feat(receipt): wasm-friendly rosalind-receipt crate + in-browser "caught-you" verifier

Wave 1.3 of docs/GROWTH.md — the most shareable artifact: check a receipt's
tamper-evidence in the browser, running the SAME shipped code (no reimplementation).

- Extract src/provenance/ into a new leaf crate `rosalind-receipt` (std + blake3, no
  htslib) so it compiles to wasm. The root crate re-exports it as `provenance`, so
  `rosalind::provenance::*` and every call site / test are unchanged. The single
  MemoryBudget coupling is inlined; build-identity is injected at runtime via
  `set_build_identity` (the binary installs it at startup) instead of `env!`, keeping
  the crate free of build.rs/env! — the binary's build.rs is untouched.
- Add `verify_manifest_str(json) -> ReceiptCheck` (TDD'd, 5 tests): a pure, file-free
  re-derivation of the claim self-hash + the independent measurement hash — exactly what
  `rosalind verify` checks, minus re-hashing the input/output files.
- `crates/receipt-wasm` (standalone, excluded from the workspace): a wasm-bindgen
  `verify()` over the above, built by `scripts/build-wasm-verifier.sh` (wasm-pack) into a
  71 KB module. `web/verify/index.html` is a static, fully client-side page (drag a
  receipt / edit a byte -> flips to TAMPERED), preloaded with a real sample receipt.
- `crates/receipt/examples/verify_file.rs`: the native equivalent.

Verified: fmt + clippy -D warnings + full suite green (incl. 42 receipt-crate tests);
the verifier compiles to wasm32 and wasm-pack produces the bundle; the embedded sample
verifies and a one-byte edit is caught (Verified -> Tampered).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: logannye

.gitignore

@@ -1,7 +1,13 @@
 # Rust
 /target
+# Build dirs for workspace members / the standalone wasm crate (wasm-pack).
+**/target/
 **/*.rs.bk
 *.pdb
+
+# Built wasm bundle for the in-browser receipt verifier (regenerated by
+# scripts/build-wasm-verifier.sh).
+/web/verify/pkg/
 # Cargo.lock IS tracked: rosalind ships a binary, so a pinned lockfile is part of
 # the reproducible-build story behind the receipts (and stabilizes CI cache keys).
 

Cargo.lock

@@ -10,7 +10,16 @@ license = "MIT OR Apache-2.0"
 keywords = ["genomics", "alignment", "variant-calling", "bioinformatics", "bwt", "fm-index"]
 categories = ["science::bioinformatics", "algorithms"]
 
+[workspace]
+members = ["crates/receipt"]
+# The wasm-bindgen verifier is its own standalone crate (built via wasm-pack), kept
+# out of this workspace so the normal build/test/clippy loop is unaffected.
+exclude = ["crates/receipt-wasm"]
+
 [dependencies]
+# Reproducibility receipt model + offline verification, factored into a leaf crate
+# with no htslib (std + blake3 only) so the verifier can compile to wasm.
+rosalind-receipt = { path = "crates/receipt", version = "0.1.0" }
 # OS bindings (read-only mmap of large reference/index files; peak-RSS readout)
 libc = "0.2"
 # Fast hashing for the reproducibility receipts

Cargo.toml

@@ -0,0 +1,19 @@
+# Standalone (its own [workspace]) so the main Rosalind workspace and its CI are
+# untouched; built only via `wasm-pack`. See web/verify/README.md.
+[package]
+name = "rosalind-receipt-wasm"
+version = "0.1.0"
+edition = "2021"
+rust-version = "1.83"
+license = "MIT OR Apache-2.0"
+description = "Browser (wasm) bindings for rosalind-receipt: drag in a receipt, verify its tamper-evident BLAKE3 self-hash entirely client-side."
+publish = false
+
+[workspace]
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+
+[dependencies]
+rosalind-receipt = { path = "../receipt" }
+wasm-bindgen = "0.2"

crates/receipt-wasm/Cargo.lock

@@ -0,0 +1,59 @@
+//! Browser (wasm) bindings for the Rosalind receipt verifier.
+//!
+//! [`verify`] runs the SAME canonical-JSON + BLAKE3 self-hash check that ships in the
+//! `rosalind verify` CLI (via the `rosalind-receipt` crate) — entirely client-side, no
+//! upload, no server. It returns a small JSON string the page renders.
+
+use rosalind_receipt::{verify_manifest_str, ReceiptVerdict};
+use wasm_bindgen::prelude::*;
+
+/// Verify a receipt's JSON text. Returns a JSON object string:
+/// `{"verdict":"verified|tampered|unverifiable|unparseable","detail":"…",
+/// "self_hash_ok":true|false|null,"measurement_hash_ok":…,"schema_version":N|null,
+/// "subcommand":"…"|null}` — the page does `JSON.parse(verify(text))`.
+#[wasm_bindgen]
+pub fn verify(json: &str) -> String {
+    let c = verify_manifest_str(json);
+    let verdict = match c.verdict {
+        ReceiptVerdict::Verified => "verified",
+        ReceiptVerdict::Tampered => "tampered",
+        ReceiptVerdict::Unverifiable => "unverifiable",
+        ReceiptVerdict::Unparseable => "unparseable",
+    };
+    let tribool = |b: Option<bool>| match b {
+        Some(true) => "true",
+        Some(false) => "false",
+        None => "null",
+    };
+    let opt_u32 = |n: Option<u32>| n.map(|v| v.to_string()).unwrap_or_else(|| "null".to_string());
+    let opt_str = |s: Option<String>| match s {
+        Some(v) => format!("\"{}\"", json_escape(&v)),
+        None => "null".to_string(),
+    };
+    format!(
+        "{{\"verdict\":\"{}\",\"detail\":\"{}\",\"self_hash_ok\":{},\"measurement_hash_ok\":{},\"schema_version\":{},\"subcommand\":{}}}",
+        verdict,
+        json_escape(&c.detail),
+        tribool(c.self_hash_ok),
+        tribool(c.measurement_hash_ok),
+        opt_u32(c.schema_version),
+        opt_str(c.subcommand),
+    )
+}
+
+/// Minimal JSON string escaping for the small set of characters in our detail/subcommand.
+fn json_escape(s: &str) -> String {
+    let mut out = String::with_capacity(s.len());
+    for ch in s.chars() {
+        match ch {
+            '"' => out.push_str("\\\""),
+            '\\' => out.push_str("\\\\"),
+            '\n' => out.push_str("\\n"),
+            '\r' => out.push_str("\\r"),
+            '\t' => out.push_str("\\t"),
+            c if (c as u32) < 0x20 => out.push_str(&format!("\\u{:04x}", c as u32)),
+            c => out.push(c),
+        }
+    }
+    out
+}

crates/receipt-wasm/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "rosalind-receipt"
+version = "0.1.0"
+edition = "2021"
+rust-version = "1.83"
+authors = ["Logan Nye <logannye@users.noreply.github.com>"]
+description = "Rosalind's canonical-JSON, self-hashing BLAKE3 reproducibility receipt: the RunManifest model, content-addressed claim hashing, and offline verification. No htslib — std + blake3 only, so it compiles to wasm."
+repository = "https://github.com/logannye/rosalind"
+license = "MIT OR Apache-2.0"
+keywords = ["reproducibility", "provenance", "blake3", "receipt", "genomics"]
+categories = ["science::bioinformatics", "cryptography"]
+
+[dependencies]
+blake3 = "1.5"

crates/receipt-wasm/src/lib.rs

@@ -0,0 +1,34 @@
+//! Check a receipt's tamper-evident integrity from its `*.manifest.json` alone — the
+//! same self-hash check the in-browser verifier (and `rosalind verify`) runs, without
+//! re-hashing the input/output files.
+//!
+//!   cargo run -p rosalind-receipt --example verify_file -- path/to/sample.manifest.json
+//!
+//! Exit code: 0 = Verified, 1 = anything else (Tampered / Unverifiable / Unparseable).
+
+use std::process::ExitCode;
+
+use rosalind_receipt::{verify_manifest_str, ReceiptVerdict};
+
+fn main() -> ExitCode {
+    let Some(path) = std::env::args().nth(1) else {
+        eprintln!("usage: verify_file <path/to/*.manifest.json>");
+        return ExitCode::from(2);
+    };
+    let json = match std::fs::read_to_string(&path) {
+        Ok(s) => s,
+        Err(e) => {
+            eprintln!("cannot read {path}: {e}");
+            return ExitCode::from(2);
+        }
+    };
+    let c = verify_manifest_str(&json);
+    println!(
+        "{:?}  (self_hash={:?}, measurement_hash={:?}, schema={:?}, subcommand={:?})\n  {}",
+        c.verdict, c.self_hash_ok, c.measurement_hash_ok, c.schema_version, c.subcommand, c.detail
+    );
+    match c.verdict {
+        ReceiptVerdict::Verified => ExitCode::SUCCESS,
+        _ => ExitCode::FAILURE,
+    }
+}

crates/receipt/Cargo.toml

@@ -212,7 +212,7 @@ fn flag_to_key(flag: &str) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::provenance::RunManifest;
+    use crate::RunManifest;
 
     // Build a capture WITHOUT touching the filesystem by injecting hashes directly.
     fn sample() -> CommandCapture {