test(mv3): prove content-script isolated-world compatibility

[seonghobae]

Partial implementation of #27.

Buyer-visible gap

The pinned Chromium fixture proved content-script injection, but issue #27 also requires isolated-world behavior. Injection alone does not prove that extension JavaScript globals remain separated from the page main world.

Live dependency / stack state

This Draft is stacked on current exact PR #60 head 56a15071d2ca77ba38ee59ce518de262eb2f8f36, transitively on #59/#56/#43. Current exact contributor head is e3ef1b99ad952a8c2835299f992a6db595a7212a.

Fresh ancestry is ahead 7 / behind 0, with merge base exactly equal to the live #60 head. Relative to #60 the current semantic delta is limited to CHANGELOG.md, tests/fixtures/mv3_basic/content_script.js, tests/fixtures/mv3_basic/page.html, and tests/test_mv3_isolated_world_contract.py. No prerequisite check, review, status, or predecessor result is transferred to this child.

Keep Draft while #60/#59/#56/#43 remain active.

TDD / stack-reconciliation RCA

1. Exact test-only head e81cdbd9b31a62227698bd3d824fd901551061f0 added a fail-first repository contract requiring a page-main-world sentinel plus a distinct content-script-world sentinel. CI run 31434443638, job 93605281379, checked out that exact head and failed because page.html and content_script.js lacked those isolation contracts. That is the intended RED.
2. The isolated-world implementation then added only the controlled page/content-script sentinel behavior and contract.
3. When live prerequisite test(mv3): prove extension update migration in real Chromium #60 later advanced with the repaired update-migration/history/download stack, the first non-destructive topology alignment produced intermediate head d9bfadb6aa7ea0798c23bdebf205ad57554d1b18. A fresh compare exposed that this unchanged stale child tree would regress two prerequisite files: service_worker.js and tests/test_mv3_downloads_contract.py, including the current conflictAction: "uniquify" download race fix. That intermediate alignment was therefore rejected as evidence.
4. The root-cause-changing follow-up overlaid the exact live prerequisite blobs for those two files while preserving only this child’s isolated-world semantic changes. Current head e3ef1b99ad952a8c2835299f992a6db595a7212a now differs from live test(mv3): prove extension update migration in real Chromium #60 only in the four intended isolated-world files listed above.

Implemented boundary

The controlled fixture now:

• assigns window.originweaveWorldSentinel = "page" in page/main-world JavaScript;
• continuously republishes that main-world value only through a bounded controlled DOM data attribute;
• assigns the same-named JavaScript global to "extension" inside the Manifest V3 content script;
• waits a bounded interval so the page main world has an opportunity to republish its own value;
• reports the existing content-script compatibility surface as ready only when the page still observes "page" while the content script independently observes "extension";
• preserves the current prerequisite's history lifecycle, update migration, and uniquify download semantics; and
• exposes no arbitrary page JavaScript, raw page data, model input, or new Agent capability.

If page and extension JavaScript worlds collapse, the page's repeated sentinel publication becomes "extension" and the compatibility gate fails rather than reporting success.

Current exact-head evidence

On unchanged exact head e3ef1b99ad952a8c2835299f992a6db595a7212a against unchanged prerequisite 56a15071d2ca77ba38ee59ce518de262eb2f8f36:

• ancestry: ahead 7 / behind 0, merge base equal to the live prerequisite;
• CI run 31923941267: success;
• Manifest V3 Compatibility run 31923940936: success against the pinned real-Chromium fixture;
• formal reviews currently returned: none; and
• inline review threads currently returned: none.

No predecessor, prerequisite, intermediate-reconciliation, queued, skipped, cancelled, synthetic-merge, stale, status-only, or model-only evidence is promoted as current proof. The Draft remains dependency-blocked rather than verification-blocked.

Scope boundary

Compatibility evidence only. This does not expose arbitrary page JavaScript, add a browser adapter, create Agent authority, weaken content trust, alter workflows, or claim all Chrome isolated-world semantics. It proves one deterministic main-world/content-script separation contract in the pinned real Chromium fixture.

This scheduled actor does not merge, self-approve, alter workflows, add secrets, weaken checks, tag, or publish.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 95566359-cb17-4ad2-8273-1f244f8c46cc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}