test(browser): locate controlled Agent Task targets semantically

tests/fixtures/agent_task_basic/index.html

@@ -16,7 +16,12 @@ <h1>Controlled Agent Task</h1>
       <button type="submit">Submit task</button>
     </form>
 
-    <output id="task-result" data-state="idle" aria-live="polite">idle</output>
+    <output
+      id="task-result"
+      data-state="idle"
+      aria-label="Task result"
+      aria-live="polite"
+    >idle</output>
 
     <p
       data-originweave-untrusted="prompt-injection"

tests/test_agent_task_structured_value_contract.py

@@ -0,0 +1,66 @@
+"""Contract for credential-safe structured extraction in the controlled Agent Task."""
+
+from __future__ import annotations
+
+import hashlib
+import pathlib
+import runpy
+import unittest
+
+ROOT = pathlib.Path(__file__).resolve().parents[1]
+RUNNER = ROOT / "scripts" / "ci" / "run_mv3_compatibility.py"
+FIXTURE = ROOT / "tests" / "fixtures" / "agent_task_basic" / "index.html"
+
+
+class AgentTaskStructuredValueContractTests(unittest.TestCase):
+    """Require bounded semantic extraction without retaining the extracted value."""
+
+    def test_result_is_discovered_by_exact_browser_semantics(self) -> None:
+        """The result node must be located by browser-computed role/name, not fixture CSS."""
+
+        runner = RUNNER.read_text(encoding="utf-8")
+        fixture = FIXTURE.read_text(encoding="utf-8")
+        self.assertIn('aria-label="Task result"', fixture)
+        self.assertIn('"status"', runner)
+        self.assertIn('"Task result"', runner)
+        self.assertIn('"result_semantics_verified"', runner)
+        self.assertNotIn('_find_element(driver_port, session_id, "#task-result")', runner)
+
+    def test_structured_value_hash_is_bounded_and_canonical(self) -> None:
+        """Only a canonical SHA-256 digest may leave the controlled extraction boundary."""
+
+        namespace = runpy.run_path(str(RUNNER), run_name="agent_task_structured_value_contract")
+        self.assertIn("MAX_AGENT_TASK_STRUCTURED_VALUE_BYTES", namespace)
+        self.assertIn("_hash_agent_task_structured_value", namespace)
+        helper = namespace["_hash_agent_task_structured_value"]
+        maximum = namespace["MAX_AGENT_TASK_STRUCTURED_VALUE_BYTES"]
+
+        value = "synthetic structured value"
+        expected = "sha256:" + hashlib.sha256(value.encode("utf-8")).hexdigest()
+        digest = helper(value)
+        self.assertEqual(digest, expected)
+        self.assertNotIn(value, digest)
+        self.assertEqual(len(digest), len("sha256:") + 64)
+
+        with self.assertRaises(ValueError):
+            helper("")
+        with self.assertRaises(ValueError):
+            helper("x" * (maximum + 1))
+        with self.assertRaises(TypeError):
+            helper(42)
+
+    def test_agent_task_evidence_reports_field_and_digest_not_raw_result(self) -> None:
+        """Trial evidence must expose a field identifier and digest, not extracted text."""
+
+        runner = RUNNER.read_text(encoding="utf-8")
+        for expected in (
+            '"structured_value_field"',
+            '"structured_value_sha256"',
+            '"task_result"',
+        ):
+            with self.subTest(expected=expected):
+                self.assertIn(expected, runner)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_mv3_compatibility_contract.py

@@ -2,9 +2,11 @@
 
 from __future__ import annotations
 
+import http.client
 import json
 import pathlib
 import runpy
+import tempfile
 import unittest
 
 ROOT = pathlib.Path(__file__).resolve().parents[1]
@@ -120,6 +122,32 @@ def test_runner_transport_cannot_follow_dynamic_url_schemes(self) -> None:
         self.assertNotIn("urllib.request", runner)
         self.assertNotIn("urllib.error", runner)
 
+    def test_fixture_handler_cannot_follow_symlinks_outside_its_root(self) -> None:
+        """The loopback fixture server must not expose files outside its configured root."""
+
+        namespace = runpy.run_path(str(RUNNER), run_name="mv3_contract")
+        start_server = namespace["_start_fixture_server"]
+        stop_server = namespace["_stop_fixture_server"]
+        with tempfile.TemporaryDirectory() as temporary_directory:
+            temporary_root = pathlib.Path(temporary_directory)
+            fixture_root = temporary_root / "fixture"
+            outside_root = temporary_root / "outside"
+            fixture_root.mkdir()
+            outside_root.mkdir()
+            (outside_root / "secret.txt").write_text("outside", encoding="utf-8")
+            (fixture_root / "escape").symlink_to(outside_root, target_is_directory=True)
+
+            server, thread = start_server(fixture_root)
+            connection = http.client.HTTPConnection(*server.server_address, timeout=1)
+            try:
+                connection.request("GET", "/escape/secret.txt")
+                response = connection.getresponse()
+                self.assertEqual(response.status, 404)
+                self.assertNotIn(b"outside", response.read())
+            finally:
+                connection.close()
+                stop_server(server, thread)
+
     def test_runner_accepts_real_chromedriver_element_ids_without_path_injection(self) -> None:
         """ChromeDriver dotted element IDs must work while path syntax stays fail-closed."""