feat(network): write bounded BiDi WebSocket opening request

[seonghobae]

Buyer/runtime boundary

This Draft owns one narrow WebDriver BiDi transport step: write the complete bounded RFC 6455 client opening request on the same verified TCP stream produced by its prerequisite stack, without reading or accepting the server handshake.

Fresh stack truth

• protected main: exact 542ca1e9c0a863595b8b6697790005d2471f5413;
• prerequisite PR feat(network): serialize bounded BiDi WebSocket opening request #193 is GitHub-merged into its retained parent stack branch, not integrated into protected main; its retained head and this PR's live base are exact 6922dd98779e8f8aad132a3b1f563d7ba6e6d070;
• this Draft exact contributor head: 5c111d0db6c363f9d1786c21cc01c5c7398007bd;
• GitHub currently reports the Draft open and mergeable; and
• the prerequisite chain remains dependency-root work. This child stays stacked until that chain is deliberately integrated/reconstructed dependency-first.

A prior projection of only this child's non-CHANGELOG files onto protected main exposed the missing prerequisite boundary immediately: exact-head CI 33230664617 failed because originweave-network referenced predecessor module webdriver_bidi_connection, which is not present on protected main. That failed hypothesis remains causal evidence, not passing evidence. The branch was repaired non-destructively by restoring the prerequisite-complete tree and retargeting this PR to the retained #193 base. No force-push, destructive rebase, or predecessor evidence transfer was used.

Historical RED/GREEN predecessor SHAs remain regression lineage only. No prerequisite check, review, approval, coverage, mergeability, synthetic-merge, or stale-head evidence transfers.

Implemented boundary

The current branch:

• consumes the already-verified stream and writes the complete bounded opening request under one nonzero caller deadline capped at five seconds;
• uses one monotonic deadline and retries only interrupted writes;
• distinguishes timeout-configuration, timeout/would-block, zero-write, non-recoverable write, deadline, and timeout-cleanup failures with typed causal errors;
• drops the consumed stream on failed write paths so partial request state cannot be promoted as success;
• clears the operation-local socket write timeout before successful handoff;
• retains verified transport evidence, the exact RFC 6455 client key, request byte count, and configured write budget;
• classifies fully-written-but-deadline-expired or otherwise ambiguous completion as ReconciliationRequired, preventing blind redispatch; and
• permits only a fresh authority/route/connection/deadline revalidation path after a provably incomplete failed write.

It deliberately does not read or validate the peer opening response, establish WebSocket state, authenticate Chromium/ChromeDriver process provenance, or grant browser/Agent authority.

Exact-current evidence

For unchanged exact head 5c111d0db6c363f9d1786c21cc01c5c7398007bd:

• CI run 33230894881: success;
• Manifest V3 Compatibility run 33230894868: success;
• Security Scan run 33230894871: success;
• SAST Semgrep run 33230894874: failure, with exactly one unsuppressed finding from javascript.lang.security.detect-insecure-websocket.detect-insecure-websocket at crates/originweave-core/src/webdriver_bidi_websocket_endpoint.rs:54 for the literal ws://;
• exact scanner checkout identity matched this head, Semgrep scanned the tree successfully, and the failure occurred only at the finding-enforcement step;
• all currently returned inline review threads are resolved; and
• current formal reviews are comments only; there is no qualifying independent APPROVED review.

The SAST finding is not treated as passing. Exact source review shows that ws:// is admitted only by the bounded first-Chromium-fixture endpoint type, which then requires loopback host identity; non-loopback hosts fail closed, later connect-target construction does not inherit ambient DNS authority, and the endpoint retains whether TLS is required. The failing rule is a JavaScript insecure-WebSocket heuristic applied to Rust transport metadata and does not model this reviewed loopback-only authority boundary. Product semantics are therefore not being obscured or weakened merely to silence the scanner. The evidence-system false positive has been routed with exact head/run/rule/path evidence through OriginWeave governance issue #215 for the organization-owned SAST owner; after a central rule/config repair, this exact tree or its deliberately reconstructed descendant must be rescanned and real remote insecure-WebSocket cases must remain blocking.

Governance / integration boundary

The active organization ruleset requires one qualifying independent approval, stale-review dismissal after pushes, resolved review threads, and the configured central required workflows on protected-branch integration. Passing automation is not approval, and the current SAST failure remains a real integration blocker for this exact head. Protected-main AGENTS.md remains authoritative.

This scheduled actor does not use administrative bypass, merge, self-approve, force-push, destructively rebase, alter workflows/rulesets/secrets, weaken checks, tag, release, or publish.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}