feat(network): bind typed transport evidence to BiDi teardown

CHANGELOG.md

@@ -8,6 +8,8 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 - Typed outbound WebDriver BiDi `session.end` over the bounded client WebSocket stream: it serializes only the standards-defined method with empty params, rejects invalid frame deadlines before correlation registration, retires only the just-registered id when frame preflight proves no command bytes were emitted, preserves exact command-kind correlation across ambiguous writes, and does not treat frame-write success as proof that the browser session ended.
 - Typed `session.end` response admission that consumes only the exact outstanding command-kind correlation after complete envelope validation, preserves remote protocol errors as failures, and does not claim browser-process exit or resource cleanup from a protocol acknowledgment.
+- Fail-closed `session.end` teardown assessment that binds only the typed observation produced by consuming the exact transport, keeps browser-process-exit and task-profile-removal evidence unavailable until their runtime owners exist, and therefore cannot report operational completion from caller-supplied booleans.
+- Bounded WebDriver BiDi transport-closure observation that consumes the established stream, accepts only a validated peer Close frame or clean pre-frame EOF, permits at most one unsolicited Pong, and keeps transport closure separate from process-exit and profile-cleanup claims.
 - Bounded RFC 6455 WebDriver BiDi opening-response validation on the exact peer-verified stream: it admits only HTTP/1.1 `101`, case-insensitive `Upgrade`/`Connection` tokens, and the client-key-correlated `Sec-WebSocket-Accept` value within monotonic time and header-size ceilings; it restores blocking mode and still does not implement WebSocket frames or grant browser/Agent authority.
 - Typed outbound WebDriver BiDi `session.status` over the bounded client WebSocket stream: it serializes only the standards-defined method with empty params, preserves exact typed command-id correlation, rejects invalid frame deadlines before registration, retires only the just-registered id when a local masking-key preflight proves no command bytes were emitted, and keeps correlation outstanding after partial or ambiguous writes; frame-write success is not treated as command completion or browser/Agent authority.
 - Bounded WebDriver BiDi loopback TCP transport that consumes one exact no-DNS connect target, retries only explicitly recoverable local transport failures within repository timeout and attempt ceilings, exposes the stream only after operating-system peer inspection and exact peer verification, supports a consuming handoff of the original stream with typed credential-free peer/session/TLS and bounded-attempt evidence, preserves typed causal errors, and performs no DNS, proxy/PAC, process authentication, TLS, WebSocket, BiDi message, browser-action, or Agent-authority step.

crates/originweave-network/src/lib.rs

@@ -9,8 +9,10 @@
 //! unmasked server-frame reads, assembles bounded WebDriver BiDi text messages,
 //! classifies complete local-end JSON envelopes, tracks bounded command-response
 //! correlation, sends narrowly typed `session.status` and `session.end` commands,
-//! and admits typed correlated status and end responses without exposing generic
-//! JSON bodies or granting browser, TLS, policy, secret, or Agent authority.
+//! admits typed correlated status and end responses, observes bounded peer Close
+//! or clean-EOF transport cessation, and keeps protocol/transport evidence separate
+//! from explicit operational teardown observations without exposing generic JSON
+//! bodies or granting browser, TLS, policy, secret, process, profile, or Agent authority.
 
 #![forbid(unsafe_code)]
 #![deny(missing_docs)]
@@ -23,10 +25,12 @@ mod webdriver_bidi_session_end_command;
 mod webdriver_bidi_session_end_response;
 mod webdriver_bidi_session_status_command;
 mod webdriver_bidi_session_status_response;
+mod webdriver_bidi_session_teardown;
 mod webdriver_bidi_websocket_frame;
 mod webdriver_bidi_websocket_handshake;
 mod webdriver_bidi_websocket_message;
 mod webdriver_bidi_websocket_opening_recovery;
+mod webdriver_bidi_websocket_transport_closure;
 
 #[cfg(test)]
 mod webdriver_bidi_json_envelope_public_boundary_tests;
@@ -62,6 +66,10 @@ pub use webdriver_bidi_session_status_response::{
     MAX_WEBDRIVER_BIDI_SESSION_STATUS_MESSAGE_SIZE, WebDriverBiDiSessionStatusResponseError,
     WebDriverBiDiSessionStatusResult,
 };
+pub use webdriver_bidi_session_teardown::{
+    WebDriverBiDiSessionTeardownAssessment, WebDriverBiDiSessionTeardownDisposition,
+    WebDriverBiDiSessionTeardownObservations,
+};
 pub use webdriver_bidi_websocket_frame::{
     MAX_WEBSOCKET_FRAME_PAYLOAD_SIZE, MAX_WEBSOCKET_FRAME_TIMEOUT,
     WebDriverBiDiWebSocketEstablished, WebDriverBiDiWebSocketFrame,
@@ -81,3 +89,7 @@ pub use webdriver_bidi_websocket_message::{
     WebDriverBiDiWebSocketTextMessage,
 };
 pub use webdriver_bidi_websocket_opening_recovery::WebDriverBiDiWebSocketOpeningWriteRecoveryDisposition;
+pub use webdriver_bidi_websocket_transport_closure::{
+    WebDriverBiDiWebSocketTransportClosureError, WebDriverBiDiWebSocketTransportClosureKind,
+    WebDriverBiDiWebSocketTransportClosureObservation,
+};

crates/originweave-network/src/webdriver_bidi_session_teardown.rs

@@ -0,0 +1,111 @@
+use crate::{WebDriverBiDiSessionEndResult, WebDriverBiDiWebSocketTransportClosureObservation};
+
+/// Fail-closed operational disposition derived from teardown observations.
+///
+/// The current assessment can report only `OperationalTeardownPending`. Transport closure already
+/// has a typed owner, while browser-process exit and task-profile removal are not represented until
+/// their own typed runtime owners are connected. Missing owner evidence cannot establish operational
+/// completion or grant process, profile, browser, network, policy, secret, or Agent authority.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum WebDriverBiDiSessionTeardownDisposition {
+    /// Operational teardown is not yet proven by typed observations from every owning boundary.
+    OperationalTeardownPending,
+}
+
+/// Explicit operational observations retained after a correlated WebDriver BiDi `session.end` ack.
+///
+/// Transport closure is represented by the typed observation produced only by consuming the exact
+/// established WebSocket at its bounded closure-observation boundary. Browser-process exit and task
+/// profile removal are deliberately absent until their own typed runtime owners can supply
+/// non-forgeable evidence.
+#[derive(Debug, Eq, PartialEq)]
+pub struct WebDriverBiDiSessionTeardownObservations {
+    transport_closure_observation: Option<WebDriverBiDiWebSocketTransportClosureObservation>,
+}
+
+impl WebDriverBiDiSessionTeardownObservations {
+    /// Construct the typed transport observation retained by this boundary.
+    ///
+    /// Transport closure cannot be asserted with a caller-supplied boolean. `Some` requires the
+    /// typed closure observation returned by the bounded transport owner; `None` keeps teardown
+    /// pending. Process and profile state cannot be supplied as placeholders and remain unproven
+    /// until their typed runtime owners are connected.
+    #[must_use]
+    pub const fn new(
+        transport_closure_observation: Option<WebDriverBiDiWebSocketTransportClosureObservation>,
+    ) -> Self {
+        Self {
+            transport_closure_observation,
+        }
+    }
+
+    /// Return whether typed closure evidence for the exact session transport was supplied.
+    #[must_use]
+    pub const fn transport_closed_observed(&self) -> bool {
+        self.transport_closure_observation.is_some()
+    }
+
+    /// Borrow the typed transport-closure observation when one was supplied.
+    #[must_use]
+    pub const fn transport_closure_observation(
+        &self,
+    ) -> Option<&WebDriverBiDiWebSocketTransportClosureObservation> {
+        self.transport_closure_observation.as_ref()
+    }
+}
+
+/// One correlated `session.end` acknowledgment kept separate from operational teardown evidence.
+///
+/// A protocol acknowledgment alone is never operational completion. Typed transport closure is
+/// retained from the consumed WebSocket, while process/profile evidence remains absent until its
+/// owning runtime boundaries can provide typed observations. Consequently this assessment remains
+/// fail closed in the current dependency-ordered slice.
+#[derive(Debug, Eq, PartialEq)]
+pub struct WebDriverBiDiSessionTeardownAssessment {
+    protocol_ack: WebDriverBiDiSessionEndResult,
+    observations: WebDriverBiDiSessionTeardownObservations,
+}
+
+impl WebDriverBiDiSessionTeardownAssessment {
+    /// Bind one correlated protocol acknowledgment to separately supplied operational observations.
+    #[must_use]
+    pub const fn from_protocol_ack(
+        protocol_ack: WebDriverBiDiSessionEndResult,
+        observations: WebDriverBiDiSessionTeardownObservations,
+    ) -> Self {
+        Self {
+            protocol_ack,
+            observations,
+        }
+    }
+
+    /// Return the exact command id proven by the correlated protocol acknowledgment.
+    #[must_use]
+    pub const fn command_id(&self) -> u64 {
+        self.protocol_ack.command_id()
+    }
+
+    /// Borrow the explicit operational observations bound to this assessment.
+    #[must_use]
+    pub const fn observations(&self) -> &WebDriverBiDiSessionTeardownObservations {
+        &self.observations
+    }
+
+    /// Return whether typed evidence proves every required operational teardown boundary.
+    ///
+    /// This is always `false` while typed browser-process-exit and task-profile-removal evidence is
+    /// absent from this boundary.
+    #[must_use]
+    pub const fn is_operationally_complete(&self) -> bool {
+        false
+    }
+
+    /// Return the fail-closed disposition for the currently supplied observations.
+    ///
+    /// The current boundary cannot emit an operational-completion disposition because process and
+    /// profile cleanup still lack typed owner evidence.
+    #[must_use]
+    pub const fn disposition(&self) -> WebDriverBiDiSessionTeardownDisposition {
+        WebDriverBiDiSessionTeardownDisposition::OperationalTeardownPending
+    }
+}

crates/originweave-network/src/webdriver_bidi_websocket_transport_closure.rs

@@ -0,0 +1,129 @@
+use std::{error::Error, fmt, time::Duration};
+
+use crate::{WebDriverBiDiWebSocketEstablished, WebDriverBiDiWebSocketFrameError};
+
+/// Bounded transport-closure condition observed on one consumed WebDriver BiDi WebSocket.
+///
+/// This classification proves only what the already session-correlated transport itself exposed.
+/// A peer Close frame does not prove browser-process exit or profile cleanup, while peer EOF does
+/// not imply that the RFC 6455 closing handshake completed.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum WebDriverBiDiWebSocketTransportClosureKind {
+    /// The peer sent one RFC 6455 Close frame that passed the existing strict frame validator.
+    PeerCloseFrame,
+    /// The peer ended the TCP byte stream cleanly before any new WebSocket frame byte was read.
+    PeerEof,
+}
+
+/// Credential-free observation that one established WebDriver BiDi transport ceased carrying data.
+///
+/// Construction consumes the established WebSocket, so this value cannot be used to regain the
+/// underlying connection. It records only a validated peer Close status when one was actually
+/// present, or clean TCP EOF before a new frame began. It grants no browser, process, profile,
+/// policy, secret, retry, reconnect, or Agent authority and does not perform a reciprocal Close
+/// handshake.
+#[derive(Debug, Eq, PartialEq)]
+pub struct WebDriverBiDiWebSocketTransportClosureObservation {
+    kind: WebDriverBiDiWebSocketTransportClosureKind,
+    peer_close_status_code: Option<u16>,
+}
+
+impl WebDriverBiDiWebSocketTransportClosureObservation {
+    /// Consume one established connection and observe one bounded transport-closure condition.
+    ///
+    /// A validated peer Close frame and zero-byte clean EOF are the only success cases. One
+    /// unsolicited Pong may be ignored before that closure signal because Pong requires no client
+    /// response; a second Pong, Ping, data frame, partial-frame EOF, timeout, malformed Close, I/O
+    /// failure, or integrity failure remains a typed error. This fixed two-read envelope prevents
+    /// peer control traffic from extending teardown observation indefinitely and does not invent
+    /// masking entropy or outbound authority to answer Ping frames.
+    pub fn observe(
+        established: WebDriverBiDiWebSocketEstablished,
+        frame_timeout: Duration,
+    ) -> Result<Self, WebDriverBiDiWebSocketTransportClosureError> {
+        Self::observe_frame(established, frame_timeout, true)
+    }
+
+    fn observe_frame(
+        established: WebDriverBiDiWebSocketEstablished,
+        frame_timeout: Duration,
+        allow_pong: bool,
+    ) -> Result<Self, WebDriverBiDiWebSocketTransportClosureError> {
+        match established.read_frame(frame_timeout) {
+            Ok((established, frame)) if frame.opcode() == 0xa && allow_pong => {
+                Self::observe_frame(established, frame_timeout, false)
+            }
+            Ok((established, frame)) => {
+                if frame.opcode() != 0x8 {
+                    return Err(
+                        WebDriverBiDiWebSocketTransportClosureError::UnexpectedFrame {
+                            opcode: frame.opcode(),
+                        },
+                    );
+                }
+                let peer_close_status_code = frame
+                    .payload()
+                    .get(..2)
+                    .map(|bytes| u16::from_be_bytes([bytes[0], bytes[1]]));
+                drop(established);
+                Ok(Self {
+                    kind: WebDriverBiDiWebSocketTransportClosureKind::PeerCloseFrame,
+                    peer_close_status_code,
+                })
+            }
+            Err(WebDriverBiDiWebSocketFrameError::FrameEnded { bytes_read: 0 }) => Ok(Self {
+                kind: WebDriverBiDiWebSocketTransportClosureKind::PeerEof,
+                peer_close_status_code: None,
+            }),
+            Err(source) => Err(WebDriverBiDiWebSocketTransportClosureError::Frame { source }),
+        }
+    }
+
+    /// Return the exact transport-closure condition that produced this observation.
+    #[must_use]
+    pub const fn kind(&self) -> WebDriverBiDiWebSocketTransportClosureKind {
+        self.kind
+    }
+
+    /// Return the validated peer Close status when a Close frame actually carried one.
+    #[must_use]
+    pub const fn peer_close_status_code(&self) -> Option<u16> {
+        self.peer_close_status_code
+    }
+}
+
+/// Fail-closed errors while converting one established BiDi transport into closure evidence.
+#[derive(Debug)]
+pub enum WebDriverBiDiWebSocketTransportClosureError {
+    /// The peer sent a valid WebSocket frame that was not an admissible closure signal.
+    UnexpectedFrame {
+        /// Exact validated RFC 6455 opcode observed instead of an admissible closure signal.
+        opcode: u8,
+    },
+    /// The existing bounded WebSocket frame reader failed before closure was proven.
+    Frame {
+        /// Original typed frame failure retained as the causal source.
+        source: WebDriverBiDiWebSocketFrameError,
+    },
+}
+
+impl fmt::Display for WebDriverBiDiWebSocketTransportClosureError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::UnexpectedFrame { .. } => formatter
+                .write_str("WebDriver BiDi peer sent non-closure traffic instead of closing"),
+            Self::Frame { .. } => {
+                formatter.write_str("WebDriver BiDi transport closure could not be observed safely")
+            }
+        }
+    }
+}
+
+impl Error for WebDriverBiDiWebSocketTransportClosureError {
+    fn source(&self) -> Option<&(dyn Error + 'static)> {
+        match self {
+            Self::UnexpectedFrame { .. } => None,
+            Self::Frame { source } => Some(source),
+        }
+    }
+}