test(browser): observe pinned presentation cleanup

AGENTS.md

@@ -58,6 +58,10 @@ The organization currently documents a **solo-maintainer** governance condition.
 ## Architecture constraints
 
 - Keep Blink, V8, Skia, Viz, Dawn, Chromium sandboxing, Site Isolation, and Manifest V3 compatibility upstream-aligned.
+- Pinned-Chromium presentation evidence may use only fixed CDP commands and declared static-fixture DOM outputs; page-provided scripts must never select commands or supply evaluation text.
+- For hidden fixture outputs, read the bounded `textContent` property rather than rendered element text, and reject a probe baseline that already equals its target so an ACK cannot masquerade as a causal presentation transition.
+- Browser-session failures may retain only a closed, credential-free WebDriver category; ChromeDriver startup/process diagnostics belong to their canonical owner lane and must not be captured here. Never emit remote or local diagnostic text into CI evidence.
+- Hosted Ubuntu sandbox remediation is a canonical `.github` sandbox-helper workflow-contract dependency: do not add `--no-sandbox` or copy workflow setup into a product PR; adopt the reviewed immutable owner release and rerun the three browser trials.
 - New product logic belongs in Rust control-plane modules behind narrow adapters.
 - Rust crates must remain independently understandable and reusable.
 - Keep logical origin, resolved destination, operating-system TCP peer, TLS service identity, proxy route, and HTTP semantics as separate authority boundaries.

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ## [Unreleased]
 
+- Keep Agent Task evidence to the standard bounded WebDriver session-creation category; ChromeDriver startup/process diagnostics remain with their canonical owner.
+- Preserve the bounded standard WebDriver session-creation failure category in Agent Task evidence while continuing to redact remote driver diagnostics.
+- Recognize the standard session-creation category from a ChromeDriver HTTP error response before applying the generic HTTP failure boundary.
+- Added a pinned-Chromium presentation probe to the controlled Agent Task evidence lane. It records a baseline, applies fixed viewport/DPR/timezone overrides before the observed navigation, then resets and proves the baseline returns through declared fixture DOM outputs. Hosted browser evidence remains required.
 - Keep WebDriver remote HTTP bodies, W3C error/message text, last-response startup detail, and mismatched remote `browserVersion` capability values out of CI exception strings while preserving fail-closed command/readiness/version decisions and the response-size bound.
 - Publish success-shaped MV3/Agent Task compatibility JSON only after both owned loopback fixture servers complete their shutdown post-conditions; browser/trial gate failures still emit bounded diagnostic evidence before raising.
 - Require loopback fixture-server cleanup to observe helper-thread termination after the bounded join, so a timed join cannot be treated as cleanup success while an owned server thread remains live.
@@ -121,4 +125,4 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - The hourly product agent has no Git metadata or repository authority. A separate post-verification publisher opens one PR and cannot approve or merge it.
 - The unprivileged OpenCode user is restricted to loopback egress during model execution, preventing runner-wide allow-listed endpoints from becoming direct source-exfiltration channels.
 
-[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD
+[Unreleased]: https://github.com/ContextualWisdomLab/OriginWeave/compare/main...HEAD

CLAUDE.md

@@ -11,4 +11,8 @@ Additional constraints:
 - Do not merge logical origin, destination authorization, direct TCP peer proof, TLS service identity, proxy routing, or HTTP resource policy into one ambient authority.
 - Do not add hostname reconnect, proxy-environment inheritance, dangerous certificate-verifier hooks, Common Name fallback, TLS 0-RTT, key logging, or secret extraction to a production TLS path.
 - Keep changes bounded to one product gap and preserve modular crate boundaries.
+- Browser presentation probes use fixed CDP commands and static-fixture DOM observations only; never turn page content into executable input.
+- Read hidden fixture observations through the bounded `textContent` property, and require every pre-override value to differ from its target before accepting a presentation transition.
+- Preserve only a closed WebDriver category in browser evidence; ChromeDriver startup/process diagnostics remain in their canonical owner lane, and diagnostic text is never serialized.
+- Treat hosted Ubuntu sandbox remediation as a `.github` workflow-owner dependency; preserve Chromium sandboxing and require a released helper contract before rerunning browser evidence.
 - Never claim a test, benchmark, browser integration, TLS identity, GPU execution, release, or merge succeeded without current exact-head evidence.

docs/product-technical-gap-baseline.md

@@ -2,6 +2,13 @@
 
 This is a dated delivery baseline, not a substitute for the PRD, TRD, roadmap, architecture decisions, or live GitHub state. It keeps buyer-visible gaps, current issues, active pull-request evidence, and commercial completion tracks in one discoverable place. Protected `main` is the implementation boundary: code in an open pull request is not shipped behavior.
 
+## Live continuity note: 2026-09-09
+
+- The next #292 evidence slice is stacked on the existing pinned-Chrome Agent Task owner. It uses fixed Chromium CDP viewport/DPR/timezone commands, static fixture DOM observations, an observed pre-override baseline, and observed explicit-reset restoration. It is active-PR evidence only until the exact Chrome for Testing job succeeds.
+- A failed Agent Task session start records only the bounded credential-free WebDriver failure category; this consumer neither captures nor classifies ChromeDriver startup/process diagnostics. Those diagnostics belong to their canonical owner lane, and no remote or local diagnostic text enters CI evidence.
+- Historical #299 browser job `34316793780` on `f8cb436c` classified all three pre-navigation failures as `sandbox`. The remediation remains the canonical `.github#1792` sandbox-helper workflow contract, not a leaf workflow copy or `--no-sandbox`; owner PR `.github#1857` and its CodeQL wake-race successor `.github#2056` remain unreleased, so consumer evidence is blocked pending immutable owner adoption and a fresh three-trial replay.
+- This runner proves a narrow browser-evidence contract, not a product Browser Session implementation. It does not transfer #293's standard-BiDi capability boundary into protected main or claim full-profile admission.
+
 ## Observed snapshot: 2026-08-26
 
 ### Protected-main truth

docs/traceability/agent-task-cleanup-failure-provenance.md

@@ -0,0 +1,33 @@
+# Agent Task cleanup-failure provenance
+
+## Problem
+
+Agent Task browser and profile cleanup wrappers preserve an earlier causal failure in Python exception chaining, but predecessor `d329f9e5dfbd5e4200eeec5fc40bf37d526fb77b` serialized only the wrapper `failure_type` into durable browser evidence. A page-observed/action failure followed by WebDriver-session cleanup failure, or a browser-pass failure followed by profile cleanup failure, therefore became indistinguishable from a cleanup-only failure once the process artifact was consumed.
+
+Review `5151447157` records the first exact-head finding. Test-first commit `70c710f00ad06a1437d74d10604820fb30272be2` requires the emitted failed-trial record to retain the bounded primary failure type and cleanup failure type while excluding hostile exception detail. Production commit `3f8f1cc15ec6c37c5b85e8cf6959c5d1c039b1fc` adds only closed exception-class metadata to the two cleanup wrappers and the Agent Task failure materializer. Commit `a297811635636942afa8f0d650f0ec3f9183dfca` binds the profile-cleanup regression to the same explicit primary-failure metadata used by production. Commit `d31a8d5e54a5b14fbc5e3a17980f97ec40b43c81` corrects the focused harness so cleanup exceptions and the `main()` materializer come from the same `runpy` module instance; otherwise Python class identity would make an artificial cross-module exception miss the production `isinstance` branch.
+
+Review `5151777477` found one remaining nested case: browser/action failure A can be wrapped by WebDriver-session cleanup failure B and then by profile cleanup failure C. The predecessor durable record retained only `BrowserProfileCleanupError`, `BrowserSessionCleanupError`, and C's class name, losing the original A type and B's cleanup type. Test-first `2320dd7f7313b443a87f5735266330ddd61f6053` requires the three-level chain to retain the root failure type plus both cleanup-stage type names while rejecting hostile messages. Production `08133c3166dd899fe5925ce96781023e1dce5ed7` propagates only those already-bounded class names through `BrowserProfileCleanupError` and the existing Agent Task materializer.
+
+Review `5156823718` found the analogous session-start path was still lossy: `WebDriverSessionNotCreatedError` is intentionally wrapped by `AgentTaskSessionStartError`, but a later profile-cleanup failure caused durable JSON to retain only the wrapper name and discard the already-bounded WebDriver category. Test-first `8e68cf8228a4d602defe1d23de3abfcf4cd86367` requires `session not created -> profile cleanup` evidence to keep `failure_type=BrowserProfileCleanupError`, `failure_cause_type=WebDriverSessionNotCreatedError`, and the outer cleanup type without exposing messages. Hosted CI `34374258739` is an executed RED for that test-first tree: the Rust-contract job reached Python repository contracts and failed there, while exact production coverage remained successful. Production `0050fffd1e5f50dca568db3eeeaba86b0c8f890f` minimally unwraps the existing `AgentTaskSessionStartError.session_error_type` metadata when profile cleanup wraps that error; it adds no new diagnostic source or taxonomy.
+
+Review `5158052125` found the remaining three-stage session-start path: `WebDriverSessionNotCreatedError -> AgentTaskSessionStartError -> BrowserSessionCleanupError -> BrowserProfileCleanupError`. The session-cleanup wrapper still reduced its primary error to `AgentTaskSessionStartError`, so the outer profile wrapper could no longer recover the already-bounded WebDriver category. Test-first `7e612800cf8069385c3aa62976a2c8268ecb340b` adds the real JSON-materialization regression and hosted CI `34386678497` is executed RED at Python repository contracts; production coverage on that test-only tree still passed. Production `960c1acc85c8e582a2a9c6a792eca29db39cfee0` minimally forwards `AgentTaskSessionStartError.session_error_type` at the first cleanup wrapper, without retaining an exception object, message, path, process diagnostic, or new category.
+
+## Constraints
+
+The artifact must not serialize `str(error)`, WebDriver response text, browser/page-controlled values, profile paths, ChromeDriver process diagnostics, credentials, or secret-shaped content. ChromeDriver startup/process classification remains owned by PR #148. Sandbox-helper workflow mechanics remain owned by the canonical `.github` path. Browser interaction, presentation apply/reset, URL stability, cleanup semantics, and the three-trial denominator must not change.
+
+## Alternatives
+
+Dropping the original browser failure was rejected because it destroys causal provenance after cleanup wraps the failure. Serializing exception messages or the full exception chain was rejected because remote, page-controlled, filesystem, or secret-bearing detail could cross the CI evidence boundary. Inferring a primary type from arbitrary chained exceptions at serialization time was rejected because cleanup-only and secondary-cleanup cases can have different chaining semantics. Flattening a nested cleanup chain to the wrapper class name was rejected because it discards the already-bounded root and session-cleanup types needed to distinguish A -> B -> C from an unrelated wrapper failure. Keeping separate `runpy` module instances in the contract was rejected because identical-looking exception classes from separate executions are distinct Python class objects and would test an impossible production boundary rather than the runner's real materializer. Treating `AgentTaskSessionStartError` itself as the durable root was rejected because the wrapper already carries a narrower closed WebDriver session-error category; losing it only when cleanup also fails makes RCA less precise without improving redaction. Reconstructing the WebDriver category later in `BrowserProfileCleanupError` was rejected because the first cleanup wrapper had already discarded it; preserving the bounded category at that first wrapper is the smaller causal repair and keeps the outer wrapper generic.
+
+## Decision
+
+`BrowserSessionCleanupError` retains `cleanup_error_type` and optional `primary_error_type`; when its primary is `AgentTaskSessionStartError`, it forwards that wrapper's already-bounded `session_error_type` rather than the wrapper class name. `BrowserProfileCleanupError` retains its own `cleanup_error_type`; when its primary error is the local `BrowserSessionCleanupError`, it also preserves that wrapper's bounded `cleanup_error_type` as `session_cleanup_error_type` and forwards the wrapper's bounded root `primary_error_type` when one exists. When the primary is `AgentTaskSessionStartError`, it forwards that wrapper's already-bounded `session_error_type` as `primary_error_type`. Failed Agent Task evidence publishes the root as `failure_cause_type`, the session cleanup as optional `session_cleanup_error_type`, and the outer cleanup as `cleanup_error_type`. Existing one-stage cleanup records remain compatible. No message text is added.
+
+## Risk and effect
+
+The additional behavior exposes only a Python exception class name already retained inside a bounded local wrapper; it does not retain the exception object or any raw diagnostic. This improves post-run RCA by preserving the standard session-creation category even when WebDriver-session deletion and profile deletion both fail, and by distinguishing the root browser/action failure, WebDriver-session cleanup failure, and profile-cleanup failure without broadening diagnostic authority. The repair does not establish real-browser GREEN; exact-head repository gates and pinned-Chromium execution remain independent acceptance evidence.
+
+## Acceptance
+
+The focused contract must prove single-stage session/profile cleanup still emit `failure_type`, `failure_cause_type`, and `cleanup_error_type`. The nested contract must additionally prove `browser/action A -> session cleanup B -> profile cleanup C` emits the closed root type, `session_cleanup_error_type`, and final `cleanup_error_type`, while hostile primary/session/profile messages remain absent from JSON output. A `WebDriverSessionNotCreatedError -> AgentTaskSessionStartError -> profile cleanup` chain must emit the underlying `WebDriverSessionNotCreatedError` as `failure_cause_type`. The three-stage `WebDriverSessionNotCreatedError -> AgentTaskSessionStartError -> session cleanup -> profile cleanup` chain must preserve that same root category plus both cleanup types and must not serialize cleanup detail. Contracts must exercise the same loaded runner namespace as the failure materializer. Exact-head repository CI must pass before this repair is considered repository GREEN. Pinned Chromium must still complete the existing three-trial causal browser sequence before #299 can claim browser acceptance.