feat(workflows): add sandboxed OriginWeave browser evidence

[seonghobae]

Summary

• add a centrally owned, read-only reusable workflow for OriginWeave pinned-Chromium evidence
• verify Chrome for Testing and ChromeDriver 150.0.7871.129 against exact SHA-256 values from successful OriginWeave run 33866932365
• install the root-owned mode-4755 Chromium sandbox helper and execute the product-owned runner at the exact caller revision
• retain bounded evidence with immutable action pins, declared egress, no secrets, and no caller-authored shell input

Verification

• test-first RED: the new owner contract failed because the reusable workflow did not exist
• uv run --with pytest pytest -q tests/test_originweave_mv3_workflow_contract.py — 1 passed
• actionlint .github/workflows/originweave-mv3-evidence.yml — passed
• uv run --with pytest pytest -q — 2815 passed, 1 pre-existing skip, 21 subtests passed
• git diff --check — passed

Boundary

This PR supplies the owner workflow only. It does not claim OriginWeave consumer execution or product shipment. After protected-main integration, OriginWeave must pin the exact merged SHA in its thin caller, then #43/#70/#245 must adopt it and produce fresh exact-head browser evidence.

Refs #1792 and ContextualWisdomLab/OriginWeave#212.

Summary by CodeRabbit

• 새 기능

  • 고정된 Chrome/ChromeDriver 버전과 체크섬을 검증하는 재사용 가능한 MV3 브라우저 호환성 증거 워크플로를 추가했습니다.
  • 실행 결과와 검증 자료를 제한된 기간 동안 아티팩트로 제공합니다.

• 문서

  • 워크플로의 신뢰 경계, 실행 조건, 권한 및 검증 기준을 문서화했습니다.
  • 변경 사항을 미출시 변경 로그에 기록했습니다.

• 테스트

  • 워크플로의 버전 고정, 샌드박스, 최소 권한 및 시크릿 미사용 조건을 검증하는 계약 테스트를 추가했습니다.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: fe62a8fe-6b0a-44c8-8cdb-8aec4977c7fd

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 5eddef82-10a8-452d-a66d-22e0925b25ac

📥 Commits

Reviewing files that changed from the base of the PR and between 7696915 and 8e1eb57.

📒 Files selected for processing (4)

• .github/workflows/originweave-mv3-evidence.yml
• CHANGELOG.md
• docs/doctoring/originweave-mv3-evidence.md
• tests/test_originweave_mv3_workflow_contract.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

재사용 가능한 GitHub Actions 워크플로가 호출 리비전에서 MV3 호환성 검사를 실행합니다. 고정된 Chrome과 ChromeDriver를 SHA256으로 검증하고, Chromium 샌드박스를 설정한 뒤 결과와 검증 파일을 보존합니다. 문서와 계약 테스트가 실행 조건을 명시합니다.

Changes

OriginWeave MV3 증거

Layer / File(s)	Summary
워크플로 실행 및 증거 생성 .github/workflows/originweave-mv3-evidence.yml, tests/test_originweave_mv3_workflow_contract.py	재사용 워크플로가 호출 저장소와 리비전을 확인합니다. 고정된 Chrome 150.0.7871.129와 ChromeDriver를 SHA256으로 검증합니다. 샌드박스 권한을 설정하고 scripts/ci/run_mv3_compatibility.py를 실행합니다. 결과 파일을 항상 아티팩트로 업로드합니다. 계약 테스트가 최소 권한, 무비밀, 샌드박스 및 고정 버전 조건을 검증합니다.
실행 계약 문서화 docs/doctoring/originweave-mv3-evidence.md, CHANGELOG.md	워크플로의 저장소 제한, 읽기 전용 권한, 브라우저 검증, 샌드박스 설정, 증거 판정 조건을 문서화합니다. [Unreleased] 항목에 변경 사항을 추가합니다.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 8e1eb

This adds a read-only reusable MV3 browser-evidence workflow with pinned browser artifacts, sandbox configuration, and bounded evidence retention. No current merge-blocking risk remains.

Sequence Diagram(s)

sequenceDiagram
  participant Caller as 호출 저장소
  participant Runner as Actions 러너
  participant Chrome as Chrome for Testing
  participant MV3 as OriginWeave MV3 실행기
  participant Artifacts as 아티팩트 저장소
  Caller->>Runner: 재사용 워크플로 호출
  Runner->>Chrome: 고정 Chrome과 ChromeDriver 다운로드
  Chrome-->>Runner: 아카이브 및 체크섬
  Runner->>MV3: 샌드박스 환경에서 호환성 검사 실행
  MV3-->>Runner: JSON 결과 생성
  Runner->>Artifacts: 검증 파일과 결과 업로드

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 샌드박스된 OriginWeave 브라우저 증거 워크플로 추가라는 주요 변경 사항을 정확하고 간결하게 설명합니다.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files. (3 skipped: 3 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/originweave-mv3-owner

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Triage: resolved merge conflict against main

This PR's head (935a42d4e) was dirty (real merge conflict), blocking the mechanical scheduler from updating it.

Root cause: both this branch and main (via #1877, merged after this branch's last sync) added a bullet to the same ## [Unreleased] CHANGELOG.md section — a textual conflict only, not a semantic one.

Fix: merged origin/main (b5efbc276) into this branch in a scratch worktree via git fetch origin main && git merge --no-edit, kept both changelog entries (this PR's OriginWeave MV3 evidence-workflow entry, followed by main's five unrelated entries), no other files needed manual resolution (17 other files auto-merged cleanly). Pushed as cc674cb6e (no force, no rebase).

Validation before push:

• PYTHONPATH=. python3 -m pytest tests/test_originweave_mv3_workflow_contract.py -q → 1 passed
• PYTHONPATH=. coverage run -m pytest tests -q → 2834 passed, 1 skipped, 21 subtests passed (vs. 2833 passed on origin/main alone — the +1 is this PR's own new test; zero regressions)
• coverage report → 99% (scripts/ci/review_admission_controller.py at 85% is a pre-existing gap already present identically on plain origin/main, tracked separately — not introduced by this merge)
• interrogate scripts/ci → 98.3%, likewise identical to the origin/main baseline
• git diff --check origin/main...HEAD → clean
• All touched workflow YAML re-parses as valid YAML

No production code was changed by this fix — only the conflict in CHANGELOG.md was resolved, and all other files auto-merged. The resulting head will go through full re-review before it can merge, per this repo's governance model.

---

Generated by Claude Code