fix(core): bind protocol dispatch to observed document epoch

[seonghobae]

Partial implementation of #28, stacked on exact PR #120 head 144895d5b86ca6b4cceeb0653638e41e9578f130.

Buyer/security gap

PR #120 revalidates exact browser session, browsing context, canonical origin, and protocol metadata immediately before one callback, but it deliberately returns the registry's current DocumentEpoch instead of comparing that epoch with the document that produced the caller's observation/action intent. A same-origin navigation can advance the document epoch, rebind the same canonical origin, and still satisfy the PR #120 origin boundary. For typed input, issue #28 requires the exact observed document epoch to remain current before the side effect.

Dependency

This Draft still targets independently refetched exact #120 head 144895d5b86ca6b4cceeb0653638e41e9578f130 and must remain Draft while #120 and its prerequisites remain active. No prerequisite check, review, status, coverage, mergeability, or synthetic merge evidence transfers.

TDD and implementation proof

The test-only predecessor 97d2a896c204c3245f56445c351c2d01168991bc defined the missing same-call epoch contract before production support. The current exact head 3d00eb5c9bcb3258550bc8e75e6bedf9d0b9f01b now implements that contract by:

• grouping the exact session/context/origin target with the observed DocumentEpoch;
• revalidating exact-current session/context/origin before comparing the epoch;
• returning typed DocumentEpochMismatch when a same-origin new document has replaced the observed document;
• proving the callback is not invoked on stale authority; and
• preserving exact protocol generation/family/adapter-version/revision/capability validation after document authority remains current.

At exact head 3d00eb5c9bcb3258550bc8e75e6bedf9d0b9f01b, repository CI run 31611351981 and Manifest V3 Compatibility run 31611352072 both completed successfully. The branch remains Draft solely because its exact base is an active stacked prerequisite, not because predecessor evidence is being reused.

Truth boundary

This deterministic composition does not authenticate the adapter/browser process, derive the origin or epoch from Chromium, decide when browser mutation must rotate the epoch, authorize destination/network/TLS/HTTP, perform browser I/O, grant Agent policy approval, validate semantic node state, or prove a post-condition. A trusted runtime must derive the observed epoch from the exact observation used to construct the action and supply it immediately before dispatch.

---

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c59706d2-226c-421d-90bc-4a7f0069a347

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 0 potential issues.