feat(network): send bounded WebDriver BiDi session.status command

CHANGELOG.md

@@ -7,6 +7,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 ### Added
 
 - Bounded RFC 6455 WebDriver BiDi opening-response validation on the exact peer-verified stream: it admits only HTTP/1.1 `101`, case-insensitive `Upgrade`/`Connection` tokens, and the client-key-correlated `Sec-WebSocket-Accept` value within monotonic time and header-size ceilings; it restores blocking mode and still does not implement WebSocket frames or grant browser/Agent authority.
+- Typed outbound WebDriver BiDi `session.status` over the bounded client WebSocket stream: it serializes only the standards-defined method with empty params, preserves exact typed command-id correlation, rejects invalid frame deadlines before registration, retires only the just-registered id when a local masking-key preflight proves no command bytes were emitted, and keeps correlation outstanding after partial or ambiguous writes; frame-write success is not treated as command completion or browser/Agent authority.
 - Bounded WebDriver BiDi loopback TCP transport that consumes one exact no-DNS connect target, retries only explicitly recoverable local transport failures within repository timeout and attempt ceilings, exposes the stream only after operating-system peer inspection and exact peer verification, supports a consuming handoff of the original stream with typed credential-free peer/session/TLS and bounded-attempt evidence, preserves typed causal errors, and performs no DNS, proxy/PAC, process authentication, TLS, WebSocket, BiDi message, browser-action, or Agent-authority step.
 - Exact WebDriver BiDi socket-peer verification that consumes an approved no-DNS connect target, requires the observed IP address and port to match exactly, preserves the TLS requirement and exact correlated session id, and remains inert metadata that does not authenticate an OS process, does not negotiate TLS, perform a WebSocket handshake, or grant Agent authority.
 - Explicit no-DNS WebDriver BiDi loopback connection targets that derive exact IPv4/IPv6 loopback `SocketAddr` metadata from a session-correlated endpoint, reject `localhost` as requiring separately trusted name resolution, preserve the TLS requirement and exact session id, perform no socket I/O, and grant no Agent authority.
@@ -55,7 +56,9 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ### Changed
 
+- Kept the `session.status` frame-failure coverage contract focused on observable correlation state, avoiding assertion-internal uncovered branches without weakening preflight retirement or ambiguous-write retention checks.
 - Made the command-correlation release-record check run in the existing CI test suite, preserving its exact bounds and authority exclusions; carried the verified message-parent fixture repairs into the correlation stack.
+- Carried the verified parent fixture and release-check repairs into the session-status sender without changing command or correlation behavior.
 - Aligned the bounded WebDriver BiDi error-envelope vocabulary with the current specification by admitting the defined `no such client window` response while retaining fail-closed rejection of unknown error codes.
 - Separated logical origin authority from resolved network destination authority; an origin grant no longer implies permission to connect to every resolver result.
 - Separated resolved-address authorization from direct transport evidence; an approved IP now becomes a usable stream only after the operating system reports the exact requested IP and port.

crates/originweave-network/src/lib.rs

@@ -7,9 +7,10 @@
 //! `originweave-core` into one bounded exact TCP connection, binds and validates
 //! the RFC 6455 opening exchange, provides bounded masked client writes and
 //! unmasked server-frame reads, assembles bounded WebDriver BiDi text messages,
-//! classifies complete local-end JSON envelopes, and tracks bounded command-response
-//! correlation without exposing generic JSON bodies or granting browser, TLS,
-//! policy, secret, or Agent authority.
+//! classifies complete local-end JSON envelopes, tracks bounded command-response
+//! correlation, and sends one narrowly typed `session.status` command without
+//! exposing generic JSON bodies or granting browser, TLS, policy, secret, or
+//! Agent authority.
 
 #![forbid(unsafe_code)]
 #![deny(missing_docs)]
@@ -18,6 +19,7 @@ mod connection;
 mod webdriver_bidi_command_correlation;
 mod webdriver_bidi_connection;
 mod webdriver_bidi_json_envelope;
+mod webdriver_bidi_session_status_command;
 mod webdriver_bidi_websocket_frame;
 mod webdriver_bidi_websocket_handshake;
 mod webdriver_bidi_websocket_message;
@@ -44,6 +46,9 @@ pub use webdriver_bidi_json_envelope::{
     MAX_WEBDRIVER_BIDI_JS_UINT, MAX_WEBDRIVER_BIDI_JSON_DEPTH, WebDriverBiDiJsonEnvelope,
     WebDriverBiDiJsonEnvelopeError, WebDriverBiDiJsonEnvelopeKind,
 };
+pub use webdriver_bidi_session_status_command::{
+    WebDriverBiDiSessionStatusCommand, WebDriverBiDiSessionStatusCommandError,
+};
 pub use webdriver_bidi_websocket_frame::{
     MAX_WEBSOCKET_FRAME_PAYLOAD_SIZE, MAX_WEBSOCKET_FRAME_TIMEOUT,
     WebDriverBiDiWebSocketEstablished, WebDriverBiDiWebSocketFrame,

crates/originweave-network/src/webdriver_bidi_command_correlation.rs

@@ -2,6 +2,7 @@ use std::{collections::BTreeMap, error::Error, fmt};
 
 use crate::{
     MAX_WEBDRIVER_BIDI_JS_UINT, WebDriverBiDiJsonEnvelope, WebDriverBiDiJsonEnvelopeRouting,
+    webdriver_bidi_connection::WebDriverBiDiConnectionGeneration,
 };
 
 /// Maximum number of local WebDriver BiDi commands retained as outstanding at once.
@@ -25,6 +26,12 @@ pub enum WebDriverBiDiCommandKind {
     SessionEnd,
 }
 
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+struct OutstandingCommand {
+    kind: WebDriverBiDiCommandKind,
+    connection_generation: Option<WebDriverBiDiConnectionGeneration>,
+}
+
 /// Outcome of a response after it has consumed the matching outstanding command identifier.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum WebDriverBiDiCorrelatedResponseOutcome {
@@ -36,12 +43,16 @@ pub enum WebDriverBiDiCorrelatedResponseOutcome {
 
 /// Credential-free evidence that one parsed response consumed one outstanding local command.
 ///
-/// This value carries only the matched command identifier and success/error classification. It
-/// does not retain result bodies, error text, browser authority, transport authority, or secrets.
+/// This value carries only the matched command identifier and success/error classification. A
+/// private process-local connection generation is retained when the command owner bound one before
+/// I/O so a later response-provenance owner can compare transport evidence without accepting
+/// caller-supplied provenance. It does not retain result bodies, error text, browser authority,
+/// transport authority, or secrets.
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct WebDriverBiDiCorrelatedResponse {
     command_id: u64,
     outcome: WebDriverBiDiCorrelatedResponseOutcome,
+    connection_generation: Option<WebDriverBiDiConnectionGeneration>,
 }
 
 impl WebDriverBiDiCorrelatedResponse {
@@ -76,6 +87,16 @@ pub enum WebDriverBiDiCommandCorrelationError {
         /// Command family actually registered for the outstanding identifier.
         actual: WebDriverBiDiCommandKind,
     },
+    /// A connection-bound consumer found an outstanding command with no connection provenance.
+    CommandConnectionProvenanceMissing {
+        /// Exact outstanding local command identifier.
+        command_id: u64,
+    },
+    /// The response was received on a different verified connection from the outstanding command.
+    ResponseConnectionMismatch {
+        /// Exact outstanding local command identifier left untouched after rejection.
+        command_id: u64,
+    },
     /// An event is not a command response and cannot consume correlation state.
     EventIsNotResponse,
     /// A protocol error with a `null` id cannot be attributed to one outstanding command.
@@ -92,6 +113,12 @@ impl fmt::Display for WebDriverBiDiCommandCorrelationError {
             Self::CommandKindMismatch { .. } => {
                 "WebDriver BiDi response command kind does not match the outstanding command"
             }
+            Self::CommandConnectionProvenanceMissing { .. } => {
+                "WebDriver BiDi outstanding command lacks connection provenance"
+            }
+            Self::ResponseConnectionMismatch { .. } => {
+                "WebDriver BiDi response arrived on a different connection"
+            }
             Self::EventIsNotResponse => "WebDriver BiDi event cannot be correlated as a response",
             Self::UncorrelatableErrorResponse => {
                 "WebDriver BiDi error response has no correlatable command id"
@@ -106,14 +133,16 @@ impl Error for WebDriverBiDiCommandCorrelationError {}
 /// Bounded local WebDriver BiDi command-response correlation state.
 ///
 /// Register an id together with its exact typed command family only after the caller has committed
-/// to that outbound command. A success or correlatable error response consumes the id exactly once
-/// only through a matching typed consumer. Events, null-id errors, and command-kind mismatches leave
-/// outstanding state untouched. This type performs no I/O, retry, command serialization, browser
-/// authentication, or authority grant. Debug output reports only the outstanding-count summary;
-/// command identifiers and command families remain private correlation state.
+/// to that outbound command. Connection-owning command adapters may additionally bind the private
+/// generation of the exact established transport before I/O. Generic success or correlatable error
+/// responses consume the id exactly once through a matching typed consumer; a later slice that owns
+/// received-connection evidence adds the connection-sensitive consuming boundary. This type
+/// performs no I/O, retry, command serialization, browser authentication, or authority grant. Debug
+/// output reports only the outstanding-count summary; command identifiers, families, and
+/// generations remain private correlation state.
 #[derive(Default)]
 pub struct WebDriverBiDiCommandCorrelation {
-    outstanding: BTreeMap<u64, WebDriverBiDiCommandKind>,
+    outstanding: BTreeMap<u64, OutstandingCommand>,
 }
 
 impl fmt::Debug for WebDriverBiDiCommandCorrelation {
@@ -147,6 +176,24 @@ impl WebDriverBiDiCommandCorrelation {
         &mut self,
         command_id: u64,
         command_kind: WebDriverBiDiCommandKind,
+    ) -> Result<(), WebDriverBiDiCommandCorrelationError> {
+        self.register(command_id, command_kind, None)
+    }
+
+    pub(crate) fn register_command_for_connection(
+        &mut self,
+        command_id: u64,
+        command_kind: WebDriverBiDiCommandKind,
+        connection_generation: WebDriverBiDiConnectionGeneration,
+    ) -> Result<(), WebDriverBiDiCommandCorrelationError> {
+        self.register(command_id, command_kind, Some(connection_generation))
+    }
+
+    fn register(
+        &mut self,
+        command_id: u64,
+        command_kind: WebDriverBiDiCommandKind,
+        connection_generation: Option<WebDriverBiDiConnectionGeneration>,
     ) -> Result<(), WebDriverBiDiCommandCorrelationError> {
         if command_id > MAX_WEBDRIVER_BIDI_JS_UINT {
             return Err(WebDriverBiDiCommandCorrelationError::CommandIdOutOfRange);
@@ -157,7 +204,13 @@ impl WebDriverBiDiCommandCorrelation {
         if self.outstanding.len() >= MAX_WEBDRIVER_BIDI_OUTSTANDING_COMMANDS {
             return Err(WebDriverBiDiCommandCorrelationError::OutstandingCommandLimit);
         }
-        let _previous = self.outstanding.insert(command_id, command_kind);
+        let _previous = self.outstanding.insert(
+            command_id,
+            OutstandingCommand {
+                kind: command_kind,
+                connection_generation,
+            },
+        );
         Ok(())
     }
 
@@ -179,7 +232,8 @@ impl WebDriverBiDiCommandCorrelation {
     ///
     /// Successful responses and error responses with ids consume exactly one matching command.
     /// Unknown ids and command-kind mismatches fail without consuming state. Events and null-id
-    /// errors fail before touching the map.
+    /// errors fail before touching the map. This generic path does not claim received-connection
+    /// provenance; connection-sensitive response handling belongs to its owning child slice.
     pub fn correlate_response_for(
         &mut self,
         envelope: &WebDriverBiDiJsonEnvelope,
@@ -211,19 +265,19 @@ impl WebDriverBiDiCommandCorrelation {
         &self,
         command_id: u64,
         expected_kind: WebDriverBiDiCommandKind,
-    ) -> Result<(), WebDriverBiDiCommandCorrelationError> {
+    ) -> Result<OutstandingCommand, WebDriverBiDiCommandCorrelationError> {
         let actual = self
             .outstanding
             .get(&command_id)
             .copied()
             .ok_or(WebDriverBiDiCommandCorrelationError::CommandNotOutstanding)?;
-        if actual != expected_kind {
+        if actual.kind != expected_kind {
             return Err(WebDriverBiDiCommandCorrelationError::CommandKindMismatch {
                 expected: expected_kind,
-                actual,
+                actual: actual.kind,
             });
         }
-        Ok(())
+        Ok(actual)
     }
 
     fn complete(
@@ -232,11 +286,12 @@ impl WebDriverBiDiCommandCorrelation {
         expected_kind: WebDriverBiDiCommandKind,
         outcome: WebDriverBiDiCorrelatedResponseOutcome,
     ) -> Result<WebDriverBiDiCorrelatedResponse, WebDriverBiDiCommandCorrelationError> {
-        self.require_command_kind(command_id, expected_kind)?;
+        let outstanding = self.require_command_kind(command_id, expected_kind)?;
         let _removed = self.outstanding.remove(&command_id);
         Ok(WebDriverBiDiCorrelatedResponse {
             command_id,
             outcome,
+            connection_generation: outstanding.connection_generation,
         })
     }
 }
@@ -271,6 +326,16 @@ mod tests {
                 },
                 "WebDriver BiDi response command kind does not match the outstanding command",
             ),
+            (
+                WebDriverBiDiCommandCorrelationError::CommandConnectionProvenanceMissing {
+                    command_id: 7,
+                },
+                "WebDriver BiDi outstanding command lacks connection provenance",
+            ),
+            (
+                WebDriverBiDiCommandCorrelationError::ResponseConnectionMismatch { command_id: 7 },
+                "WebDriver BiDi response arrived on a different connection",
+            ),
             (
                 WebDriverBiDiCommandCorrelationError::EventIsNotResponse,
                 "WebDriver BiDi event cannot be correlated as a response",