feat(core): declare versioned browser protocol capabilities

[seonghobae]

Partial implementation of #28 and Proposed ADR 0107, stacked on canonical browser-authority owner PR #40.

Buyer/foundation boundary

OriginWeave needs an explicit version/capability descriptor before WebDriver BiDi and pinned CDP adapters can coexist safely. BrowserProtocolAdapterDescriptor records explicit protocol kind, bounded adapter/upstream-protocol/browser revision tokens, and a non-empty duplicate-free capability set in deterministic canonical order. Protocol family grants no capability by itself and this metadata grants no browser/action/network/secret authority.

Fresh dependency state

Protected main is exact b05d5acca82b9d916ada2c8e82f59f92a89817e1. Canonical prerequisite #40 is exact 93ce1e7efad0a1e8c107f1f465a5260ba568d466. Current #106 head is exact 378a9f2613f4044ece20246bab6cd77f35018981.

Fresh comparison from exact #40 to this head is 20 commits ahead / 0 behind, with merge base exactly 93ce1e7efad0a1e8c107f1f465a5260ba568d466. The semantic delta is the intended protocol descriptor plus the required current-crate-root export adaptation: CHANGELOG.md, crates/originweave-core/src/browser_protocol.rs, crates/originweave-core/src/lib.rs, crates/originweave-core/src/root.rs, and crates/originweave-core/tests/browser_protocol_adapter.rs. GitHub reports the PR open, Draft, and mergeable. Keep Draft while #40 remains active.

Reconstruction / repair lineage

The predecessor child had diverged from moved #40. This run non-destructively reconstructed the descriptor on the exact live #40 tree at merge commit 56e7b5e1f9000f27022dfc7f4a01d6d928cb399b, restored the child changelog at 4943b824877a44068a22d3ef17ce1de66b926173, then used exact-head CI as a real adaptation test. CI 32790736295 exposed that the current crate root is src/root.rs, so editing only src/lib.rs left the public descriptor unavailable to external tests. Exact head 01fd68fe1f8faa8725558fb2a8ed61e67602e10b repaired the crate-root export; its next CI reached only canonical rustfmt drift. Current head 378a9f2613f4044ece20246bab6cd77f35018981 applies that canonical formatting. No force-push or destructive rebase was used.

Historical test-only heads c0da8bd7537c0b242d9f6e6d38dce8ff42417032 and 8d2549cbad8cdabfe09a5ee61aa7a7ee1de81cc8 remain regression lineage only: they established the missing descriptor boundary and caller-order-dependent capability identity respectively.

Exact-current GREEN evidence

On unchanged exact head 378a9f2613f4044ece20246bab6cd77f35018981:

• CI 32791314299: success;
• Rust contracts job 97633270488: exact-head checkout, Python repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 97633270287: exact-head checkout and owned production functions, lines, regions, and branches all exactly 100% covered;
• coverage artifact 9543254652, exact-coverage-378a9f2613f4044ece20246bab6cd77f35018981, ZIP SHA-256 1370c6f27e2421303c709be02621b2880840ef54d30f1cd23157e46b8cba23eb;
• Manifest V3 Compatibility 32791314189: success;
• fresh formal review inventory: empty; and
• fresh inline review-thread inventory: empty.

This exact feature-base head exposes CI and Manifest V3 workflows only; no SAST or Security Scan result is claimed. No prerequisite/predecessor/synthetic/skipped/cancelled/pending/status-only/model-only evidence is promoted as current proof.

Authority / truth boundary

This descriptor does not speak BiDi/CDP, authenticate an adapter, mint session/context/node authority, execute input, authorize destination/network/TLS/HTTP, expose arbitrary JavaScript, or establish BiDi/CDP semantic parity. #40's authority-registry and extension/task constraints are inherited prerequisite semantics, not unique #106 work.

There is no qualifying independent current-head approval. Protected-main AGENTS.md remains authoritative; this scheduled writer does not merge, self-approve, alter workflows/rulesets/secrets, force-push, tag, release, or publish.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 10c861da-94e6-431a-aec7-9a994f53806f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.