feat: bind observed nodes to exact browser authority

[seonghobae]

Buyer-visible gap

Prevent an agent from acting on a node handle that belongs to another browser automation session, tab or frame, origin, navigation, or replaced document. Adapter-local node identifiers can collide across those boundaries, so the handle itself must retain the authority that made the observation meaningful.

Implementation

• add nonzero BrowserSessionId, BrowsingContextId, and DocumentEpoch identities;
• bind ObservedNodeHandle to the exact browser session, browsing context, canonical origin, document epoch, and nonzero adapter-local node identifier;
• validate all authority components immediately before use and return typed deterministic errors for cross-session, cross-context, cross-origin, and stale-document reuse;
• keep the contract reusable in originweave-core without Chromium, WebDriver, selectors, arbitrary script execution, network, storage, secrets, or model dependencies;
• add ADR 0010 and primary-spec doctoring for WebDriver/WebDriver BiDi session-and-context node-reference semantics;
• align architecture, roadmap, and changelog with the implemented boundary.

TDD evidence

The regression was intentionally split into two independently observed production boundaries.

1. Browsing-context binding:
   • 337f63912acf31a7c7da42550622429cd4bb5708 is the formatting-clean test head.
   • CI run 31301446454, Rust contracts job 93214774032, reached cargo check --locked --workspace --all-targets and failed because BrowsingContextId, its errors, and the context-aware constructor/validator did not exist.
   • 141a25b3d060b8738996b86f57fd88084cc4598e implemented the context-bound API.
2. Browser-session binding:
   • 787bc764e54d53a940e2c1d34008baa750c83485 is the formatting-clean test head.
   • CI run 31301938793, Rust contracts job 93216018381, reached the same production compile boundary and failed because BrowserSessionId, its errors, and the session-aware constructor/validator did not exist.
   • c161c01a729b6d5460de492c34ccaa660080bdba implemented the session-bound API.

On exact current head c0c08772942bc8ae7d4106b1f8375f25e7aa7542:

• CI run 31302337557 completed successfully;
• Rust contracts job 93217061762 passed repository contracts, formatting, locked workspace checks, all Rust tests, strict Clippy, and rustdoc;
• production coverage job 93217061732 passed exact function, line, region, and branch enforcement;
• Security Scan 31302337555 and SAST Semgrep 31302337574 completed successfully;
• CodeRabbit exact-head commit status is successful;
• all returned review threads are resolved.

Authority boundary

The numeric identities are OriginWeave-internal opaque registry values, not raw WebDriver, WebDriver BiDi, CDP, renderer, process, frame-tree, or DOM identifiers. A future adapter must translate external identifiers through a session-scoped registry, allocate collision-free internal identities, rotate the document epoch whenever the actionable document lifetime changes, and validate the exact session, context, origin, and epoch immediately before acting.

A valid node handle proves observation authority only. It does not grant a browser capability, origin permission, destination or transport authority, sensitive-data disclosure, merge approval, or successful action post-condition.

Ready for independent review. Merge remains subject to an exact-current-head qualifying non-author formal APPROVED review and a final unchanged-head gate and writer-lease revalidation.

[coderabbitai]

Warning

Review limit reached

@seonghobae, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 33 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 56520703-bcaa-4e63-8431-90a00ff8d73d

📥 Commits

Reviewing files that changed from the base of the PR and between f167def and 2309a79.

📒 Files selected for processing (7)

• ARCHITECTURE.md
• CHANGELOG.md
• crates/originweave-core/src/lib.rs
• crates/originweave-core/tests/document_epoch.rs
• docs/adr/0010-session-context-bound-node-authority.md
• docs/doctoring/session-context-node-authority.md
• docs/product-roadmap.md

📝 Walkthrough

Walkthrough

문서 epoch과 canonical origin에 결합된 노드 핸들 계약을 추가했습니다. 핸들은 현재 문서 컨텍스트와 일치할 때만 유효합니다. 식별자 검증, 오류 동작, 관련 변경 이력을 테스트와 문서에 반영했습니다.

Changes

문서 노드 권한

Layer / File(s)	Summary
노드 핸들 계약 및 오류 처리 crates/originweave-core/src/lib.rs, CHANGELOG.md, docs/product-roadmap.md	DocumentEpoch은 0 값을 거부합니다. ObservedNodeHandle은 origin, document epoch, node ID를 저장하고 현재 값과 비교합니다. 불일치 유형별 NodeHandleError와 표시 문자열을 추가했습니다. 변경 이력과 로드맵에 문서 노드 권한 및 stale-node 무효화를 기록했습니다.
노드 핸들 검증 테스트 crates/originweave-core/tests/document_epoch.rs	0 값 검증, 컨텍스트·origin·document epoch 일치 검증, 오류 문자열과 source() 동작을 확인합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 관찰된 노드 핸들을 정확한 브라우저 권한에 결합하는 PR의 주요 변경 사항을 명확하게 요약합니다.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/document-epoch-node-authority

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@crates/originweave-core/src/lib.rs`:
- Around line 257-315: Update ObservedNodeHandle to store a BrowsingContextId
and expose it through an accessor, extending new and validate_current to accept
and compare the context alongside origin and document epoch. Add
InvalidBrowsingContextId validation for construction and BrowsingContextMismatch
to NodeHandleError, preserving the existing origin and epoch checks and matching
the required public API.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 181d54ef-3157-4c7c-ae57-cb0c984eb463

📥 Commits

Reviewing files that changed from the base of the PR and between b228693 and f167def.

📒 Files selected for processing (4)

• CHANGELOG.md
• crates/originweave-core/src/lib.rs
• crates/originweave-core/tests/document_epoch.rs
• docs/product-roadmap.md