[Product Gap] Complete the first real Chromium agent vertical slice

[seonghobae]

Buyer-visible gap

OriginWeave currently has substantial reusable Rust authority kernels, but a buyer still cannot run a real Chromium session through the complete OriginWeave observation/action/evidence chain. Until this exists, the product is an agent-safety/control-plane foundation rather than a usable browser runtime.

This issue defines the first executable browser slice. It must use stock/pinned Chromium first; do not start a large Chromium fork before this workflow proves product value.

Vertical slice

Deliver one isolated delegated browser task end to end:

pinned stock Chromium
→ isolated Agent Task profile/context
→ versioned WebDriver BiDi adapter for navigation/input lifecycle
→ CDP adapter only where BiDi does not yet expose required observation evidence
→ exact browser session + browsing context + canonical origin + document epoch
→ accessibility + DOM/layout semantic observation
→ typed node query
→ policy-authorized typed action
→ real browser input event
→ observed post-condition
→ credential-safe evidence/provenance bundle
→ clean session teardown/checkpoint

The first slice should use a controlled local/fixture web application so the expected DOM, accessibility tree, navigation, mutation, network and post-condition are deterministic. Add selected real-site compatibility benchmarks only after this controlled path is stable.

Adapter boundary

• Do not expose CDP/BiDi identifiers directly as durable OriginWeave authority.
• Translate adapter identifiers through a session-scoped registry into OriginWeave opaque IDs.
• WebDriver BiDi remains the browser-neutral automation path; CDP is a Chromium-specific diagnostic/observation adapter.
• CDP tip-of-tree instability must not leak into the product contract; pin the Chromium/protocol revision and version the adapter.
• WebMCP is experimental and optional; it may become the highest-priority structured observation when present but cannot be the only path.
• MCP exposes high-level OriginWeave tools and never connects the model directly to Chromium/CDP.

Session isolation

The Agent Task must not inherit the user's default browser profile.

Required first-slice evidence:

• ephemeral task profile or equivalent isolated browser context;
• no ambient cookies, local storage, extension state or saved credentials from the human profile;
• explicit origin capability;
• clean teardown and deletion/retention semantics;
• attached-human-tab support remains Planned and must be labeled reduced-assurance when later implemented.

Semantic observation

Create a bounded semantic snapshot from structured browser evidence rather than sending raw HTML to a model.

At minimum expose:

• document epoch;
• OriginWeave session/context identity;
• canonical origin;
• opaque node handle;
• role and accessible name;
• visible text when bounded and policy-permitted;
• enabled/visible/selected state;
• parent/child relationship needed for the fixture;
• bounding rectangle only where needed;
• supported typed actions;
• evidence channels used (Accessibility/DOM/layout/etc.).

A relevant navigation or same-document mutation that changes action semantics must invalidate previous handles. Before every action, revalidate exact session, context, origin and document epoch.

Typed action and success semantics

Start with a minimal action vocabulary sufficient to prove the lifecycle, for example:

• navigate
• query_nodes
• click_node
• type_text
• wait_for_state
• capture_evidence

Do not expose unrestricted Runtime.evaluate as a normal tool.

Command return is not success. The adapter must observe the declared post-condition, such as URL change, DOM/AX state change, dialog state, or fixture network mutation, before the action is recorded successful.

Security regressions

Tests must include at least:

1. stale node after navigation;
2. stale node after relevant same-document mutation;
3. cross-session handle reuse;
4. cross-context/frame handle reuse;
5. cross-origin action without grant;
6. hidden page text attempting prompt injection;
7. page content attempting to request a new tool/capability;
8. raw secret never appearing in model-visible observation/evidence;
9. unexpected redirect/destination authority failure propagation;
10. renderer/tab crash or forced close with deterministic task failure/recovery evidence;
11. oversized observation/text truncation or fail-closed bounds;
12. browser process cleanup with no leaked task profile.

Realistic benchmark

The controlled fixture must exercise a real user workflow, not only protocol echoing. Example:

1. navigate to an authenticated-looking local fixture without real credentials;
2. locate a form field by semantic role/name;
3. type non-sensitive text;
4. submit a reversible local action;
5. observe the exact post-condition;
6. extract one structured value and prove its source node/network evidence;
7. repeat the workflow multiple times and record success/recovery variance.

Resource evidence

Record, at minimum, browser/task RSS, observation bytes, action latency and task duration. If local AI is not used in this slice, say so rather than inventing GPU evidence. The later resource-governor integration must consume actual adapter telemetry rather than a simulated browser budget.

Documentation and standards

Update the canonical PRD/TRD/Architecture/UML/ERD/traceability only where this slice changes current truth. Add an adapter ADR if existing protocol ADRs do not fully define the implementation. Record current primary WebDriver BiDi, Chromium/CDP and accessibility sources in APA 7th form. Distinguish W3C Working Draft/experimental interfaces from final standards.

Acceptance

Close only when:

• a pinned Chromium binary/revision is exercised by CI or a reproducible supported test environment;
• the isolated Agent Task runs the complete observation → policy → action → post-condition → evidence chain;
• hostile/stale authority tests pass;
• every OriginWeave-owned production function/line/region/branch remains at the repository's exact 100% gate where applicable;
• public Rust APIs have complete rustdoc;
• CI, Security Scan and SAST are exact-head success;
• the shipped-vs-planned documentation graph is updated;
• no demo-only success stub remains in the vertical path.

Figma is not a prerequisite for this headless/runtime slice. Use Figma when the first approval/evidence/Agent side-panel user interface is designed.