feat(policy): classify raw extension proposals as untrusted

[seonghobae]

Partial implementation of #27, stacked on PR #76.

Buyer/security gap

PR #76 composes exact extension proposal authority with ordinary action policy, but it accepts an already-constructed ActionRequest. A raw extension-message adapter must not be able to construct that request with InstructionSource::User or EnterprisePolicy merely because extension transport delivered the message.

Dependency

This Draft is stacked on unchanged exact PR #76 head 3d2fff3daa766e5e6d7f25e7727a18e01ff52a2e and must remain Draft while #76/#74 are active.

TDD and implementation state

The original test-only head dbe06efc006fda316201ba295af4b933a4b41f14 established the missing raw-message trust boundary. Exact current head 3fd7d563d814a895e20d04fc6bd37371e548a875 now implements ExtensionMessageActionProposal and evaluate_extension_message_action_proposal.

The production boundary:

• contains typed action, source/target origin, secret-delivery metadata, and immutable intent digest but exposes no instruction-source selector;
• evaluates exact extension/session/context ProposeTypedAction access first;
• constructs the ordinary ActionRequest internally with InstructionSource::WebContent; and
• delegates unchanged to PR feat(policy): compose extension proposals with action policy #76 ordinary action-policy composition, so extension-produced message content cannot mint human or enterprise instruction trust.

Exact-head CI run 31477648663 completed successfully. No formal reviews or inline review threads are currently returned for this exact head. CodeRabbit explicitly skipped an automated review because the PR remains Draft; that skip is not passing review evidence and is not treated as approval.

Truth boundary / remaining #27 work

A separately trusted future adapter may authenticate independent user or managed-policy provenance through a different explicit boundary. This lane does not parse Chromium extension messages, establish transport sender authenticity beyond the existing extension/session/context grant, execute browser input, resolve secrets, verify post-conditions, persist managed-extension policy, or complete the issue #27 compatibility matrix/release gate.

This PR remains Draft until #76/#74 integrate and fresh exact-head/live-base acceptance is re-established. It does not close #27.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 72fed118-61d8-4f2f-9745-691ccb0a33b1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}