feat(core): expire extension grants at exclusive trusted time

[cursor]

Buyer-visible gap

Partial implementation of #27. After origin-bound grants (#177), a grant that still matches extension identity, session, browsing context, and canonical origin remains usable after the Agent Task window ends. ADR 0013 requires exclusive expiry. A buyer cannot treat a same-origin grant as time-bounded without that check.

Current exact implemented boundary

This branch is stacked on #177 afabb68c58b132f27f13ceb47bfbbd947f0fdedf and adds exclusive trusted-time expiry at 16a872c:

• ExtensionAgentGrant carries expires_at_epoch_seconds;
• ExtensionAccessRequest carries trusted now_epoch_seconds from the host, not a page, extension, or model clock;
• now >= expires_at is DenyExpired after origin match and before capability check;
• one second before the deadline still allows an otherwise exact grant;
• missing grants, wrong extension/session/context/origin, and ungated capabilities still fail closed.

This PR does not bind task identity, install an extension, parse Chrome messages, or mint Agent capabilities from Manifest V3 permissions. Do not fold Chrome-permission isolation (#175), MV3 downloads (#43), or HTTP (#37) onto this head.

Prefer this head over merging #177 alone once exact-head checks succeed. #177 remains the origin-only review vehicle.

TDD

The first compile failed because ExtensionAgentGrant::new and ExtensionAccessRequest::new did not accept expiry or trusted time, and DenyExpired did not exist. After those fields existed, the evaluator was updated to fail closed at the exclusive deadline. Local verification: originweave-core tests, Clippy -D warnings, rustdoc -D warnings, and the extension-authority / product-documentation Python contracts passed.

Standards

Lodderstedt, T., Bradley, J., Labunets, A., & Fett, D. (2025). OAuth 2.0 security best current practice (RFC 9700). Internet Engineering Task Force. https://doi.org/10.17487/RFC9700

Exclusive expiry uses the same now >= expires_at rule as the existing sensitive-handle contract. Partial implementation of #27.

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[seonghobae]

Reviewed exact head 16a872cddd0e336adfe0a686a75d057c05d8c74a against protected main 0c376acf059be9ddddddfbde1d0189e4f39ef014. The change composes canonical-origin matching with host-supplied trusted time and exclusive expiry (now >= expires_at) before capability admission, preserves fail-closed mismatch ordering, and adds boundary coverage for before/at/after expiry while keeping task identity and runtime/browser integration explicitly out of scope. Exact-head CI, Manifest V3 compatibility, SAST, and Security Scan are successful; no unresolved review threads are present. I found no source-level defect in this bounded slice.