feat(evidence): record validated browser protocol metadata

[seonghobae]

Partial implementation of #28 and Proposed ADR 0107, stacked on the exact current PR #112 head c2b572f0aa238611af7a29c614fd9ad4838e7eba.

Buyer/security gap

ADR 0107 requires browser adapter version/provenance to be available for audit and incident reconstruction. The active browser-protocol stack produces ValidatedBrowserProtocolUse only after exact OriginWeave generation, runtime protocol family, pinned runtime revisions, and one declared capability have passed together. This slice adds a credential-safe immutable receipt for that already validated metadata without turning cloneable audit evidence into reusable browser authority.

Live dependency / stack state

This Draft targets PR #112 branch feat/browser-protocol-runtime-kind-binding at exact current head c2b572f0aa238611af7a29c614fd9ad4838e7eba, transitively on #111/#110/#109/#108/#107/#106/#40. Current exact #113 head is 2562ca403117dfe789a73716162c7e1f20c1af0c.

Fresh exact comparison is ahead 6 / behind 0, with merge base exactly equal to the live prerequisite. The current semantic delta is limited to CHANGELOG.md, crates/originweave-evidence/src/lib.rs, and crates/originweave-evidence/tests/browser_protocol_validation_evidence.rs. Keep Draft while prerequisites remain active. No prerequisite check, review, status, coverage, mergeability, synthetic-merge, predecessor-head, skipped, cancelled, queued, absent, or model-only evidence transfers.

TDD / repair lineage

1. Historical test-only head 2e939a6a64515efd7a73e9d9ea74f0d23128a93d introduced the receipt contract before production support, but CI 31571990077 stopped first at canonical rustfmt. That setup failure is not counted as the intended RED.
2. Formatting-only head f11a88b62c58f076e853ecbf8eb053ab4716f583 reached the intended production boundary in CI 31572894086: repository contracts and canonical formatting passed, then Rust contracts job 94038496074 failed at the locked workspace check because public BrowserProtocolValidationEvidence did not exist. This is the valid RED.
3. Production head 9ae9b62ed39364fea852656fac0a52393b71c69d added the narrow evidence value and passed CI 31573399280, including Rust contracts and exact production coverage.
4. Historical head 79aeef1cdc7dffa7b11ae2a7e29867eb1881019d added the truthful Unreleased changelog entry on an earlier feat(core): bind validated browser use to runtime protocol kind #112 prerequisite. The branch has since been non-destructively aligned to the current feat(core): bind validated browser use to runtime protocol kind #112 authority line; current exact head is 2562ca403117dfe789a73716162c7e1f20c1af0c. Historical check evidence is not transferred.

Implemented boundary

BrowserProtocolValidationEvidence:

• can be constructed only from an existing ValidatedBrowserProtocolUse;
• copies the exact validated WebDriver BiDi/CDP family, OriginWeave protocol generation, adapter version, pinned upstream protocol revision, pinned browser revision, and exact validated capability into owned read-only audit metadata;
• is intentionally cloneable as evidence while the validation prerequisite remains non-cloneable; and
• grants no browser, Agent, origin, session, context, network, or secret authority.

Exact-current proof

On unchanged exact head 2562ca403117dfe789a73716162c7e1f20c1af0c against unchanged exact prerequisite #112 head c2b572f0aa238611af7a29c614fd9ad4838e7eba:

• ancestry: ahead 6 / behind 0, merge base equal to the live prerequisite;
• CI run 31937587609: success;
• Rust contracts job 95141831985: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 95141831960: exact owned-production function, line, region, and branch measurement and enforcement success;
• GitHub reports the Draft mergeable against its exact current prerequisite base;
• formal reviews returned by the fresh current-head refetch: none; and
• inline review threads returned by the fresh current-head refetch: none.

Manifest V3, protected-main-only security/SAST, and central review workflows not generated for this stacked evidence-only Draft are absent evidence, not passing evidence. No predecessor-head or prerequisite evidence is transferred. Passing automation is not independent approval.

Truth boundary

This slice records deterministic validation metadata only. It does not authenticate an adapter or browser process, attest that runtime metadata came from the running transport, authorize browser/session/network activity, execute WebDriver BiDi/CDP, prove a side effect/post-condition, persist an audit log, or make evidence tamper-evident. A trusted runtime still must derive the runtime metadata and consume the non-cloneable validation prerequisite immediately before browser I/O; the receipt is audit evidence only.

This scheduled actor does not merge, self-approve, alter workflows, add secrets, weaken checks, tag, or publish.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3b626e96-379f-46cc-865c-30ce20f8173b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

Devin Review found 1 new potential issue.