feat(policy): compose extension proposals with action policy

[seonghobae]

Partial implementation of #27, stacked on PR #74.

Buyer/security gap

PR #74 proves that exact ProposeTypedAction extension authority and ordinary typed-action policy are separate fail-closed boundaries. This child provides the narrow composition API so a future trusted extension adapter cannot accidentally check only extension access or only Agent action policy.

Live dependency / stack state

This Draft is stacked on current exact PR #74 head 9ce259834095cef91052db1e826f283689fb688f. Current exact contributor head is fc9c7348d367a0b6295d8e2f0289b0262ef3675f.

Fresh ancestry is ahead 9 / behind 0, with merge base exactly equal to the live prerequisite. Relative to #74 the child delta remains limited to CHANGELOG.md, crates/originweave-policy/src/lib.rs, and crates/originweave-policy/tests/extension_action_proposal.rs. The branch retains the prerequisite's current protected-main/documentation lineage while preserving this PR's production boundary. No prerequisite check, review, status, or predecessor result is transferred to this child.

Keep Draft while #74 remains active.

TDD / RCA sequence

1. Initial test-only head 5c0e5be959fabe53367315a574840bdb1c4d175c exposed only canonical rustfmt drift, so it was not counted as the intended RED.
2. Formatted test-only head af629d3aebadb67041ba28b97dfab0cc01dcf283 established the real production-boundary RED in CI run 31471940073, Rust contracts job 93717027443: repository contracts and rustfmt passed, then cargo check --locked --workspace --all-targets failed because public ExtensionProposalDecision and evaluate_extension_action_proposal did not exist.
3. Production head dfb411c219a8d935cf0a99dab3f9585e2400e3d8 added the smallest composition boundary; CI then exposed only canonical import wrapping.
4. Later heads established exact-green implementation, changelog truth, and non-destructive stack alignment.
5. The current prerequisite added canonical-origin binding and exclusive trusted-time expiry to extension grants. Current head fc9c7348d367a0b6295d8e2f0289b0262ef3675f carries those gates through evaluate_extension_action_proposal: source origin is taken from the caller-supplied ActionRequest, and trusted now_epoch_seconds is required before ordinary action policy runs.

Implemented boundary

evaluate_extension_action_proposal now:

• constructs the exact ExtensionAccessRequest for extension identity, browser session, browsing context, request source origin, trusted current time, and ExtensionAgentCapability::ProposeTypedAction;
• stops before action policy when the grant is missing, mismatched, expired, origin-mismatched, or lacks proposal capability;
• evaluates the caller-supplied ActionRequest unchanged only after proposal access is allowed; and
• preserves the request's instruction source, capability, source/target origin, secret-delivery, risk, approval and intent requirements instead of minting any from extension transport.

Focused integration regressions cover missing/wrong capability, wrong origin, expired grant, exact proposal-grant success into ordinary policy, preservation of WebContent as untrusted instruction, and the independent R3 approval requirement for broker-handle secret fill.

Current exact-head evidence

For unchanged exact head fc9c7348d367a0b6295d8e2f0289b0262ef3675f against exact prerequisite 9ce259834095cef91052db1e826f283689fb688f:

• ancestry: ahead 9 / behind 0, merge base equal to the live prerequisite;
• changed-file boundary relative to the prerequisite: the three files listed above only;
• CI run 32032674326: success;
• formal reviews currently returned: none; and
• inline review threads currently returned: none.

Security Scan, SAST and central review/workflow evidence are not returned for this exact head, so they are not counted as passing. No predecessor, prerequisite, skipped, queued, cancelled, absent, synthetic-merge, stale, status-only, or model-only evidence is promoted as current proof. The Draft remains dependency/evidence-gated rather than merge-ready.

Truth boundary

This is a pure policy-composition prerequisite, not a Chromium extension adapter. It does not parse extension messages, authenticate user/enterprise instruction provenance, transform arbitrary extension/page data into an ActionRequest, execute browser input, resolve or disclose secrets, verify a post-condition, persist policy, alter managed-extension configuration, or close issue #27. A later trusted adapter must construct the typed request and its instruction-source classification from independently trusted context; extension-produced content/messages remain untrusted and cannot choose their own trust class. Chrome permission, extension proposal permission, Agent capability/origin/time authority, high-risk approval, secret authority, browser execution and verified success remain separate authorities.

This scheduled actor does not merge, self-approve, alter workflows, add secrets, weaken checks, tag, or publish.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}