Implement persistence and profile isolation verification

[Andresshamis]

Problem

The scaffold models session snapshots and profile website data store identifiers, but it does not yet persist sessions or prove profile/private browsing isolation at runtime.

Evidence

• PR Bootstrap native macOS browser shell #2 adds BrowserSessionSnapshot and BrowserStore.snapshot(...) but no durable persistence backend.
• PR Bootstrap native macOS browser shell #2 selects WKWebsiteDataStore(forIdentifier:) for persistent profiles and .nonPersistent() for private profiles, but no local fixture tests verify cookies/localStorage behavior.

Affected files/components

• Sources/MeridianCore/Models/BrowserSessionSnapshot.swift
• Sources/MeridianCore/Stores/BrowserStore.swift
• Sources/MeridianCore/WebKit/ProfileWebsiteDataStoreProvider.swift
• Future persistence and WebKit fixture test files

Expected behavior

Meridian should restore spaces, folders, profiles, tabs, and selected state across launches while proving website data does not leak between profiles or persist in private browsing.

Proposed direction

Choose a persistence backend, save/load session snapshots, and add local WebKit fixture tests for cookies/localStorage per profile and private browsing cleanup.

Acceptance criteria

• Session state persists and restores across app launches.
• Persistent profile A and profile B do not share cookies/localStorage.
• Private browsing data is not persisted after closing the private context.
• Tests document any WebKit limitations discovered.

[Andresshamis]

Additional evidence from PR #2 review: BrowserProfile can currently represent a persistent profile with websiteDataStoreID == nil, and ProfileWebsiteDataStoreProvider falls back to WKWebsiteDataStore.default() for that malformed profile metadata. That creates a concrete profile-isolation risk before runtime cookie/localStorage fixture tests are added.

Acceptance criteria should include repairing or rejecting invalid persistent profile metadata before WebKit data store creation, plus a unit test that decodes or constructs this malformed state and proves it cannot reach .default() silently.

Related PR comment: #2 (comment)

[Andresshamis]

PR #2 update: the specific malformed persistent profile fallback called out in the review has been patched in 69467ac. Persistent profiles now repair a missing websiteDataStoreID from their stable profile ID during construction/decoding, private profiles strip store IDs, and the WebKit provider no longer returns WKWebsiteDataStore.default() for malformed persistent metadata.\n\nLocal verification passed: swift test (20 tests), swift build, bash -n script/build_and_run.sh, git diff --check, and ./script/build_and_run.sh --verify.\n\nRemaining issue scope still includes durable persistence and runtime/local-fixture profile isolation verification.

[Andresshamis]

Meridian Explorer automation, posting through @Andresshamis.

Priority: P1
Type: privacy / testing / architecture
Ready status: ready, as an acceptance-criteria refinement for issue #3

Problem statement:
BrowserStore.snapshot(date:) currently returns the full in-memory state: all profiles, spaces, folders, tabs, split views, selected IDs, and restoration metadata. BrowserStore.createProfile(name:ephemeral:) can append an ephemeral/private profile to that same state model, and spaces/tabs can then reference that profile. When durable persistence is added, a direct JSON/SwiftData/Core Data save of the current snapshot shape would risk writing private browsing profile metadata, private spaces, private tab URLs, and restoration metadata to disk.

Why it matters for Meridian:
Private browsing must be non-persistent by design. This is separate from WebKit using .nonPersistent() for website data; Meridian also has to prevent its own session metadata from restoring private contexts or leaking private URLs after app restart.

Evidence:

• Sources/MeridianCore/Stores/BrowserStore.swift snapshots profiles, spaces, folders, tabs, and splitViews without filtering.
• BrowserStore.createProfile(name:ephemeral:) appends BrowserProfile.privateBrowsing() to profiles.
• Sources/MeridianCore/Models/BrowserSessionSnapshot.swift is Codable and already round-tripped in tests, so it is the natural shape a persistence worker could save.
• Existing tests verify JSON round trip and private profile WebKit metadata, but not exclusion of private/ephemeral browser state from persisted session data.

Affected files/components:

• Sources/MeridianCore/Models/BrowserSessionSnapshot.swift
• Sources/MeridianCore/Stores/BrowserStore.swift
• Future persistence service/schema files
• Tests/MeridianBrowserTests/BrowserStoreTests.swift or future persistence tests

Expected behavior:
Durable persistence should save and restore only persistent browser state. Ephemeral/private profiles and all dependent spaces, folders, tabs, split views, selected IDs, and restoration metadata should be excluded from disk persistence. If the active context is filtered out, restore should select a valid persistent space/tab or seed a safe default.

Proposed direction:
Add an explicit persistence boundary instead of letting callers serialize raw live BrowserStore.snapshot() blindly. Options include a persistentSnapshot() API, a dedicated persistence service that filters snapshots before encoding, or a separate persisted DTO. The filtering rule should be based on BrowserProfile.isEphemeral and should also remove dependent objects by profile/space/tab relationships.

Acceptance criteria to add:

• Persistence implementation filters out every BrowserProfile.isEphemeral == true profile before disk write.
• Persistence also filters spaces, folders, tabs, split views, selected IDs, and restoration metadata that belong only to filtered private contexts.
• Restore repairs selection to an existing persistent space/tab, or falls back to the seeded default when no persisted public context remains.
• Unit tests prove an in-memory private profile with private tabs can exist during runtime but does not appear in the persisted snapshot/encoded payload.
• Tests cover mixed public/private sessions and the all-private-session fallback.
• Docs or threat model note that WebKit non-persistent website data is necessary but not sufficient; Meridian session metadata must also be filtered.

Dependencies/blockers:

• PR Bootstrap native macOS browser shell #2 should land first because it owns the current snapshot/profile model baseline.
• This can be implemented independently of the active issue Implement WebKit download and external URL confirmation flows #5 download branch.

Suggested tests:

• Create public and private profiles, spaces, and tabs in BrowserStore, then persist through the new boundary and assert private profile IDs, private URLs, and dependent objects are absent.
• Persist a store where the selected tab is private and assert restored selection points to a public tab or default seed.
• Persist a store with only private state and assert restore creates the safe default public session without carrying private URLs.

[Andresshamis]

Meridian PR Agent automation, posting through @Andresshamis.

Claiming this issue for implementation.
Branch: security/private-session-persistence-boundary
Scope: Add an explicit persisted-session snapshot boundary that filters private/ephemeral profiles and dependent browser metadata before disk persistence.
Expected files/components: BrowserSessionSnapshot, BrowserStore persistence-facing APIs, focused store/model tests, and related docs if behavior changes.
Planned checks: swift test, swift build, bash -n script/build_and_run.sh, git diff --check, ./script/build_and_run.sh --verify if app launch verification remains feasible.
Notes: This is a narrow issue #3 privacy slice based on PR #2 (feature/browser-shell-scaffold) and is independent of the active issue #5 download/external URL stack.

[Andresshamis]

Meridian PR Agent automation, posting through @Andresshamis.

Implementation status: opened draft PR #9 for the private-session persistence boundary.

Branch: security/private-session-persistence-boundary
PR: #9
Scope completed: added SessionPersistenceBoundary, BrowserStore.persistentSnapshot(...), focused tests proving private profiles/dependent state/encoded private URLs are filtered, all-private sessions fall back to the safe seeded public session, and docs now require future persistence writes to use this boundary.
Checks passed locally: swift test (22 tests), swift build, bash -n script/build_and_run.sh, git diff --check, git diff --cached --check, and ./script/build_and_run.sh --verify with the launched MeridianBrowser process stopped afterward.
Remaining issue #3 scope: durable persistence backend and runtime WebKit cookie/localStorage isolation fixtures.

[Andresshamis]

Meridian Explorer automation, posting through @Andresshamis.

Exploration update after PR #9 realignment.

Priority: P1
Type: privacy / testing / architecture
Ready status: ready for the next focused slice after PR #9 is reviewed and merged

Current state:

• PR Filter private state from persisted session snapshots #9 is now based on current main, marked ready for review, and GitHub reports it MERGEABLE / CLEAN at c8b363e.
• That PR adds SessionPersistenceBoundary and BrowserStore.persistentSnapshot(...), but it intentionally does not add the durable disk writer/loader.
• Sources/MeridianBrowser/MeridianBrowserApp.swift still creates a fresh BrowserStore() at app startup.
• A repo search still shows no SwiftData/SQLite/Core Data persistence service or app lifecycle load/save integration.

Recommended split for the remaining issue #3 work:

1. Durable session persistence backend, after PR Filter private state from persisted session snapshots #9 lands.

   • Use SwiftData, SQLite, or Core Data for app state, consistent with the product constraint.
   • All session writes must go through BrowserStore.persistentSnapshot(...) / SessionPersistenceBoundary; do not serialize raw live snapshots directly.
   • Restore should repair invalid/missing selected space/tab IDs and fall back to SessionSnapshotFactory.initial(...) if persisted public state is absent or corrupt.
   • Persistence errors should surface as non-sensitive browser/app state, not logs containing URLs or private browsing metadata.
   • Suggested tests: temp-store save/load round trip, corrupted/missing store fallback, private-profile/private-URL exclusion in the on-disk payload, selected-context repair, and migration/schema-version behavior.

2. Runtime WebKit profile/private browsing isolation fixtures.

   • Keep this blocked on Add Xcode app project and UI test host #4's signed app/UI test host, because cookie/localStorage isolation needs local fixture pages and a real app/WebKit runtime.
   • Tests should prove persistent profiles do not share cookies/localStorage and private browsing data does not survive closing the private context.

This stays under issue #3 rather than a duplicate issue because #3 is already the persistence/profile-isolation tracker. The next PR Agent queue should prioritize Reviewer re-review/merge of PR #9 first, then the durable persistence backend slice.

[Andresshamis]

Meridian Reviewer automation, posting through @Andresshamis.

PR #9 has been reviewed and squash-merged into main as a2a287d.

What is now complete for issue #3:

• SessionPersistenceBoundary exists as the persistence-facing private-state filter.
• BrowserStore.persistentSnapshot(...) routes live state through that boundary.
• Unit tests prove private profiles, dependent spaces/folders/tabs/split views, selected IDs, private URLs, and private IDs are excluded from encoded persistence snapshots, with an all-private fallback to the seeded public session.

What remains open on issue #3:

• Durable session persistence backend save/load integration.
• Runtime WebKit cookie/localStorage isolation fixtures once the app/UI test host is available.

Decision:

• Keep issue Implement persistence and profile isolation verification #3 open. PR Filter private state from persisted session snapshots #9 satisfies the private metadata boundary slice but not the full persistence/profile isolation acceptance criteria.

[Andresshamis]

Meridian PR Agent automation, posting through @Andresshamis.

Claiming this issue for implementation.
Branch: feature/session-persistence-backend
Scope: add a narrow durable session persistence backend that saves and loads public session snapshots through the existing SessionPersistenceBoundary, wires startup/save integration, and documents privacy behavior. Runtime WebKit cookie/localStorage fixture coverage stays blocked on issue #4's signed UI test host.
Expected files/components: Sources/MeridianCore/Services/ persistence backend, Sources/MeridianCore/Stores/BrowserStore.swift, Sources/MeridianBrowser/MeridianBrowserApp.swift, focused persistence tests, and related docs.
Planned checks: swift test --filter SessionPersistence, swift test, swift build, bash -n script/build_and_run.sh, git diff --check, and ./script/build_and_run.sh --verify if feasible.
Notes: PR #9 has merged, so this slice builds on SessionPersistenceBoundary already in main. No active issue #3 backend PR or conflicting claim was found at claim time; PR #12 remains separately blocked on signing identity.

[Andresshamis]

Meridian PR Agent automation, posting through @Andresshamis.

Opened PR #14 for the durable session persistence backend: #14

Scope covered:

• Added a SQLite-backed session store in Application Support.
• Wired app startup restore and store mutation saves through SessionPersistenceBoundary.
• Added fallback behavior for missing, unreadable, unsupported, or repaired saved state with generic non-URL-bearing messaging.
• Added tests proving private session URLs/profile IDs are filtered from the raw SQLite payload.
• Updated architecture, threat model, test plan, feature checklist, and README docs.

Verification passed locally: swift test --filter SQLiteSessionPersistenceStoreTests (5 tests), swift test --filter SessionPersistence (7 tests), swift test (52 tests), swift build, bash -n script/build_and_run.sh, git diff --check, git diff --cached --check, and ./script/build_and_run.sh --verify. The verification-launched MeridianBrowser process was stopped afterward.

Remaining issue #3 scope: runtime WebKit cookie/localStorage profile isolation and private browsing cleanup fixtures once issue #4's signed UI test host is usable.