feat(browser): connect owned Chromium hosts to Core and Desktop

.gitattributes

@@ -1,2 +1,5 @@
 # Keep text checkouts stable across developer and CI operating systems.
 * text=auto eol=lf
+
+# Unified patches use a single space for an empty context line.
+native/browser/component/patches/macos-owned-process/chromium.patch whitespace=-blank-at-eol

.github/workflows/premerge.yml

@@ -638,6 +638,25 @@ jobs:
         continue-on-error: true
         working-directory: apps/desktop
         run: npm run test:approval-runtime
+      - name: Build pinned CEF and accept the supervised owned Windows browser
+        id: owned_chromium
+        continue-on-error: true
+        timeout-minutes: 45
+        shell: pwsh
+        run: ./scripts/ci/browser-windows-native.ps1
+      - name: Retain bounded owned Windows browser evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: windows-owned-chromium-source-acceptance
+          path: |
+            .local/windows-owned-browser-evidence/native-factory.json
+            .local/windows-owned-browser-evidence/native-factory.log
+            .local/windows-owned-browser-evidence/browser-component.json
+            .local/windows-owned-browser-evidence/*startup*.log
+            .local/windows-owned-browser-evidence/core-death-*.log
+          if-no-files-found: warn
+          retention-days: 7
       - name: Retain Windows plugin acceptance evidence
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -660,6 +679,7 @@ jobs:
           PLUGIN_RUNTIME_OUTCOME: ${{ steps.plugin_runtime.outcome }}
           APPROVAL_RUNTIME_OUTCOME: ${{ steps.approval_runtime.outcome }}
           CLOUD_NATIVE_OUTCOME: ${{ steps.cloud_native.outcome }}
+          OWNED_CHROMIUM_OUTCOME: ${{ steps.owned_chromium.outcome }}
         run: |
           set -eu
           failed=
@@ -669,7 +689,8 @@ jobs:
             "desktop-tests=$NATIVE_TEST_OUTCOME" \
             "desktop-plugin-runtime=$PLUGIN_RUNTIME_OUTCOME" \
             "desktop-approval-runtime=$APPROVAL_RUNTIME_OUTCOME" \
-            "desktop-cloud-native=$CLOUD_NATIVE_OUTCOME"
+            "desktop-cloud-native=$CLOUD_NATIVE_OUTCOME" \
+            "owned-chromium=$OWNED_CHROMIUM_OUTCOME"
           do
             if test "${result#*=}" != success; then
               failed="$failed ${result%%=*}"

Cargo.toml

@@ -1,5 +1,6 @@
 [workspace]
 resolver = "3"
+exclude = ["native/browser/driver", "native/browser/pki", "native/browser/process-broker", "native/browser/tls-broker"]
 members = [
     "crates/colossus-cloud",
     "crates/colossus-cloud-postgres",
@@ -10,6 +11,9 @@ members = [
     "xtask",
     "crates/colossus-domain",
     "crates/colossus-contracts",
+    "crates/colossus-browser",
+    "crates/colossus-browser-bridge",
+    "crates/colossus-browser-presentation",
     "crates/colossus-credentials",
     "crates/colossus-api-proto",
     "crates/colossus-api",
@@ -77,6 +81,9 @@ repository = "https://github.com/obscuritylabs/Colossus"
 publish-sdks = false
 
 [workspace.dependencies]
+colossus-browser = { version = "=0.11.8", path = "crates/colossus-browser" }
+colossus-browser-bridge = { version = "=0.11.8", path = "crates/colossus-browser-bridge" }
+colossus-browser-presentation = { version = "=0.11.8", path = "crates/colossus-browser-presentation" }
 colossus-communication = { version = "=0.11.8", path = "crates/colossus-communication" }
 chrono = "0.4.44"
 openidconnect = { version = "4.0.1", default-features = false, features = ["reqwest", "rustls-tls"] }
@@ -275,6 +282,12 @@ strip = "symbols"
 [profile.test]
 strip = "debuginfo"
 
+# Retina frames cross independently authenticated native boundaries. Unoptimized
+# SHA-256 consumed about 245ms per 6.9MiB frame on the Mac acceptance machine;
+# keep full authentication within the unchanged visibility/control deadlines.
+[profile.dev.package.sha2]
+opt-level = 3
+
 # Runnable VSIX binaries keep assertions without producing large MSVC symbol files.
 [profile.vscode]
 inherits = "dev"