fix(network): restore bounded BiDi opening-response validation

CHANGELOG.md

@@ -6,6 +6,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ### Added
 
+- Bounded RFC 6455 WebDriver BiDi opening-response validation on the exact peer-verified stream: it admits only HTTP/1.1 `101`, case-insensitive `Upgrade`/`Connection` tokens, and the client-key-correlated `Sec-WebSocket-Accept` value within monotonic time and header-size ceilings; it restores blocking mode and still does not implement WebSocket frames or grant browser/Agent authority.
 - Bounded WebDriver BiDi loopback TCP transport that consumes one exact no-DNS connect target, retries only explicitly recoverable local transport failures within repository timeout and attempt ceilings, exposes the stream only after operating-system peer inspection and exact peer verification, supports a consuming handoff of the original stream with typed credential-free peer/session/TLS and bounded-attempt evidence, preserves typed causal errors, and performs no DNS, proxy/PAC, process authentication, TLS, WebSocket, BiDi message, browser-action, or Agent-authority step.
 - Exact WebDriver BiDi socket-peer verification that consumes an approved no-DNS connect target, requires the observed IP address and port to match exactly, preserves the TLS requirement and exact correlated session id, and remains inert metadata that does not authenticate an OS process, does not negotiate TLS, perform a WebSocket handshake, or grant Agent authority.
 - Explicit no-DNS WebDriver BiDi loopback connection targets that derive exact IPv4/IPv6 loopback `SocketAddr` metadata from a session-correlated endpoint, reject `localhost` as requiring separately trusted name resolution, preserve the TLS requirement and exact session id, perform no socket I/O, and grant no Agent authority.

crates/originweave-network/Cargo.toml

@@ -11,8 +11,10 @@ homepage.workspace = true
 publish = false
 
 [dependencies]
+base64 = "0.22.1"
 originweave-core = { path = "../originweave-core" }
 originweave-destination = { path = "../originweave-destination" }
+sha1 = "0.10.6"
 
 [lints]
 workspace = true

crates/originweave-network/src/lib.rs

@@ -5,9 +5,10 @@
 //! peers before exposing transport I/O, and emits credential-free evidence.
 //! It also bridges a session-correlated WebDriver BiDi loopback target from
 //! `originweave-core` into one bounded exact TCP connection, binds an RFC 6455
-//! opening request to that verified plain stream, and can write that exact request
-//! under one bounded deadline without claiming a completed WebSocket handshake or
-//! granting browser, WebSocket, TLS, policy, or Agent authority.
+//! opening request to that verified plain stream, can write that exact request
+//! under one bounded deadline, and validates its bounded RFC 6455 opening response
+//! without implementing WebSocket framing or granting browser, WebSocket, TLS,
+//! policy, or Agent authority.
 
 #![forbid(unsafe_code)]
 #![deny(missing_docs)]
@@ -26,8 +27,10 @@ pub use webdriver_bidi_connection::{
     WebDriverBiDiTcpConnectionEvidence, WebDriverBiDiTcpConnectionPlan,
 };
 pub use webdriver_bidi_websocket_handshake::{
+    MAX_WEBSOCKET_OPENING_RESPONSE_SIZE, MAX_WEBSOCKET_OPENING_RESPONSE_TIMEOUT,
     MAX_WEBSOCKET_OPENING_WRITE_TIMEOUT, WebDriverBiDiWebSocketClientKey,
-    WebDriverBiDiWebSocketHandshakeError, WebDriverBiDiWebSocketHandshakePlan,
+    WebDriverBiDiWebSocketEstablished, WebDriverBiDiWebSocketHandshakeError,
+    WebDriverBiDiWebSocketHandshakePlan, WebDriverBiDiWebSocketHandshakeResponseError,
     WebDriverBiDiWebSocketOpeningRequestSent, WebDriverBiDiWebSocketOpeningWriteError,
 };
 pub use webdriver_bidi_websocket_opening_recovery::WebDriverBiDiWebSocketOpeningWriteRecoveryDisposition;