feat(extension): expire managed Agent Task policy

[seonghobae]

Partial implementation of #27, stacked on PR #85.

Buyer/security gap

PR #85 makes Agent Task extension admission an exact managed allow-list but deliberately carries no policy freshness. A previously valid managed-extension set must not remain replayable indefinitely after enterprise policy changes.

TDD and implementation

Exact test-only head f4521bacf98f052f275fc87d0f75c108f6e096e9 established the missing freshness boundary before production changed. The tests require one explicit half-open validity window, caller-supplied trusted evaluation time, fail-closed invalid/reversed windows, not-yet-valid and expired decisions, exact-boundary expiry, u64::MAX safety, exact extension identity matching, and preservation of the separate Agent capability boundary.

Production now carries the smallest deterministic implementation: AgentTaskExtensionPolicy stores valid_from and valid_until; evaluate_agent_task_extension receives the trusted evaluation time; invalid windows, not-yet-valid policy and expired policy have separate typed denials; and membership is evaluated only after the freshness checks. The implementation does not read or attest a clock, so all three time values remain in one caller-attested time domain.

Dependency and exact-current proof

This Draft targets unchanged exact PR #85 head e836e833be920da8764d3dd72e058e02cd9ed72b. Current exact #94 head is 759d2f04d81dcf52bca29b88d860fb9aaeca56e8 and GitHub reports it mergeable against that prerequisite.

On that unchanged exact head:

• CI run 31541736861: success;
• no formal reviews are currently returned;
• no inline review threads are currently returned; and
• no prerequisite check, review, status, or mergeability evidence is transferred.

Keep Draft while #85/#83/#82 remain active. Any prerequisite or current-head movement requires fresh exact-head/live-base verification.

Truth boundary

This slice governs only deterministic policy validity time. It does not authenticate an administrator, read Chrome enterprise policy, attest a clock, install/enable/disable extensions, verify extension signatures/update provenance, mutate profiles, grant Agent capability, authorize native messaging, persist policy, or claim managed enterprise extension support complete.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c4260cb-180a-493f-bc1e-79a6721b9fc4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}