Add Firefox wasm runtime smoke evidence

Author: eldryoth

CHANGELOG.md

@@ -13,6 +13,9 @@
   trips.
 - Added Chromium-family browser runtime smoke evidence for the same admitted
   wasm `simd128` profile.
+- Added Firefox/SpiderMonkey WebDriver runtime smoke evidence through
+  `geckodriver` and an optional Safari/WebKit WebDriver smoke script for
+  macOS evidence gathering.
 - Added a fail-closed wasm encode scalar-verification step: fixed-block wasm
   encode output is staged, compared against scalar output, wiped, and only then
   copied to caller output.

README.md

@@ -49,8 +49,8 @@ binary is compiled with `target-feature=+simd128`, the `simd` feature, and the
 explicit `allow-wasm32-best-effort-wipe` feature.
 
 The latest patch in this line is `1.3.3`, which admits narrow wasm `simd128`
-runtime dispatch with Node/V8, Wasmtime, and Chromium-family browser smoke
-evidence, keeps the wasm cleanup caveat fail-closed by default, and adds
+runtime dispatch with Node/V8, Wasmtime, Chromium-family browser, and
+Firefox/SpiderMonkey smoke evidence, keeps the wasm cleanup caveat fail-closed by default, and adds
 wrapped-profile helper ergonomics. The workspace crate family stays
 version-aligned at `1.3.3`.
 
@@ -109,8 +109,12 @@ Implemented on this branch now:
   decode for Standard and URL-safe alphabets when built for `wasm32` with
   `target-feature=+simd128`, `simd`, and
   `allow-wasm32-best-effort-wipe`. The admission is backed by Node/V8,
-  Wasmtime, and Chromium-family browser runtime smoke evidence; unsupported
+  Wasmtime, Chromium-family browser, and Firefox/SpiderMonkey runtime smoke evidence; unsupported
   wasm builds stay scalar by compiling without `+simd128`.
+  A Safari/WebKit WebDriver smoke script is included for macOS evidence
+  gathering once Safari remote automation is enabled, but Safari is not part
+  of the admitted release claim until its output is captured for a release
+  candidate.
 - Optional `base64-ng-sanitization` companion crate for applications that
   already admit `sanitization` and want direct CT decode helpers into
   clear-on-drop secret containers.

docs/CRATE_VERSION_MATRIX.md

@@ -9,8 +9,8 @@ sets.
 
 The `1.3.3` release keeps the workspace crate family synchronized. The main
 crate carries the narrow wasm `simd128` runtime-dispatch admission, Node/V8,
-Wasmtime, and Chromium-family browser smoke evidence, release-gated wasm
-codegen evidence, and wrapped-profile helper ergonomics. Companion crates
+Wasmtime, Chromium-family browser, and Firefox/SpiderMonkey smoke evidence,
+release-gated wasm codegen evidence, and wrapped-profile helper ergonomics. Companion crates
 receive synchronized package metadata so downstream users see one coherent
 crate-family version.
 

docs/PLAN.md

@@ -1062,6 +1062,10 @@ inside the `1.3.x` line if they remain evidence-gated and do not weaken the
 - Add `scripts/check_wasm_browser_dispatch.sh` to execute the same smoke module
   in a Chromium-family browser when available, without turning the admission
   into a browser-wide claim.
+- Add `scripts/check_wasm_browser_firefox_dispatch.sh` for
+  Firefox/SpiderMonkey WebDriver smoke evidence and
+  `scripts/check_wasm_browser_safari_dispatch.sh` as optional macOS
+  Safari/WebKit evidence tooling.
 - Keep wasm wipe behavior fail-closed unless callers explicitly enable
   `allow-wasm32-best-effort-wipe`.
 - Document JIT, runtime, timing, and zeroization caveats without implying

docs/RELEASE_EVIDENCE.md

@@ -78,6 +78,13 @@ The release gate runs:
   `scripts/check_wasm_browser_dispatch.sh`, which executes the same wasm32
   smoke module in a Chromium-family browser when installed or when
   `BASE64_NG_BROWSER` points to a compatible browser binary
+- wasm simd128 Firefox/SpiderMonkey smoke evidence through
+  `scripts/check_wasm_browser_firefox_dispatch.sh`, which executes the same
+  wasm32 smoke module through `geckodriver` when Firefox is installed
+- optional Safari/WebKit WebDriver smoke evidence through
+  `scripts/check_wasm_browser_safari_dispatch.sh`; this is a manual
+  evidence-gathering script until a release candidate records its output and
+  broadens the admitted browser claim
 - fail-closed unsupported-native wipe policy documented through
   `allow-compiler-fence-only-wipe` for architectures without an implemented
   hardware wipe barrier

docs/SIMD.md

@@ -193,8 +193,9 @@ runtime behavior for that line.
   whole-input scalar validation. Custom alphabets remain scalar because
   portable wasm SIMD does not provide a direct 64-byte alphabet lookup.
   Wasm encode stages vector output and compares it against scalar output before
-  copying to caller output. Node/V8, Wasmtime, and Chromium-family browser runtime smoke evidence proves active backend reporting, deterministic length
-  sweeps, independent scalar reference encode checks, malformed-input
+  copying to caller output. Node/V8, Wasmtime, Chromium-family browser, and
+  Firefox/SpiderMonkey runtime smoke evidence proves active backend reporting,
+  deterministic length sweeps, independent scalar reference encode checks, malformed-input
   rejection, and round trips for the admitted profile; this is not a
   browser-wide timing, register-retention, or cleanup guarantee. The
   release-facing decision is
@@ -279,8 +280,11 @@ compiles under `no_std` when the corresponding Rust targets are installed. For
 wasm `simd128`, it also builds the wasm test binaries with `simd128` enabled so
 the admitted fixed-block wasm code is checked; runtime execution is covered by
 `scripts/check_wasm_runtime_dispatch.sh` when Node/V8 and Wasmtime are
-installed, and by `scripts/check_wasm_browser_dispatch.sh` when a
-Chromium-family browser is installed.
+installed, by `scripts/check_wasm_browser_dispatch.sh` when a Chromium-family
+browser is installed, and by `scripts/check_wasm_browser_firefox_dispatch.sh`
+when Firefox plus `geckodriver` are installed. Safari/WebKit evidence can be
+gathered separately with `scripts/check_wasm_browser_safari_dispatch.sh` on
+macOS with Safari remote automation enabled.
 
 Capture local backend and prototype evidence:
 

docs/SIMD_ADMISSION.md

@@ -67,8 +67,8 @@ side-channel evidence package.
 For the `1.3.3` line, wasm `simd128` is admitted for runtime dispatch when the
 binary is compiled for `wasm32` with `target-feature=+simd128`, the `simd`
 feature, and the explicit `allow-wasm32-best-effort-wipe` feature. The
-admitted runtime profile is backed by Node/V8, Wasmtime, and Chromium-family
-browser runtime smoke evidence.
+admitted runtime profile is backed by Node/V8, Wasmtime, Chromium-family
+browser, and Firefox/SpiderMonkey runtime smoke evidence.
 
 This is a narrow admission, not a browser-wide or runtime-universal claim.
 Wasm execution passes through runtime/JIT engines outside the crate's control,
@@ -77,6 +77,10 @@ limited to the evidence named in this release. Broader browser claims remain
 out of scope until separately evidenced. The wasm32 wipe policy remains
 fail-closed unless callers explicitly enable `allow-wasm32-best-effort-wipe`.
 
+An optional Safari WebKit smoke script is available at
+`scripts/check_wasm_browser_safari_dispatch.sh`, but Safari is not part of the
+admitted release claim until its output is captured for a release candidate.
+
 The detailed runtime decision is tracked in
 [WASM_SIMD128_RUNTIME_REVIEW.md](WASM_SIMD128_RUNTIME_REVIEW.md).
 
@@ -124,7 +128,7 @@ State labels are intentionally strict:
 | AVX2 | admitted backend | `avx2` | std x86/x86_64 runtime-dispatched encode and strict decode for Standard and URL-safe alphabet families; encode uses fixed 24-byte input blocks, and decode uses fixed 32-byte encoded blocks only after whole-input scalar validation preserves public error shape; shorter inputs fall back to SSSE3/SSE4.1 or scalar, tails use scalar, and unsupported alphabets, in-place encode/decode, wrapped decode, legacy decode, CT secret decode, line-ending insertion, and `no_std` use scalar fallback |
 | SSSE3/SSE4.1 | admitted backend | `ssse3`, `sse4.1` | std x86/x86_64 runtime-dispatched encode and strict decode for Standard and URL-safe alphabet families; encode uses fixed 12-byte input blocks, and decode uses fixed 16-byte encoded blocks only after whole-input scalar validation preserves public error shape; shorter inputs, tails, unsupported alphabets, in-place encode/decode, wrapped decode, legacy decode, CT secret decode, line-ending insertion, and `no_std` use scalar fallback |
 | NEON | admitted backend | `neon` | little-endian std aarch64 runtime-dispatched encode and strict decode for Standard and URL-safe alphabet families; encode uses fixed 12-byte input blocks, and decode uses fixed 16-byte encoded blocks only after whole-input scalar validation preserves public error shape; shorter inputs, tails, unsupported alphabets, big-endian AArch64, 32-bit ARM, in-place encode/decode, wrapped decode, legacy decode, CT secret decode, line-ending insertion, and `no_std` use scalar fallback |
-| wasm `simd128` | admitted backend | `simd128` | wasm32 runtime-dispatched encode and strict decode for Standard and URL-safe alphabet families when compiled with `target-feature=+simd128`, the `simd` feature, and `allow-wasm32-best-effort-wipe`; wasm encode stages vector output and compares it against scalar output before copying to caller output; Node/V8, Wasmtime, and Chromium-family browser runtime smoke evidence proves active encode/decode reporting, a deterministic length sweep, independent scalar reference encode checks, malformed-input rejection, and round trips; shorter inputs, tails, unsupported alphabets, in-place encode/decode, wrapped decode, legacy decode, CT secret decode, line-ending insertion, and broader browser-specific claims remain scalar, out of scope, or separately reviewed |
+| wasm `simd128` | admitted backend | `simd128` | wasm32 runtime-dispatched encode and strict decode for Standard and URL-safe alphabet families when compiled with `target-feature=+simd128`, the `simd` feature, and `allow-wasm32-best-effort-wipe`; wasm encode stages vector output and compares it against scalar output before copying to caller output; Node/V8, Wasmtime, Chromium-family browser, and Firefox/SpiderMonkey runtime smoke evidence proves active encode/decode reporting, a deterministic length sweep, independent scalar reference encode checks, malformed-input rejection, and round trips; shorter inputs, tails, unsupported alphabets, in-place encode/decode, wrapped decode, legacy decode, CT secret decode, line-ending insertion, Safari/WebKit, and broader browser-specific claims remain scalar, out of scope, or separately reviewed |
 
 ## Encode Surface Review
 

docs/UNSAFE.md

@@ -1241,7 +1241,7 @@ Limitations:
 
 - Wasm engines include a runtime/JIT optimization layer outside Rust's compiler
   boundary. This admission is backed by Node/V8, Wasmtime, and
-  Chromium-family browser runtime smoke evidence for correctness and dispatch
+  Chromium-family browser and Firefox/SpiderMonkey runtime smoke evidence for correctness and dispatch
   reporting, but it does not claim runtime timing, register-retention, or JIT
   zeroization guarantees.
 

docs/WASM_SIMD128_RUNTIME_REVIEW.md

@@ -17,8 +17,8 @@ The admitted runtime profile is intentionally narrow:
 - full fixed blocks use `simd128`; tails and unsupported surfaces use scalar
 - no line-wrapped decode, legacy whitespace decode, custom alphabets,
   bcrypt-style profiles, in-place decode, or `ct` secret decode
-- runtime smoke evidence is required for Node/V8, Wasmtime, and at least one
-  Chromium-family browser
+- runtime smoke evidence is required for Node/V8, Wasmtime, at least one
+  Chromium-family browser, and Firefox/SpiderMonkey
 
 When compiled with `simd128`, active encode and decode backends are `wasm-simd128`
 on `wasm32`.
@@ -33,6 +33,11 @@ The admission is backed by:
 - `scripts/check_wasm_browser_dispatch.sh`, which executes the same smoke
   module in a Chromium-family browser through synchronous browser
   `WebAssembly.Module` instantiation.
+- `scripts/check_wasm_browser_firefox_dispatch.sh`, which executes the same
+  smoke module in Firefox/SpiderMonkey through `geckodriver`.
+- `scripts/check_wasm_browser_safari_dispatch.sh`, which is an optional
+  operator-run WebDriver evidence script for Safari WebKit. This script is not
+  release-gated until its output is captured for a release candidate.
 - The smoke checks `runtime::backend_report()` and requires candidate, active
   encode, and active decode backend reporting to be `wasm-simd128`.
 - The smoke runs a deterministic length sweep from 0 through 200 bytes with
@@ -53,7 +58,8 @@ Wasm execution still includes a runtime or JIT layer outside the Rust compiler
 and outside this crate's control. This admission proves correctness and
 dispatch behavior for the named runtime smoke profile; it does not claim:
 
-- browser-wide behavior beyond the named Chromium-family smoke runtime
+- browser-wide behavior beyond the named Chromium-family and
+  Firefox/SpiderMonkey smoke runtimes
 - runtime/JIT timing behavior for every V8, SpiderMonkey, Wasmtime, Wasmer, or
   edge-compute deployment
 - hardware register-retention cleanup guarantees after the wasm runtime lowers
@@ -92,6 +98,13 @@ provide:
 - `scripts/check_wasm_browser_dispatch.sh` executes the same runtime smoke in
   a Chromium-family browser when Chrome/Chromium is installed or
   `BASE64_NG_BROWSER` points to a compatible browser binary.
+- `scripts/check_wasm_browser_firefox_dispatch.sh` executes the same runtime
+  smoke through `geckodriver` when Firefox evidence is requested locally or in
+  CI.
+- `scripts/check_wasm_browser_safari_dispatch.sh` executes the same runtime
+  smoke through `safaridriver` when Safari remote automation is enabled on
+  macOS. Safari remains optional evidence until captured for a release
+  candidate.
 - `scripts/check_simd_feature_bundles.sh` keeps compile/test-binary evidence
   for `wasm32-unknown-unknown` with `target-feature=+simd128` when the target
   is installed.

release-notes/RELEASE_NOTES_1.3.3.md

@@ -15,6 +15,11 @@ wasm `simd128` runtime-dispatch profile with explicit runtime smoke evidence.
   encode checks, malformed-input rejection, and public API round trips.
 - Added Chromium-family browser runtime smoke evidence for the same admitted
   wasm `simd128` profile.
+- Added Firefox/SpiderMonkey WebDriver runtime smoke evidence through
+  `geckodriver` for the same admitted wasm `simd128` profile.
+- Added an optional Safari/WebKit WebDriver smoke script for macOS evidence
+  gathering; Safari remains outside the admitted claim until its output is
+  captured for a release candidate.
 - Added fail-closed scalar verification for wasm fixed-block encode before
   copying staged SIMD output to caller output.
 - Added release-gated wasm SIMD codegen evidence through
@@ -28,10 +33,11 @@ wasm `simd128` runtime-dispatch profile with explicit runtime smoke evidence.
 
 ## Security Notes
 
-- Wasm `simd128` is admitted only for the named Node/V8, Wasmtime, and
-  Chromium-family browser smoke profiles and the narrow Standard/URL-safe
-  encode plus strict-decode surface.
-- Browser-wide behavior beyond the named Chromium-family runtime,
+- Wasm `simd128` is admitted only for the named Node/V8, Wasmtime,
+  Chromium-family browser, and Firefox/SpiderMonkey smoke profiles and the
+  narrow Standard/URL-safe encode plus strict-decode surface.
+- Browser-wide behavior beyond the named Chromium-family and
+  Firefox/SpiderMonkey runtimes,
   runtime/JIT timing behavior, and performance claims remain out of scope
   until separately evidenced.
 - The default wasm cleanup policy remains fail-closed unless