Refresh wasm admission release evidence

Author: eldryoth

CHANGELOG.md

@@ -19,6 +19,13 @@
 - Added a fail-closed wasm encode scalar-verification step: fixed-block wasm
   encode output is staged, compared against scalar output, wiped, and only then
   copied to caller output.
+- Hardened the wasm scalar-verification error path so staged stack buffers are
+  wiped before any verification error returns, and narrowed the unsafe block to
+  only the fixed-size wasm SIMD view/call.
+- Added Standard and URL-safe strict decode error-surface evidence proving
+  `decode_slice`, `decode_slice_clear_tail`, stack-buffer, vec, and secret
+  helpers match scalar error shapes and that clear-tail buffers are wiped on
+  rejected input.
 - Added `scripts/generate_wasm_simd_evidence.sh` and wired it into the local
   release checks so installed wasm targets emit release test-harness LLVM IR
   with `target-feature=+simd128` and checked vector-codegen markers.

docs/SIMD_ACTIVATION_CHECKLIST.md

@@ -1,11 +1,11 @@
 # SIMD Activation Checklist
 
 This checklist is mandatory before any additional SIMD code becomes
-dispatchable. AVX-512 VBMI, AVX2, SSSE3/SSE4.1, and NEON encode are admitted
-only for std x86/x86_64 or little-endian std aarch64 Standard and URL-safe
-alphabet families.
-wasm, custom-alphabet, in-place, and decode SIMD paths remain prototype-only or
-scalar until their own checklist evidence is complete.
+dispatchable. AVX-512 VBMI, AVX2, SSSE3/SSE4.1, NEON, and the narrow wasm
+`simd128` runtime profile are admitted only for their documented Standard and
+URL-safe alphabet-family scopes. Custom-alphabet, in-place, wrapped, legacy,
+CT-secret, broader wasm/browser, and future decode surfaces remain
+prototype-only or scalar until their own checklist evidence is complete.
 
 ## Non-Negotiable Rule
 
@@ -64,10 +64,10 @@ and deployment profile have generated-code/JIT evidence, or the release notes
 scope wasm SIMD out of any register-retention claim.
 
 Current non-dispatchable prototypes are exempt from admission only because they
-are test-only and non-dispatchable. The wasm prototype already loads caller
-bytes into vector registers and therefore carries generated-code notes plus
-unsafe-inventory documentation as evidence. That evidence is not enough for
-active dispatch until the full admission package is complete.
+are test-only and non-dispatchable. The narrow wasm `simd128` profile is no
+longer prototype-only: it is admitted only for the documented runtime smoke
+profile and remains scoped out of hardware-like register-retention and
+runtime/JIT timing claims.
 
 ## Source Changes
 

docs/TRUST.md

@@ -12,8 +12,8 @@ stable release.
 | Default dev dependencies | Zero external crates | `Cargo.toml` |
 | Optional runtime features | `alloc`, `std`, `stream`; `allow-wasm32-best-effort-wipe` explicit wasm cleanup-limit acceptance; `allow-compiler-fence-only-wipe` explicit unsupported-native cleanup-limit acceptance; reserved `simd`, `tokio`, `kani`, `fuzzing`. AArch64 CSDB attestation uses custom cfg `base64_ng_aarch64_csdb_attested`, not a feature. | `Cargo.toml`, `scripts/check_reserved_features.sh`, `scripts/check_wasm_wipe_policy.sh` |
 | Unsafe policy | Scalar encode/decode remains safe Rust; audited unsafe is limited to volatile wiping, constant-time comparison, CT alphabet scan and result-gate barriers, and the reviewed SIMD boundary; runtime unsafe-boundary reports are conservative and mark SIMD-enabled builds as not high-assurance-boundary-enforced | `src/cleanup.rs`, `src/ct/`, `src/simd/`, `docs/UNSAFE.md` |
-| Active backend | Scalar by default; std x86/x86_64 AVX-512 VBMI encode preferred, then AVX2, then SSSE3/SSE4.1 encode, plus little-endian std aarch64 NEON encode, when `simd` is enabled and platform checks pass. Strict decode has a separate runtime report method and may use std x86/x86_64 AVX-512 VBMI, AVX2, SSSE3/SSE4.1, or little-endian std aarch64 NEON only. | `runtime::backend_report()` tests |
-| SIMD status | AVX-512 VBMI, AVX2, SSSE3/SSE4.1, and NEON encode admitted for Standard and URL-safe alphabet families; AVX-512 VBMI, AVX2, SSSE3/SSE4.1, and NEON strict decode admitted for std x86/x86_64 or little-endian std aarch64 Standard and URL-safe alphabet families. wasm, custom-alphabet, in-place, wrapped, legacy, CT secret, big-endian AArch64, and `no_std` acceleration remain prototype-only or scalar. | `docs/SIMD.md` |
+| Active backend | Scalar by default; std x86/x86_64 AVX-512 VBMI encode preferred, then AVX2, then SSSE3/SSE4.1 encode, plus little-endian std aarch64 NEON encode, when `simd` is enabled and platform checks pass. Strict decode has a separate runtime report method and may use std x86/x86_64 AVX-512 VBMI, AVX2, SSSE3/SSE4.1, or little-endian std aarch64 NEON. wasm32 binaries compiled with `target-feature=+simd128`, `simd`, and `allow-wasm32-best-effort-wipe` may use the admitted narrow wasm `simd128` encode and strict-decode backend. | `runtime::backend_report()` tests |
+| SIMD status | AVX-512 VBMI, AVX2, SSSE3/SSE4.1, NEON, and narrow wasm `simd128` encode admitted for Standard and URL-safe alphabet families; AVX-512 VBMI, AVX2, SSSE3/SSE4.1, NEON, and narrow wasm `simd128` strict decode admitted for the documented runtime profiles. Custom-alphabet, in-place, wrapped, legacy, CT secret, big-endian AArch64, broader wasm/browser, and `no_std` acceleration remain prototype-only or scalar. | `docs/SIMD.md` |
 | Strict decoding | Default behavior rejects whitespace, mixed alphabets, malformed padding, and non-canonical trailing bits | integration tests |
 | Legacy compatibility | Explicit opt-in APIs only | `decode_slice_legacy`, `validate_legacy` |
 | Constant-time API | Constant-time-oriented scalar validation/decode and equal-length redacted-buffer comparison helpers exist with isolated dudect-style timing evidence; no formal cryptographic constant-time guarantee | `docs/CONSTANT_TIME.md`, `docs/DUDECT.md` |
@@ -65,8 +65,8 @@ without `std`-equivalent runtime probing.
 
 - formally verified cryptographic constant-time behavior
 - formal zeroization of all historical memory copies
-- wasm, custom-alphabet, in-place, wrapped, legacy, CT secret, or `no_std`
-  acceleration
+- custom-alphabet, in-place, wrapped, legacy, CT secret, broader wasm/browser,
+  or `no_std` acceleration
 - async/Tokio support in the core crate's inert `tokio` feature
 - serde or bytes integration in the core crate
 - Kani-complete whole-crate formal verification

docs/WASM_SIMD128_RUNTIME_REVIEW.md

@@ -88,9 +88,11 @@ provide:
 
 - `src/simd/mod.rs` includes `WasmSimd128` in `ActiveBackend` only behind
   `cfg(all(feature = "simd", target_arch = "wasm32"))`.
-- `src/simd/wasm.rs` stages wasm encode output and compares it against scalar
-  output before copying bytes to the caller's output buffer; specifically, it
-  compares it against scalar output before copying bytes to caller output.
+- `src/simd/wasm.rs` stages wasm encode output, compares it against scalar
+  output before copying bytes to the caller's output buffer, and wipes staged
+  stack buffers on every verification failure path before returning.
+  Evidence phrase: compares it against scalar output before copying bytes to the caller's output buffer.
+  Evidence phrase: wipes staged stack buffers on every verification failure path before returning.
 - `scripts/validate-wasm-posture.sh` checks this review document, the SIMD
   documentation, the admission manifest, and the runtime boundary.
 - `scripts/check_wasm_runtime_dispatch.sh` executes the runtime smoke under

release-notes/RELEASE_NOTES_1.3.3.md

@@ -21,6 +21,12 @@ wasm `simd128` runtime-dispatch profile with explicit runtime smoke evidence.
   for the same admitted wasm `simd128` profile.
 - Added fail-closed scalar verification for wasm fixed-block encode before
   copying staged SIMD output to caller output.
+- Hardened wasm scalar-verification cleanup so staged stack buffers are wiped
+  before any verification error returns, and kept the unsafe block scoped to
+  the fixed-size wasm SIMD view/call.
+- Added strict decode error-surface evidence for Standard and URL-safe
+  padded/unpadded public helpers, including clear-tail wiping on rejected
+  input.
 - Added release-gated wasm SIMD codegen evidence through
   `scripts/generate_wasm_simd_evidence.sh`, which emits test-harness LLVM IR
   with `target-feature=+simd128` when the wasm target is installed.

scripts/validate-release-metadata.sh

@@ -213,7 +213,7 @@ for required_trust_text in \
 	"Active backend | Scalar by default; std x86/x86_64 AVX-512 VBMI encode preferred, then AVX2, then SSSE3/SSE4.1 encode, plus little-endian std aarch64 NEON encode" \
 	"no formal cryptographic constant-time guarantee" \
 	"formally verified cryptographic constant-time behavior" \
-	"wasm, custom-alphabet, in-place, wrapped, legacy, CT secret" \
+	"custom-alphabet, in-place, wrapped, legacy, CT secret, broader wasm/browser" \
 	"async/Tokio support" \
     "serde or bytes integration"
 do

scripts/validate-wasm-posture.sh

@@ -49,7 +49,8 @@ require_text "$review_doc" "active encode and decode backends are \`wasm-simd128
 require_text "$review_doc" "deterministic length sweep from 0 through 200 bytes"
 require_text "$review_doc" "independent scalar reference encoder"
 require_text "$review_doc" "malformed block-boundary inputs"
-require_text "$review_doc" "compares it against scalar output before copying bytes"
+require_text "$review_doc" "compares it against scalar output before copying bytes to the caller's output buffer"
+require_text "$review_doc" "wipes staged stack buffers on every verification failure path before returning"
 require_text "$review_doc" "scripts/generate_wasm_simd_evidence.sh"
 require_text "$review_doc" "scripts/check_wasm_runtime_dispatch.sh"
 require_text "$review_doc" "scripts/check_wasm_browser_dispatch.sh"