feat(network): bind session.end ack to operational teardown evidence

[seonghobae]

Boundary and safe-successor topology

Draft child of #252. This intermediate assessment still accepts three caller-supplied booleans and can emit OperationallyComplete; review 5120013340 remains an intentionally unresolved finding on this branch. A rustdoc caveat, passing structural tests, hosted CI, or numerical coverage does not authenticate those values. Do not integrate #253 into protected main as trusted operational-completion evidence.

The valid typed teardown-assessment delta is preserved in successor #255. #255 now directly targets #252 and includes both #253/#254 valid deltas plus the later connection-bound provenance repair, so protected integration no longer needs to pass through this unsafe intermediate generation. Keep this PR open until that successor's inheritance and protected delivery are independently verified; do not Close it merely to reduce queue count.

Current source evidence

Exact head remains afb623e4449b7cbf926fdcef7225ceaca822cfcf, ordinarily integrating predecessor 0d72082e... and #252 6569bf40b6595ac74c2f0a997d202137f07ba1db. Child assessment source, exports and loopback tests are unchanged. Local verification passed 142 Python contracts, compileall, Rust 1.97.1 fmt/check/workspace tests/strict Clippy/rustdoc, with numeric production coverage 1054 functions / 10747 lines / 13787 regions / 1194 branches at 100% and the known unstable branch-option warning. Exact-head CI 33960670119 is terminal success.

That quality evidence does not resolve the caller-supplied-evidence defect. Browser process/profile cleanup and operational completion remain unavailable here. No workflow/ruleset/secret mutation, self-approval, bypass, force update, destructive rebase, protected merge, tag, release or publication is authorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Parent/base RCA completed for exact head 4c112e71f9a73edd27789b93460c55934543e072.

I merged the current #252 head (aa4af82806c3f7e3d0622c0025fbf1a8fadf3089) without rewriting history. The historical coverage failure was inherited from shared correlation and is repaired in the parent chain. The teardown assessment remains deliberately narrow: protocol acknowledgment, transport closure, process exit, and task-profile removal stay distinct, and caller-supplied observation booleans are not mislabeled as authenticated evidence. I added the missing buyer-visible changelog entry.

Exact-tree local evidence: documentation contracts 22 passed / 177 subtests; rustfmt clean; strict all-target/all-feature Clippy clean; full workspace tests and rustdoc with warnings denied passed after one retry of the existing macOS socket-timeout cleanup race; pinned-nightly LLVM production functions, lines, regions, and branches are 100% covered. Hosted exact-head checks remain authoritative.

[seonghobae]

Exact-head parent refresh: 5e2b17c7a8d1953bb06a41e0296f801f0d015a9a now adopts #252 881a599fb3a920b6bfd4f0a276f3cf24a61d8194 without conflict. Rustfmt, all-feature/all-target check, strict Clippy, rustdoc, 141 Python contracts, and CI-equivalent pinned-nightly production function/line/region/branch coverage all passed. Hosted checks remain authoritative; the PR stays Draft for ordered stack integration.

[seonghobae]

Non-force restacked on PR #252 exact head 2015259529ada99af836989079cc85a15779a2d8; PR #253 is now exact head 0d72082e595c0e1fcc03d609ba337896ed14e2fc. Verification: rustfmt, all-feature/all-target check, strict Clippy, rustdoc, 141 Python contracts, and CI-equivalent pinned-nightly production function/line/region/branch coverage at 100%. Fresh hosted exact-head checks and ordered parent integration remain required.

[seonghobae]

Exact-head security finding on 0d72082e595c0e1fcc03d609ba337896ed14e2fc: the public API currently upgrades three unauthenticated caller booleans into WebDriverBiDiSessionTeardownDisposition::OperationallyComplete. WebDriverBiDiSessionTeardownObservations::new(true, true, true) is sufficient after any correlated session.end ack; the focused test correlated_ack_plus_all_operational_observations_is_complete confirms this exact path. The rustdoc caveat that observations are not authenticated does not survive the return type/name, so a consumer can accidentally treat a caller assertion as process-exit/profile-removal evidence.

Repair acceptance: keep protocol acknowledgment separate, but do not emit an operational-completion disposition from raw booleans. Require non-forgeable typed observations issued by the owning transport/process/profile boundaries and bound to the same session/task/profile identity, or keep the result explicitly named as unverified caller claims until those types exist. Add a RED proving raw booleans cannot mint operational completion, then preserve the existing missing-observation cases. Do not weaken parent-first ordering or claim teardown completion from the protocol ack alone.