fix(policy): revalidate current semantic state at dispatch

[seonghobae]

Partial implementation of #28, stacked on current #102.

Current stack

Exact live prerequisite #102 is a123c55d4839dae1db7e6671f7d4d158c7cfd9db; exact #103 head is 8b3416169346fa04b53c915b813d55ccf47d1876. The branch was advanced by non-force merge after rechecking both refs; the parent-relative delta remains the same-call dispatch gate and its focused policy tests.

Contract

dispatch_if_current_observation checks the retained registry-issued browser authority first, then compares the supplied fresh semantic state for exact node identity, retained action support, and required enabled state. The adapter callback is never invoked when either check fails. After document advance removes admission, the browser-authority failure is NotAdmitted. The boundary does not obtain or authenticate the observation, execute Chromium by itself, expand authority, or prove a post-condition.

Exact-current evidence

At exact head 8b3416169346fa04b53c915b813d55ccf47d1876, focused RED reproduced the stale inherited authority diagnostic and a test-first documentation RED established the missing non-transitive boundary. Local verification passed 146 Python contracts; locked Rust format, check, all-target tests, strict Clippy, and rustdoc; exact 100% production function, line, region, and branch coverage. Hosted exact-head checks remain non-passing until terminal success.

Keep Draft while #102 and its upstream stack remain active. No self-approval, force-push, destructive rebase, workflow/ruleset/secret mutation, gate weakening, release, or predecessor-evidence transfer is authorized.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Restacked non-destructively on PR #102 exact head a4ea8064c3f121b8aff24059d48246a163801d62; new exact head is c6d89a170f6816f8eb2f46b0023b37d168703130. The semantic diff remains limited to current-observation dispatch revalidation and its tests; it also inherits the deterministic loopback peer-lifetime fix. Local verification: 139 Python contracts, full locked workspace tests, fmt, strict Clippy, rustdoc, and fresh-worktree LLVM function/line/region/branch coverage all pass at 100%.

[seonghobae]

Restacked non-destructively on exact current #102 a123c55d4839dae1db7e6671f7d4d158c7cfd9db; new #103 exact head is 8b3416169346fa04b53c915b813d55ccf47d1876. Focused RED showed the inherited document-advance diagnostic must now be NotAdmitted; a documentation RED now preserves browser-authority-first, semantic-state-second ordering and the non-transitive callback result. Local exact-head verification passed 146 Python contracts, all locked Rust gates, and exact 100% production function/line/region/branch coverage. Hosted checks remain pending and are not claimed as passing.