P0 reframe: native offline browser runtime, trust classes and isolation ADRs

[marcohost33-maker]

Decision state

Marco's product gate G1 = T3 is decided as of 2026-07-14. APP-01's North Star is a native, offline-capable browser/runtime that can progress through:

1. T1 — owner-controlled signed apps;
2. T2 — curated third-party signed apps;
3. T3 — arbitrary foreign web content/apps.

This deliberately overrides the earlier cross-family recommendation to keep v1 T1-only. The staged T1→T2→T3 delivery order remains a safety and evidence strategy; it must not be used to erase the owner-selected T3 product target.

browser is the offline/browser runtime foundation. nigin-engine remains the contract/engine core. browser-nigin is a separate optional AI/LLM layer. APP-01 must function without AI, LLM tokens or cloud-hosting dependency.

Critical clarification

"Run arbitrary foreign webapps offline" is not one technical mode. Issue #30 defines the required distinction between:

• signed packaged apps;
• origin-bound installed PWAs;
• captured/snapshotted sites;
• ordinary remote browsing with optional cache.

No production or compatibility claim may use the generic phrase without naming the acquisition/execution mode and its degraded semantics.

Runtime direction

T3 requires a browser-grade Chromium family path, not a generic system-WebView shell.

ADR-006 / #23 must compare at least:

1. CEF Chrome Runtime / Chrome Bootstrap;
2. Electron bundled Chromium as a rapid-development baseline;
3. Full Chromium downstream/control path as the highest-parity and highest-maintenance option;
4. Tauri/WRY/WebView2 only as a T1/APP-02 or negative/control baseline.

Framework names do not prove isolation. The spike must demonstrate Site Isolation/OOPIF process placement, sandboxing, storage/profile boundaries, popup/navigation/download/protocol controls, IPC sender binding, crash containment and a real engine security patch/rollback drill.

Package, trust and update direction

ADR-007 / #24 compares .swbn/IWA-compatible packages with a minimal deterministic signed package, but package signing is only one layer.

The design must keep these states separate:

• cryptographically valid;
• publisher trusted/admitted;
• security/privacy reviewed;
• capability approved;
• installed;
• enabled;
• quarantined/revoked.

Package signatures bind content and identity; they do not prove harmlessness. Updates require rollback/freeze/mix-and-match protection, key rotation and revocation. Evaluate a TUF-style root/targets/snapshot/timestamp metadata layer rather than inventing these controls ad hoc.

Required ADRs and workstreams

ADR-005 — Product and trust classes

• record G1=T3 and staged T1→T2→T3;
• define the exact acceptance boundary for each class;
• reference P0 architecture: define offline acquisition modes for foreign webapps #30 for acquisition/execution modes.

ADR-006 — Runtime and isolation

Owned by #23. No runtime winner before the adversarial fixture and patch drill.

ADR-007 — Package identity and secure updates

Owned by #24. Separate package verification from trust/admission and secure-update metadata.

ADR-008 — Isolation and capability broker

Require:

• per-app and per-site profile/storage boundaries;
• browser-grade process/Site Isolation evidence;
• no generic native bridge in untrusted renderer contexts;
• typed broker requests bound to app ID, origin/site, frame/SiteInstance, renderer process, capability, arguments and user action;
• default-deny filesystem, process, shell, device, clipboard, download and external-protocol access;
• atomic install/update/rollback and auditable decisions.

T2 governance

Owned by #25. No third-party package admission until T1 runtime/package evidence exists.

Offline semantics

Owned by #30. No claim that a normal foreign website is faithfully offline without explicit evidence for origin, authentication, server dependencies, capture rights and compatibility degradation.

Existing implementation state

PR #17 and PR #22 are merged. Their framing-neutral security, CI, SBOM/evidence, governance, trust-class and evaluation artifacts are useful foundations. Merged documentation does not constitute runtime, package, isolation or patch evidence.

Acceptance gate

• ADR-005 updated to G1=T3 and P0 architecture: define offline acquisition modes for foreign webapps #30 mode taxonomy;
• old T1-only recommendation retained as historical/advisory evidence, not current owner decision;
• P0 T3 runtime spike: CEF Chrome Runtime vs Electron vs Full Chromium #23 produces runtime/Site-Isolation and patch-drill evidence;
• P0 package and secure-update spike: .swbn/IWA vs minimal signed package #24 produces package/parser/update/key-lifecycle evidence;
• P1 governance: T2 publisher admission, capability approval and emergency removal #25 produces T2 admission/removal policy;
• P0 architecture: define offline acquisition modes for foreign webapps #30 defines offline acquisition/execution modes and compatibility grades;
• ADR-008 capability-broker and process/storage model accepted;
• independent final-head security review;
• Marco release/promotion decision.

Primary references

• Chromium Site Isolation: https://www.chromium.org/Home/chromium-security/site-isolation/
• Chromium sandbox: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/design/sandbox.md
• Electron security: https://www.electronjs.org/docs/latest/tutorial/security
• CEF general usage: https://chromiumembedded.github.io/cef/general_usage.html
• ChromeOS Isolated Web Apps: https://chromeos.dev/en/web/isolated-web-apps
• WICG Web Package: https://github.com/WICG/webpackage
• TUF specification: https://theupdateframework.github.io/specification/latest/

No runtime, hostile-content safety or production-readiness claim is made by this issue.

[marcohost33-maker]

Cross-family update after Gemini V2 arrived:

Consensus

• native IPC/core boundary is security-critical;
• app contexts must have no direct filesystem/process capabilities;
• signed offline packages and manual sideload are useful foundations;
• system-WebView differences require explicit cross-platform evidence.

Material divergence

1. Arbitrary foreign apps — Gemini V2 says Tauri v2 capabilities validate both own and foreign apps. Official Tauri docs only claim impact minimization and explicitly exclude malicious Rust code, lax scopes, incorrect command checks, WebView vulnerabilities and supply-chain compromise. Registered custom commands also need explicit restriction. Empty IPC grants do not implement browser-grade navigation, download, profile, permission or patch handling. Proposed disposition: v1 = T1 owner-controlled packages; T2 curated packages after evidence; T3 arbitrary foreign content separate programme.

2. Package format — Gemini V2 selects IWA/.swbn immediately and says it prevents XSS. Chrome documents strong CSP, Trusted Types and cross-origin isolation, but also states CSP is not sufficient against potentially malicious third-party code. IWA initial product availability remains managed-ChromeOS/select-partner oriented; WICG lists Rust Web Bundle tooling as experimental and Go/Node for IWA integrity-block signing. The earlier ChatGPT choice of NAP-1 was also premature. Proposed disposition: two-track verifier spike before selection.

3. Custom protocol wording — .swbn is signed, not encrypted. Serving it through app:// does not inherit Chrome's isolated-app:// origin, storage, CSP, cross-origin isolation or permission enforcement.

Implementation

Draft PR #22 adds ADR-005/006/007 and a comprehensive decision checklist. No runtime or format is claimed as selected. Vero adjudication and Marco's trust-class decision remain open.

[marcohost33-maker]

PR #22 update: head 8e348a3a6a06b78742aadebf41e32112f028c4bc is mergeable; security-ci run 92 and docs-ci run 98 both succeeded. The implementation-status document now reflects the native offline-runtime reframe and distinguishes reusable merged controls from proposed architecture gates. The PR remains Draft pending Vero adjudication, Marco's trust-class decision, runtime/package spikes, PR #17 disposition, and independent final-head review.

[marcohost33-maker]

Vero-Adjudikation (claim-by-claim) — 007 Cross-Family abgeschlossen

Cross-Family-Runde verarbeitet: Gemini (V1/V2) + ChatGPT (v2, hat Gemini bereits cross-family gehärtet) → Vero-Adjudikation (nicht Mehrheitsvotum, claim-by-claim, wie von ChatGPT erbeten).

Konsens bestätigt: browser = natives offline Runtime-Fundament; nigin-engine = Contract-Core; native IPC-Grenze = zentrale Trust-Boundary; App-Webviews default keine nativen Fähigkeiten; signierte Offline-Pakete + getrennte App-Identitäten/Datenräume + fail-closed Updates; manueller Sideload = Baseline.

Falsifiziert/korrigiert (Vero konkuriert mit ChatGPT): „Tauri-Capabilities machen fremde Apps sicher" = falsch (allgemein); „IWA verhindert XSS out-of-the-box" = Überclaim (Signatur = Herkunft, nicht Harmlosigkeit); .swbn = signiert, nicht verschlüsselt; app:// ≠ IWA-Isolation (jede Eigenschaft einzeln re-implementieren/testen); Wasmtime ≠ DOM-Ersatz.

Vero-Netto-Empfehlung:

• v1 = T1-only (eigene signierte Pakete). T3 (arbiträre fremde Webinhalte) = separates künftiges Browser-Produkt, out-of-scope.
• Runtime: ADR-006-Spike, skopiert aufs T1-Bedrohungsmodell (Tauri = Default-Hypothese, Electron/WebView2 = gemessene Baselines; kein Sieger vor Spike; kein synthetischer Gesamtscore).
• Paket: Lean Track B (minimales signiertes Manifest) für v1 — wir sind alleiniger Publisher, und es existiert derzeit kein gepflegter Rust-.swbn-Verifier (IWA-Consumer = enterprise-only). Track A als Studien-Vergleich.
• Zwingendes zusätzliches Cut-Kriterium: auslieferbarer Engine-Security-Patch-Pfad — System-Webview (Tauri) patcht das OS (evtl. spät/nie), gebündeltes Chromium (Electron/CEF) patchen wir selbst. Kann Tauri kippen; ehrlich messen.

Echte Marco-Gates (offen): G1 v1-Scope T1-only? · G2 Publisher-Key-Custody/Release-Autorität · G3 PR #17-Disposition (Vero-Rec: framing-neutrale Härtung transplantieren, Alt-Prämisse-ADRs supersedieren, dann mergen).

Volltext: 007-Chat 02_ANTWORTEN/2026-07-14_007_ANTWORT_browser-reframe_Vero-ADJUDIKATION.

[marcohost33-maker]

Marco-Entscheid (2026-07-14): G1 = T3 (Voll-Browser)

Marco entscheidet den zentralen Scope-Gate: das Programm soll arbiträre fremde Webapps offline ausführen (nicht nur eigene), gestaffelt T1→T2→T3. Dies überstimmt bewusst die konvergente T1-only-Empfehlung (Vero+ChatGPT+Aegis) — Produkt-Call.

Konsequenz: Runtime-Richtung = Chromium/CEF/Electron (geerbte Site-Isolation), nicht Tauri; Engine-Security-Patch-Pfad = zentrales Cut-Kriterium; .swbn/IWA (Track A) für Fremd-Publisher wichtiger. G3 = Transplant läuft (Codie). G2 (Publisher-Key-Custody) → ADR-007. Merge-Gate: Branch-Protection auf 0-Approval angeglichen; nigin-engine #5 (unblockt ADR-002), browser-nigin #3, zaehl #6 gemergt.

007-Entscheid-Protokoll: 02_ANTWORTEN/2026-07-14_007_ENTSCHEID_browser-reframe-G1-T3_Marco.

[marcohost33-maker]

Triage 2026-07-17 — verdict: STILL-VALID (umbrella) · ADR-008 alignment note

This reframe umbrella stays open. One refinement from the ADR-008 standalone reframe (local branch vero/2026-07-16-standalone-reframe-and-report, 12 commits, unpushed during the CI/budget freeze — ADR-008 is not yet on main):

• The wording here — "nigin-engine remains the contract/engine core" — is tightened by ADR-008: nigin-engine/browser-nigin are separate repos with no build or runtime dependency on browser; the relationship is knowledge-transfer only. APP-01 must build, ship and run with zero dependency on those repos.
• MCP is a browser-internal, optional capability off the critical path — not a product pillar.
• The staged T1→T2→T3 order and the ADR-005/006/007/008 workstream split (P0 T3 runtime spike: CEF Chrome Runtime vs Electron vs Full Chromium #23/P0 package and secure-update spike: .swbn/IWA vs minimal signed package #24/P1 governance: T2 publisher admission, capability approval and emergency removal #25/P0 architecture: define offline acquisition modes for foreign webapps #30) remain correct.

Cross-family (007acc 2026-07-16): no runtime candidate is pre-selected; site-isolation ≠ origin-isolation; patchability measured end-to-end; T1 runtime need not equal T3 runtime (split architecture allowed) — already reflected on #23/#24.

Next action: once the freeze lifts, push the reframe branch so ADR-008 + the ADR-007 amendment become live, then reconcile this acceptance checklist. Priority: P0 (umbrella).