feat(network): subscribe to committed navigation events

[seonghobae]

Partial implementation of #28, stacked directly on live PR #261 branch feat/webdriver-bidi-navigation-origin-binding exact head da84955d74ff12b158a8cb2e75eadf218c787f46.

Buyer-visible boundary

A conforming WebDriver BiDi local end must explicitly subscribe before relying on browsingContext.navigationCommitted. This Draft owns the complete narrow subscription exchange for exactly that event and one already-registered OriginWeave browsing context:

• typed session.subscribe command serialization only for browsingContext.navigationCommitted;
• exact session/context/external-context authority revalidation immediately before correlation and network I/O;
• registration of the command id before the first possible remote side effect;
• bounded RFC 6455 transport on the already established verified WebSocket;
• complete local-end JSON-envelope validation and exact outstanding-command correlation;
• typed projection of the required session.SubscribeResult.subscription identifier under a 4096-byte local retention bound;
• typed correlated remote-protocol errors; and
• fail-closed handling of malformed, ambiguous, event, null-id, unknown-id, and oversized responses without consuming unrelated correlation state.

The boundary does not expose arbitrary event names, global/user-context subscription authority, generic JSON/method dispatch, raw browser authority, or any inference that successful subscription authorizes navigation, destination, origin, action, policy, secret use, or proves that an event has fired.

Primary specification checked against the WebDriver BiDi Editor's Draft: session.SubscribeParameters permits event/context scoping and session.SubscribeResult contains one opaque text subscription identifier.

Test-first lineage

Exact test-only head 9ab369c4dc406aef19dcecacc50304224c060242 introduced the realistic loopback TCP → RFC 6455 opening exchange → masked session.subscribe frame → local-end success response → message assembly → exact correlation regression before production support existed.

The implementation subsequently added the typed command/response boundary and repaired repository-contract and exact-production-coverage findings on this same canonical branch. Later ancestor convergence moved the live base and contributor head; no parent/predecessor checks, reviews, or coverage are transferred to the current exact state.

Fresh exact-head evidence

Current contributor head: 9df2fc23abf42133beaebab4f5466fbdc942d336.
Current live base: PR #261 exact da84955d74ff12b158a8cb2e75eadf218c787f46.
Fresh ancestry has that exact base as the merge base, with this branch ahead by its twenty-five subscription commits and not behind. GitHub reports this PR open, Draft, and mergeable.

Exact native CI run 33440991551 completed success on this unchanged current head:

• Rust contracts job 99648880437: exact checkout, repository contracts, canonical formatting, workspace check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 99648880775: exact owned-production function/line/region/branch measurement, diagnostics upload, and exact enforcement success.

Fresh formal reviews and inline review threads are empty. Those absences are not represented as approval or passing review evidence. Central workflow results not returned for this exact stacked head remain absent evidence; live governance issue #215 owns the effective central-gate verification.

Remaining stack boundary

Keep Draft while #261 and its ancestors remain Draft. Event admission and later subscription teardown remain independently reviewable lifecycle work and are owned by the existing descendant stack; this PR itself does not infer active event authority merely from command/receipt success.

Protected-main AGENTS.md and live GitHub governance remain authoritative. The active organization ruleset requires one independent approving review, stale-review dismissal after pushes, resolved review threads, and the listed central workflows. This scheduled branch does not merge, self-approve, use admin bypass, force-push, destructively rebase, alter workflows/rulesets/secrets, weaken checks, tag, release, or publish.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Fresh parent-first repair evidence: this PR is no longer clean against its actual live parent. PR #261's branch is now c59b31c4e7fa31546fb4c7e5bf88dc1e436fd60b, while this head remains 9df2fc23abf42133beaebab4f5466fbdc942d336; the tips diverge from merge base da84955d74ff12b158a8cb2e75eadf218c787f46, and GitHub reports this PR dirty/non-mergeable. The body statement that the current base is da84955... is therefore stale.

I reconstructed the unique six-file subscription delta non-destructively on the current parent as Draft #277, exact head 74fdedb6ee441a4055ee335bc5a5b96dee852661. The reconstruction preserves the live parent's command-kind correlation change in src/lib.rs instead of overwriting it with the stale child blob. Fresh compare is ahead 1 / behind 0 from current parent with the same six-file product boundary. CI run 33600076214 has been created for #277 and is queued, so no old #262 GREEN is transferred.

Do not close this PR yet. #277 must first obtain exact-head repository-native coverage/contracts and applicable governance evidence, then unique-delta equivalence can be rechecked. Only after that is this PR safely superseded and #263 eligible for parent-first reconstruction/restack.