feat(browser): fail closed on oversized Agent Task observation

[seonghobae]

Partial implementation of #28 on the live test/agent-task-structured-value-evidence prerequisite.

Buyer/security boundary

The controlled pinned-Chromium Agent Task must not allow a role/name semantic-observation snapshot to become unbounded evidence. This branch makes that boundary executable and fail closed.

Implemented contract

The runner:

• defines MAX_AGENT_TASK_SEMANTIC_OBSERVATION_BYTES = 4_096 as a product-safety budget, not a protocol-validity claim;
• accepts only a non-empty object;
• canonicalizes it as compact sorted-key UTF-8 JSON;
• accepts exactly 4,096 bytes and rejects one byte over;
• routes the real controlled browser-observation path through _measure_agent_task_semantic_observation_bytes; and
• requires successful trial evidence to retain a positive semantic-observation byte count no greater than the same ceiling.

The evidence remains limited to reviewed browser-computed role/name fields for the controlled fixture. It does not authorize arbitrary page text, raw HTML, credentials, unrestricted JavaScript, or model-visible browser content.

TDD provenance

The original test-only head 71e78784332b2cbe34d3d704b6a03d0d69ff35c2 produced the intended repository-contract RED before production support existed. Subsequent commits implemented and refined the bounded measurement path.

Fresh exact-head truth

Current exact head: f60771f7afb23ea4bf63f15d8c6a0d5b507cda5b.

Current exact live base reported by GitHub: 43ea212770e5b9fb2a34da5196d6811036b396c5.

On this unchanged head:

• CI run 31942508997: success;
• Manifest V3 Compatibility run 31942509048: success;
• current formal review inventory: none;
• current inline review threads: none;
• GitHub reports the Draft mergeable against its live prerequisite.

The current changed-file set now includes a truthful Unreleased CHANGELOG.md entry for the 4,096-byte semantic-observation contract. The older PR-body statement that release-note debt remained was stale and is superseded by this live branch state.

No predecessor check, prerequisite result, synthetic merge result, bot status, comment, or model output is treated as current-head approval.

Stack / authority

This remains Draft while its prerequisite/descendant stack is active. No merge, approval, workflow, secret, ruleset, tag, release, or publication mutation is included.

Truth boundary

This lane bounds only controlled compatibility-runner semantic-observation evidence. A production browser adapter still requires its own reviewed structured-observation authority and product-wide budget.

---

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[seonghobae]

Reviewed the remaining informational thread on exact head 06b8505fb4bd683659db8beae35aafc5fc60126d (parent 43ea212770e5b9fb2a34da5196d6811036b396c5). It describes the intended fail-closed behavior rather than requesting a repair: the bounded observation helper executes before clear/type/click, an oversized observation raises ValueError, the trial loop records passed: false, and the repeatability gate rejects the incomplete trial set. The current fixture first verifies the exact short role/name strings before measuring the observation.

Both existing observation-bound/schema contract suites passed locally (5 tests). No code change is needed for this informational comment. Resolving that thread does not claim pinned-browser execution, hosted GREEN, independent approval, or protected-main delivery; the PR remains Draft.