feat(core): gate protocol dispatch on current context origin

ARCHITECTURE.md

@@ -166,7 +166,7 @@ Observation should prefer the most structured trustworthy source available:
 4. accessibility tree combined with DOM and layout;
 5. screenshot or vision fallback for canvas and inaccessible custom interfaces.
 
-Raw HTML is not the default model input. Full snapshots are followed by incremental semantic diffs, versioned by document epoch. Node references become invalid after navigation or epoch change.
+Raw HTML is not the default model input. Full snapshots are followed by incremental semantic diffs, versioned by document epoch. Node references become invalid after navigation or epoch change. An untrusted WebDriver BiDi `locateNodes` result becomes an `ObservedNodeHandle` only after the adapter transfers a non-cloneable `QueryNodes` / `SemanticObservation` protocol-use proof into `bind_current_nodes` and the exact current session, browsing context, canonical origin, and document epoch still match. Navigation or TypedInput proofs fail closed. That control-plane composition does not perform browser I/O or authorize typed input.
 
 ## 8. Action lifecycle
 

CHANGELOG.md

@@ -6,6 +6,9 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ### Added
 
+- Bounded WebDriver BiDi loopback TCP transport that consumes one exact no-DNS connect target, retries only explicitly recoverable local transport failures within repository timeout and attempt ceilings, exposes the stream only after operating-system peer inspection and exact peer verification, supports a consuming handoff of the original stream with typed credential-free peer/session/TLS and bounded-attempt evidence, preserves typed causal errors, and performs no DNS, proxy/PAC, process authentication, TLS, WebSocket, BiDi message, browser-action, or Agent-authority step.
+- Exact WebDriver BiDi socket-peer verification that consumes an approved no-DNS connect target, requires the observed IP address and port to match exactly, preserves the TLS requirement and exact correlated session id, and remains inert metadata that does not authenticate an OS process, does not negotiate TLS, perform a WebSocket handshake, or grant Agent authority.
+- Explicit no-DNS WebDriver BiDi loopback connection targets that derive exact IPv4/IPv6 loopback `SocketAddr` metadata from a session-correlated endpoint, reject `localhost` as requiring separately trusted name resolution, preserve the TLS requirement and exact session id, perform no socket I/O, and grant no Agent authority.
 - Bound explicit extension-to-Agent grants to a nonzero host-assigned Agent Task identity, so a grant that otherwise matches extension, session, browsing context, origin, expiry, and capability fails closed when reused by a different task.
 - Bound explicit extension-to-Agent grants to exclusive trusted-time expiry in addition to extension identity, session, browsing context, and canonical origin, so a same-origin grant cannot be reused at or after the deadline.
 - Bound explicit extension-to-Agent grants to the exact canonical origin in addition to extension identity, session, and browsing context, so a same-session navigation or port change cannot reuse the grant.
@@ -17,8 +20,23 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Runtime browser-adapter version binding at the atomic protocol-use boundary: the caller-supplied bounded adapter-version token must exactly match the reviewed descriptor version before runtime revision or capability checks can succeed, preventing adapter-build drift from silently reusing otherwise matching protocol/browser metadata without authenticating or attesting the adapter process.
 - Same-call browser-protocol dispatch gating that validates current protocol family, adapter version, pinned protocol/browser revisions, OriginWeave generation, and required capability before invoking one callback, transferring the non-cloneable validation proof by ownership without turning metadata validation into browser or Agent authority.
 - Context-bound browser-protocol dispatch composition that revalidates the exact OriginWeave browser session/context pair, carries the registry's current document epoch into the immediate callback, and separately requires the same exact runtime protocol metadata/capability checks before dispatch without claiming origin, destination, typed-input, transport-authentication, or post-condition authority.
+- Typed browser-protocol operations that derive the exact adapter capability inside the strongest current context/origin/document-epoch dispatch boundary, preventing callers from independently selecting mismatched operation and capability metadata without performing browser I/O or granting policy authority.
+- Bounded WebDriver BiDi accessibility-node query parameters for `browsingContext.locateNodes`, with reviewed selector/result budgets, exact-token role and control-free accessible-name admission, minimal remote-value serialization options, and fail-closed revalidation that rejects an untrusted adapter response whose returned node count exceeds the exact request budget before node normalization or retention.
+- Deterministic WebDriver BiDi `browsingContext.locateNodes` command serialization that accepts only protocol-range `js-uint` identifiers and bounded injection-safe browsing-context identifiers, JSON-escapes reviewed query text, and emits the exact accessibility locator, finite node budget, and minimal serialization options without performing transport I/O or granting browser or Agent authority.
+- Fail-closed WebDriver BiDi `locateNodes` response correlation that consumes the exact serialized command, rejects out-of-range or mismatched response `id` values, and returns non-cloneable correlation evidence carrying only the matched command identifier and browsing context without parsing the response or granting browser/Agent authority.
+- Typed WebDriver BiDi response-envelope correlation that preserves success/error classification, rejects success responses with absent ids, treats nullable error ids as explicitly uncorrelatable, and prevents correlated error envelopes from becoming success correlation evidence without raw JSON parsing or browser/Agent authority grants.
+- Correlated WebDriver BiDi `locateNodes` result admission that consumes exact response-correlation evidence, revalidates the serialized browsing-context identifier against the registered browsing-context identity, enforces the command's node budget, and binds admitted nodes atomically without granting browser or Agent authority.
+- Bounded raw WebDriver BiDi response-document admission before JSON parsing, with a 65,536-byte product safety budget, exact wire-text retention, JSON-whitespace-aware top-level object-boundary checks, and typed fail-closed errors; this coarse boundary deliberately does not claim JSON validity, response correlation, browser authenticity, or Agent authority.
+- One consuming bounded WebDriver BiDi response-document correlation boundary that parses the exact admitted JSON document and feeds only its typed response kind and protocol-range id into the existing exact command-correlation gate, preserving nested parser/correlation error sources without authenticating transport or granting browser/Agent authority.
+- Consuming WebDriver BiDi WebSocket endpoint/session correlation that validates one caller-supplied canonical session UUID and rejects exact session mismatches before later transport use; the correlated type preserves only bounded endpoint metadata and does not authenticate Chromium, ChromeDriver, the caller, or the socket peer.
+- Fail-closed WebDriver BiDi `script.NodeRemoteValue` admission that requires the exact remote type `node` and a non-empty `sharedId` within the same UTF-8 identifier budget as browser session and context identifiers, rejecting control and whitespace so an untrusted `locateNodes` item cannot be retained as a later typed-input handle without a usable shared node identity.
+- Same-call `locateNodes` result admission that revalidates the exact current session, browsing context, canonical origin, and document epoch, rejects an over-budget or non-node result, and translates each admitted `sharedId` through the authority registry into an `ObservedNodeHandle` without performing browser I/O.
+- Same-call QueryNodes admission that transfers a non-cloneable SemanticObservation protocol-use proof by ownership into `bind_current_nodes` before an untrusted `locateNodes` result can become current `ObservedNodeHandle` values, so Navigation-only or TypedInput-only proofs cannot mint observation handles.
+- Fail-closed rejection of reviewed Unicode format and bidirectional-override characters in accessibility roles, accessible names, BiDi `sharedId` values, and registry external identifiers, while ordinary spaces in accessible names remain valid.
 - Explicit `BrowserAuthorityRegistry::bind_context_origin` registration that binds one canonical origin to the exact current browser session, browsing context, and document epoch before origin-sensitive protocol use, rejecting cross-session ownership and same-epoch origin changes without granting navigation or action authority.
 - Explicit `BrowserAuthorityRegistry::require_context_origin` revalidation that requires the exact registered canonical origin for the current browser session, browsing context, and document epoch before origin-sensitive protocol use, failing closed when binding is absent or mismatched without granting navigation or action authority.
+- Origin-gated `dispatch_if_context_origin_current` composition that revalidates the exact registered session, browsing context, and canonical origin, carries the current document epoch into the same synchronous callback, and then validates protocol metadata and capability without claiming destination, network, TLS, adapter-authentication, action, or post-condition authority.
+- Epoch-gated `dispatch_if_context_origin_epoch_current` composition that additionally requires the registry's current document epoch to equal the observed epoch before protocol validation or callback execution, failing closed on same-origin navigation without granting browser, action, or post-condition authority.
 - Credential-safe browser-protocol validation evidence that copies only the already validated protocol family, OriginWeave generation, adapter version, pinned protocol/browser revisions, and exact capability into cloneable audit metadata without recreating the non-cloneable validation prerequisite or granting browser/Agent authority.
 - Canonical HTTPS and loopback-origin boundary with case-normalized schemes and hosts, default-port normalization, IPv4/IPv6 handling, browser-special numeric-host rejection, and explicit malformed-input errors.
 - Typed browser actions, capabilities, risk classes, execution modes, robots decisions, secret-delivery contracts, immutable canonical action-intent digests, and intent-bound approval scopes.

crates/originweave-core/src/browser_authority_registry.rs

@@ -0,0 +1,163 @@
+use crate::browser_registry::BrowserAuthorityRegistry as RawBrowserAuthorityRegistry;
+use crate::{
+    BrowserRegistryError, BrowserSessionId, BrowsingContextId, DocumentEpoch, ObservedNodeHandle,
+    Origin,
+};
+
+/// Public browser-authority registry with raw node minting kept inside the crate.
+///
+/// Browser-session, browsing-context, document-epoch, and canonical-origin lifecycle operations are
+/// public because trusted adapters need them to maintain current authority. Converting untrusted
+/// browser-protocol node identifiers into [`ObservedNodeHandle`] values is deliberately
+/// crate-private: external callers must use a reviewed semantic-observation admission boundary such
+/// as [`crate::WebDriverBiDiAccessibilityQuery::bind_current_nodes`], which consumes the required
+/// protocol-use proof, validates the complete batch, and revalidates the exact current document
+/// before atomically minting handles.
+pub struct BrowserAuthorityRegistry {
+    inner: RawBrowserAuthorityRegistry,
+}
+
+impl BrowserAuthorityRegistry {
+    /// Create an empty registry with the reviewed default per-namespace identifier capacity.
+    #[must_use]
+    pub fn new() -> Self {
+        Self {
+            inner: RawBrowserAuthorityRegistry::new(),
+        }
+    }
+
+    /// Create an empty registry with a caller-selected per-namespace identifier capacity.
+    ///
+    /// Session, browsing-context, and node identifiers retain independent monotonic namespaces.
+    /// The node namespace is still reachable only through crate-owned semantic admission.
+    #[must_use]
+    pub fn with_identifier_limit(maximum_identifier: u64) -> Self {
+        Self {
+            inner: RawBrowserAuthorityRegistry::with_identifier_limit(maximum_identifier),
+        }
+    }
+
+    /// Register one opaque external browser-session identifier.
+    pub fn register_session(
+        &mut self,
+        external_identifier: &str,
+    ) -> Result<BrowserSessionId, BrowserRegistryError> {
+        self.inner.register_session(external_identifier)
+    }
+
+    /// Register one opaque external browsing-context identifier inside a known browser session.
+    pub fn register_context(
+        &mut self,
+        browser_session: BrowserSessionId,
+        external_identifier: &str,
+    ) -> Result<BrowsingContextId, BrowserRegistryError> {
+        self.inner
+            .register_context(browser_session, external_identifier)
+    }
+
+    /// Retire one browsing context and all registry-local authority derived from it.
+    pub fn remove_context(
+        &mut self,
+        browsing_context: BrowsingContextId,
+    ) -> Result<(), BrowserRegistryError> {
+        self.inner.remove_context(browsing_context)
+    }
+
+    /// Retire one browser session and every registered context and node binding beneath it.
+    pub fn remove_session(
+        &mut self,
+        browser_session: BrowserSessionId,
+    ) -> Result<(), BrowserRegistryError> {
+        self.inner.remove_session(browser_session)
+    }
+
+    /// Return the currently active document epoch for a known browsing context.
+    pub fn current_epoch(
+        &self,
+        browsing_context: BrowsingContextId,
+    ) -> Result<DocumentEpoch, BrowserRegistryError> {
+        self.inner.current_epoch(browsing_context)
+    }
+
+    /// Return the current document epoch only when the supplied session owns the context.
+    pub fn current_context_epoch(
+        &self,
+        browser_session: BrowserSessionId,
+        browsing_context: BrowsingContextId,
+    ) -> Result<DocumentEpoch, BrowserRegistryError> {
+        self.inner
+            .current_context_epoch(browser_session, browsing_context)
+    }
+
+    /// Require an opaque external browsing-context identifier to name this exact context.
+    pub(crate) fn require_context_external_identifier(
+        &self,
+        browser_session: BrowserSessionId,
+        browsing_context: BrowsingContextId,
+        external_identifier: &str,
+    ) -> Result<(), BrowserRegistryError> {
+        self.inner.require_context_external_identifier(
+            browser_session,
+            browsing_context,
+            external_identifier,
+        )
+    }
+
+    /// Bind the canonical origin observed for the exact current browser document.
+    pub fn bind_context_origin(
+        &mut self,
+        browser_session: BrowserSessionId,
+        browsing_context: BrowsingContextId,
+        origin: &Origin,
+    ) -> Result<DocumentEpoch, BrowserRegistryError> {
+        self.inner
+            .bind_context_origin(browser_session, browsing_context, origin)
+    }
+
+    /// Revalidate the canonical origin bound to the exact current browser document.
+    pub fn require_context_origin(
+        &self,
+        browser_session: BrowserSessionId,
+        browsing_context: BrowsingContextId,
+        origin: &Origin,
+    ) -> Result<DocumentEpoch, BrowserRegistryError> {
+        self.inner
+            .require_context_origin(browser_session, browsing_context, origin)
+    }
+
+    /// Advance a browsing context to the next document epoch and invalidate old node bindings.
+    pub fn advance_document(
+        &mut self,
+        browsing_context: BrowsingContextId,
+    ) -> Result<DocumentEpoch, BrowserRegistryError> {
+        self.inner.advance_document(browsing_context)
+    }
+
+    /// Bind one admitted batch of adapter-local node identifiers to current browser authority.
+    ///
+    /// This operation is intentionally crate-private. The raw registry commits the batch only when
+    /// every identifier can be bound; a later failure rolls back node identifiers and any origin
+    /// binding created by the batch before the error is returned. Production callers outside this
+    /// crate therefore cannot bypass semantic admission or observe partial authority from a failed
+    /// `locateNodes` result.
+    pub(crate) fn bind_nodes(
+        &mut self,
+        browser_session: BrowserSessionId,
+        browsing_context: BrowsingContextId,
+        origin: &Origin,
+        external_identifiers: &[&str],
+    ) -> Result<Vec<ObservedNodeHandle>, BrowserRegistryError> {
+        self.inner.bind_nodes(
+            browser_session,
+            browsing_context,
+            origin,
+            external_identifiers,
+        )
+    }
+}
+
+impl Default for BrowserAuthorityRegistry {
+    fn default() -> Self {
+        Self::new()
+    }
+}