3 workflow used by this same script does not configure the pinned Chrome for Testing setuid sandbox helper. The workflow extracts chrome-linux64, chmods only chrome/chromedriver, and exports only CHROME_BIN/CHROMEDRIVER_BIN; it does not chown/chmod chrome_sandbox or set CHROME_DEVEL_SANDBOX. #43's repository contract already makes that missing canonical workflow setup explicit, and issue #212 now owns the workflow-owner repair.

Therefore do not treat the current queued MV3 run as merely waiting for a source verdict that can become security GREEN unchanged. The exact-head security acceptance for #70 depends on the authorized canonical sandbox-helper workflow repair first, followed by a fresh sandbox-enabled pinned-Chromium Agent Task run preserving semantic observation → native input/click → post-condition → exact echo/URL → cleanup. Do not restore --no-sandbox, weaken the source contract, or add a leaf workflow mutation here. Keep Draft until the owner prerequisite and fresh E2E are both proven.

[seonghobae]

RCA/update for exact head 823e2e29acdbc9a16da733c5a6fc7b9f85cc7527:

• The Rust contract failure was a missing CHANGELOG boundary sentence; restored the required statement that this fixture evidence does not claim a shipped OriginWeave browser adapter.
• The pinned-Chrome job proved MV3 3/3 but reduced every Agent Task failure to {passed:false}, preventing root-cause classification. Added credential-free failure_type evidence and a typed Agent Task session-start boundary without exposing ChromeDriver text.
• Adopted protected main 4ed08bfa7c063fc7f2ef9278ee8d281887b8296b.
• Local verification: 172 Python contracts; workspace fmt, Clippy -D warnings, all-target tests, and rustdoc tests passed.

The PR remains Draft while the new exact-head pinned-browser run identifies or clears the sandbox-enabled session-start failure.

[seonghobae]

RCA and repair on exact prior head 823e2e29acdbc9a16da733c5a6fc7b9f85cc7527: the pinned Chrome job completed all three MV3 trials but every sandbox-enabled Agent Task session failed at startup. The raw Chrome for Testing archive did not install its bundled Linux chrome_sandbox helper with Chromium-required root ownership and mode. Commit 77eb0f2e adds a failing-first workflow contract, installs that existing helper as root:root mode 4755, and broadens path triggers to the Agent Task fixture/contracts without adding --no-sandbox. Local verification: 28 focused tests and the full 173-test unittest suite passed; git diff --check and actionlint passed. Exact-head hosted-browser execution remains the authoritative acceptance gate.

[seonghobae]

Current-head browser-security review: predecessor MV3 run 33887386759 is a real hosted RED for the sandbox-enabled Agent Task lane (0/3 session starts) while the ordinary MV3 fixture remained 3/3. Exact current 77eb0f2e... is one commit beyond that RED, 0 behind main@4ed08bfa..., and adds the pinned chrome_sandbox root/mode setup plus scoped contract/docs. The current workflow delta is a repair/ownership finding, not a Close condition; #212 owns canonical sandbox workflow setup. Exact current MV3/CI/security jobs are queued, so do not transfer predecessor failure or call the helper repair GREEN until the unchanged head runs the real post-condition/cleanup sequence with sandboxing enabled.