feat(core): add bounded semantic node observation contract

[seonghobae]

Partial implementation of #28.

Buyer-visible gap

OriginWeave needs a bounded semantic observation contract between raw browser evidence and later typed policy/action logic. A semantic observation must preserve OriginWeave-owned node authority, bound attacker-controlled text and relationships, and identify how the observation was produced without turning page/tool metadata into instruction or execution authority.

This stacked lane remains based on exact PR #40 head 9e635e80e9813a1d2a9c408155d52221b76eeed3 and therefore remains Draft while that prerequisite is active.

TDD and RCA

The lane began with fail-first contracts for the base semantic observation primitive and later for explicit observation provenance. The latest relationship refinement was also test-first.

Exact test-only head b1bd4f8bd3b5597dac8ad3c40530beba7288e8ca required:

• optional parent and ordered child relationships;
• at most 128 children;
• exact relationship authority across browser session, browsing context, canonical origin and document epoch;
• fail-closed self-parent/self-child and duplicate-child rejection; and
• stable credential-free typed errors.

CI run 31414009540 established the intended RED because the production fields, accessors, bound and errors did not yet exist. Production commits then implemented that boundary and applied only the canonical rustfmt delta surfaced by CI.

Exact head dbe75ca557fc6f501b0e54846c81dffa58812ced passed ordinary contracts/tests/rustdoc but exact coverage found the remaining meaningful branch gap: the short-circuit authority comparison had exercised only the origin-mismatch axis. Production functions and lines were already 100%, while regions were 5409/5417 and branches 516/520 overall.

Current exact head 94fd284fe41746eeba9edc05d9753903b1c41ebf adds focused regressions for independent browser-session, browsing-context, origin and document-epoch mismatches plus child-side mismatch propagation. No production logic was weakened to satisfy coverage.

Current implemented boundary

SemanticNodeObservation now:

• remains bound to an OriginWeave-owned ObservedNodeHandle rather than a raw BiDi/CDP/renderer identifier;
• bounds role, accessible name and optional visible-text excerpts;
• records explicit enabled/visible/selected state;
• carries finite node-local typed action descriptors that are descriptive evidence only and grant no execution authority;
• requires at least one observation evidence channel;
• supports an optional parent and ordered children with a maximum of 128 child relationships;
• requires every relationship to match the observation's exact browser session, browsing context, canonical origin and document epoch;
• rejects self relationships and duplicate child handles; and
• exposes typed read-only accessors with stable credential-free validation errors.

Accessibility, DOM, layout, structured data, WebMCP and visual content remain untrusted observations rather than policy/instruction authority. Relationship metadata cannot mint capability.

Exact-head evidence

On unchanged exact head 94fd284fe41746eeba9edc05d9753903b1c41ebf, stacked on exact prerequisite #40 head 9e635e80e9813a1d2a9c408155d52221b76eeed3:

• CI run 31428454410: success;
• repository Python contracts: success;
• canonical formatting: success;
• locked workspace/all-target check and tests: success;
• strict Clippy: success;
• rustdoc/API documentation: success;
• exact owned production function/line/region/branch coverage: success;
• Manifest V3 Compatibility run 31428454350: success;
• CodeRabbit exact-head commit status: success; and
• GitHub reports the PR mergeable.

No predecessor-head result is transferred to this exact head.

Scope boundary

This PR adds no browser I/O, Chromium/BiDi/CDP/WebMCP transport, raw HTML retention, unrestricted JavaScript execution, action dispatch, post-condition verification, persistence, secrets, network authority, model call, workflow mutation or release claim. It is an authority/provenance-bound semantic-observation value prerequisite for the first real Chromium vertical slice, not the browser observation adapter itself.

Canonical whole-product documentation remains owned by PR #44, which records #52 only as active/non-shipped evidence and does not invent a new service, physical ERD entity or Accepted ADR for this value primitive.

Dependency/governance

Keep Draft while prerequisite #40 remains active. This scheduled actor does not merge or self-approve. Any later head movement invalidates the exact-head evidence above and requires fresh validation.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 326c9f16-876c-4c35-9a6a-19ab2a4f7719

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}