test(browser): stage controlled Agent Task without workflow mutation

CHANGELOG.md

@@ -4,8 +4,25 @@ All notable changes to OriginWeave are documented in this file. The format follo
 
 ## [Unreleased]
 
+- Keep WebDriver remote HTTP bodies, W3C error/message text, last-response startup detail, and mismatched remote `browserVersion` capability values out of CI exception strings while preserving fail-closed command/readiness/version decisions and the response-size bound.
+- Publish success-shaped MV3/Agent Task compatibility JSON only after both owned loopback fixture servers complete their shutdown post-conditions; browser/trial gate failures still emit bounded diagnostic evidence before raising.
+- Require loopback fixture-server cleanup to observe helper-thread termination after the bounded join, so a timed join cannot be treated as cleanup success while an owned server thread remains live.
+- Require the controlled Agent Task lane to observe an empty input `value` after native WebDriver Element Clear and before Send Keys, so clear command acknowledgement cannot substitute for browser-observed action evidence.
+- Require the controlled Agent Task lane to read the browser-observed input value after native WebDriver typing and before click, so send-keys command acknowledgement cannot substitute for evidence that the synthetic input actually reached the controlled field.
+- Require controlled Agent Task success to re-observe the browser URL after submitted-state and exact-echo verification, so URL stability is proven through the accepted outcome boundary rather than only immediately after click.
+- Require the controlled Agent Task lane to observe the canonical idle result baseline before native clear/type/click and to carry that baseline witness into repeatability surface completeness, preventing a pre-fired fixture from being accepted as an action-caused success.
+- Separate Agent Task extension-isolation launch intent from verified browser surfaces: `--disable-extensions` is recorded as requested configuration only and no longer counts toward observed success completeness.
+- Keep page-derived browser post-condition text, observed URLs, and extension/page datasets out of CI exception payloads while preserving their local comparison role and fail-closed browser evidence semantics.
 - Refreshed the product-gap queue to 126 open pull requests (54 ready, 72 draft) after #190, #188, #185, #192, #182, #184, #115, #181, #116, #117, #118, #183, #114, #127, #112, #109, #186, #110, #108, #111, #174, and #113 were merged into their immediate stacked prerequisites. PRs #147, #146, #145, #144, #143, #142, #141, #139, #136, #132, #129, and #128 moved to ready after exact-head checks and thread review; these are queue-consolidation results, not protected-main shipment.
 
+- Classified bounded WebDriver HTTP cleanup failures, including truncated responses, as typed cleanup evidence while preserving the primary browser error.
+- Record truncated WebDriver trial responses as bounded failed-trial evidence instead of aborting the complete MV3 compatibility run.
+- Close the first pinned-Chrome fixture server when startup of the second server fails, and attempt both shutdowns when one cleanup fails, preventing partial compatibility runs from leaking loopback server threads.
+- The fixture-shutdown contract now exercises successful MV3 and Agent Task trial paths before asserting reverse-order server cleanup.
+- The fixture-shutdown success double now includes both browser-computed semantic verification surfaces, so cleanup failures cannot mask incomplete Agent Task evidence.
+- Preserve Chromium's process sandbox in the controlled Agent Task evidence lane by removing that lane's `--no-sandbox` launch argument after a test-first source contract reproduced the defect; sandbox-enabled pinned-browser exact-head execution remains required before the repaired lane is promoted to security evidence.
+- Classify Agent Task browser-session startup failures in credential-free trial evidence without exposing ChromeDriver text; this fixture evidence does not claim a shipped OriginWeave browser adapter.
+- Keep Chrome for Testing sandbox-helper installation in the separately governed workflow activation; this workflow-free slice does not claim hosted sandbox execution.
 ### Added
 - Corrected the 2026-08-26 product-gap snapshot with current #229 presentation-identity evidence, stacked-only #205 integration evidence, current base/head pairs, the 126-PR queue count, explicit root-versus-child merge ordering, and the active GitHub counted-approval gate.
 - Refreshed the product and technical gap baseline onto the 2026-08-26 live inventory: 126 open pull requests (54 ready, 72 draft), protected-main promotion of #168/#194/#196/#216/#151, a verified maintenance-loop record (supersession closure of #153, conflict reconciliations on #37/#149/#152/#173/#175, issue #212 option-(b) authorization on #43, Strix vuln-0001 homoglyph remediation on #124), provider-rerun outcome evidence, an organization review-pipeline congestion record, and refreshed merge-order queue guidance. Documentation evidence contracts were aligned to the same snapshot so the baseline, its dated markers, and the pinned exact-head rows cannot silently diverge.
@@ -36,6 +53,8 @@ All notable changes to OriginWeave are documented in this file. The format follo
 - Real loopback TCP integration proof plus deterministic timeout, refusal, retry, peer-inspection, peer-mismatch, canonicalization, IPv6 metadata, and single-use replay tests.
 - Real loopback rustls integration covering trusted DNS SAN, Common-Name fallback rejection, wrong-name and untrusted-root rejection, fixed-time expiry and not-yet-valid failures, exact IPv4 and IPv6 SANs, TLS 1.2/TLS 1.3, required and optional ALPN, and transport-origin binding.
 - Cumulative interactive-first RAM, VRAM, batch, local-model, admission, pause, and compositor-pressure mitigation plans, including active-consumer reduction at exact hard limits.
+- Real pinned-Chrome WebDriver evidence for the controlled Agent Task fixture: the CI lane uses an isolated profile, requests extensions disabled as launch configuration, types and submits synthetic text, observes the same-document post-condition, and proves profile cleanup; extension disablement itself is not promoted to a verified browser surface without an independent observation. Predecessor sandbox-disabled success is compatibility evidence only until the repaired sandbox-enabled exact head executes successfully.
+- Active pinned-Chrome Agent Task evidence verifies browser-computed role/name for controlled input and submit targets before action; this remains test-harness semantic evidence and does not claim a product semantic observer or authority.
 - Universally value-redacted network evidence with explicit path, metadata, and provenance bounds; ambiguous path rejection; validated source URLs; lowercase SHA-256 identifiers; and verification state.
 - Versioned schema-bound extraction contracts with bounded identifiers and field counts, typed value/cardinality metadata, explicit duplicate-free reviewed source channels, fail-closed schema validation, and deterministic `Display`/`std::error::Error` contracts for public schema failures.
 - Rust 1.97.1 build contract, strict Clippy and rustdoc gates, and exact production function, line, region, and branch coverage enforcement.

docs/DOCUMENTATION_FITNESS.md

@@ -158,9 +158,9 @@ Active #64 makes a successful action-outcome value require existing verified pro
 
 ### 3.19 Controlled Agent Task fixture
 
-Active #65 supplies a deterministic synthetic local web fixture with a labelled semantic input, submit control, same-document post-condition and explicitly hidden/untrusted prompt-injection text. The fixture contains no credential collection surface and requires no live third-party site.
+Active #65 supplies a deterministic synthetic local web fixture with a labelled semantic input, submit control, same-document post-condition and explicitly hidden/untrusted prompt-injection text. Active #70 executes that fixture through real WebDriver on pinned Chrome with an isolated profile, an extension-disable launch request, synthetic input, same-document post-condition verification and profile cleanup. The launch request is recorded as configuration metadata and is not a verified browser surface without independent observation. If the second fixture server cannot start, the runner also closes the first one; cleanup attempts both servers even when one shutdown fails, so partial setup does not leak loopback threads. Active #71 verifies browser-computed role/name for the controlled input and submit button before action. The fixture contains no credential collection surface and requires no live third-party site.
 
-**Resolution:** the fixture makes the future real Chromium vertical slice reproducible without turning a third-party site into a test dependency. It is not a browser adapter, semantic extractor, input dispatcher, policy engine, trusted clock, process-attribution source or proof of real Chromium execution.
+**Resolution:** the #65/#70/#71 lane makes controlled browser-level and browser-computed role/name evidence reproducible without turning a third-party site into a test dependency. It is not a browser adapter, product semantic extractor, OriginWeave input-dispatch authority, policy engine, trusted clock, process-attribution source or proof of the shipped product runtime.
 
 ### 3.20 Bounded browser process-set resource evidence
 
@@ -273,4 +273,4 @@ The graph becomes **PROTECTED-MAIN-SUFFICIENT** only when:
 8. security, test, operability, privacy and release docs agree on shipped-vs-planned boundaries; and
 9. this documentation reconciliation itself reaches protected main through repository governance and is re-evaluated against whatever feature heads actually integrated.
 
-Until then, OriginWeave is **design-documented but not protected-main documentation-closed**. That finding must never be used as an excuse to stop unrelated safe implementation work.
+Until then, OriginWeave is **design-documented but not protected-main documentation-closed**. That finding must never be used as an excuse to stop unrelated safe implementation work.

docs/TEST_STRATEGY.md

@@ -78,6 +78,45 @@ session creation
 -> task close/recovery
 ```
 
+Draft PR #288 carries the current controlled Agent Task fixture lane on pinned
+Chrome for Testing without owning the workflow that activates Chromium. The lane
+uses browser-computed role/name evidence, real WebDriver clear/type/click,
+browser-observed input state, URL-stability observation, exact synthetic echo and
+profile cleanup. The controlled input deliberately starts with a non-empty
+synthetic value, so the lane requires Element Clear to be followed by a browser
+Get Element Property observation proving `value == ""` before Send Keys. It then
+requires a second Get Element Property observation proving the synthetic typed
+value after Send Keys and before click. A successful command acknowledgement for
+either input action is insufficient.
+
+The lane also requires a browser-observed `#task-result` baseline
+(`data-state=idle` and rendered `idle`) before clear/type, and observes the same
+idle result baseline again after typing and submit-target semantic verification,
+immediately before the native click. Successful evidence therefore carries
+`pre_action_baseline_verified`, `clear_value_verified`, `input_value_verified`,
+and `pre_click_baseline_verified`; all four are mandatory in repeatability surface
+completeness. This prevents a pre-fired fixture, a no-op or incomplete clear, a
+failed/partial send-keys operation accepted only from command ACK, or a regression
+that pre-satisfies the post-condition during typing from being accepted as
+click-caused success.
+
+URL stability is sampled immediately after the native click and again only after
+the submitted-state and exact synthetic-echo post-condition has been observed.
+The trial may emit `url_unchanged: true` only when both observations equal the
+original controlled fixture URL. This keeps a delayed navigation from escaping
+the accepted outcome boundary merely because an earlier post-click URL sample
+was still unchanged.
+
+The two idle baselines, browser-observed clear/typed input values, post-condition
+and URL observations are compared locally and unexpected page-controlled values
+are not echoed into CI diagnostics. The lane remains active-PR fixture evidence,
+not a shipped OriginWeave browser adapter. CSS locators are harness selectors; the
+work does not establish OriginWeave semantic node authority, policy-authorized
+production dispatch, WebDriver BiDi/CDP authority translation, or protected-main
+runtime acceptance. Workflow/sandbox activation remains #212 authority and
+ChromeDriver process/protocol diagnostics remain #148 authority.
+Draft-policy-skipped CI/MV3 runs are not browser GREEN.
+
 ### 3.5 Buyer acceptance
 
 Versioned task packs measure repeatable product outcomes rather than one lucky agent run. The benchmark artifact records browser build, OriginWeave version, model/provider/reasoning configuration, seed where supported, policy profile, hardware profile and source fixtures.

docs/doctoring/chromium-sandbox-evidence-boundary.md

@@ -0,0 +1,41 @@
+# Chromium sandbox evidence boundary
+
+Status: active verification evidence for PR #288. This note does not claim protected-main delivery or a passing browser gate.
+
+## Problem
+
+OriginWeave uses pinned real Chromium as compatibility and Agent Task evidence. A browser test that succeeds only after disabling Chromium process sandboxing does not prove the security posture expected from the governed-browser runtime. The transferred PR #288 generation originally inherited two real-browser launch paths in `scripts/ci/run_mv3_compatibility.py`: the Agent Task path kept sandboxing enabled, while the ordinary Manifest V3 compatibility path passed `--no-sandbox`. That source defect is repaired: both ordinary Manifest V3 and Agent Task real-browser paths omit `--no-sandbox`.
+
+Chromium's current Linux security guidance states that `--no-sandbox` disables critical security features and recommends installing/configuring a sandbox helper for developer builds instead. Chromium's Linux debugging guidance likewise says sandbox testing is needed on automated waterfall bots rather than routinely running them without the sandbox. The SUID sandbox development guidance documents the helper ownership/mode and `CHROME_DEVEL_SANDBOX` setup used when the normal user-namespace sandbox is unavailable.
+
+## Constraints and rejected alternatives
+
+The scheduled OriginWeave product writer does not own `.github/**`; workflow setup belongs to issue #212. Disabling Ubuntu/AppArmor restrictions runner-wide, retaining `--no-sandbox`, reducing browser trials, or treating ChromeDriver command acknowledgement as product success would weaken the evidence boundary and is rejected.
+
+Copying the complete #43 runner is also rejected. #43 contains unrelated downloads and diagnostic work. The reviewed causal precedent is narrower: commit `a45c83e4d8988fe89920ecb6a9eac469815f5b9b` removes the single `--no-sandbox` launch override and records that a sandbox-incompatible environment must fail instead of weakening Chromium isolation.
+
+## Selected repair path
+
+1. Keep `tests/test_mv3_browser_sandbox_contract.py` as the product-side invariant for both ordinary MV3 and Agent Task real-browser paths, including the documentation/source consistency guard.
+2. Preserve the repaired ordinary `_run_browser_pass` launch without `--no-sandbox`; do not import unrelated #43 product delta.
+3. Let #212 own the canonical workflow helper setup needed by the pinned Chrome for Testing archive, including root ownership/mode and environment wiring when the chosen Linux sandbox requires it.
+4. Run the full repository contract suite on the repaired exact head, then execute fresh pinned-Chromium compatibility and Agent Task trials with sandboxing enabled. A skipped Draft job, command ACK, mock-fixture JSON, source inspection, or predecessor run is not GREEN browser evidence.
+
+## Exact active evidence
+
+- Protected base when the regression was recorded: `87c4daa1830bac5a5228b6036752ad5633232085`.
+- Test-first RED generation for the launch defect: `101470a19b370bd30533ab3db330a882a2c25bc3`.
+- Product repair commit: `6c072c3cd035319a57977d012007898c29602402`, which removes the ordinary `--no-sandbox` override.
+- Diagnostic-restoration/source-verification generation: `0f434bc29d468127412366b6864b733b40b83c4d`; both real-browser option lists omit the forbidden override there. Its reported 173 Python/full-Rust/numeric-coverage verification is source/test evidence, not an actual Chromium execution; the `agent_task` JSON produced by the tests is a mock fixture.
+- Documentation-consistency RED commit: `e74acd7b83aac2c7768ba21a2a9b5d9ea2b8a31b`; the new focused contract rejects the stale current-tense `--no-sandbox` statement that this revision repairs.
+- Reviewed causal precedent: #43 commit `a45c83e4d8988fe89920ecb6a9eac469815f5b9b`.
+- Canonical workflow-owner path: issue #212.
+- Prior Agent Task hosted RED remains #70 MV3 run `33887386759`, job `101070423144`; it is predecessor evidence only and does not establish the current head as GREEN.
+
+## References
+
+The Chromium Authors. (2026). *AppArmor user namespace restrictions vs. Chromium developer builds*. Chromium source documentation. https://chromium.googlesource.com/chromium/src/+/main/docs/security/apparmor-userns-restrictions.md
+
+The Chromium Authors. (2026). *Linux SUID sandbox development*. Chromium source documentation. https://chromium.googlesource.com/chromium/src/+/main/docs/linux/suid_sandbox_development.md
+
+The Chromium Authors. (2026). *Tips for debugging on Linux*. Chromium source documentation. https://chromium.googlesource.com/chromium/src/+/main/docs/linux_debugging.md