feat(core): bind browser protocol validation to dispatch call

[seonghobae]

Partial implementation of #28 and Proposed ADR 0107, stacked on the live PR #114 branch feat/browser-protocol-runtime-adapter-version-binding at exact current head 36bac73ecd66b3846f634fb977139d15c1e237de.

Buyer/security gap

PR #114 makes browser-protocol metadata validation complete for one immediate use, but validation and adapter invocation remained two independent caller operations. A future transport could call validate_use, retain the non-cloneable proof, and dispatch later rather than proving that the runtime metadata check immediately gates the operation callback. The first real browser adapter needs one same-call boundary so invalid or drifted runtime metadata prevents the callback from running at all.

Dependency

This Draft targets #114 at exact current head 36bac73ecd66b3846f634fb977139d15c1e237de, transitively on #113/#112/#111/#110/#109/#108/#107/#106/#40. Current exact #115 head is b906dec3fbfc34d64041f4cdceeb02c026ffb2d9. GitHub currently reports the Draft mergeable against that exact prerequisite. Keep Draft while prerequisites remain active. No prerequisite check, review, status, coverage, mergeability, synthetic-merge, predecessor-head, skipped, cancelled, queued, absent, or model-only evidence transfers.

TDD / implementation

The test-first lane began with an intentionally missing BrowserProtocolAdapterDescriptor::dispatch_if_runtime_matches production boundary. The current implementation provides the narrow same-call composition.

BrowserProtocolRuntimeMetadata carries the caller-supplied runtime protocol family, adapter version, upstream protocol revision and browser revision as untrusted descriptive input. dispatch_if_runtime_matches validates the exact OriginWeave generation, runtime protocol family, adapter version, protocol/browser revisions and required capability through the existing atomic validator before invoking one callback. The callback receives the non-cloneable ValidatedBrowserProtocolUse by ownership; metadata mismatch prevents callback execution, while a callback's own return/failure remains separate after validation succeeds.

Exact-current proof

On unchanged exact head b906dec3fbfc34d64041f4cdceeb02c026ffb2d9 against exact current prerequisite #114 head 36bac73ecd66b3846f634fb977139d15c1e237de:

• CI run 32199979667: success;
• Manifest V3 Compatibility run 32199979689: success;
• GitHub reports the Draft mergeable against its exact current prerequisite base;
• formal reviews returned by the fresh refetch: none; and
• inline review threads returned by the fresh refetch: none.

Security Scan and SAST workflows are absent on this stacked exact head and are therefore not passing evidence. No predecessor-head, prerequisite, synthetic, skipped, queued, absent, or model-only evidence is promoted as current proof. Passing automation, including skipped draft-review automation, is not independent approval.

Truth boundary

This slice provides same-call metadata validation and callback gating only. It does not authenticate the callback/adapter process, derive runtime metadata from Chromium, serialize WebDriver BiDi/CDP messages, perform browser I/O, authorize session/context/origin/network activity, or prove a browser post-condition. It is a narrow prerequisite for a trusted transport to make validated metadata non-optional at the operation boundary.

This scheduled actor does not merge, self-approve, alter workflows, add secrets, weaken checks, tag, or publish.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 744bce53-a85c-46ec-a4da-040f3846a70c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.