feat(core): bind protocol dispatch to current browser context

CHANGELOG.md

@@ -12,6 +12,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Atomic browser-protocol use validation that requires the exact OriginWeave protocol generation, caller-supplied runtime protocol family, exact pinned runtime protocol/browser revisions, and an explicitly declared capability in deterministic fail-closed order before producing non-cloneable validation evidence; this metadata proof does not authenticate the adapter or grant browser/Agent authority.
 - Runtime browser-adapter version binding at the atomic protocol-use boundary: the caller-supplied bounded adapter-version token must exactly match the reviewed descriptor version before runtime revision or capability checks can succeed, preventing adapter-build drift from silently reusing otherwise matching protocol/browser metadata without authenticating or attesting the adapter process.
 - Same-call browser-protocol dispatch gating that validates current protocol family, adapter version, pinned protocol/browser revisions, OriginWeave generation, and required capability before invoking one callback, transferring the non-cloneable validation proof by ownership without turning metadata validation into browser or Agent authority.
+- Context-bound browser-protocol dispatch composition that revalidates the exact OriginWeave browser session/context pair, carries the registry's current document epoch into the immediate callback, and separately requires the same exact runtime protocol metadata/capability checks before dispatch without claiming origin, destination, typed-input, transport-authentication, or post-condition authority.
 - Credential-safe browser-protocol validation evidence that copies only the already validated protocol family, OriginWeave generation, adapter version, pinned protocol/browser revisions, and exact capability into cloneable audit metadata without recreating the non-cloneable validation prerequisite or granting browser/Agent authority.
 - Canonical HTTPS and loopback-origin boundary with case-normalized schemes and hosts, default-port normalization, IPv4/IPv6 handling, browser-special numeric-host rejection, and explicit malformed-input errors.
 - Typed browser actions, capabilities, risk classes, execution modes, robots decisions, secret-delivery contracts, immutable canonical action-intent digests, and intent-bound approval scopes.

crates/originweave-core/src/browser_protocol_dispatch.rs

@@ -1,6 +1,9 @@
+use std::fmt;
+
 use crate::{
-    BrowserProtocolAdapterDescriptor, BrowserProtocolCapability, BrowserProtocolKind,
-    BrowserProtocolUseValidationError, OriginWeaveProtocolVersion, ValidatedBrowserProtocolUse,
+    BrowserAuthorityRegistry, BrowserProtocolAdapterDescriptor, BrowserProtocolCapability,
+    BrowserProtocolKind, BrowserProtocolUseValidationError, BrowserRegistryError, BrowserSessionId,
+    BrowsingContextId, DocumentEpoch, OriginWeaveProtocolVersion, ValidatedBrowserProtocolUse,
 };
 
 /// Current runtime metadata sampled from the browser-protocol adapter about to perform I/O.
@@ -37,6 +40,44 @@ impl<'a> BrowserProtocolRuntimeMetadata<'a> {
     }
 }
 
+/// Exact OriginWeave browser session/context requested for one immediate protocol dispatch.
+///
+/// This value only keeps the two identifiers together so a caller cannot accidentally reorder or
+/// independently substitute them at the dispatch boundary. Constructing or copying it does not
+/// prove that either identifier is registered, current, or authorized; the authority registry must
+/// validate the pair immediately before protocol metadata validation and callback invocation.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub struct BrowserContextDispatchTarget {
+    browser_session: BrowserSessionId,
+    browsing_context: BrowsingContextId,
+}
+
+impl BrowserContextDispatchTarget {
+    /// Group one OriginWeave browser session and browsing context for immediate dispatch checking.
+    #[must_use]
+    pub const fn new(
+        browser_session: BrowserSessionId,
+        browsing_context: BrowsingContextId,
+    ) -> Self {
+        Self {
+            browser_session,
+            browsing_context,
+        }
+    }
+
+    /// Return the OriginWeave browser session requested for this dispatch.
+    #[must_use]
+    pub const fn browser_session(self) -> BrowserSessionId {
+        self.browser_session
+    }
+
+    /// Return the OriginWeave browsing context requested for this dispatch.
+    #[must_use]
+    pub const fn browsing_context(self) -> BrowsingContextId {
+        self.browsing_context
+    }
+}
+
 impl BrowserProtocolAdapterDescriptor {
     /// Validate current browser-protocol metadata and immediately invoke one dispatch callback.
     ///
@@ -68,4 +109,77 @@ impl BrowserProtocolAdapterDescriptor {
         )?;
         Ok(dispatch(validated))
     }
+
+    /// Revalidate exact browser session/context ownership and runtime metadata before dispatch.
+    ///
+    /// The registry check occurs first and returns its current document epoch. The exact protocol
+    /// generation, runtime protocol family, adapter version, upstream/browser revisions, and
+    /// required capability are then validated before `dispatch` can run. The callback receives the
+    /// non-cloneable protocol-use proof plus the registry epoch sampled for this immediate use.
+    ///
+    /// This is a composition prerequisite, not complete browser-action authority. In particular,
+    /// typed input still requires separate current origin/document/node and deterministic policy
+    /// authorization, while navigation still requires destination/network/TLS/HTTP authority.
+    /// The caller remains responsible for sampling runtime metadata from the adapter about to
+    /// perform I/O and for preventing registry mutation across its larger execution transaction.
+    pub fn dispatch_if_context_current<R, F>(
+        &self,
+        authority_registry: &BrowserAuthorityRegistry,
+        target: BrowserContextDispatchTarget,
+        required_originweave_protocol_version: OriginWeaveProtocolVersion,
+        runtime_metadata: BrowserProtocolRuntimeMetadata<'_>,
+        required_capability: BrowserProtocolCapability,
+        dispatch: F,
+    ) -> Result<R, BrowserContextProtocolDispatchError>
+    where
+        F: FnOnce(ValidatedBrowserProtocolUse, DocumentEpoch) -> R,
+    {
+        let current_epoch = authority_registry
+            .current_context_epoch(target.browser_session(), target.browsing_context())
+            .map_err(BrowserContextProtocolDispatchError::BrowserAuthority)?;
+        self.dispatch_if_runtime_matches(
+            required_originweave_protocol_version,
+            runtime_metadata,
+            required_capability,
+            |validated| dispatch(validated, current_epoch),
+        )
+        .map_err(BrowserContextProtocolDispatchError::ProtocolValidation)
+    }
+}
+
+/// Failure to compose current browser context ownership with protocol validation before dispatch.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BrowserContextProtocolDispatchError {
+    /// The supplied browser session/context pair is not current in the authority registry.
+    BrowserAuthority(BrowserRegistryError),
+    /// The current browser-protocol metadata or required capability failed validation.
+    ProtocolValidation(BrowserProtocolUseValidationError),
+}
+
+impl fmt::Display for BrowserContextProtocolDispatchError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::BrowserAuthority(error) => {
+                write!(
+                    formatter,
+                    "browser context authority denied protocol dispatch: {error}"
+                )
+            }
+            Self::ProtocolValidation(error) => {
+                write!(
+                    formatter,
+                    "browser protocol validation denied context dispatch: {error}"
+                )
+            }
+        }
+    }
+}
+
+impl std::error::Error for BrowserContextProtocolDispatchError {
+    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
+        match self {
+            Self::BrowserAuthority(error) => Some(error),
+            Self::ProtocolValidation(error) => Some(error),
+        }
+    }
 }

crates/originweave-core/src/browser_registry.rs

@@ -170,6 +170,34 @@ impl BrowserAuthorityRegistry {
             .ok_or(BrowserRegistryError::UnknownBrowsingContext)
     }
 
+    /// Return the current document epoch only when the supplied session owns the context.
+    ///
+    /// This is an immediate-use registry check for trusted browser adapters. It proves only that
+    /// the OriginWeave session/context pair is currently registered together and returns the
+    /// registry's current document epoch. It does not authenticate a browser process, authorize an
+    /// origin or action, or make the returned epoch a reusable browser capability.
+    pub fn current_context_epoch(
+        &self,
+        browser_session: BrowserSessionId,
+        browsing_context: BrowsingContextId,
+    ) -> Result<DocumentEpoch, BrowserRegistryError> {
+        if !self.known_sessions.contains(&browser_session) {
+            return Err(BrowserRegistryError::UnknownBrowserSession);
+        }
+        let expected_session = self
+            .context_session
+            .get(&browsing_context)
+            .copied()
+            .ok_or(BrowserRegistryError::UnknownBrowsingContext)?;
+        if expected_session != browser_session {
+            return Err(BrowserRegistryError::ContextSessionMismatch {
+                expected: expected_session,
+                actual: browser_session,
+            });
+        }
+        self.current_epoch(browsing_context)
+    }
+
     /// Advance a browsing context to the next document epoch and invalidate old node bindings.
     ///
     /// Call this whenever navigation or document replacement invalidates actionable node identity.

crates/originweave-core/src/lib.rs

@@ -23,7 +23,10 @@ pub use browser_protocol::{
     BrowserProtocolVersionRequirementError, MAX_BROWSER_PROTOCOL_METADATA_BYTES,
     OriginWeaveProtocolVersion, OriginWeaveProtocolVersionParseError, ValidatedBrowserProtocolUse,
 };
-pub use browser_protocol_dispatch::BrowserProtocolRuntimeMetadata;
+pub use browser_protocol_dispatch::{
+    BrowserContextDispatchTarget, BrowserContextProtocolDispatchError,
+    BrowserProtocolRuntimeMetadata,
+};
 pub use browser_registry::{
     BrowserAuthorityRegistry, BrowserRegistryError, MAX_EXTERNAL_BROWSER_IDENTIFIER_BYTES,
 };