feat(resource): aggregate bounded browser process-set RSS

[seonghobae]

Partial implementation of #28, stacked on live PR #51.

Buyer-visible gap

PR #51 samples one caller-supplied Linux process RSS value, but Chromium is multi-process. A resource governor that accepts only one PID can materially undercount a real Agent Task even when every individual /proc/<pid>/status sample is valid. This follow-up defines a bounded, duplicate-safe process-set aggregation boundary and additionally prevents a PID-reuse race from silently rebinding a previously observed process identity to a different Linux process.

Live dependency / reconstructed stack

The independently refetched live prerequisite is exact PR #51 head 6b1595e9e04ddb791a2e219bd81dd6752c1f3d84. The prior #66 head had merge base ed01297e5fd0e6a97336078e23f49206c0952ef3 and had become 77 commits behind that live prerequisite.

This lane was therefore reconstructed non-destructively: the current #51 tree was used as the fresh base, #66's unique resource production/tests were overlaid unchanged, and the unique process-set CHANGELOG semantics were reapplied onto the current prerequisite CHANGELOG instead of carrying the stale whole-file blob. Current exact #66 head is 15713ac15e52cc88369af2c4b50abd86fce869b9.

Fresh comparison reports ahead 28 / behind 0, with merge base exactly current #51. The current semantic delta is limited to:

• CHANGELOG.md;
• crates/originweave-resource/src/lib.rs;
• crates/originweave-resource/tests/browser_process_identity_rss.rs; and
• crates/originweave-resource/tests/browser_process_set_rss.rs.

No prerequisite/predecessor check, review, status, synthetic-merge, or historical-head evidence transfers. Keep Draft while #51 remains active.

Implemented boundary

The process-set slice:

• accepts an explicit caller-owned process set of at most 256 unique nonzero PIDs;
• provides pure aggregate_browser_process_rss_samples over explicit (pid, rss_bytes) samples;
• samples supplied Linux PIDs through the existing strict /proc/<pid>/status VmRSS parser;
• rejects empty, zero-PID, duplicate and oversized process sets;
• uses checked addition and rejects aggregate overflow rather than silently undercounting;
• fails the entire process-set sample if any member cannot be sampled;
• parses Linux /proc/<pid>/stat structurally from the final ) of the process comm field and extracts the kernel process start-time field without assuming the command name is delimiter-free;
• binds LinuxProcessIdentity to exact nonzero PID plus kernel start-time ticks;
• verifies that identity before identity-bound RSS sampling and returns typed ProcessIdentityChanged when the PID names another process; and
• preserves fail-closed duplicate/empty-set behavior for identity-set sampling.

The implementation does not infer Chromium ownership from a PID or process set. A trusted browser/process adapter must still derive and authenticate the intended process set for the governed task.

Exact-current evidence

On unchanged exact head 15713ac15e52cc88369af2c4b50abd86fce869b9 against exact prerequisite 6b1595e9e04ddb791a2e219bd81dd6752c1f3d84:

• ancestry: ahead 28 / behind 0, merge base exactly the live prerequisite;
• CI run 32957302027: success;
• Rust contracts job 98141784683: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success on exact checkout;
• Production coverage job 98141784983: exact owned-production function/line/region/branch measurement and enforcement success;
• exact coverage totals: functions 461/461, lines 3944/3944, regions 4922/4922, branches 576/576 — all 100%;
• exact coverage artifact 9602525440, digest sha256:1571754db68a9581fb15bf8fcb062646010d078349665d9843b3f6a82dfb07db;
• current formal reviews: none; and
• current inline review threads: none.

The exact-head workflow inventory for this feature-base Draft exposes CI only. SAST/Semgrep, Security Scan, Manifest V3, OpenCode, Noema, Strix, or independent approval evidence not returned for this head is absent, not passing. No predecessor-head, prerequisite-head, skipped, queued, cancelled, synthetic, stale, status-only, or model-only evidence is promoted.

The live organization ruleset currently requires one qualifying approval, stale-review dismissal on push, resolved review threads, and does not require latest-push approval. No approval is manufactured or inferred from automated checks, comments, model output, or author activity.

Truth / authority boundary

This lane does not discover Chromium PIDs, prove that supplied identities belong to one browser task, walk or authenticate a Chromium process tree/cgroup, sample GPU/VRAM or JS heap, launch/control Chromium, persist telemetry, or make release claims. Protected-main AGENTS.md remains authoritative. This scheduled actor does not merge, self-approve, force-push, destructively rebase, alter workflows/rulesets/secrets, weaken checks, tag, release, or publish.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}