feat(extension): bind managed Agent Task policy to browser session

[seonghobae]

Partial implementation of #27, stacked on PR #94.

Buyer/security gap

PR #94 makes managed Agent Task extension admission time-bounded but still leaves the policy reusable across OriginWeave browser sessions. A valid managed-extension policy for one isolated Agent Task session must not become ambient authority for another session. A mismatched session also must not learn whether the policy window is malformed, overlong, not yet valid, or expired, nor whether an extension is managed.

TDD / RCA sequence

1. Exact test-only head 6cc5211e4b7de3262368651446ea8be8227b650d required every mismatched-session evaluation to return DenySessionMismatch, including when the bound policy window was malformed, overlong, not yet valid, or expired. Its first CI stopped at canonical formatting, so that setup failure was not promoted as semantic RED.
2. Formatting-only head 52e33a06d665a2c8c299edac61ffb1b3d5d51c70 reached the intended production boundary in CI run 31938116305: repository contracts, formatting, and workspace check passed, then mismatched_session_cannot_probe_policy_window_state failed with actual DenyInvalidPolicyWindow versus required DenySessionMismatch. This is the valid semantic RED.
3. Production head 85a9fa723cc9efddac7008dcb5ef92e81a8049b3 moved exact session validation before policy-window and allow-list evaluation. A foreign session therefore receives one stable typed denial without learning bound-session policy state.
4. After the live prerequisite advanced, exact old head 3c96a289824f6cc946867c16dda3a30097993c77 failed exact CI run 32024664291, Rust contracts job 95371434724, at the branch-local negative-capability test: current ExtensionAccessRequest::new requires canonical Origin plus trusted evaluation time, while this descendant still supplied the former four-argument request shape.
5. Current exact head b1ea0b0867ea77262415c1707a7df93ab1c07151 non-destructively reconciles exact current feat(extension): expire managed Agent Task policy #94 while preserving all session-binding production semantics and regressions. The compatibility repair supplies a valid controlled HTTPS origin plus trusted time only to the separate negative-capability request construction, preserving DenyMissingGrant. No production authority or evidence gate was weakened.

Live dependency / stack state

The independently resolved live prerequisite is exact PR #94 head ed6d191802d378303d1dd71a742f86592f206639, transitively on #85/#83/#82. Current exact #97 head is b1ea0b0867ea77262415c1707a7df93ab1c07151.

Fresh compare reports ahead 15 / behind 0, with merge base exactly the live prerequisite. The unique session-binding delta is limited to crates/originweave-policy/src/lib.rs and crates/originweave-policy/tests/agent_task_extension_policy.rs. The reconciliation preserves prerequisite native-messaging/core authority changes and #94 freshness behavior. No prerequisite check, review, status, coverage, mergeability, or synthetic-merge result transfers.

Keep Draft while the prerequisite stack remains active.

Implemented boundary

AgentTaskExtensionPolicy is constructed for one exact BrowserSessionId. evaluate_agent_task_extension:

• checks the current OriginWeave browser session first;
• returns DenySessionMismatch before inspecting validity-window shape, duration, trusted time, or allow-list membership;
• preserves invalid, overlong, not-yet-valid, expired, managed, and unmanaged decisions for the exact bound session only; and
• remains separate from Chromium profile attestation, native-messaging authority, installation state, and ExtensionAgentGrant capability.

Current exact-head evidence

On unchanged exact head b1ea0b0867ea77262415c1707a7df93ab1c07151 against exact live prerequisite ed6d191802d378303d1dd71a742f86592f206639:

• CI run 32077521031: success;
• Rust contracts job 95533742711: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 95533742587: exact owned production function/line/region/branch measurement and enforcement success;
• GitHub reports the Draft mergeable;
• formal reviews currently returned: none; and
• inline review threads currently returned: none.

Security/SAST/central/model workflows not returned for this stacked Draft are absent evidence, not passing. No predecessor-head, prerequisite-head, queued, pending, skipped, cancelled, stale, synthetic, status-only, or model-only evidence is promoted as current proof.

Truth boundary

This slice binds deterministic managed-extension admission policy to one OriginWeave browser session and prevents foreign-session policy-state probing. It does not authenticate an administrator, read or attest Chrome enterprise policy, prove the browser profile belongs to that session, attest a clock, install/update/enable extensions, verify signatures or supply-chain provenance, authorize native messaging, grant Agent capabilities, persist policy, or claim managed enterprise extension support complete.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2ea184aa-33c8-482a-b52a-9b5d3f83b85f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}