feat: extract broker orchestration and Devframe integration

[dvcolomban]

Background

Embedding hosts currently compose provider pairing, grants, recovery and browser management themselves. This adds a public broker runtime and a Devframe adapter so hosts can reuse that flow while retaining their own process lifecycle, tool registry and approval policy.

Changes

Add @dvcol/cdb-broker with declarative configuration, persistent identity storage, authoritative grant coordination and per-principal browser tools. Add @dvcol/cdb-devframe as a context-lifetime service that carries provider traffic and cancellation over an existing authenticated RPC peer. Its panel consumes an existing broker connection.

Add the optional Chrome adapter and notification controller to @dvcol/cdb-extension. The standalone example demonstrates the service, native MCP tools, panel and a trusted extension-popup approval channel on Devframe 0.9.10 and DevTools Kit 0.6.1. Both new packages join the fixed release train; publication remains pending npm bootstrap and trusted-publisher setup.

Notification updates preserve message registrations and use the existing Devframe update API. The workspace backports upstream toast removal through the pinned hub-ui patch. Independent frame discovery reads run with bounded concurrency while retaining complete ambiguity checks and fresh actionability checks. Authenticated WebSocket requests now wait for the host’s first listener during asynchronous session setup, preserving order within the existing pending-message limit.

Verification

Affected lint and type checks pass. Final validation reproduced a WebSocket startup race where the initial request was discarded before asynchronous host setup attached its listener. The regression failed before the fix; all 21 focused WebSocket tests and both original Chromium approval/group tests pass afterward. This does not establish the cause of all earlier intermittent stalls. Regression tests cover pairing continuity, principal isolation, approval replay, concurrent membership, navigation policy, recovery and shutdown. A real Devframe RPC test verifies that cancelling browser input leaves ordinary host traffic usable. The patched embedded and standalone notification browser tests pass locally.

The Chromium E2E runs extension → Devframe RPC → broker → native MCP with 10,000 DOM nodes, 200 levels, 20 closed shadow roots and three cross-origin frame levels. It also exercises overlapping grants, live group membership, provider reconnect, generation replacement, cross-origin navigation and the hosted panel. Full pnpm verify passes on commit 85f75ef in CI run 34695125827.

Live staging and local-shell control previously passed, including a successful non-persisting interaction inside the Zoning iframe. That interaction required an explicit longer deadline and does not establish a passing latency gate. Live Reject and notification updates during group membership changes remain to be completed on the final integration. Earlier QA Helper proof used a branch containing the separately parked handshake and build fixes; it does not establish independent adoption without them.

The experimental release retains performance and intermittent stalls as follow-ups. The latest snapshot gates failed and the final repeated lifecycle run was incomplete. The manual Browser diagnostics workflow runs transports and lifecycle suites sequentially, retains partial summaries after failures, and writes full measurements to logs and bounded job summaries. Generated benchmark CSVs are removed; historical summaries retain failed results. Full MVP validation requires passing latency gates and the complete lifecycle matrix.