feat(extension): bound Agent Task managed extension admission

[seonghobae]

Partial implementation of #27, stacked on live PR #83 (feat/attached-tab-reduced-assurance).

Buyer/security gap

Issue #27 requires Agent Task mode to default to no extensions or an explicit managed allow-list. Existing work separates Chromium extension permissions, OriginWeave Agent grants, native-messaging host authority, and attached-tab assurance, but there was no production policy primitive that answered the narrower question: may this exact extension identity be present in an isolated Agent Task profile under the managed extension admission policy?

Current dependency / stack state

The independently resolved live prerequisite is exact #83 head 2412fb1f7eefd61f4e71985ece378a5604ac77b6. Current exact #85 head is a3cfb7cc763841fa6953b459bd7c6f4047cd6c6d.

Fresh compare from the exact live prerequisite reports ahead 14 / behind 0, with merge base exactly 2412fb1f7eefd61f4e71985ece378a5604ac77b6. The unique managed-extension policy delta remains limited to CHANGELOG.md, crates/originweave-policy/src/lib.rs, and crates/originweave-policy/tests/agent_task_extension_policy.rs. No prerequisite review, check, status, or synthetic-merge evidence transfers.

Keep Draft while #83/#82 remain active.

TDD / RCA sequence

1. Exact original test-only head 23f128fc84b2d2b5b4c188211575ef69c5c5d070 established the intended production-boundary RED. CI run 31490857300, Rust contracts job 93776779728, passed repository contracts and formatting then failed at the workspace check with E0432 because the managed Agent Task admission API did not exist.
2. RCA found the deterministic admission evaluator belongs to originweave-policy, not originweave-core: core owns stable extension identity/grant value contracts, while policy owns fail-closed decisions. The test was therefore moved to the policy crate rather than widening the core authority surface.
3. Production adds AgentTaskExtensionPolicy, AgentTaskExtensionDecision, and evaluate_agent_task_extension. An empty policy denies all; only exact canonical ExtensionId membership is admitted; duplicate entries collapse without widening authority; and policy admission never mints ExtensionAgentGrant capability.
4. After the live prerequisite advanced, exact head a1234974e6c386859b315f12d4bc0f098cdc332a failed CI run 32026832564, Rust contracts job 95377888012, at cargo check --locked --workspace --all-targets: the prerequisite had hardened ExtensionAccessRequest::new to require canonical Origin plus trusted evaluation time, while this branch-local negative-capability test still supplied the former four-argument request shape.
5. Current head a3cfb7cc763841fa6953b459bd7c6f4047cd6c6d performs the smallest compatibility repair in the existing owning test: it supplies a valid controlled HTTPS origin and trusted time while preserving the assertion that managed-profile admission alone still yields DenyMissingGrant. No production authority was widened and no gate was weakened.

Current exact-head evidence

For unchanged exact head a3cfb7cc763841fa6953b459bd7c6f4047cd6c6d on exact live prerequisite 2412fb1f7eefd61f4e71985ece378a5604ac77b6:

• CI run 32076921926: success;
• Rust contracts job 95531989724: repository contracts, canonical formatting, locked workspace/all-target check, full tests, strict Clippy, and rustdoc success;
• Production coverage job 95531989810: exact owned production function/line/region/branch measurement and enforcement success;
• fresh ancestry: ahead 14 / behind 0, merge base exactly the live prerequisite;
• formal reviews currently returned: none; and
• inline review threads currently returned: none.

Only checks actually returned for this exact stacked head are represented above. Manifest V3, central Security/SAST/OpenCode/Noema/Strix checks absent for this Draft base are absent, not passing. No predecessor-head, prerequisite-head, synthetic merge, queued, pending, skipped, cancelled, stale, status-only, or model-only evidence is promoted as current proof.

Truth boundary

This policy primitive does not read Chrome enterprise policy, install/enable/disable extensions, verify signatures or update provenance, mutate a browser profile, launch Chromium, persist policy, authenticate an administrator, authorize native messaging, or grant any OriginWeave Agent capability/action. A future trusted profile/enterprise-policy adapter must derive the exact managed extension set from independently authenticated policy and compose it with Chromium startup/install state.

This PR does not close #27. Passing automation is not independent approval, and this scheduled actor does not merge or self-approve.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Restacked this branch onto its current parent #83 at ae3f2afdcd048d40d2d63409fb3d7824d81b40e5 with signed-off merge commit c9adea680d6186f1842a280e248ce55da4f1305b. Root cause of the DIRTY state was the stale stacked base plus overlap in CHANGELOG.md and policy imports; the resolution preserves the parent MCP/attached-tab contracts and this PR’s bounded managed-extension admission. Parent-relative semantic delta is now limited to 3 files (+247/-1). Local verification: focused policy tests 25/25, cargo fmt --check, workspace clippy with warnings denied, all workspace tests, Python tests 155/155, and nightly LLVM coverage at 100% functions/lines/regions/branches. Hosted exact-head checks and eligible review remain authoritative.