feat(browser): bind protocol identifiers to OriginWeave authority

CHANGELOG.md

@@ -9,8 +9,11 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Refreshed the product and technical gap baseline with the 2026-08-24 live inventory: 158 open pull requests (44 ready, 114 draft), refreshed exact base/head evidence for the #208–#222 release, enterprise-approval, BAP, and WARC/PROV chains, the governance issue additions #212 and #215, and a required-check provider-failure record for the fail-closed Strix re-dispatches on #208/#218/#220.
 - Added a dated product and technical gap baseline that separates protected-main implementation truth, active pull-request evidence, live review/check blockers, and the next buyer-visible Phase 1 acceptance work.
 - Refreshed the product and technical gap baseline with the current open-PR inventory and exact base/head evidence for the newest Chromium, BAP, extraction, WARC, and idempotency slices.
+- Bound explicit extension-to-Agent grants to a nonzero host-assigned Agent Task identity, so a grant that otherwise matches extension, session, browsing context, origin, expiry, and capability fails closed when reused by a different task.
 - Bound explicit extension-to-Agent grants to exclusive trusted-time expiry in addition to extension identity, session, browsing context, and canonical origin, so a same-origin grant cannot be reused at or after the deadline.
 - Bound explicit extension-to-Agent grants to the exact canonical origin in addition to extension identity, session, and browsing context, so a same-session navigation or port change cannot reuse the grant.
+- Added a bounded browser-protocol authority registry that maps opaque session, browsing-context, and node identifiers to registry-local identities, rotates document epochs, and revalidates live node handles before actions.
+- Versioned browser-protocol adapter metadata that distinguishes WebDriver BiDi from pinned CDP, binds bounded adapter/browser revision tokens to an explicit duplicate-free capability set, and grants no browser, action, network, or secret authority by protocol kind alone.
 - Rust workspace for independently reusable core, policy, destination, network, TLS, resource, and evidence modules.
 - Canonical HTTPS and loopback-origin boundary with case-normalized schemes and hosts, default-port normalization, IPv4/IPv6 handling, browser-special numeric-host rejection, and explicit malformed-input errors.
 - Typed browser actions, capabilities, risk classes, execution modes, robots decisions, secret-delivery contracts, immutable canonical action-intent digests, and intent-bound approval scopes.
@@ -59,12 +62,14 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ### Security
 
+- Registry-issued node validation authenticates registry-instance issuance before session or context lookup, so caller-constructed and cross-registry handles cannot probe whether numeric browser-session identifiers are currently registered.
 - Raw page content cannot become a trusted instruction.
 - Raw secrets are rejected and secret-capable actions require an opaque broker handle.
 - Crawler mode is read-only, must pair with the public-crawl purpose, and fails closed without an applicable robots-policy decision.
 - State-changing actions are same-origin by default.
 - R3 and R4 approvals are bound to the exact action, target origin, and immutable digest of the complete canonical action intent; R5 legal consent is non-delegable.
 - Shortened, integer, hexadecimal, and legacy octal-looking IPv4 host spellings are rejected so the policy origin cannot diverge from Chromium host interpretation.
+- Bare hexadecimal-prefix host labels such as `0x`, including terminal `.0x` and `.0X` spellings, are rejected as browser-special numeric hosts rather than admitted as DNS authorities.
 - IPv4-mapped IPv6 is canonicalized before destination classification and pin comparison so mapped private or loopback addresses cannot bypass IPv4 policy.
 - The default destination policy permits only public addresses and denies unspecified, loopback, private, shared, link-local, metadata, documentation, benchmarking, multicast, broadcast, transition, and protocol-reserved destinations.
 - Azure platform IP `168.63.129.16` and Amazon EKS Pod Identity endpoints `169.254.170.23` and `fd00:ec2::23` are classified as metadata or platform services before broader public, link-local, or unique-local rules.

crates/originweave-core/src/browser_protocol.rs

@@ -0,0 +1,187 @@
+use std::fmt;
+
+/// Maximum UTF-8 byte length for browser protocol adapter metadata tokens.
+pub const MAX_BROWSER_PROTOCOL_METADATA_BYTES: usize = 128;
+
+/// Browser automation protocol family used by one versioned adapter.
+///
+/// The protocol family is descriptive metadata only. Selecting a kind does not
+/// grant any OriginWeave capability or imply that a particular protocol
+/// feature is available.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BrowserProtocolKind {
+    /// Standards-track WebDriver BiDi adapter.
+    WebDriverBiDi,
+    /// Chromium-specific Chrome DevTools Protocol adapter.
+    ChromeDevToolsProtocol,
+}
+
+/// One browser operation surface explicitly implemented by an adapter.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BrowserProtocolCapability {
+    /// Navigate a controlled browser context through the adapter.
+    Navigation,
+    /// Produce bounded semantic browser observations.
+    SemanticObservation,
+    /// Dispatch typed browser input after OriginWeave policy authorization.
+    TypedInput,
+    /// Observe bounded network evidence needed by higher-level provenance.
+    NetworkObservation,
+}
+
+/// Immutable version and capability metadata for one browser protocol adapter.
+///
+/// This value is deliberately not browser authority. It contains no browser
+/// session, context, origin, node handle, action grant, credential, or network
+/// permission. Higher layers may use it to fail closed when a required adapter
+/// capability is absent, while all OriginWeave authority remains separately
+/// validated.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct BrowserProtocolAdapterDescriptor {
+    kind: BrowserProtocolKind,
+    adapter_version: String,
+    protocol_revision: String,
+    browser_revision: String,
+    capabilities: Vec<BrowserProtocolCapability>,
+}
+
+impl BrowserProtocolAdapterDescriptor {
+    /// Construct one explicit adapter descriptor.
+    ///
+    /// Adapter version, upstream protocol revision, and browser revision are
+    /// separate bounded ASCII metadata tokens. This prevents an OriginWeave
+    /// adapter release from being mistaken for the WebDriver BiDi/CDP revision
+    /// or the pinned browser build it was validated against. The declared
+    /// capability list must be non-empty and duplicate-free and is normalized
+    /// into one stable order so caller ordering cannot change descriptor identity.
+    pub fn new(
+        kind: BrowserProtocolKind,
+        adapter_version: &str,
+        protocol_revision: &str,
+        browser_revision: &str,
+        capabilities: &[BrowserProtocolCapability],
+    ) -> Result<Self, BrowserProtocolDescriptorError> {
+        if !metadata_token_is_valid(adapter_version) {
+            return Err(BrowserProtocolDescriptorError::InvalidAdapterVersion);
+        }
+        if !metadata_token_is_valid(protocol_revision) {
+            return Err(BrowserProtocolDescriptorError::InvalidProtocolRevision);
+        }
+        if !metadata_token_is_valid(browser_revision) {
+            return Err(BrowserProtocolDescriptorError::InvalidBrowserRevision);
+        }
+        if capabilities.is_empty() {
+            return Err(BrowserProtocolDescriptorError::EmptyCapabilities);
+        }
+
+        let mut canonical_capabilities = Vec::with_capacity(capabilities.len());
+        for capability in capabilities {
+            if canonical_capabilities.contains(capability) {
+                return Err(BrowserProtocolDescriptorError::DuplicateCapability);
+            }
+            canonical_capabilities.push(*capability);
+        }
+        canonical_capabilities.sort_unstable_by_key(|capability| capability_rank(*capability));
+
+        Ok(Self {
+            kind,
+            adapter_version: adapter_version.to_owned(),
+            protocol_revision: protocol_revision.to_owned(),
+            browser_revision: browser_revision.to_owned(),
+            capabilities: canonical_capabilities,
+        })
+    }
+
+    /// Return the explicitly declared browser protocol family.
+    #[must_use]
+    pub const fn kind(&self) -> BrowserProtocolKind {
+        self.kind
+    }
+
+    /// Return the bounded OriginWeave adapter-version metadata token.
+    #[must_use]
+    pub fn adapter_version(&self) -> &str {
+        &self.adapter_version
+    }
+
+    /// Return the bounded upstream browser-protocol revision metadata token.
+    #[must_use]
+    pub fn protocol_revision(&self) -> &str {
+        &self.protocol_revision
+    }
+
+    /// Return the bounded pinned browser-revision metadata token.
+    #[must_use]
+    pub fn browser_revision(&self) -> &str {
+        &self.browser_revision
+    }
+
+    /// Return the number of explicitly declared capabilities.
+    #[must_use]
+    pub fn capability_count(&self) -> usize {
+        self.capabilities.len()
+    }
+
+    /// Return whether this descriptor explicitly declares one capability.
+    #[must_use]
+    pub fn supports(&self, capability: BrowserProtocolCapability) -> bool {
+        self.capabilities.contains(&capability)
+    }
+}
+
+const fn capability_rank(capability: BrowserProtocolCapability) -> u8 {
+    match capability {
+        BrowserProtocolCapability::Navigation => 0,
+        BrowserProtocolCapability::SemanticObservation => 1,
+        BrowserProtocolCapability::TypedInput => 2,
+        BrowserProtocolCapability::NetworkObservation => 3,
+    }
+}
+
+fn metadata_token_is_valid(value: &str) -> bool {
+    !value.is_empty()
+        && value.len() <= MAX_BROWSER_PROTOCOL_METADATA_BYTES
+        && value.is_ascii()
+        && value
+            .bytes()
+            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'.' | b'_' | b'-'))
+        && value.bytes().any(|byte| byte.is_ascii_alphanumeric())
+}
+
+/// Failure to construct canonical browser protocol adapter metadata.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BrowserProtocolDescriptorError {
+    /// The adapter-version token was empty, oversized, non-ASCII, or malformed.
+    InvalidAdapterVersion,
+    /// The upstream protocol-revision token was empty, oversized, non-ASCII, or malformed.
+    InvalidProtocolRevision,
+    /// The browser-revision token was empty, oversized, non-ASCII, or malformed.
+    InvalidBrowserRevision,
+    /// The adapter declared no supported browser capability.
+    EmptyCapabilities,
+    /// The adapter declared the same capability more than once.
+    DuplicateCapability,
+}
+
+impl fmt::Display for BrowserProtocolDescriptorError {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        match self {
+            Self::InvalidAdapterVersion => formatter.write_str(
+                "browser protocol adapter version must be a bounded ASCII metadata token",
+            ),
+            Self::InvalidProtocolRevision => formatter
+                .write_str("browser protocol revision must be a bounded ASCII metadata token"),
+            Self::InvalidBrowserRevision => {
+                formatter.write_str("browser revision must be a bounded ASCII metadata token")
+            }
+            Self::EmptyCapabilities => {
+                formatter.write_str("browser protocol adapter must declare at least one capability")
+            }
+            Self::DuplicateCapability => {
+                formatter.write_str("browser protocol adapter capabilities must be unique")
+            }
+        }
+    }
+}
+
+impl std::error::Error for BrowserProtocolDescriptorError {}