fix(web): require executable provenance for managed process ownership
Summary
Record managed browser processes from observed executable provenance before identity-gated cleanup. Fixes #4375.
Native daemon roots must match canonical managed binaries. Browser-home roots are canonicalized per ownership snapshot and require contained executable realpaths; unrelated Chrome arguments confer no ownership. The launch-marker path requires an observed Chrome executable. Stable descendants inherit proven roots. Unknown provenance fails closed; legacy records stay unsignaled. Windows aliases require matching file identity, and observer commands use the supplied host configuration.
10 files cover observation, admission, lifecycle integration and regression coverage. No parallel ownership store is introduced.
Validation
Head 4cab4dcd5cfa82c77c19a50920bd3996c8b04991; base eec35e9622c339a21b1a588794254f6bdf50d476.
Pinned install/build and exact affected gate passed: eight stages, 389 related and 19,505 unit tests (three skipped). exactCommit=true, checkoutChanged=false, failOpen=false; #4050 retained. Eight checks have explicit CI/manual owners; provider integration was deduplicated.
Independent review at d86e765 found no findings; cache/fixture deltas had coordinator cold review. Isolated proof: candidate/restored 51 passed; prior production 50 passed/one intended failure, admitting outside Chrome and missing contained helpers. Production-identical 6318647 macOS open/snapshot/interaction/close passed; a native Chrome-named surrogate outside the managed home stayed unrecorded and alive. Actual executable observations and complete owned cleanup were verified.
Evidence and limitations. GitHub:19successful checks,1skipped; MERGEABLE/CLEAN. All threads resolved; maintainer decision unset. Windows/Linux live behavior and adversarial PID-race guarantees remain unproven. Native-adoption finding withdrawn after source/policy/live evidence. Historical failures are retained; no merge performed.