test(browser): stage controlled Agent Task without workflow mutation

CHANGELOG.md

@@ -6,6 +6,14 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 - Refreshed the product-gap queue to 126 open pull requests (54 ready, 72 draft) after #190, #188, #185, #192, #182, #184, #115, #181, #116, #117, #118, #183, #114, #127, #112, #109, #186, #110, #108, #111, #174, and #113 were merged into their immediate stacked prerequisites. PRs #147, #146, #145, #144, #143, #142, #141, #139, #136, #132, #129, and #128 moved to ready after exact-head checks and thread review; these are queue-consolidation results, not protected-main shipment.
 
+- Classified bounded WebDriver HTTP cleanup failures, including truncated responses, as typed cleanup evidence while preserving the primary browser error.
+- Record truncated WebDriver trial responses as bounded failed-trial evidence instead of aborting the complete MV3 compatibility run.
+- Close the first pinned-Chrome fixture server when startup of the second server fails, and attempt both shutdowns when one cleanup fails, preventing partial compatibility runs from leaking loopback server threads.
+- The fixture-shutdown contract now exercises successful MV3 and Agent Task trial paths before asserting reverse-order server cleanup.
+- The fixture-shutdown success double now includes both browser-computed semantic verification surfaces, so cleanup failures cannot mask incomplete Agent Task evidence.
+- Preserve Chromium's process sandbox in the controlled Agent Task evidence lane by removing that lane's `--no-sandbox` launch argument after a test-first source contract reproduced the defect; sandbox-enabled pinned-browser exact-head execution remains required before the repaired lane is promoted to security evidence.
+- Classify Agent Task browser-session startup failures in credential-free trial evidence without exposing ChromeDriver text; this fixture evidence does not claim a shipped OriginWeave browser adapter.
+- Install Chrome for Testing's bundled Linux sandbox helper with Chromium's required ownership and mode so the Agent Task evidence lane can start without disabling the browser sandbox.
 ### Added
 - Corrected the 2026-08-26 product-gap snapshot with current #229 presentation-identity evidence, stacked-only #205 integration evidence, current base/head pairs, the 126-PR queue count, explicit root-versus-child merge ordering, and the active GitHub counted-approval gate.
 - Refreshed the product and technical gap baseline onto the 2026-08-26 live inventory: 126 open pull requests (54 ready, 72 draft), protected-main promotion of #168/#194/#196/#216/#151, a verified maintenance-loop record (supersession closure of #153, conflict reconciliations on #37/#149/#152/#173/#175, issue #212 option-(b) authorization on #43, Strix vuln-0001 homoglyph remediation on #124), provider-rerun outcome evidence, an organization review-pipeline congestion record, and refreshed merge-order queue guidance. Documentation evidence contracts were aligned to the same snapshot so the baseline, its dated markers, and the pinned exact-head rows cannot silently diverge.
@@ -36,6 +44,8 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Real loopback TCP integration proof plus deterministic timeout, refusal, retry, peer-inspection, peer-mismatch, canonicalization, IPv6 metadata, and single-use replay tests.
 - Real loopback rustls integration covering trusted DNS SAN, Common-Name fallback rejection, wrong-name and untrusted-root rejection, fixed-time expiry and not-yet-valid failures, exact IPv4 and IPv6 SANs, TLS 1.2/TLS 1.3, required and optional ALPN, and transport-origin binding.
 - Cumulative interactive-first RAM, VRAM, batch, local-model, admission, pause, and compositor-pressure mitigation plans, including active-consumer reduction at exact hard limits.
+- Real pinned-Chrome WebDriver evidence for the controlled Agent Task fixture: the CI lane uses an isolated profile, disables extensions, types and submits synthetic text, observes the same-document post-condition, and proves profile cleanup; predecessor sandbox-disabled success is compatibility evidence only until the repaired sandbox-enabled exact head executes successfully.
+- Active pinned-Chrome Agent Task evidence verifies browser-computed role/name for controlled input and submit targets before action; this remains test-harness semantic evidence and does not claim a product semantic observer or authority.
 - Universally value-redacted network evidence with explicit path, metadata, and provenance bounds; ambiguous path rejection; validated source URLs; lowercase SHA-256 identifiers; and verification state.
 - Versioned schema-bound extraction contracts with bounded identifiers and field counts, typed value/cardinality metadata, explicit duplicate-free reviewed source channels, fail-closed schema validation, and deterministic `Display`/`std::error::Error` contracts for public schema failures.
 - Rust 1.97.1 build contract, strict Clippy and rustdoc gates, and exact production function, line, region, and branch coverage enforcement.
@@ -102,4 +112,4 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - The hourly product agent has no Git metadata or repository authority. A separate post-verification publisher opens one PR and cannot approve or merge it.
 - The unprivileged OpenCode user is restricted to loopback egress during model execution, preventing runner-wide allow-listed endpoints from becoming direct source-exfiltration channels.
 
-[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD
+[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD

docs/DOCUMENTATION_FITNESS.md

@@ -158,9 +158,9 @@ Active #64 makes a successful action-outcome value require existing verified pro
 
 ### 3.19 Controlled Agent Task fixture
 
-Active #65 supplies a deterministic synthetic local web fixture with a labelled semantic input, submit control, same-document post-condition and explicitly hidden/untrusted prompt-injection text. The fixture contains no credential collection surface and requires no live third-party site.
+Active #65 supplies a deterministic synthetic local web fixture with a labelled semantic input, submit control, same-document post-condition and explicitly hidden/untrusted prompt-injection text. Active #70 executes that fixture through real WebDriver on pinned Chrome with an isolated profile, disabled extensions, synthetic input, same-document post-condition verification and profile cleanup. If the second fixture server cannot start, the runner also closes the first one; cleanup attempts both servers even when one shutdown fails, so partial setup does not leak loopback threads. Active #71 verifies browser-computed role/name for the controlled input and submit button before action. The fixture contains no credential collection surface and requires no live third-party site.
 
-**Resolution:** the fixture makes the future real Chromium vertical slice reproducible without turning a third-party site into a test dependency. It is not a browser adapter, semantic extractor, input dispatcher, policy engine, trusted clock, process-attribution source or proof of real Chromium execution.
+**Resolution:** the #65/#70/#71 lane makes controlled browser-level and browser-computed role/name evidence reproducible without turning a third-party site into a test dependency. It is not a browser adapter, product semantic extractor, OriginWeave input-dispatch authority, policy engine, trusted clock, process-attribution source or proof of the shipped product runtime.
 
 ### 3.20 Bounded browser process-set resource evidence
 

docs/TEST_STRATEGY.md

@@ -78,6 +78,18 @@ session creation
 -> task close/recovery
 ```
 
+Active PR #70 exercises the controlled local Agent Task fixture on the pinned
+Chrome for Testing build through real WebDriver input, same-document
+post-condition observation and ephemeral-profile cleanup. That lane proves
+browser-level fixture execution only; it does not replace the OriginWeave
+BiDi/CDP authority adapter, semantic node contract, policy dispatch or
+protected-main runtime acceptance required by issue #28.
+
+Active PR #71 additionally verifies browser-computed role/name for the
+controlled input and submit target before the real WebDriver action. CSS remains
+a fixture-harness locator; this does not establish OriginWeave node authority,
+semantic provenance or policy dispatch.
+
 ### 3.5 Buyer acceptance
 
 Versioned task packs measure repeatable product outcomes rather than one lucky agent run. The benchmark artifact records browser build, OriginWeave version, model/provider/reasoning configuration, seed where supported, policy profile, hardware profile and source fixtures.

docs/doctoring/mv3-compatibility.md

@@ -1,13 +1,21 @@
 # Manifest V3 compatibility evidence baseline
 
 - **Status:** Active implementation evidence for issue #27
-- **Reviewed:** 2026-08-11
+- **Reviewed:** 2026-09-03
 - **Pinned browser:** Chrome for Testing `150.0.7871.129`, Chromium revision `r1639810`
 
 OriginWeave uses Chromium as its compatibility kernel, so browser-extension compatibility must be demonstrated with executable Chromium evidence rather than inferred from architecture alone. The protected-main lane exercises a controlled unpacked Manifest V3 extension against one exact Chrome for Testing build and proves service-worker, content-script, storage, declarative-network-request, tabs, windows, scripting, commands, side-panel, bookmarks/history read compatibility, restart persistence, repeatability, and one real WebDriver click/post-condition. Active stacked compatibility work adds downloads, bounded bookmark/history mutation, profile isolation, explicit extension update/version-migration evidence, and an exact content-script isolated-world check. OriginWeave does **not claim 100% Chrome extension compatibility**.
 
 The checked-in fixture is intentionally local-only. Its host permission is limited to loopback HTTP used by the deterministic test server. It contains no remote code, user credential, model call, external content, native-messaging host, or production PII. Chrome permissions remain distinct from the explicit OriginWeave extension-to-Agent grant implemented in `originweave-core`. Compatibility mutation tests create only controlled synthetic state inside the ephemeral test profile and must clean it up; successful API compatibility never grants the OriginWeave Agent ambient bookmarks/history/downloads authority.
 
+The runner treats expected `http.client.HTTPException` transport failures, including truncated ChromeDriver responses, as failed trials and continues to emit bounded aggregate evidence. It does not classify such a run as successful: the repeatability gate still fails when the required trial count is not met.
+
+## Chromium sandbox evidence boundary
+
+Chromium's process sandbox is part of the browser security boundary, not a test decoration. Chromium's current sandbox library describes sandboxing as privilege/capability restriction for code that handles untrustworthy data, implemented with platform-specific OS isolation. Chromium's Linux debugging guidance treats `--no-sandbox` as a temporary debugging escape and explicitly warns against using it on waterfall bots because sandbox testing is required.
+
+PR #70 therefore separates compatibility evidence from security evidence. Its test-first contract rejects `--no-sandbox` in `_run_agent_task_browser_pass`. The pre-repair source failed that contract; repair commit `60b697095be510a129cfb61a3fd97790cf7a0679` removes exactly that Agent Task launch argument while leaving the separate MV3 compatibility pass unchanged. Chrome for Testing arrives as a raw archive, so the workflow installs its bundled `chrome_sandbox` helper with Chromium's required root ownership and `4755` mode before execution. A focused source-contract GREEN is not a substitute for browser execution: the repaired Agent Task lane remains Draft until the pinned sandbox-enabled Chromium job actually runs and preserves semantic role/name observation, native input/click, same-document post-condition, exact echo/URL, and profile cleanup. If a hosted environment cannot start sandboxed Chromium, that environment may support a narrowly labelled compatibility lane but cannot be promoted to governed-browser security evidence by weakening the assertion.
+
 ## Supported-capability evidence matrix
 
 This matrix separates protected-main executable evidence from active, non-shipped evidence and from genuinely unproven surfaces. A row marked **ACTIVE_PR** is never a release claim; exact head/run provenance belongs in `docs/evidence/2026-08-10-active-pr-maturity.md` and must be refreshed when the branch changes.
@@ -27,6 +35,7 @@ This matrix separates protected-main executable evidence from active, non-shippe
 | History add/read/delete lifecycle | **ACTIVE_PR #59** | Controlled synthetic loopback visit is added, exactly read back, deleted in `finally`, and required to be absent afterward. | Compatibility only; no Agent history capability. |
 | Downloads | **ACTIVE_PR #43** | Controlled loopback payload is downloaded and validated through pinned Chromium. | No general download persistence, unsafe filename, or Agent filesystem authority claim. |
 | Per-trial Agent Task profile isolation | **ACTIVE_PR #49** | Compatibility trials use isolated ephemeral profiles rather than ambient human state. | Full production Agent Task browser orchestration remains issue #28 work. |
+| Agent Task Chromium sandbox preservation | **ACTIVE_PR #70** | Source contract rejects `--no-sandbox`; exact repair removes it only from Agent Task launch. | Sandbox-enabled pinned-browser exact-head execution is still required before security evidence is claimed; MV3 compatibility launch remains a separate lane. |
 | Extension update/version migration | **ACTIVE_PR #60** | Trial-local extension copy transitions `1.0.0` → `1.0.1` on the same ephemeral profile; versioned storage state is required to migrate and real pinned-Chromium evidence reports the update-migration surface. | No Chrome Web Store updater, enterprise deployment channel, arbitrary downgrade, or protected-main release claim. |
 | Managed enterprise extension policy | **PLANNED** | No protected-main executable compatibility proof yet. | Do not infer managed-policy support from Chromium ancestry alone. |
 | Native messaging | **PLANNED / SECURITY-GATED** | No compatibility claim. | Future support requires an explicit host-managed allow-list and process boundary. |
@@ -52,6 +61,12 @@ The CI lane downloads the exact Chrome/ChromeDriver version from the official Ch
 
 ## Primary references — APA 7th
 
+Chromium Authors. (n.d.). *Sandbox library*. Chromium source. Retrieved September 3, 2026, from https://chromium.googlesource.com/chromium/src/sandbox/
+
+Chromium Authors. (n.d.). *Linux SUID sandbox development*. Chromium source. Retrieved September 4, 2026, from https://chromium.googlesource.com/chromium/src/+/main/docs/linux/suid_sandbox_development.md
+
+Chromium Authors. (n.d.). *Tips for debugging on Linux*. Chromium source. Retrieved September 3, 2026, from https://chromium.googlesource.com/chromium/src/+/main/docs/linux/debugging.md
+
 Chrome for Developers. (n.d.). *Extensions / Manifest V3*. Google. Retrieved August 9, 2026, from https://developer.chrome.com/docs/extensions/develop/migrate/what-is-mv3
 
 Chrome for Developers. (2023, May 2). *Extension service worker basics*. Google. https://developer.chrome.com/docs/extensions/develop/concepts/service-workers/basics