feat(core): bind runtime adapter version before protocol use - #114
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…l-runtime-dispatch-validation feat(core): bind browser protocol validation to dispatch call
…-protocol-dispatch feat(core): bind protocol dispatch to current browser context
…-origin-binding feat(core): bind browser context origin before observation
…apter-version-binding' into HEAD # Conflicts: # CHANGELOG.md # tests/test_repository_contract.py
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…-origin-revalidation feat(core): revalidate current browser context origin
7d550d8
into
feat/browser-protocol-validation-evidence
| runtime_kind, | ||
| }); | ||
| } | ||
| if !metadata_token_is_valid(runtime_adapter_version) { | ||
| return Err(BrowserProtocolUseValidationError::InvalidAdapterVersion); | ||
| } | ||
| if self.adapter_version != runtime_adapter_version { | ||
| return Err(BrowserProtocolUseValidationError::AdapterVersionMismatch); | ||
| } | ||
| self.require_runtime_revisions(runtime_protocol_revision, runtime_browser_revision) | ||
| .map_err(BrowserProtocolUseValidationError::RuntimeRevision)?; | ||
| self.require_capability(required_capability) |
There was a problem hiding this comment.
📝 Info: validate_use gains required parameter, all callers updated
validate_use now takes a required runtime_adapter_version. Every caller in the workspace was updated; the only non-test consumer is dispatch_if_runtime_matches. No production caller is left passing the old argument list.
(Refers to this code)
Was this helpful? React with 👍 or 👎 to provide feedback.
1 participant
Partial implementation of #28 and Proposed ADR 0107, stacked on the live PR #113 branch
feat/browser-protocol-validation-evidenceat exact current head2562ca403117dfe789a73716162c7e1f20c1af0c.Buyer/security gap
The active protocol-use validator binds the exact OriginWeave generation, runtime protocol family, pinned upstream protocol revision, pinned browser revision, and required capability, but previously did not compare the adapter implementation version reported by the trusted runtime with the descriptor's reviewed adapter version. A descriptor for
originweave-bidi-v1could therefore validate a runtime that reported a different adapter build as long as the protocol/browser revisions happened to match. Proposed ADR 0107 independently versions adapters and requires adapter version/provenance for audit and rollback, so runtime adapter-version drift must fail closed before browser I/O.Dependency
This Draft targets PR #113 at exact current head
2562ca403117dfe789a73716162c7e1f20c1af0c, transitively on #112/#111/#110/#109/#108/#107/#106/#40. Current exact #114 head is36bac73ecd66b3846f634fb977139d15c1e237de. The live comparison is ahead of the prerequisite with merge base equal to the exact #113 head; GitHub currently reports the Draft mergeable. Keep Draft while prerequisites remain active. No prerequisite check, review, status, coverage, mergeability, synthetic-merge, predecessor-head, skipped, cancelled, queued, absent, or model-only evidence transfers.TDD / implementation
Historical test-only head
b521bbcc3c70907cdf66a189d932c6cfa8c3a526requiredvalidate_useto receive trusted runtime adapter-version metadata, accept the exact reviewed adapter version, reject a different runtime adapter version before revision/capability checks, and reject malformed runtime adapter-version metadata fail closed. CI run31576973212failed on that exact test-only head; its independent Manifest V3 result is historical evidence only.The production implementation adds the narrow runtime adapter-version check inside the existing same-call validation boundary.
validate_usechecks, in order: exact OriginWeave Protocol generation, exact runtime protocol family, bounded runtime adapter-version syntax and exact adapter-version equality, exact runtime protocol/browser revisions, then the required declared capability. Malformed runtime adapter-version metadata fails asInvalidAdapterVersion; valid-but-different metadata fails asAdapterVersionMismatchbefore revision or capability state can influence the result.Exact-current proof
On unchanged exact head
36bac73ecd66b3846f634fb977139d15c1e237deagainst exact current prerequisite #113 head2562ca403117dfe789a73716162c7e1f20c1af0c:32199896206: success;32199896197: success;Security Scan and SAST workflows are absent on this stacked exact head and are therefore not passing evidence. No predecessor-head, prerequisite, synthetic, skipped, queued, absent, or model-only evidence is promoted as current proof. Passing automation is not independent approval.
Truth boundary
This slice compares deterministic runtime adapter-version metadata only. It does not authenticate the adapter process, attest how the runtime version was derived, execute WebDriver BiDi/CDP, bind browser session/context/origin authority, prove capability implementation, or make the complete Chromium vertical slice ready. A trusted runtime still must derive the exact adapter/protocol/browser metadata from the adapter that is about to perform browser I/O.
This scheduled actor does not merge, self-approve, alter workflows, add secrets, weaken checks, tag, or publish.