fix(policy): treat extension-produced instructions as untrusted

[seonghobae]

Partial implementation of #27, stacked on PR #97.

Buyer/security gap

Issue #27 requires extension content, messages, and tool output to remain untrusted observations rather than executable instructions. The current policy rejects InstructionSource::WebContent, but the core trust-class enum has no extension-produced source, so an adapter cannot represent this boundary explicitly.

Dependency

This Draft is stacked on exact PR #97 head 912e0909169ed2fee1b26bce126f14e9390822bd. Keep Draft while #97 and its prerequisites remain active. No predecessor check/review/status transfers.

TDD state

Current test-only head 7a8e9c074ca5bebf56e366d1d3be6b509b117be1 adds a realistic policy-boundary regression requiring InstructionSource::Extension and requiring it to fail closed with Deny(UntrustedInstructionSource) even when the requested observation otherwise has capability and origin authority. Production support is intentionally absent at this head so CI can establish RED.

Truth boundary

This slice classifies extension-produced instructions as untrusted policy input. It does not authenticate an extension, attest Chromium permissions/profile state, grant extension or Agent capabilities, parse extension messages, authorize native messaging, or complete the Manifest V3 compatibility matrix.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: eb216d62-462d-4e58-9c34-95d9875cf8ef

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Closing as superseded/duplicate after fresh exact-current comparison with active PR #78 (3fd7d563d814a895e20d04fc6bd37371e548a875). #78 already owns the raw extension-message trust boundary: its production API deliberately exposes no instruction-source selector and internally constructs the delegated ActionRequest as InstructionSource::WebContent, preserving extension content/messages as untrusted input before ordinary policy evaluation. That is the narrower authority boundary required by issue #27 and avoids adding a second trust-class representation for the same source. PR #98 is test-only and carries no unique production behavior to preserve. Its failed CI at 7a8e9c074ca5bebf56e366d1d3be6b509b117be1 is the expected compile RED for the proposed duplicate enum variant, not evidence that #78 is deficient. No checks/reviews from either head are transferred.