feat(network): admit and compare typed-text postconditions

[seonghobae]

Partial implementation of #28, stacked directly on current PR #270 branch feat/webdriver-bidi-type-text-postcondition-transport.

Buyer-visible boundary

This Draft carries typed-text post-condition response admission after the fixed product-owned script.callFunction observation is transported through the reviewed WebDriver BiDi/RFC 6455 boundary. The exact correlated script.CallFunctionResult is admitted and a successful string RemoteValue is compared with the already-authorized intended non-secret text. Page-controlled text is reduced immediately to byte-count/equality evidence and is not retained in public result, Debug, or error diagnostics.

Parser/correlation success is deliberately separate from browser-state success. verify_webdriver_bidi_text_value_postcondition returns success only for an exact value match; a structurally valid, exactly correlated response whose page value differs becomes PostconditionMismatch. Command ACK is therefore not post-condition proof.

Malformed envelopes/results, unsupported values, script exceptions, protocol errors/events, correlation mismatches, invalid expected text, and over-budget payloads remain fail-closed. This slice does not retry, grant browser/policy/destination/secret authority, or expose caller-supplied JavaScript.

Fresh stack / exact-current evidence

• Exact live prerequisite feat(network): transport typed text-value postcondition observations #270 head: 191a14535219ea8033777fa4c970efb281b62418.
• Exact current feat(network): admit and compare typed-text postconditions #271 head: 802ec806cdd4560eab48c484f435766ecabda353.
• The child adopted feat(network): transport typed text-value postcondition observations #270 with a non-force merge. Local exact-head verification passes 141 Python contracts, formatting, workspace checks, full Rust tests, strict Clippy, rustdoc, and exact 100% production function/line/region/branch coverage.
• Fresh hosted exact-head CI is required; queued, skipped, cancelled, or absent jobs are non-passing.
• All predecessor heads/checks, including earlier clippy/coverage/rustfmt repairs, are historical only and do not transfer.
• Formal-review and unresolved-thread evidence must be rebound to this exact head before any state progression.

Downstream convergence

The later semantic-action descendants were based on predecessor #271 lineage. They must each adopt current head 802ec806cdd4560eab48c484f435766ecabda353 in dependency order and obtain independent exact-head checks; their existing hashes and checks are historical and non-transferable.

Keep Draft while #270 and its ancestors remain active. Protected-main AGENTS.md and live ruleset remain authoritative. No self-approval, force-push, destructive rebase, workflow/ruleset/secret mutation, gate weakening, tag, release, or predecessor-evidence transfer is authorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

RCA: the text-value observation transport registered TextValueObservation, but both success and protocol-error response admission still used the legacy unclassified correlation path. The same numeric id therefore failed with CommandKindMismatch; the affected fixtures also registered legacy commands and rustfmt had pending changes. Commit 89e19ec makes response admission consume only the exact typed command family, updates every affected fixture, preserves the explicit unrelated-command rejection, and covers the defensive malformed-success invariant.

Verified locally at this head: 139 Python repository tests; locked workspace/all-target Rust tests; Clippy with warnings denied; rustdoc with warnings denied; rustfmt; and LLVM coverage at 100% functions, lines, regions, and branches. One known macOS revoked-socket NotConnected fixture flake passed on its single retry.

[seonghobae]

Parent repair propagation: this branch is now non-force reconciled onto #270 exact 64722daac0cbcbaf01375736b5f418838aa88c70 at current head 90f4620407bbec5e6325992aad26abf03f84a931. The merge conflict was caused by this child’s artificial construction of a parser-invalid success envelope to cover the parent’s unreachable fallback. That synthetic invariant break was removed; the parser-proven non-null success id is now carried by the parent implementation. Exact parent-to-child diff retains the intended text-value response/post-condition slice. Local evidence: 139 Python contracts pass, originweave-network all-target tests and strict Clippy pass, and workspace LLVM coverage is exactly 100% for functions/lines/regions/branches. One macOS socket-timeout cleanup test failed once with EINVAL and passed on immediate isolated plus full-suite rerun; hosted exact-head CI remains authoritative.

[seonghobae]

Parent synchronization and documentation repair on exact head 802ec806cdd4560eab48c484f435766ecabda353: adopted #270 exact 191a14535219ea8033777fa4c970efb281b62418 with a non-force merge; parent-relative response/comparison code remains intact. RED first proved the CHANGELOG and traceability dossier lacked #271’s equality-only success and page-text non-retention boundary. GREEN: focused documentation contract 1/1, complete Python 141/141, formatting, workspace checks, full Rust tests, strict Clippy, rustdoc, and exact 100% production function/line/region/branch coverage. Fresh hosted checks are required; descendants must resynchronize in order.