test(browser): constrain semantic observation evidence schema

[seonghobae]

Partial implementation of #28, stacked on exact PR #128 head 24446c9cacd05bab370d8a636552514d656fcf42.

Buyer/security gap

PR #128 bounds the controlled Agent Task semantic-observation bytes, but the executable object shape was not independently machine-checked. A later runner change could add unreviewed raw page text, hidden prompt-injection content, or arbitrary instruction-like fields while staying under the byte ceiling. The controlled compatibility lane needs an exact reviewed evidence-schema contract without pretending that the generic byte-measurement helper is a semantic validator.

TDD / RCA

Exact test-only head 5791b650ccd7f1f9c40ea49ed565fc051d9f018d deliberately attempted to require the generic _measure_agent_task_semantic_observation_bytes helper to reject extra/malformed fields. CI run 31625916343, Rust contracts job 94212118955, checked out that exact head and failed in Python repository contracts as expected.

RCA then narrowed the first failing boundary: the helper is explicitly a canonical byte-measurement/boundary function, while the security property belongs to the one executable semantic_observation construction feeding it. Widening the helper into a hard-coded fixture schema validator would conflate measurement with controlled-fixture semantics and would also invalidate #128's general exact-limit tests.

The smallest root-cause-changing remedy therefore moved the contract to the actual executable call site. Head 46efc3d530494b41f84c25ae50bc8fd1e623e027 parses the runner AST and requires exactly one controlled semantic_observation construction containing only:

• top-level input and submit objects;
• exact role and name fields for each object;
• the already validated browser-computed input_role/input_name and submit_role/submit_name values; and
• exactly one call to the bounded measurement helper with that exact object and no alternate keyword path.

CI run 31626499432 then proved the corrected contract on exact head 46efc3d530494b41f84c25ae50bc8fd1e623e027: Rust contracts and Production coverage both succeeded, including Python repository contracts, formatting, locked workspace checks/tests, strict Clippy, rustdoc, and exact production coverage. Current documentation head d199a0d1f30746aafc67986bf9dbc3ca88d802c6 adds only the Unreleased security changelog entry and requires fresh exact-head verification; predecessor evidence does not transfer.

Dependency / truth boundary

Keep Draft while #128/#105/#100 and their prerequisites remain active. This lane hardens only the controlled pinned-browser compatibility evidence shape. It does not define the final product-wide semantic observation schema, authenticate browser semantics, make accessible names trusted instructions, authorize model context, expose raw HTML, grant capabilities, or complete the end-to-end browser adapter. No prerequisite check, review, status, artifact, coverage, or mergeability result transfers.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 05e48f3e-0b3a-4def-bf54-1c4e8c3997c5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}