feat(core): fail closed on unsupported browser protocol capabilities

[seonghobae]

Partial implementation of #28 and Proposed ADR 0107, stacked on live PR #106.

Buyer/foundation gap

PR #106 makes browser protocol capabilities explicit metadata, but boolean supports alone leaves every caller to invent its own unsupported-capability error or fallback policy. ADR 0107 requires unsupported adapter capabilities to fail closed with typed errors before later browser use.

Live dependency / exact state

• protected main: 0841d2ab3d8b5e60a03c0a8e818cf438e2716829;
• exact prerequisite feat(core): declare versioned browser protocol capabilities #106 head: 1a13007b6cb43cff949b6bd09d69de0a02b327f6;
• exact feat(core): fail closed on unsupported browser protocol capabilities #107 head: 193f3a3843f7bbb92b8d720ba8e127a82f2dcb47;
• GitHub reports this PR open, Draft, mergeable, and based on feat/browser-protocol-capability-descriptor at the exact current feat(core): declare versioned browser protocol capabilities #106 head.

The branch was non-destructively aligned with the moved #106 prerequisite through merge commit 92fd4ab3be4c57c76395a0fcd9325ca0ea812590, preserving the capability-requirement implementation while inheriting the current descriptor and #40 authority lineage. Current head 193f3a... restores the capability-requirement changelog entry on top of the current prerequisite changelog. Keep Draft while #106/#40 remain active. No prerequisite check, review, status, coverage, mergeability, synthetic-merge, or predecessor-head evidence transfers.

TDD / implementation

1. Test-only head c0da8bd7537c0b242d9f6e6d38dce8ff42417032 established the missing versioned descriptor boundary on the predecessor stack.
2. Production added explicit WebDriver BiDi/CDP kind, separately bounded adapter/protocol/browser revision tokens, and a finite declared capability set.
3. Test-only head 8d2549cbad8cdabfe09a5ee61aa7a7ee1de81cc8 exposed caller-order-dependent capability-set identity; predecessor production canonicalized the set.
4. This slice adds BrowserProtocolAdapterDescriptor::require_capability and typed BrowserProtocolCapabilityRequirementError::UnsupportedCapability, so unsupported surfaces fail closed without protocol-family inference or silent fallback.
5. Current alignment preserves that contract while incorporating the exact current prerequisite stack rather than carrying stale predecessor authority code.

Implemented boundary

BrowserProtocolAdapterDescriptor::require_capability returns Ok(()) only for a capability explicitly present in the canonical descriptor and otherwise returns typed UnsupportedCapability(capability). The decision is independent of WebDriver BiDi versus CDP family and triggers no fallback or side effect.

Exact-current proof

On unchanged exact head 193f3a3843f7bbb92b8d720ba8e127a82f2dcb47 against exact live prerequisite 1a13007b6cb43cff949b6bd09d69de0a02b327f6:

• CI run 32044867924: success;
• Rust contracts job 95430530156: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 95430530084: exact owned-production function/line/region/branch enforcement success;
• Manifest V3 Compatibility run 32044867694: success;
• exact-head CodeRabbit commit status: success;
• formal reviews currently returned: none;
• inline review threads currently returned: none; and
• GitHub reports the Draft mergeable against its exact prerequisite base.

No predecessor-head, prerequisite-head, synthetic, skipped, cancelled, absent, pending, stale, status-only, or model-only evidence is promoted as current proof.

Review / governance boundary

This Draft has no qualifying independent latest-push approval. Passing automation, bot comments, author activity, prerequisite reviews, or model output are not approval. Live protected-main governance and AGENTS.md remain authoritative; this scheduled writer does not merge, self-approve, alter workflows, add secrets, weaken checks, tag, or publish.

Truth boundary

This slice is deterministic adapter metadata validation only. It does not authenticate or invoke BiDi/CDP, prove actual capability implementation, mint browser/Agent authority, execute input, authorize network/TLS/HTTP, negotiate OriginWeave Protocol versions, expose arbitrary JavaScript, or claim the real browser adapter complete.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}