feat(network): admit and compare typed-text postconditions

AGENTS.md

@@ -81,6 +81,8 @@ The organization currently documents a **solo-maintainer** governance condition.
 
 ## Testing expectations
 
+For an ACK coverage deficit, trace every pre-consumption guard and the lower correlation result before adding tests. Remove a duplicate post-check only when the same validated envelope and exact-id correlation make its failure impossible. Cover reachable malformed, event, remote-error, wrong-id and foreign-connection paths with real receipts, assert pending-state counts, and compare opaque diagnostics without exposing text. Keep reusable test helpers public only within integration-test crates; never widen production provenance access to make a fixture compile.
+
 Use realistic cases, including:
 
 - malformed origins, IPv4/IPv6 loopback, user information, paths, ports, and Unicode/control input;

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ## [Unreleased]
 
+- Strengthened text-entry acknowledgment checks with real-connection regression tests for unrelated replies, malformed responses and private diagnostics; removed a redundant check without changing pending-request protection.
+
+- Reject field-value replies received on a replacement connection, even when their request identifier and text match.
+
 - Reject field-observation requests on another browser session and preserve pending requests only when a write may have reached the peer.
 
 - Preserve fixed field-observation checks while adopting current input safeguards; constructing a request still does not verify that the field changed.
@@ -97,6 +101,7 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Registry-issued admitted node handles and authority-bound WebDriver BiDi pointer-click construction that revalidate the exact session, context, canonical origin, document epoch, registry provenance, and retained `sharedId` before serializing `input.performActions`; caller-constructed node tuples or arbitrary wire identifiers cannot become typed-input authority, and the command itself grants no policy or Agent authority.
 - Node-bound WebDriver BiDi text input that revalidates the exact session, browsing context, canonical origin, current document epoch, registry-issued node provenance, and admitted `sharedId` before serializing bounded protocol-safe non-secret `input.performActions`; the command focuses the admitted element before keyboard input, and its diagnostic representation exposes only command metadata and text byte length rather than typed text or the serialized wire payload.
 - Fixed sandboxed text-value observation for an admitted current node, with product-owned `script.callFunction` source and no generic script surface; transport correlation and observed post-condition comparison remain separate active-stack work.
+- Typed text-value post-condition verification that admits only the exact correlated observation response, compares it with the already-authorized expected text, discards page-controlled text, and reports mismatch without treating command acknowledgement as success.
 - Fail-closed rejection of reviewed Unicode format and bidirectional-override characters in accessibility roles, accessible names, BiDi `sharedId` values, and registry external identifiers, while ordinary spaces in accessible names remain valid.
 - Credential-safe browser-protocol validation evidence that copies only the already validated protocol family, OriginWeave generation, adapter version, pinned protocol/browser revisions, and exact capability into cloneable audit metadata without recreating the non-cloneable validation prerequisite or granting browser/Agent authority.
 - Canonical HTTPS and loopback-origin boundary with case-normalized schemes and hosts, default-port normalization, IPv4/IPv6 handling, browser-special numeric-host rejection, and explicit malformed-input errors.

crates/originweave-network/src/lib.rs

@@ -10,7 +10,10 @@
 //! binds received fragmented text to one exact verified connection, classifies
 //! complete local-end JSON envelopes, tracks bounded command-response correlation,
 //! transports narrowly typed pointer-click and node-bound non-secret text-input
-//! actions and fixed sandboxed text-value observations, admits typed correlated protocol responses, sends a context-bound committed-navigation subscription and retains
+//! actions and fixed sandboxed text-value observations, admits typed correlated
+//! protocol responses, binds positive text-value evidence to a sender-minted
+//! acknowledged typed-input intent, sends a context-bound committed-navigation
+//! subscription and retains
 //! its typed bounded correlated identifier, binds navigation-event admission to
 //! that active command/receipt lifecycle with bounded fail-closed navigation replay
 //! prevention, explicitly unsubscribes that exact
@@ -49,7 +52,10 @@ mod webdriver_bidi_session_end_response;
 mod webdriver_bidi_session_status_command;
 mod webdriver_bidi_session_status_response;
 mod webdriver_bidi_session_teardown;
+mod webdriver_bidi_text_value_observation_response;
 mod webdriver_bidi_text_value_observation_transport;
+mod webdriver_bidi_text_value_postcondition;
+mod webdriver_bidi_type_text_intent;
 mod webdriver_bidi_type_text_response;
 mod webdriver_bidi_type_text_transport;
 mod webdriver_bidi_websocket_frame;
@@ -60,6 +66,8 @@ mod webdriver_bidi_websocket_transport_closure;
 
 #[cfg(test)]
 mod webdriver_bidi_json_envelope_public_boundary_tests;
+#[cfg(test)]
+mod webdriver_bidi_text_value_observation_public_boundary_tests;
 
 pub use connection::{
     ConnectionPlan, DirectTcpConnection, MAX_CONNECT_TIMEOUT, MAX_CONNECTION_ATTEMPTS,
@@ -147,9 +155,22 @@ pub use webdriver_bidi_session_teardown::{
     WebDriverBiDiSessionTeardownAssessment, WebDriverBiDiSessionTeardownAssessmentError,
     WebDriverBiDiSessionTeardownDisposition, WebDriverBiDiSessionTeardownObservations,
 };
+pub use webdriver_bidi_text_value_observation_response::{
+    WebDriverBiDiTextValueObservationProjectionError,
+    WebDriverBiDiTextValueObservationResponseError, WebDriverBiDiTextValueObservationResult,
+};
 pub use webdriver_bidi_text_value_observation_transport::{
     WebDriverBiDiTextValueObservationSendError, send_webdriver_bidi_text_value_observation,
 };
+pub use webdriver_bidi_text_value_postcondition::{
+    WebDriverBiDiTextValuePostcondition, WebDriverBiDiTextValuePostconditionError,
+    verify_webdriver_bidi_text_value_postcondition,
+};
+pub use webdriver_bidi_type_text_intent::{
+    WebDriverBiDiAcknowledgedTypeTextIntent, WebDriverBiDiTypeTextIntentAcknowledgementError,
+    WebDriverBiDiTypeTextIntentWitness, acknowledge_webdriver_bidi_type_text_intent,
+    send_webdriver_bidi_type_text_with_postcondition_intent,
+};
 pub use webdriver_bidi_type_text_response::{
     WebDriverBiDiTypeTextResponseError, WebDriverBiDiTypeTextResult,
 };

crates/originweave-network/src/webdriver_bidi_text_value_observation_public_boundary_tests.rs

@@ -0,0 +1,208 @@
+use std::{
+    error::Error,
+    io::{self, Read, Write},
+    net::{TcpListener, TcpStream},
+    thread,
+    time::Duration,
+};
+
+use originweave_core::WebDriverBiDiWebSocketEndpoint;
+
+use crate::{
+    WebDriverBiDiCommandCorrelation, WebDriverBiDiCommandKind, WebDriverBiDiConnectionMessageRead,
+    WebDriverBiDiReceivedTextMessage, WebDriverBiDiTcpConnectionPlan,
+    WebDriverBiDiTextValueObservationResponseError, WebDriverBiDiTextValueObservationResult,
+    WebDriverBiDiWebSocketClientKey, WebDriverBiDiWebSocketHandshakePlan,
+    WebDriverBiDiWebSocketMessageReader,
+};
+
+const SESSION_ID: &str = "01234567-89ab-cdef-0123-456789abcdef";
+const RFC6455_SAMPLE_KEY: &str = "dGhlIHNhbXBsZSBub25jZQ==";
+const OPENING_RESPONSE: &[u8] = b"HTTP/1.1 101 Switching Protocols\r\nUpgrade: websocket\r\nConnection: Upgrade\r\nSec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=\r\n\r\n";
+const ERROR_UNKNOWN_COMMAND: &[u8] =
+    br#"{"type":"error","id":71,"error":"unknown error","message":"remote failure"}"#;
+const MALFORMED_PROJECTION: &[u8] = br#"{"type":"success","id":70,"result":{"type":"success","result":{"type":"string","value":"expected"}}}"#;
+const SUCCESS_UNKNOWN_COMMAND: &[u8] = br#"{"type":"success","id":72,"result":{"type":"success","realm":"realm-1","result":{"type":"string","value":"expected"}}}"#;
+const FINAL_EXPECTED_TEXT: &str = "Quarterly review";
+const VALID_SUCCESS: &[u8] = br#"{"type":"success","id":70,"result":{"type":"success","realm":"realm-1","result":{"type":"string","value":"Quarterly review"}}}"#;
+
+fn read_opening_request(stream: &mut TcpStream) -> io::Result<()> {
+    stream.set_read_timeout(Some(Duration::from_secs(2)))?;
+    let mut request = Vec::new();
+    let mut buffer = [0_u8; 512];
+    while !request.ends_with(b"\r\n\r\n") {
+        let count = stream.read(&mut buffer)?;
+        if count == 0 {
+            return Err(io::Error::new(
+                io::ErrorKind::UnexpectedEof,
+                "client opening request ended before the header terminator",
+            ));
+        }
+        request.extend_from_slice(&buffer[..count]);
+    }
+    Ok(())
+}
+
+fn write_unmasked_text_frame(stream: &mut TcpStream, document: &[u8]) -> io::Result<()> {
+    if document.len() <= 125 {
+        let length = u8::try_from(document.len()).map_err(|_| {
+            io::Error::new(io::ErrorKind::InvalidData, "short frame length exceeds u8")
+        })?;
+        stream.write_all(&[0x81, length])?;
+    } else {
+        let length = u16::try_from(document.len()).map_err(|_| {
+            io::Error::new(
+                io::ErrorKind::InvalidData,
+                "unit JSON document exceeds two-byte frame length",
+            )
+        })?;
+        stream.write_all(&[0x81, 126])?;
+        stream.write_all(&length.to_be_bytes())?;
+    }
+    stream.write_all(document)
+}
+
+fn read_text_over_loopback(
+    document: &'static [u8],
+    correlation: Option<&mut WebDriverBiDiCommandCorrelation>,
+) -> Result<WebDriverBiDiReceivedTextMessage, Box<dyn Error>> {
+    let listener = TcpListener::bind(("127.0.0.1", 0))?;
+    let local_addr = listener.local_addr()?;
+    let server = thread::spawn(move || -> io::Result<()> {
+        let (mut stream, _) = listener.accept()?;
+        read_opening_request(&mut stream)?;
+        stream.write_all(OPENING_RESPONSE)?;
+        write_unmasked_text_frame(&mut stream, document)
+    });
+
+    let endpoint = format!("ws://{local_addr}/session/{SESSION_ID}");
+    let target = WebDriverBiDiWebSocketEndpoint::new(&endpoint)?
+        .correlate_session_id(SESSION_ID)?
+        .into_explicit_connect_target()?;
+    let connection =
+        WebDriverBiDiTcpConnectionPlan::new(target, Duration::from_secs(1), 1)?.connect()?;
+    let established = WebDriverBiDiWebSocketHandshakePlan::new(
+        connection,
+        WebDriverBiDiWebSocketClientKey::new(RFC6455_SAMPLE_KEY)?,
+    )?
+    .write_opening_request(Duration::from_millis(500))?
+    .read_opening_response(Duration::from_millis(500))?;
+    if let Some(correlation) = correlation {
+        correlation.register_command_for_connection(
+            70,
+            WebDriverBiDiCommandKind::TextValueObservation,
+            established.transport_evidence().connection_generation(),
+        )?;
+    }
+    let text = match WebDriverBiDiWebSocketMessageReader::new(established)
+        .read_next(Duration::from_millis(500))?
+    {
+        WebDriverBiDiConnectionMessageRead::Text { message, .. } => message,
+        other => {
+            return Err(io::Error::other(format!(
+                "validated text frame produced unexpected assembly state: {other:?}"
+            ))
+            .into());
+        }
+    };
+
+    server
+        .join()
+        .map_err(|_| io::Error::other("text-value unit server panicked"))??;
+    Ok(text)
+}
+
+#[test]
+fn public_text_value_boundary_covers_error_adapters_and_credential_safe_result()
+-> Result<(), Box<dyn Error>> {
+    let mut correlation = WebDriverBiDiCommandCorrelation::new();
+    correlation.register_command_for(70, WebDriverBiDiCommandKind::TextValueObservation)?;
+
+    let invalid = read_text_over_loopback(b"not-json", None)?;
+    let envelope_result = WebDriverBiDiTextValueObservationResult::parse_correlate_and_compare(
+        &invalid,
+        "expected",
+        &mut correlation,
+    );
+    assert!(matches!(
+        &envelope_result,
+        Err(WebDriverBiDiTextValueObservationResponseError::Envelope { .. })
+    ));
+    assert_eq!(
+        envelope_result
+            .as_ref()
+            .err()
+            .map(ToString::to_string)
+            .as_deref(),
+        Some("WebDriver BiDi text-value observation envelope is invalid")
+    );
+    assert_eq!(correlation.outstanding_count(), 1);
+
+    let error_unknown = read_text_over_loopback(ERROR_UNKNOWN_COMMAND, None)?;
+    assert!(matches!(
+        WebDriverBiDiTextValueObservationResult::parse_correlate_and_compare(
+            &error_unknown,
+            "expected",
+            &mut correlation,
+        ),
+        Err(WebDriverBiDiTextValueObservationResponseError::Correlation { .. })
+    ));
+    assert_eq!(correlation.outstanding_count(), 1);
+
+    let malformed_projection = read_text_over_loopback(MALFORMED_PROJECTION, None)?;
+    let projection_result = WebDriverBiDiTextValueObservationResult::parse_correlate_and_compare(
+        &malformed_projection,
+        "expected",
+        &mut correlation,
+    );
+    assert!(matches!(
+        &projection_result,
+        Err(WebDriverBiDiTextValueObservationResponseError::Projection { .. })
+    ));
+    assert_eq!(
+        projection_result
+            .as_ref()
+            .err()
+            .map(ToString::to_string)
+            .as_deref(),
+        Some("WebDriver BiDi text-value observation result is invalid")
+    );
+    assert_eq!(correlation.outstanding_count(), 1);
+
+    let success_unknown = read_text_over_loopback(SUCCESS_UNKNOWN_COMMAND, None)?;
+    let correlation_result = WebDriverBiDiTextValueObservationResult::parse_correlate_and_compare(
+        &success_unknown,
+        "expected",
+        &mut correlation,
+    );
+    assert!(matches!(
+        &correlation_result,
+        Err(WebDriverBiDiTextValueObservationResponseError::Correlation { .. })
+    ));
+    assert_eq!(
+        correlation_result
+            .as_ref()
+            .err()
+            .map(ToString::to_string)
+            .as_deref(),
+        Some("WebDriver BiDi text-value observation response correlation failed")
+    );
+    assert_eq!(correlation.outstanding_count(), 1);
+
+    correlation.retire_command_for(70, WebDriverBiDiCommandKind::TextValueObservation)?;
+    let valid_success = read_text_over_loopback(VALID_SUCCESS, Some(&mut correlation))?;
+    let result = WebDriverBiDiTextValueObservationResult::parse_correlate_and_compare(
+        &valid_success,
+        FINAL_EXPECTED_TEXT,
+        &mut correlation,
+    )?;
+    assert_eq!(result.command_id(), 70);
+    assert_eq!(result.observed_text_bytes(), FINAL_EXPECTED_TEXT.len());
+    assert!(result.matches_expected_text());
+    assert_eq!(correlation.outstanding_count(), 0);
+
+    let debug = format!("{result:?}");
+    assert!(debug.contains("WebDriverBiDiTextValueObservationResult"));
+    assert!(!debug.contains(FINAL_EXPECTED_TEXT));
+    Ok(())
+}