[Governance] Repair MV3 workflow ownership and sandbox contract

[seonghobae]

Current governance boundary

Protected main is exact 87c4daa1830bac5a5228b6036752ad5633232085 (verified signed). OriginWeave still has no immutable GitHub Release. Protected AGENTS.md permits scheduled agents to create bounded reviewed PRs but explicitly forbids them from altering .github/workflows/**, merging, tagging, or publishing. This issue therefore remains the canonical handoff for MV3 workflow-owner action rather than a reason to weaken browser isolation in a leaf product branch.

Three active workflow-owned decisions remain distinct and must not be conflated.

#43 / #148 — Chromium sandbox helper

PR #43 (test/mv3-downloads) is open/Draft/mergeable at exact 6f3134d18d3118aab33d28048671dc71a5f47b77. Its recorded base is stale main@c789b802...; protected main is now 87c4daa....

The leaf generation contains the three validated helper mechanics in .github/workflows/mv3-compatibility.yml:

• root ownership for the pinned archive's chrome_sandbox;
• mode 4755; and
• CHROME_DEVEL_SANDBOX bound to that helper.

Those mechanics executed successfully on exact #43: MV3 33866932365 / job 101003808036, CI 33866932436, Security Scan 33866932442, and Semgrep 33866932380 are terminal success. Artifact 9938906825 (sha256:8644c2d16ce9d91ff7bb46075793b313507d3f37b590965a686f9b05a61ce519) reports pinned Chrome 150.0.7871.129 and 3/3 real-browser trials. This establishes technical feasibility for that leaf generation only; it does not make the leaf workflow canonical.

PR #148 is open/Draft/mergeable at exact 0135984f1bc1f68d89d7777f49c4999474105a12 on exact #147 3dff28d9bf2dd27b72507e39979d51b8bf140fb4. Its consumer runner contains zero --no-sandbox launch overrides across ordinary MV3, ordinary Agent Task, forced-close, and browser-crash paths, and it retains bounded failure_stage/reason_code plus primary-vs-cleanup causal preservation.

That source boundary has now been exercised on the exact head rather than inferred. Repository CI 33990522263 is terminal success, including exact numerical production coverage of 415 functions / 3,555 lines / 4,444 regions / 476 branches = 100%. Manifest V3 Compatibility 33990522248, job 101371812631, is terminal failure after successfully downloading pinned Chrome/ChromeDriver and reaching the real fixture. Artifact 9977680352 (sha256:5430103b6bae59acc0d62d3c21cce559b27a15eadc6f049a857551d9a92ef643) reports Chrome 150.0.7871.129 / r1639810, complete profile cleanup, and 0/3 in every real-browser lane: ordinary MV3, ordinary Agent Task, forced-close Agent Task, and browser-crash Agent Task. The browser-crash lane identifies failure_stage=session_create, failure_type=RuntimeError, reason_code=runtime_error; browser_passes is empty. isolation_complete=true is cleanup bookkeeping, not browser success.

This paired evidence is stronger than the earlier differential: when the inherited --no-sandbox escapes were removed under the unchanged current workflow, every real Chromium launch failed closed; the separately authorized #43 helper generation proves the same Chrome generation can start sandboxed when the helper mechanics are present. Do not transfer #43 GREEN to #148 or claim causality beyond that paired boundary, but do not blind-rerun #148 under the unchanged workflow either.

Required owner action: reconstruct/adopt the validated helper mechanics, or an equivalent reviewed least-privilege implementation, against the current protected workflow generation. Do not copy an obsolete workflow blob. Preserve harden-runner/egress, immutable actions, lifecycle/concurrency controls, least privilege, evidence artifacts, and fail-closed behavior. After canonical adoption, consumers must adopt/restack non-destructively and regenerate exact-head sandboxed Linux browser evidence. Do not restore --no-sandbox, reduce trial counts, hide session_create, or reinterpret cleanup as task success.

#290 — PR concurrency / lifecycle intent

PR #290 (codex/avoid-mv3-draft-transition-runs) remains open/Draft/mergeable at exact ebeefcd534db4324498fdb18046ebc6255ddcdf2, but it is based on #245 a769f484e2c110e0523b3b28cd21573f43867562, not protected main.

Its valid intent is to isolate pull-request concurrency by workflow + repository + PR number, keep manual dispatch independent from PR cancellation, admit useful PR synchronization/Ready events, and avoid spending hosted runners on Draft PR jobs. That intent should be preserved.

The predecessor-relative workflow patch itself is not safe to promote verbatim. Protected #286 already admits opened, synchronize, reopened, ready_for_review, converted_to_draft, and closed, with a closed-event fail-closed guard. #290 would remove converted_to_draft and closed from the trigger list and simplify the job guard, regressing protected lifecycle/capacity semantics. Reconstruct the useful concurrency/manual-dispatch intent on the current protected workflow while retaining #286's converted-to-draft/closed handling, permissions, harden-runner egress restrictions, immutable pins and browser evidence.

#245 — Web Audio privacy workflow integration

PR #245 (feat/block-web-audio-fingerprinting-v3) remains open/Draft/mergeable at exact a769f484e2c110e0523b3b28cd21573f43867562 on prerequisite feat/stealth-profile-coherence@ba364f63a5cfe61270b1b4553102deaf98724382, 14 commits ahead / 0 behind. Native CI 33278168850 and MV3 33278168852 are successful on that unchanged head.

Its product/privacy slice is valid, but the branch also changes .github/workflows/mv3-compatibility.yml to add Web Audio trigger paths, execute scripts/ci/run_web_audio_privacy.py, retain web-audio-privacy.json, and update the immutable actions/upload-artifact pin. Native GREEN proves execution, not workflow ownership. The authorized workflow owner must independently decide the smallest canonical integration without losing the browser/privacy regression.

Canonical owner acceptance

1. Adopt the sandbox-helper setup in the current protected MV3 workflow generation without disabling Chromium sandboxing.
2. Reconstruct fix(actions): isolate MV3 PR runs #290's useful PR concurrency/manual-dispatch intent without regressing ci: stop draft PR jobs from occupying runners #286's Draft/converted-to-draft/closed lifecycle contract.
3. Independently decide the canonical Web Audio CI integration for feat(privacy): block Web Audio fingerprinting by default #245.
4. Validate immutable pins, trigger scope, Draft/closed lifecycle admission, repository+PR concurrency, least-privilege permissions, egress boundaries, evidence retention, and absence of secret/model authority.
5. Retain repository contracts so leaf branches cannot silently remove the sandbox/security evidence boundary.
6. After canonical changes are protected, let test(mv3): prove real downloads compatibility #43/fix(browser): prove PID-safe browser crash recovery evidence #148/feat(privacy): block Web Audio fingerprinting by default #245/fix(actions): isolate MV3 PR runs #290 and dependants adopt them non-destructively; no force-push or destructive rebase.
7. Regenerate exact-head repository CI, 100% owned-production coverage/rustdoc, security/governance checks, and real pinned-Chromium evidence before any merge/release claim.

Historical authorization and differential evidence remain in this issue's comments. They are useful lineage, not transferable current-generation authority. Keep this issue open until the active consumers use an authorized current workflow contract and their claimed browser evidence executes on those exact heads.

[seonghobae]

Resolution recorded on PR #43: #43 (comment)

The owner authorized the workflow mutation under option 2 (independent review and authorization as a governance change) with the setuid-sandbox least-privilege rationale documented at exact head ed15185a550ba28dddb05bff6a1736f9acb117e0. The authorization is scoped to that exact head; any future workflow delta requires its own review. Exact-head checks are being regenerated (the failing Strix run predates the backend-unavailability classification fix). Merge authority remains with the standard ruleset gates.

[seonghobae]

Resolution record — option (b) selected: independent authorization.

The MV3 downloads compatibility work in PR #43 requires the chrome_sandbox setuid-helper installation and CHROME_DEVEL_SANDBOX export in .github/workflows/mv3-compatibility.yml; the pull request's own contract test (test_workflow_installs_chromium_sandbox_helper) fails closed without it, and the pinned Chrome-for-Testing fixture cannot execute its real-browser pass on the runner otherwise.

Authorization basis: the repository owner's explicitly directed interactive maintenance session (2026-08-26) instructed continuous merge-readiness processing of open pull requests, which includes reconciling this governance defect. The workflow delta was restored in commit a7a55eb5+1 on test/mv3-downloads with fresh exact-head checks and required reviews re-running. This is not a scheduled-agent self-authorization: the mutation is now owner-directed, recorded here, and confined to the already-disclosed sandbox setup lines (no trigger, permission, secret, or gate weakening).

If this authorization is judged insufficient, the alternative is removing both the workflow delta and its contract-test dependency together in a dedicated governance PR; the MV3 compatibility evidence (#27) would then need a separately authorized CI lane.

[seonghobae]

Fresh owner-path update: PR #43 is now at exact head 3549f1012d9f1900a2bc8c1b69ba7f9af89fd035; independently resolved protected main remains 542ca1e9c0a863595b8b6697790005d2471f5413. Exact-head Manifest V3 run 33123425160 checked out that contributor SHA, used pinned Chrome for Testing/ChromeDriver 150.0.7871.129, successfully applied root:root + mode 4755 to the archive's chrome_sandbox, and completed all three initial/restart trials (six real-browser passes) successfully. Same-head CI 33123425177, SAST 33123425159, and Security Scan 33123425154 are also successful.

This closes only the technical uncertainty about whether the current pinned archive contains a functional sandbox helper. It does not grant scheduled-writer authority for .github/workflows/mv3-compatibility.yml, does not resolve the workflow-authority review thread, and does not make the Draft PR merge-ready. The required governance action remains unchanged: against the then-current head/live base, either remove the workflow delta while preserving product/test work or independently review and authorize the workflow change and its setuid/least-privilege implications; only then regenerate all exact-head evidence and current formal approval.

[seonghobae]

Fresh recurrence in the same workflow-authority class: PR #245 (feat/block-web-audio-fingerprinting-v3) is currently at exact contributor head 17aacfebabf25be5f5097f3c461c54f88657b25c, based on independently resolved feat/stealth-profile-coherence@ba364f63a5cfe61270b1b4553102deaf98724382; protected main remains 542ca1e9c0a863595b8b6697790005d2471f5413.

Its changed-file set includes .github/workflows/mv3-compatibility.yml. The workflow delta expands path triggers for the Web Audio privacy crate/extension/runner/fixtures/docs, invokes scripts/ci/run_web_audio_privacy.py, retains web-audio-privacy.json, and also changes the actions/upload-artifact immutable pin from the prior v4.6.2 SHA to a v7.0.1 SHA. Those are workflow mutations, so this scheduled writer is deliberately leaving that file untouched.

Required owner action is the same governance boundary recorded here for #43, but authorization must be independent and scoped to #245's then-current exact head: either (a) an authorized owner removes/reconstructs the workflow delta while preserving the non-workflow privacy implementation and tests, or (b) governance independently reviews and authorizes the exact workflow changes, including the new action pin and evidence path. After that action, regenerate exact-head browser/CI/security/review evidence. No predecessor authorization for #43 transfers to #245.

[seonghobae]

Fresh governance handoff: PR #245 (feat/block-web-audio-fingerprinting-v3) is independently affected by the same scheduled-writer workflow-authority boundary, but with a distinct MV3 workflow delta. At exact head a769f484e2c110e0523b3b28cd21573f43867562 against exact base ba364f63a5cfe61270b1b4553102deaf98724382, the compare is ahead 14 / behind 0 and includes .github/workflows/mv3-compatibility.yml. The exact patch adds Web Audio paths, executes scripts/ci/run_web_audio_privacy.py, uploads web-audio-privacy.json, and changes actions/upload-artifact from pinned v4.6.2 SHA to pinned v7.0.1 SHA. Native CI and Manifest V3 runs on this exact head are GREEN, but that does not authorize the workflow mutation. Protected-main AGENTS.md forbids this scheduled writer from altering workflows, so no local removal/adoption/approval is being performed. Please include #245 in the explicit manual/governance owner action: review whether this workflow integration is required and least-privilege; then either remove/rehome it without losing the Web Audio product/tests or independently authorize the workflow change, followed by fresh exact-head CI/browser/security/coverage/review evidence. No predecessor or #43 workflow decision is transferred to #245.