feat(core): separate Chrome permissions from Agent authority

[cursor]

Buyer/security gap

Partial implementation of #27. Chrome extension compatibility evidence must never become OriginWeave Agent authority. Reviewed Manifest V3 permissions may prove a stock Chromium compatibility surface, but cannot mint an Agent capability, filesystem authority, browser action, secret authority, approval, or any other OriginWeave permission.

Exact current state

• protected base: main@542ca1e9c0a863595b8b6697790005d2471f5413;
• exact PR head: cursor/bc-fb7d6c9e-f364-4c0a-bda6-ab0afe7b6b31-cfc4@0ecfa765020154f2130ffd78af3694423d8764d7;
• GitHub reports content MERGEABLE but integration BLOCKED;
• current unresolved review threads: none; and
• no qualifying independent approval is established. The visible CHANGES_REQUESTED OpenCode review targets stale head 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac, not this exact head.

Implemented boundary

originweave-core::chrome_permission_authorizes_agent_action remains fail-closed:

• reviewed compatibility permissions, including downloads and nativeMessaging, return CompatibilitySurfaceOnly;
• empty, case-shifted, control-bearing, whitespace-tailed, and unreviewed tokens return UnrecognizedPermission; and
• there is no success path, so no ActionKind can turn Chrome permission text into OriginWeave Agent authority.

The branch preserves protected-main extension-grant origin binding and exclusive trusted-time expiry. Chrome compatibility evidence remains separate from explicit OriginWeave extension grants and Agent policy authority.

Exact-head verification

For unchanged exact head 0ecfa765020154f2130ffd78af3694423d8764d7:

• Rust contracts: success;
• Production coverage: success;
• pinned Chrome for Testing MV3 fixture: success;
• OpenCode review check: success;
• SAST Semgrep, CodeQL, dependency review, Security Scan, Noema, and supporting scanner checks: success; and
• Strix: failure, run 33137185789, job 98740564545.

Strix failed closed because the exact log shows NVIDIA NIM rate-limit 429, the configured NIM fallback was unavailable, OpenRouter returned 502 Invalid URL, and the OpenAI fallback returned 429 for no credits. No authoritative structured vulnerability report was produced. This is provider infrastructure evidence, not a source-test pass or a reason to weaken the security gate; no scan result is promoted.

Scope boundary

This is IMPLEMENTED_ON_ACTIVE_PR, not protected-main shipped truth. It does not implement native-messaging transport, native-host allow-listing, host-process isolation, extension installation, Chrome message parsing, browser launch/control, filesystem authority, secret brokerage, or the full #27 compatibility/runtime matrix.

Chrome for Developers. (n.d.). chrome.downloads. Google. Retrieved August 16, 2026, from https://developer.chrome.com/docs/extensions/reference/api/downloads

Chrome for Developers. (n.d.). Native messaging. Google. Retrieved August 18, 2026, from https://developer.chrome.com/docs/extensions/develop/concepts/native-messaging

This scheduled writer does not merge, self-approve, tag, publish, alter workflows, add secrets, or weaken checks.

[cursor]

Stale comment

Review — exact head f6c089b8faae015c5b8845296af7cdc3ddcd0c65

chrome_permission_authorizes_agent_action is fail-closed: a Chrome downloads token, and every other reviewed compatibility permission, cannot authorize Agent Download or any other ActionKind. Case, empty, and control-bearing tokens stay UnrecognizedPermission. That is the correct adapter check for ADR 0013 rule 4.

Next action: keep this primitive independent of MV3 runner PRs #43/#176. Do not treat a passing Chrome fixture as Agent filesystem authority. Wire adapters to call this boundary before policy, and add commands and windows to the reviewed-token list when those protected-main surfaces should be classified as CompatibilitySurfaceOnly instead of UnrecognizedPermission. Both paths already refuse the action.

Rust contracts, production coverage, and the pinned Chrome MV3 fixture succeeded on this head at review time. Remaining SAST/security/Strix/review workflows were still queued and are not promoted. This review is not an approval.

View PR

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Review — exact head f6c089b8faae015c5b8845296af7cdc3ddcd0c65

The isolation primitive is sound and independent of the #43/#176 downloads runner. chrome_permission_authorizes_agent_action never returns Ok. Reviewed Chrome tokens including downloads become CompatibilitySurfaceOnly. Empty, case-shifted, newline-injected, and unrecognized tokens become UnrecognizedPermission. The ActionKind argument is intentionally unused so a Chrome permission cannot mint Download or any other Agent action.

is_exact_chrome_permission_token correctly admits mixed-case Chrome names such as sidePanel and declarativeNetRequest while rejecting DOWNLOADS and host-permission punctuation.

Residual, non-blocking

Protected-main MV3 evidence also exercises windows and commands. Those names are not in REVIEWED_CHROME_COMPATIBILITY_PERMISSIONS, so they currently classify as UnrecognizedPermission rather than CompatibilitySurfaceOnly. Both arms still refuse Agent authority. Add them only if an adapter needs the clearer diagnostic; do not treat the omission as a capability leak.

Stay draft until exact-head required checks are green. Do not fold this into the downloads runner, HTTP #37, or reserved MV3 drafts #49/#56/#59/#60/#61.

  

_{Sent by Cursor Automation: Fix Issues}

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

Exact-head review found one current documentation-truth defect that must be fixed before approval. docs/traceability/extension-authority-security.md adds chrome_permission_authorizes_agent_action under the heading “Protected main already provides:”, but protected main is still 0c376acf059be9ddddddfbde1d0189e4f39ef014 and does not contain this PR-only function. That promotes active-PR behavior to shipped truth and violates the repository’s protected-main-vs-active-PR documentation contract. Keep the existing protected-main bullets unchanged and move/label this function as active/non-shipped PR #175 evidence (and make the docs/traceability/README.md wording equally explicit if needed). The Rust fail-closed implementation itself looks coherent on this head; exact-head CI, MV3, SAST, and Security are green. Please repair the truth-status wording without widening scope, then re-run exact-head evidence.

Superseded by current exact head db724d4. The current-main reconstruction removed the stale traceability-document changes entirely; fresh compare against protected main 0841d2a contains only CHANGELOG plus the bounded core module/Cargo/test slice. This dismissal is stale review-state cleanup only, not approval; current-head required checks and independent/latest-push approval remain required.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

Fresh current-source review found one additional issue-#27 compatibility taxonomy gap at exact head 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac: Chrome’s current official chrome.management reference requires the manifest permission management for the management API, and that API includes extension enable/disable and uninstall lifecycle operations. Issue #27 explicitly covers install/disable-enable/update-restart behavior. At this boundary, management should therefore be a reviewed compatibility-only permission, never Agent authority.

Owner action on this same canonical branch: add management to chrome_compatibility_permissions_never_mint_agent_authority first and observe the expected RED classification; then add only "management" to REVIEWED_CHROME_COMPATIBILITY_PERMISSIONS. Preserve the existing no-Ok contract and exact-token rejection. No browser-management capability, install authority, OriginWeave grant, or policy authority is widened.

Primary references: https://developer.chrome.com/docs/extensions/reference/api/management and https://developer.chrome.com/docs/extensions/reference/permissions-list . The attempted ref mutation for this test-first repair was blocked before the branch changed, so the exact PR head remains unchanged and no passing evidence is claimed for this gap.

[opencode-agent]

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac.

• Head SHA: 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac

• Workflow run: 32185290142

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (5 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (5 files)"]
  R1 --> V1["required checks"]

Loading

[opencode-agent]

OpenCode Review Overview

• Head SHA: 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac
• Workflow run: 32185290142
• Workflow attempt: 1
• Gate result: REQUEST_CHANGES (approval step)

Pull request overview

OpenCode cannot approve yet because required coverage evidence did not pass.

Review outcome

1. HIGH .github/workflows/opencode-review.yml:1 - Coverage evidence did not prove required test/docstring evidence

• Problem: The required coverage-evidence job result was failure, so OpenCode cannot establish approval sufficiency for this head.

• Root cause: Automated approval is only valid when the same-head coverage-evidence job proves supported repository test suites passed and configured docstring gates passed or were advisory, or reports not applicable because no supported source files or package manifests exist. Missing, failed, skipped, unavailable, or unsupported-tooling test evidence is a blocker.

• Fix: Install or configure the repository test/docstring evidence tooling when source files or package manifests exist, rerun the current-head coverage-evidence job, and approve only after it reports success with required evidence or explicit no-source not-applicable evidence.

• Regression test: Keep the approval branch checking needs.coverage-evidence.result == success before posting APPROVE, and publish REQUEST_CHANGES when coverage-evidence blocker states such as cancelled, skipped, failed, unsupported-tooling, or below-100 evidence are present.

• Result: REQUEST_CHANGES

• Reason: coverage-evidence result was failure, so required test/docstring evidence was not proven for current head 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac.

• Head SHA: 7fc96f8bbffe80dc6eabe9efcabfa4362e2c81ac

• Workflow run: 32185290142

• Workflow attempt: 1

Coverage evidence

Coverage Decision

• Result: FAIL
• Test evidence: not proven passing
• Docstring evidence: not proven passing when configured
• Failure count: 1

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Changed file (5 files)"]
  S1 --> I1["repository behavior"]
  I1 --> R1["Review risk: Changed file (5 files)"]
  R1 --> V1["required checks"]

Loading

[devin-ai-integration]

Devin Review found 2 potential issues.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[devin-ai-integration]

Devin Review found 1 new potential issue.

[seonghobae]

Current-head update: merged protected main 542ca1e into the stale branch and pushed merge commit 0ecfa76 via fast-forward from 7e5fcf5. Current PR base/head are 542ca1e -> 0ecfa76. Local Rust 1.97.1 verification passed: cargo test --workspace --all-features, cargo fmt --all -- --check, cargo clippy --workspace --all-targets --all-features -- -D warnings, RUSTDOCFLAGS="-D warnings" cargo doc --workspace --all-features --no-deps, and git diff --check. Hosted checks have restarted and are pending; mergeable_state=blocked and no counted approval is present.