feat: add privacy-preserving presentation identity kernel - #229
feat: add privacy-preserving presentation identity kernel#229seonghobae wants to merge 98 commits into
Conversation
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (32)
🚧 Files skipped from review as they are similar to previous changes (2)
Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review. 📝 WalkthroughWalkthrough명시적 브라우저 프레젠테이션 프로필과 제한된 fingerprint 표면을 검증하는 Rust 커널을 추가했습니다. 버전 고정 WebDriver BiDi 명령 계획과 cleanup 경계를 추가했습니다. 관련 아키텍처, 정책, ADR, 제품 문서 및 계약 테스트를 갱신했습니다. Changes프레젠테이션 정체성 및 WebDriver BiDi 경계
Priority: ⬇️ Low Estimated code review effort: 5 (Critical) | ~120 minutes Merge Risk: ⚪ Minimal · up to No actionable correctness, security, availability, or integration risk remains from the finalized findings. Sequence Diagram(s)sequenceDiagram
participant Caller
participant PresentationProfile
participant WebDriverBidiPlanner
participant BrowserTransport
Caller->>PresentationProfile: 명시적 프로필 값 검증
PresentationProfile-->>Caller: validated presentation values
Caller->>WebDriverBidiPlanner: viewport, DPR, timezone 전달
WebDriverBidiPlanner-->>Caller: apply 및 cleanup 명령 계획 반환
Caller->>BrowserTransport: 계획된 명령 전달
BrowserTransport-->>Caller: transport 결과 및 page-observed 증거는 별도 처리
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Review follow-up on exact head eae6ccd: format_ratio now exhaustively matches DevicePixelRatio, and explicit replay accepts only the enumerated language classes. I did not add the suggested set_size == 0 return: returning index 0 would still panic when derive indexes the empty eligible vector, so it is not a valid fail-closed fix. The private derivation sets retain a regression that proves every screen admits at least one enumerated viewport width and height. Full workspace tests, strict Clippy, rustdoc, 144 documentation tests, and 100% production function/line/region/branch coverage pass locally. |
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
…9' into codex/bidi-application-completeness-20260909
…rmat-20260909 fix(bidi): restore canonical cleanup formatting
…-capabilities' into codex/bidi-application-completeness-20260909
…tract-repair-20260909 test(bidi): align media authority contract
…on-completeness-20260909 fix(bidi): make reusable application scope explicit
…presentation-capabilities feat(browser): add versioned WebDriver BiDi presentation boundary
![opencode-agent[bot]](https://avatars.githubusercontent.com/in/1549082?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
OpenCode reviewed the current-head product diff. Coverage is a separate gate.
Changed files
AGENTS.md— repository behaviorARCHITECTURE.md— repository behaviorCHANGELOG.md— repository behaviorCLAUDE.md— repository behaviorCargo.lock— Rust workspace or package manifestCargo.toml— Rust workspace or package manifestREADME.md— repository behaviorcrates/originweave-bidi/Cargo.toml— Rust workspace crate API and testscrates/originweave-bidi/src/lib.rs— Rust workspace crate API and testscrates/originweave-bidi/src/presentation_capabilities.rs— Rust workspace crate API and testscrates/originweave-fingerprint/Cargo.toml— Rust workspace crate API and testscrates/originweave-fingerprint/src/lib.rs— Rust workspace crate API and testscrates/originweave-fingerprint/src/stealth.rs— Rust workspace crate API and testscrates/originweave-fingerprint/src/ua_hints.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/kernel_contract.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/presentation.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/replay_digest.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/stealth_noise_surface.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/surface_admission.rs— Rust workspace crate API and testscrates/originweave-fingerprint/tests/ua_client_hints_surface.rs— Rust workspace crate API and testsdocs/PRD.md— operator or user guidancedocs/README.md— operator or user guidancedocs/TRD.md— operator or user guidancedocs/adr/0107-browser-protocol-adapter-strategy.md— operator or user guidancedocs/adr/0108-crawler-policy.md— operator or user guidancedocs/adr/0110-privacy-preserving-presentation-identity.md— operator or user guidancedocs/adr/0111-bounded-stealth-normalization-surfaces.md— operator or user guidancedocs/adr/0112-bounded-user-agent-client-hints.md— operator or user guidancedocs/adr/README.md— operator or user guidancedocs/doctoring.md— operator or user guidancedocs/product-roadmap.md— operator or user guidancedocs/product-technical-gap-baseline.md— operator or user guidancetests/test_adr_index_provenance.py— regression suitetests/test_bidi_media_authority_contract.py— regression suitetests/test_fingerprint_dependency_pin_contract.py— regression suitetests/test_presentation_identity_documentation_contract.py— regression suitetests/test_presentation_selection_contract.py— regression suitetests/test_repository_contract.py— regression suitetests/test_webdriver_bidi_presentation_adapter_contract.py— regression suite
Changed behavior
classDiagram
class WebDriverBidiCommandError
class WebDriverBidiBrowsingContext
class new
class as_str
class WebDriverBidiPresentationCommand
class plan_standard_presentation_commands
class plan_standard_presentation_cleanup
class require_complete_presentation_profile
Changed API
WebDriverBidiCommandErrorWebDriverBidiBrowsingContextnewas_strWebDriverBidiPresentationCommandplan_standard_presentation_commandsplan_standard_presentation_cleanuprequire_complete_presentation_profilePresentationErrorPresentationSurfacerequire_presentation_surfacesScreenMetricsViewportBoundsDevicePixelRatiofrom_ratioPresentationPlatformPresentationTimeZonePresentationDigestPresentationProfilereplaylanguagesdigestStealthSurfacerequire_stealth_surfacesStealthErrorCanvasNoiseWebGlRendererTokencanonicalWebAudioRatenormalizeWebRtcInterfaceexposes_candidatesClientHintsErrorUaBrandnameversionHintsArchitecturefrom_tokenHintsBitnessHintsPlatformUaClientHintsmodelbrands
Findings
No source-backed product finding is synthesized from the coverage gate. A coverage miss belongs in the status comment.
- Head SHA:
a517eb43082173817186624997c252f3ec0c061c - Workflow run: 34336163625
- Workflow attempt: 1
- Coverage gate:
failure
Review outcome
Coverage is a gate, not the review. This body reviews the changed product files.
Changed-File Evidence Map
classDiagram
class WebDriverBidiCommandError
class WebDriverBidiBrowsingContext
class new
class as_str
class WebDriverBidiPresentationCommand
class plan_standard_presentation_commands
class plan_standard_presentation_cleanup
class require_complete_presentation_profile
OpenCode Review Overview
Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment. |
2 participants
Buyer-visible boundary
This PR adds a pure Rust presentation-identity bounded context for explicit, internally consistent browser-visible profiles and credential-free replay digests. The active delta includes bounded presentation surfaces, fail-closed required-surface admission, bounded User-Agent Client Hints values including control-safe mobile model metadata, and privacy-oriented Canvas/WebGL/WebAudio/WebRTC normalization contracts.
This remains control-plane metadata. It does not inspect the host, patch Chromium, apply a profile to a browser, choose an evidence-free default identity, bypass CAPTCHA/bot-management/access controls, or prove that a page observes the requested values. A pinned real-Chromium adapter plus cross-surface pre-script/post-observation evidence remains required before browser-presentation compatibility can be claimed.
Current protected-main lineage
Protected
mainis exact87c4daa1830bac5a5228b6036752ad5633232085through #286. Exact current head is024f63690cf05cfe6f0d4a430f0e18ea8fd2c4d6, open, Ready, and mergeable. Fresh compare is 39 ahead / 0 behind with merge base exactly current protected main. The effective delta contains 29 product/docs/test paths and no.github/**, provider/model, secret, browser-launch, network-authority, ruleset, or coverage-denominator mutation.Current
024f636...is a non-destructive parent-adoption/reconciliation generation. The conflict was limited totests/test_presentation_identity_documentation_contract.py; the resolution preserves the earlier causal repair that checks exactly one stable presentation-identity changelog entry while separately pinning the truthful boundary that Chromium application and page-observed effectiveness remain future adapter/browser-E2E work.Hosted repository-contract RED and causal repair
Exact predecessor
7aa30c57a4af724eb4e601c52c1eaf68f27d1712received hosted CI33890032169: Production coverage succeeded while Rust contracts failed in Python repository contracts before formatting/Rust/Clippy/rustdoc. The failing contract had frozen an older complete CHANGELOG sentence and rejected a valid newer product fact. Commit3772d6eddfd556b24397afc80780ef3cc980791emade the narrow repair: require exactly one presentation-identity entry by stable feature prefix and independently require the exact non-shipment suffix. The browser-application boundary therefore cannot silently disappear when the product description gains a truthful new fact.Exact-current hosted evidence
The first CI emitted by the Ready transition on this exact head,
33930571288, completed skipped under the #286 lifecycle behavior and remains diagnostic evidence only. A subsequent ordinary synchronize on the unchanged Ready head materialized terminal current-head evidence:33930580462: success;33930571275: success;33930571261: success;33930571229: failure.The CodeQL failure is the same organization central-dispatch/verdict control-plane pattern seen on #50 and #37, not an observed presentation-identity source finding. Detect-languages job
101208143940succeeded. Javascript-typescript101241595259, actions101241595274, and python101241595306each successfully requested current-head scan dispatch and then failed atRelease runner or enforce current-head CodeQL verdict. The exact recurrence is handed to canonical organization issueContextualWisdomLab/.github#712in comment5555411125. Keep the repository leaf fail-closed and do not substitute the skipped Ready-transition run, duplicate central scanning, or blind-rerun the unchanged head.All currently returned inline review threads are resolved. Exact-current eligible independent approval and live ruleset satisfaction remain separate; no predecessor, skipped, absent, model-only, author-only, or status-only result is promoted to passing acceptance.
Product truth and next slice
The presentation-identity kernel is active-PR evidence, not protected-main shipment and not proof of Chromium/page-observed behavior. The next buyer-visible boundary remains a real Chromium adapter that deterministically applies an admitted profile before page script execution, observes the declared surfaces from the page, verifies the post-condition rather than treating protocol acknowledgement as success, and proves crash/cleanup/security behavior on a pinned Chromium generation. No separate open PR currently owns that adapter slice, but it should not be rushed ahead of the governed browser/runtime prerequisites or used to duplicate Chromium/policy authority already owned elsewhere in OriginWeave.
Protected-main
AGENTS.mdand live governance remain authoritative. Keep Ready but unmerged until central verdict/review/ruleset gates are satisfied. This scheduled product lane does not merge, self-approve, bypass, force-push, destructively rebase, alter workflows/rulesets/secrets, weaken checks, tag, release, or publish.Summary by CodeRabbit
새 기능
문서
테스트