feat(browser): fail closed on oversized Agent Task observation

[seonghobae]

Partial implementation of #28, stacked on unchanged exact PR #105 head bc1d22d6c4848a173c55fdd18054574299488067.

Buyer/security gap

The pinned-Chromium controlled Agent Task measured semantic-observation JSON bytes but previously rejected only the impossible zero-length case. Issue #28 requires oversized observation/text to be truncated or fail closed. Without an explicit ceiling at the executable browser-evidence boundary, later fixture or adapter growth could silently turn a currently small role/name snapshot into unbounded evidence.

Dependency

This Draft targets unchanged exact #105 head bc1d22d6c4848a173c55fdd18054574299488067 and must remain Draft while #105/#100 and their prerequisites remain active. PR #129 already depends on this exact head, so ancestry must be preserved. No prerequisite check, review, status, artifact, coverage, mergeability, or synthetic-merge result transfers.

TDD and RCA sequence

1. Exact test-only head 71e78784332b2cbe34d3d704b6a03d0d69ff35c2 required a finite semantic-observation byte ceiling, a canonical compact UTF-8 measurement helper, exact-limit acceptance, one-byte-over rejection, object/non-empty validation, and use of the helper on the real controlled Agent Task path. CI run 31608771377, Rust contracts job 94154427922, failed in the Python repository-contract suite because all three production-like runner boundaries were absent. The independent Rust production-coverage job succeeded because this Python runner test did not alter owned Rust production code; that result is not promoted as source GREEN. This is the valid RED.
2. Head a18730b366fa34d906bbff953876765e0324e218 added the finite runner bound and canonical measurement helper and routed the real browser path through it.
3. Head 58917b02f2fe9bc5dc16278a11ca54550d02d092 added bounded semantic-locator text coverage while preserving the observation contract.
4. Current exact head 24446c9cacd05bab370d8a636552514d656fcf42 restores the bounded observation contract after that refinement and is exact-green.

Implemented contract

The controlled Agent Task runner now:

• defines MAX_AGENT_TASK_SEMANTIC_OBSERVATION_BYTES = 4_096 as a product-safety budget for this compatibility evidence, not a protocol-validity limit;
• accepts only a non-empty Python object as the semantic observation;
• serializes with canonical compact UTF-8 JSON using ensure_ascii=False, sorted keys, and compact separators;
• accepts evidence exactly at 4,096 bytes and fails closed one byte over;
• rejects empty and non-object observation values;
• routes the real browser-observation path through _measure_agent_task_semantic_observation_bytes instead of an unbounded direct len(json.dumps(...)) calculation; and
• requires every successful trial to retain a positive observation size no greater than the same exact ceiling.

The evidence remains limited to reviewed browser-computed role/name fields for the controlled input and submit elements. It does not include raw HTML, hidden page text, unrestricted script output, credentials, or model-visible page content.

Exact-head proof

On unchanged exact head 24446c9cacd05bab370d8a636552514d656fcf42 against unchanged exact prerequisite bc1d22d6c4848a173c55fdd18054574299488067:

• CI run 31621166317: success;
• Rust contracts job 94196082737: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 94196082724: exact owned production function/line/region/branch enforcement success;
• Manifest V3 Compatibility run 31621166484: success;
• CodeRabbit exact-head status: success;
• GitHub reports the Draft mergeable against its unchanged prerequisite base; and
• no formal reviews or inline review threads are currently returned.

No predecessor-head or prerequisite evidence is promoted as current proof.

Remaining branch-local closure

The implementation and acceptance evidence are exact-green, but this branch's changed-file set does not contain a dedicated truthful Unreleased changelog entry. PR #129 already depends on exact head 24446c9...; moving #128 solely for release-note prose would invalidate descendant ancestry and exact evidence. That release-note debt must be reconciled through dependency-ordered stack alignment rather than silently treated as complete.

Truth boundary

This lane bounds only the controlled semantic-observation evidence emitted by the pinned-browser compatibility runner. It does not define the final product-wide semantic snapshot budget, truncate arbitrary browser content, authenticate a browser adapter, authorize model context, expose raw HTML, add unrestricted JavaScript, or complete the end-to-end OriginWeave browser adapter. A later production adapter must apply its own reviewed structured-observation bounds at the real observation boundary.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 854d174d-a948-4083-a647-57b502888012

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}