feat(network): bind typed transport evidence to BiDi teardown

[seonghobae]

Partial implementation of #28. This Draft replaces caller-supplied teardown booleans with typed transport evidence and keeps browser-process exit/profile removal unavailable until their runtime owners provide non-forgeable evidence. Protocol ACK or transport closure alone is never operational teardown completion.

Current exact head is 3e7057443d7c9532ff526acb5eefe8cd4778c767, ordinarily integrating predecessor ebac126d1632c94775c2454423575275eec45def and actual #254 parent b11b6c9bccd8335b58a4fb599f8ad29ac419637f. Preserve dependency order through #248 → #249 → #250 → #251 → #252 → #253 → #254 → #255; predecessor checks and reviews do not transfer.

Review 5120077213 reproduced the earlier evidence-mixing defect where a session.end ACK from connection A could be combined with typed closure observed on connection B. The deeper causal gap was response parsing of a bare assembled text message: a success response with command id 7 received on separately verified connection B could consume connection A's outstanding command and inherit A's stored generation. Test-first 0a94765e0c631a043febec0973fd043304877537 reproduces this with two real loopback TCP/WebSocket connections using the same WebDriver session id and command id. This remains source-level RED lineage; hosted RED is not claimed because repair commits superseded that exact generation before terminal hosted execution.

The causal repair keeps received-message provenance non-forgeable. WebDriverBiDiWebSocketMessageReader consumes one established WebSocket and owns its assembler, so Pending/control/fragment state cannot move to another connection. WebDriverBiDiReceivedTextMessage carries only the private generation minted after exact peer verification. session.end correlation validates stored and received generations before removing the outstanding id, and teardown independently rejects a closure observation from another generation. The original response-substitution and closure-substitution inline findings are resolved on current source.

A complete local verification snapshot at e7bfec4488b7cb4776df7b546cacb46c8c9eb13e exposed a second causal RED lane: rustfmt and strict Clippy were not clean and production coverage missed connection-bound event/null-id errors, generation-exhaustion propagation, and an impossible post-correlation provenance fallback. The current follow-up addresses those causes rather than excluding them. feba41f13fb39e83fc8b377b8a55bd7c27348f9d exercises event/null-id envelopes through the real session.end response path. 89e397542060870578c43ba33a894e1854c198c1 removes the nested teardown if rejected by strict Clippy. 6f6d49f1f09324ccb753ba1fd8cc3aecb0345149 removes the impossible optional-provenance fallback by retaining the already-validated received generation. ddfac5b6ce35d5793543d2baa4125a3349e3d7ab introduces a private generation-counter seam and replaces deprecated fetch_update with try_update; Rust documents that API since 1.95, inside OriginWeave's declared Rust 1.97 MSRV. 78ffe1ca05edcfd3469d34bc71a97ea29ea1923d plus 8315eedea8780c24bc66b9e7eef6f3436dec1632 exercise exhaustion after a real loopback connect and verified peer inspection. Formatting-only test-name repairs through 2c8e9e29ac1560afe903d3690eb63c45e625d205 preserve the realistic scenarios while repairing known rustfmt drift. Doctoring now cites the 3 September 2026 W3C Working Draft, RFC 6455, and Rust standard-library compatibility evidence.

2026-09-05 소유자 통합 검증

앞선 자동화 런타임에는 Rust 도구가 없어 63cbca0a...의 로컬 GREEN을 주장하지 않았습니다. 이번 담당 작업에서는 실제 Rust 1.97.1로 재현해 사용하지 않는 private accessor만 삭제하고 rustfmt를 적용했습니다. 저장된 연결 provenance와 비교 검증은 그대로 유지했습니다. 최신 ebac126d1632c94775c2454423575275eec45def에서 fmt, strict Clippy -D warnings, 전체 workspace 테스트, rustdoc -D warnings, compileall, Python 141개가 종료 코드 0으로 통과했습니다.

cargo +1.97.1 fmt --all --check
cargo +1.97.1 clippy --locked --workspace --all-targets -- -D warnings
cargo +1.97.1 test --locked --workspace --all-targets
RUSTDOCFLAGS='-D warnings' cargo +1.97.1 doc --locked --workspace --no-deps
python3 -m compileall -q scripts tests
python3 -m unittest discover -s tests -p 'test_*.py'
cargo +nightly-2026-08-01 llvm-cov --locked --workspace --all-features --branch --json --output-path coverage.json
python3 scripts/ci/verify_coverage.py coverage.json

Production coverage 수치는 functions 1082/1082, lines 11025/11025, regions 14071/14071, branches 1202/1202입니다. 다만 마지막 계측에서 실제 warning: --branch option is unstable이 출력됐으므로 경고 없는 통과로 인정하지 않습니다. pinned cargo-llvm-cov 0.8.6/Rust nightly의 upstream 실험 기능 한계를 그대로 기록했습니다. 경고를 숨기거나 분모·branch 계측을 바꾸지 않았습니다.

이 결과는 로컬 소스 검증이며, 이전 HEAD의 CI 33953476003과 구분합니다. 새 HEAD의 hosted CI·Security·Semgrep·CodeQL·독립 승인과 부모 PR 통합, 경고 없는 계측 수용은 남아 있습니다. Draft를 유지하며 PR 종료·강제 이력 재작성·배포 완료를 주장하지 않습니다.

No workflow/ruleset/secret mutation, self-approval, bypass, force-push, destructive rebase, merge, tag, release or publication is authorized from this lane.

Current-parent verification — 2026-09-05

The ordinary merge retains both parents and all 15 connection-provenance production/child-test blobs from ebac126 byte-for-byte. It adopts the current opening-exchange fixture fixes and inherited native release contract. Before integration, an expected-one native-discovery assertion failed at zero collected tests; after integration, that contract executes and passes. Both release records survive the only merge conflict. The doctoring quality attribution now names ebac126, the actual accessor-removal commit, instead of incorrectly assigning its results to 63cbca0.

Fresh exact-tree verification passes 13 focused real-loopback received-message/response/teardown tests; all 142 Python contracts; compileall; Rust 1.97.1 fmt, workspace/all-target check, complete workspace tests, all-target/all-feature strict Clippy and rustdoc with -D warnings. Pinned-nightly numerical production coverage is 1082/1082 functions, 11032/11032 lines, 14086/14086 regions and 1202/1202 branches. The pinned cargo-llvm-cov branch warning remains explicit; this is not warning-free measurement acceptance.

The received-response and closure-substitution rejection paths remain intact, including preservation of outstanding correlation after a foreign response. Current-head hosted checks must execute independently. Draft is retained: no real Chromium authentication, process/profile cleanup, operational completion, counted approval, protected-main integration or release is claimed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head CI 33662853805 is now terminal, so the prior “workflow had not yet materialized” statement is stale. Rust contracts job 100357346802 is GREEN through repository contracts, rustfmt, workspace check/tests, strict Clippy, and rustdoc. Production coverage job 100357346476 measured successfully but failed exact enforcement. Artifact 9881810259 (sha256:1d3555f9a7ba5fa3e47732d657e32ae943c965bc5634cdc03fc851ae828a74e8) identifies exactly one uncovered production line: webdriver_bidi_command_correlation.rs:202, the Success + missing-command-id fallback. That state is not constructible through TopLevelFields::into_success, which requires a valid js-uint id before constructing every success envelope. Repair this at the common-envelope representation boundary rather than adding a synthetic test, coverage exclusion, threshold change, or panic/expect path: encode success routing with a structurally present u64, retain nullable ids only for protocol errors, keep events id-less, and consume that private routing directly in correlation while preserving public kind()/command_id() behavior. Keep #255 Draft until the repaired exact head executes full current-head verification; descendants must remain parent-first.

[seonghobae]

Parent/base reconstruction completed for exact head d60e98679f09cc067d46fae1170b464d53c0951f.

I merged the current #254 head (463859f06bf98a1a5776db0addf9cfd96f1fc9e5) without rewriting history. The sole conflict was the repeated WebDriver BiDi evidence note and was resolved to the current 4 Sep evidence. The current teardown contract now accepts only the typed observation produced by consuming the exact transport; process-exit and profile-removal evidence remain unavailable until their runtime owners exist, so caller-selected booleans cannot manufacture operational completion. The changelog now states that fail-closed contract.

Exact-tree local evidence: documentation contracts 22 passed / 177 subtests; rustfmt clean; strict all-target/all-feature Clippy clean; full workspace tests passed; rustdoc with warnings denied passed; pinned-nightly LLVM production functions, lines, regions, and branches are 100% covered. Hosted exact-head checks remain authoritative.

[seonghobae]

Exact-head parent refresh: f8edec38cf8ab7fde22b8d1de9305728c1a2f25b now adopts #254 a4841016b94cb18e917d250a9ca9149af54ceef0 without conflict. Rustfmt, all-feature/all-target check, strict Clippy, rustdoc, 141 Python contracts, and CI-equivalent pinned-nightly 100% production coverage all passed. Hosted checks remain authoritative; the PR stays Draft for ordered integration.

[seonghobae]

Non-force restacked on PR #254 exact head cbaf50dcc97753cc73135497ea8225e8b18de190; PR #255 is now exact head a13de5f9321e72c1867974eb7a43230f031e58df. Verification: rustfmt, all-feature/all-target check, strict Clippy, rustdoc, 141 Python contracts, and CI-equivalent pinned-nightly production function/line/region/branch coverage at 100%. Fresh hosted exact-head checks and ordered parent integration remain required.

[seonghobae]

Reviewed the parent-relative teardown binding at a13de5f against cbaf50d. Removing caller-supplied process/profile booleans correctly keeps overall teardown pending. One remaining evidence-correlation defect is reproducible through the public API: an ACK from connection A accepts closure observed on connection B as closure of A. Current hosted Rust contracts and Production coverage are queued; this review is not passing CI or a counted independent approval.

[seonghobae]

Exact-head review for f4e18ecb37fc670467b64ddfb2e580461ea02acd: valid finding is the received-response provenance gap, not just the already-known teardown-closure gap. Test-first 0a94765e... uses two real loopback TCP/RFC6455 connections with the same WebDriver session id and command id; on the pre-fix boundary, the response from connection B can consume connection A's outstanding session.end because parsing receives a bare text message and copies A's stored generation into the ACK. Treat that as source-level RED lineage only; no hosted RED is claimed.

Current repair is causally scoped: the connection-owned message reader retains one established transport plus fragment assembler, emits a received text value carrying only the private connection generation minted after exact peer verification, and connection-bound correlation compares that received generation before removing the outstanding id. Missing provenance and a foreign connection both fail closed without consuming A. Pending/control states preserve the same reader; completed text returns the exact established transport because no fragment state remains. Browser/process/profile/policy authority remains outside this layer, and protocol ACK is still not operational teardown completion.

Current CI 33951836718 is non-terminal; Rust contracts 101267978085 and Production coverage 101267978227 are queued with steps=[], runner_id=0. Do not inherit predecessor GREEN or treat absent security workflows as GREEN. Keep Draft until exact-head compile/test/coverage evidence is terminal and then reconstruct owner deltas parent-first rather than force-rewriting or closing dependent PRs.

[seonghobae]

Exact-snapshot verification of the received-connection repair at e7bfec4; historical subsequent head f4e18ec differed only by the new doctoring note. Later moving-head repairs require independent verification.

The original two security reproductions are now rejected by the connection owner and consumer. All 12 focused received-message/session.end/teardown tests pass, including same-session, same-endpoint reconnection; a foreign ACK leaves the original command outstanding. The reader owns one non-cloneable established stream and its assembler through Pending/Control, so callers cannot splice another socket's fragments into the trusted received-message wrapper. It returns the transport only after complete text; overall teardown remains pending. All 141 Python contracts and strict workspace rustdoc also pass.

The complete quality gates are not GREEN:

• Rust 1.97.1 formatting fails in the new/modified network files. Strict workspace Clippy fails on the nested transport-generation if in webdriver_bidi_session_teardown.rs:104 (collapsible_if).
• Pinned-nightly complete coverage execution passed, but scripts/ci/verify_coverage.py rejects lines=11046/11049 and regions=14067/14071. Functions=1081/1081 and branches=1204/1204. Uncovered: command_correlation.rs:282,285 (event and null-id errors on the connection-bound path), connection.rs:134 (allocator failure propagated from connect), session_end_response.rs:70 (the post-correlation missing-generation fallback; the validated path always returns Some). Exercise real reachable failures; remove redundant impossible state only with an invariant-preserving change, not a coverage exclusion.
• The pinned nightly also reports AtomicU64::fetch_update deprecated in favor of try_update; any replacement must retain the supported Rust 1.97.1 baseline.
• The first complete stable Rust run failed in the inherited opening_response_rejects_zero_and_excessive_deadlines_before_socket_mode_change fixture: WriteTimeoutCleanupFailed, EINVAL, after 198 opening bytes. That fixture accepts and immediately drops the peer socket before the client write/cleanup, so it races before the timeout assertion. The exact focused retry and a complete unchanged-tree Rust rerun both passed. This is recorded intermittent test evidence, not justification to weaken production cleanup errors.

Keep the current writer on this branch. Formatting, lint, full coverage and exact-head hosted checks still need completion; no approval or protected-main delivery is claimed.

Ancestry RCA: the invalid-deadline fixture repair already existed in owner #242 but was absent from this descendant. #242 now advances to 2d0e9f6 with the remaining three premature-close exchange fixtures sharing one synchronized server helper. It passed 139 contracts, full Rust gates, 50 fixture-suite runs (250 cases), and exact 100% production coverage. #243 adopted that parent at 97fab64, #246 adopted #243 at 585791f, and #248 adopted/retargeted onto #246 at b386f17. Each passed its full local Rust gates and 100% coverage. #248 additionally repaired the release-record test that native unittest discovery previously skipped; it now executes among 142 Python contracts. Fresh #246 CI 33953247053 and #248 CI 33953719566 are queued, not hosted GREEN. Later descendants should integrate this corrected chain rather than copy the fixture patch. CI 33952463254 is queued for #242, not hosted GREEN.

Follow-up quality verification at exact 63cbca0 (2026-09-05T08:20Z) is now terminal locally. All 141 Python contracts, compileall and the complete Rust 1.97.1 workspace/all-target tests pass; cargo check and strict rustdoc complete with a compiler dead_code warning. Formatting still fails, and strict Clippy exits 101 for the now-uncalled WebDriverBiDiCorrelatedResponse::connection_generation accessor. Pinned-nightly measurement completes, but coverage enforcement rejects functions=1082/1083, lines=11046/11051, regions=14071/14074; branches=1202/1202. The exact missing-lines report identifies command_correlation.rs:70–74 only. The earlier event/null-id and allocator-propagation gaps are covered; removing the impossible fallback left this unused private accessor. Remove the unused accessor and apply actual Rust 1.97.1 rustfmt output; do not add a warning/coverage exclusion or artificial caller. The current owner has the terminal results and a clear write scope; this read-only audit made no source edits.

The try_update replacement compiles under the supported toolchain and its since-1.95.0 compatibility is confirmed by the current official Rust atomic documentation. The old struct.AtomicU64.html reference returns 404 and should be updated. Exact CI 33953476003 is still pending; local behavioral success is not full quality or hosted GREEN.

The corrected parent chain has also reached #249 at 84b9407: ordinary #248 adoption, 142 Python/full Rust and 100% local coverage (989 functions, 9978 lines, 12717 regions, 1098 branches). Its CI 33954334610 is pending. #250 and later descendants must adopt the canonical parent chain in order; this does not authorize copying the fixture into #255.

[seonghobae]

Exact-head follow-up for feba41f13fb39e83fc8b377b8a55bd7c27348f9d: the foreign-response fix remains causal and connection-owned. This generation adds coverage for the two remaining connection-bound correlation routing cases: an error envelope with id: null and an event envelope both fail before consuming the outstanding session.end command. Together with the two-connection mismatch, missing-provenance, correct success/error, unknown-id, malformed-envelope, fragmented-text/control, malformed-frame, and binary-message cases, the new production branches have explicit edge coverage. Exact CI 33952042378 is queued; do not claim exact GREEN or transfer f4e18ecb... evidence. Keep Draft and preserve parent-first reconstruction.

[seonghobae]

Exact-head quality-gate repair review for 64b88e6b5d990fdb7c952ac058f451e242480092. The original cross-connection response and teardown-closure findings are resolved by current source: received messages retain connection-owned generation, correlation validates it before consuming the outstanding id, and teardown rejects closure from another generation. This generation also repairs the separate local gate failures recorded at e7bfec...: event/null-id response paths are exercised, the Clippy collapsible_if is removed without weakening the invariant, successful connection-bound correlation no longer contains an impossible optional-generation fallback, and generation exhaustion is exercised after real loopback connect + verified peer inspection through a private counter seam. AtomicU64::try_update is stable since Rust 1.95 and remains inside the Rust 1.97.1 baseline. Formatting-only test-name repairs preserve scenarios. Exact CI 33953394093 is queued; no exact-head GREEN/security GREEN/approval/integration is claimed.

[seonghobae]

Exact-head follow-up for 63cbca0a98cf9496af981819d98029e656fc4342: current source retains the resolved cross-connection response/closure invariants and records the gate-specific repairs without exclusions. Rust try_update compatibility is now stated against the repository's declared rust-version = 1.97, not the transient runner patch level. Exact CI 33953476003 is pending; predecessor COMMENT review 5120360599 remains historical only. No GREEN, approval, security completion, protected-main integration or release is inferred.