Add wasm browser runtime smoke evidence

eldryoth · eldryoth · commit a27829ebae96 · 2026-07-03T13:57:59.000+02:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -11,6 +11,8 @@
   plus Standard and URL-safe deterministic length sweeps, independent scalar
   reference encode checks, malformed-input rejection, and public API round
   trips.
+- Added Chromium-family browser runtime smoke evidence for the same admitted
+  wasm `simd128` profile.
 - Added a fail-closed wasm encode scalar-verification step: fixed-block wasm
   encode output is staged, compared against scalar output, wiped, and only then
   copied to caller output.
diff --git a/README.md b/README.md
@@ -49,9 +49,10 @@ binary is compiled with `target-feature=+simd128`, the `simd` feature, and the
 explicit `allow-wasm32-best-effort-wipe` feature.
 
 The latest patch in this line is `1.3.3`, which admits narrow wasm `simd128`
-runtime dispatch with Node/V8 and Wasmtime smoke evidence, keeps the wasm
-cleanup caveat fail-closed by default, and adds wrapped-profile helper
-ergonomics. The workspace crate family stays version-aligned at `1.3.3`.
+runtime dispatch with Node/V8, Wasmtime, and Chromium-family browser smoke
+evidence, keeps the wasm cleanup caveat fail-closed by default, and adds
+wrapped-profile helper ergonomics. The workspace crate family stays
+version-aligned at `1.3.3`.
 
 Implemented on this branch now:
 
@@ -107,9 +108,9 @@ Implemented on this branch now:
 - Runtime-dispatched wasm `simd128` fixed-block encode and normal strict
   decode for Standard and URL-safe alphabets when built for `wasm32` with
   `target-feature=+simd128`, `simd`, and
-  `allow-wasm32-best-effort-wipe`. The admission is backed by Node/V8 and
-  Wasmtime runtime smoke evidence; unsupported wasm builds stay scalar by
-  compiling without `+simd128`.
+  `allow-wasm32-best-effort-wipe`. The admission is backed by Node/V8,
+  Wasmtime, and Chromium-family browser runtime smoke evidence; unsupported
+  wasm builds stay scalar by compiling without `+simd128`.
 - Optional `base64-ng-sanitization` companion crate for applications that
   already admit `sanitization` and want direct CT decode helpers into
   clear-on-drop secret containers.
diff --git a/docs/CRATE_VERSION_MATRIX.md b/docs/CRATE_VERSION_MATRIX.md
@@ -8,9 +8,9 @@ sets.
 ## 1.3.3 Release Plan
 
 The `1.3.3` release keeps the workspace crate family synchronized. The main
-crate carries the narrow wasm `simd128` runtime-dispatch admission, Node/V8 and
-Wasmtime smoke evidence, release-gated wasm codegen evidence, and
-wrapped-profile helper ergonomics. Companion crates
+crate carries the narrow wasm `simd128` runtime-dispatch admission, Node/V8,
+Wasmtime, and Chromium-family browser smoke evidence, release-gated wasm
+codegen evidence, and wrapped-profile helper ergonomics. Companion crates
 receive synchronized package metadata so downstream users see one coherent
 crate-family version.
 
diff --git a/docs/PLAN.md b/docs/PLAN.md
@@ -1059,6 +1059,9 @@ inside the `1.3.x` line if they remain evidence-gated and do not weaken the
   execute it under Node/V8 and Wasmtime, requiring `wasm-simd128` candidate,
   active encode, and active decode backend reporting plus Standard and
   URL-safe public API round trips.
+- Add `scripts/check_wasm_browser_dispatch.sh` to execute the same smoke module
+  in a Chromium-family browser when available, without turning the admission
+  into a browser-wide claim.
 - Keep wasm wipe behavior fail-closed unless callers explicitly enable
   `allow-wasm32-best-effort-wipe`.
 - Document JIT, runtime, timing, and zeroization caveats without implying
diff --git a/docs/RELEASE_EVIDENCE.md b/docs/RELEASE_EVIDENCE.md
@@ -74,6 +74,10 @@ The release gate runs:
   when installed, requiring `wasm-simd128` active encode/decode reporting and
   Standard plus URL-safe deterministic length sweeps, independent scalar
   reference encode checks, malformed-input rejection, and round trips
+- wasm simd128 browser smoke evidence through
+  `scripts/check_wasm_browser_dispatch.sh`, which executes the same wasm32
+  smoke module in a Chromium-family browser when installed or when
+  `BASE64_NG_BROWSER` points to a compatible browser binary
 - fail-closed unsupported-native wipe policy documented through
   `allow-compiler-fence-only-wipe` for architectures without an implemented
   hardware wipe barrier
@@ -306,8 +310,9 @@ active for Standard and URL-safe alphabets. Big-endian AArch64 stays scalar,
 and 32-bit ARM NEON remains scaffold evidence. Wasm `simd128` evidence is kept
 in `scripts/check_simd_feature_bundles.sh` as compile/test-binary evidence and
 in `scripts/check_wasm_runtime_dispatch.sh` as Node/V8 and Wasmtime runtime
-smoke evidence. Runtime/JIT timing behavior remains outside the crate's formal
-claim. The script writes
+smoke evidence, and in `scripts/check_wasm_browser_dispatch.sh` as
+Chromium-family browser smoke evidence. Runtime/JIT timing behavior remains
+outside the crate's formal claim. The script writes
 `target/release-evidence/backend/MANIFEST.txt`, `runtime-backend-report.txt`,
 and `simd-prototype-equivalence.txt` so local CPU evidence can be archived. The
 manifest labels prototype-only evidence as `real-non-dispatchable` and
diff --git a/docs/SIMD.md b/docs/SIMD.md
@@ -193,11 +193,11 @@ runtime behavior for that line.
   whole-input scalar validation. Custom alphabets remain scalar because
   portable wasm SIMD does not provide a direct 64-byte alphabet lookup.
   Wasm encode stages vector output and compares it against scalar output before
-  copying to caller output. Node/V8 and Wasmtime runtime smoke evidence proves
-  active backend reporting, deterministic length sweeps, independent scalar
-  reference encode checks, malformed-input rejection, and round trips for the
-  admitted profile; this is not a browser-wide timing, register-retention, or
-  cleanup guarantee. The release-facing decision is
+  copying to caller output. Node/V8, Wasmtime, and Chromium-family browser runtime smoke evidence proves active backend reporting, deterministic length
+  sweeps, independent scalar reference encode checks, malformed-input
+  rejection, and round trips for the admitted profile; this is not a
+  browser-wide timing, register-retention, or cleanup guarantee. The
+  release-facing decision is
   tracked in
   [WASM_SIMD128_RUNTIME_REVIEW.md](WASM_SIMD128_RUNTIME_REVIEW.md).
 - `runtime::backend_report()` reports the active backend, detected candidate,
@@ -279,7 +279,8 @@ compiles under `no_std` when the corresponding Rust targets are installed. For
 wasm `simd128`, it also builds the wasm test binaries with `simd128` enabled so
 the admitted fixed-block wasm code is checked; runtime execution is covered by
 `scripts/check_wasm_runtime_dispatch.sh` when Node/V8 and Wasmtime are
-installed.
+installed, and by `scripts/check_wasm_browser_dispatch.sh` when a
+Chromium-family browser is installed.
 
 Capture local backend and prototype evidence:
 
diff --git a/docs/SIMD_ADMISSION.md b/docs/SIMD_ADMISSION.md
@@ -67,13 +67,14 @@ side-channel evidence package.
 For the `1.3.3` line, wasm `simd128` is admitted for runtime dispatch when the
 binary is compiled for `wasm32` with `target-feature=+simd128`, the `simd`
 feature, and the explicit `allow-wasm32-best-effort-wipe` feature. The
-admitted runtime profile is backed by Node/V8 and Wasmtime runtime smoke
-evidence.
+admitted runtime profile is backed by Node/V8, Wasmtime, and Chromium-family
+browser runtime smoke evidence.
 
 This is a narrow admission, not a browser-wide or runtime-universal claim.
 Wasm execution passes through runtime/JIT engines outside the crate's control,
 so timing, register-retention, cleanup, fallback, and performance claims remain
-limited to the evidence named in this release. The wasm32 wipe policy remains
+limited to the evidence named in this release. Broader browser claims remain
+out of scope until separately evidenced. The wasm32 wipe policy remains
 fail-closed unless callers explicitly enable `allow-wasm32-best-effort-wipe`.
 
 The detailed runtime decision is tracked in
@@ -123,7 +124,7 @@ State labels are intentionally strict:
 | AVX2 | admitted backend | `avx2` | std x86/x86_64 runtime-dispatched encode and strict decode for Standard and URL-safe alphabet families; encode uses fixed 24-byte input blocks, and decode uses fixed 32-byte encoded blocks only after whole-input scalar validation preserves public error shape; shorter inputs fall back to SSSE3/SSE4.1 or scalar, tails use scalar, and unsupported alphabets, in-place encode/decode, wrapped decode, legacy decode, CT secret decode, line-ending insertion, and `no_std` use scalar fallback |
 | SSSE3/SSE4.1 | admitted backend | `ssse3`, `sse4.1` | std x86/x86_64 runtime-dispatched encode and strict decode for Standard and URL-safe alphabet families; encode uses fixed 12-byte input blocks, and decode uses fixed 16-byte encoded blocks only after whole-input scalar validation preserves public error shape; shorter inputs, tails, unsupported alphabets, in-place encode/decode, wrapped decode, legacy decode, CT secret decode, line-ending insertion, and `no_std` use scalar fallback |
 | NEON | admitted backend | `neon` | little-endian std aarch64 runtime-dispatched encode and strict decode for Standard and URL-safe alphabet families; encode uses fixed 12-byte input blocks, and decode uses fixed 16-byte encoded blocks only after whole-input scalar validation preserves public error shape; shorter inputs, tails, unsupported alphabets, big-endian AArch64, 32-bit ARM, in-place encode/decode, wrapped decode, legacy decode, CT secret decode, line-ending insertion, and `no_std` use scalar fallback |
-| wasm `simd128` | admitted backend | `simd128` | wasm32 runtime-dispatched encode and strict decode for Standard and URL-safe alphabet families when compiled with `target-feature=+simd128`, the `simd` feature, and `allow-wasm32-best-effort-wipe`; wasm encode stages vector output and compares it against scalar output before copying to caller output; Node/V8 and Wasmtime runtime smoke evidence proves active encode/decode reporting, a deterministic length sweep, independent scalar reference encode checks, malformed-input rejection, and round trips; shorter inputs, tails, unsupported alphabets, in-place encode/decode, wrapped decode, legacy decode, CT secret decode, line-ending insertion, and browser-specific claims remain scalar, out of scope, or separately reviewed |
+| wasm `simd128` | admitted backend | `simd128` | wasm32 runtime-dispatched encode and strict decode for Standard and URL-safe alphabet families when compiled with `target-feature=+simd128`, the `simd` feature, and `allow-wasm32-best-effort-wipe`; wasm encode stages vector output and compares it against scalar output before copying to caller output; Node/V8, Wasmtime, and Chromium-family browser runtime smoke evidence proves active encode/decode reporting, a deterministic length sweep, independent scalar reference encode checks, malformed-input rejection, and round trips; shorter inputs, tails, unsupported alphabets, in-place encode/decode, wrapped decode, legacy decode, CT secret decode, line-ending insertion, and broader browser-specific claims remain scalar, out of scope, or separately reviewed |
 
 ## Encode Surface Review
 
diff --git a/docs/UNSAFE.md b/docs/UNSAFE.md
@@ -1240,9 +1240,10 @@ Safety argument:
 Limitations:
 
 - Wasm engines include a runtime/JIT optimization layer outside Rust's compiler
-  boundary. This admission is backed by Node/V8 and Wasmtime runtime smoke
-  evidence for correctness and dispatch reporting, but it does not claim
-  runtime timing, register-retention, or JIT zeroization guarantees.
+  boundary. This admission is backed by Node/V8, Wasmtime, and
+  Chromium-family browser runtime smoke evidence for correctness and dispatch
+  reporting, but it does not claim runtime timing, register-retention, or JIT
+  zeroization guarantees.
 
 ### `encode_12_bytes_wasm_standard_family`
 
diff --git a/docs/WASM_SIMD128_RUNTIME_REVIEW.md b/docs/WASM_SIMD128_RUNTIME_REVIEW.md
@@ -17,7 +17,8 @@ The admitted runtime profile is intentionally narrow:
 - full fixed blocks use `simd128`; tails and unsupported surfaces use scalar
 - no line-wrapped decode, legacy whitespace decode, custom alphabets,
   bcrypt-style profiles, in-place decode, or `ct` secret decode
-- runtime smoke evidence is required for Node/V8 and Wasmtime
+- runtime smoke evidence is required for Node/V8, Wasmtime, and at least one
+  Chromium-family browser
 
 When compiled with `simd128`, active encode and decode backends are `wasm-simd128`
 on `wasm32`.
@@ -29,6 +30,9 @@ The admission is backed by:
 - `scripts/check_wasm_runtime_dispatch.sh`, which builds a `cdylib` smoke
   module with `RUSTFLAGS='-C target-feature=+simd128'` and executes it under
   Node/V8 and Wasmtime.
+- `scripts/check_wasm_browser_dispatch.sh`, which executes the same smoke
+  module in a Chromium-family browser through synchronous browser
+  `WebAssembly.Module` instantiation.
 - The smoke checks `runtime::backend_report()` and requires candidate, active
   encode, and active decode backend reporting to be `wasm-simd128`.
 - The smoke runs a deterministic length sweep from 0 through 200 bytes with
@@ -49,7 +53,7 @@ Wasm execution still includes a runtime or JIT layer outside the Rust compiler
 and outside this crate's control. This admission proves correctness and
 dispatch behavior for the named runtime smoke profile; it does not claim:
 
-- browser-wide behavior
+- browser-wide behavior beyond the named Chromium-family smoke runtime
 - runtime/JIT timing behavior for every V8, SpiderMonkey, Wasmtime, Wasmer, or
   edge-compute deployment
 - hardware register-retention cleanup guarantees after the wasm runtime lowers
@@ -85,6 +89,9 @@ provide:
   documentation, the admission manifest, and the runtime boundary.
 - `scripts/check_wasm_runtime_dispatch.sh` executes the runtime smoke under
   Node/V8 and Wasmtime when the tools are installed.
+- `scripts/check_wasm_browser_dispatch.sh` executes the same runtime smoke in
+  a Chromium-family browser when Chrome/Chromium is installed or
+  `BASE64_NG_BROWSER` points to a compatible browser binary.
 - `scripts/check_simd_feature_bundles.sh` keeps compile/test-binary evidence
   for `wasm32-unknown-unknown` with `target-feature=+simd128` when the target
   is installed.
diff --git a/release-notes/RELEASE_NOTES_1.3.3.md b/release-notes/RELEASE_NOTES_1.3.3.md
@@ -13,6 +13,8 @@ wasm `simd128` runtime-dispatch profile with explicit runtime smoke evidence.
   candidate, active encode, and active decode backend reporting plus Standard
   and URL-safe deterministic length sweeps, independent scalar reference
   encode checks, malformed-input rejection, and public API round trips.
+- Added Chromium-family browser runtime smoke evidence for the same admitted
+  wasm `simd128` profile.
 - Added fail-closed scalar verification for wasm fixed-block encode before
   copying staged SIMD output to caller output.
 - Added release-gated wasm SIMD codegen evidence through
@@ -26,9 +28,11 @@ wasm `simd128` runtime-dispatch profile with explicit runtime smoke evidence.
 
 ## Security Notes
 
-- Wasm `simd128` is admitted only for the named Node/V8 and Wasmtime smoke
-  profile and the narrow Standard/URL-safe encode plus strict-decode surface.
-- Browser-wide behavior, runtime/JIT timing behavior, and performance claims
-  remain out of scope until separately evidenced.
+- Wasm `simd128` is admitted only for the named Node/V8, Wasmtime, and
+  Chromium-family browser smoke profiles and the narrow Standard/URL-safe
+  encode plus strict-decode surface.
+- Browser-wide behavior beyond the named Chromium-family runtime,
+  runtime/JIT timing behavior, and performance claims remain out of scope
+  until separately evidenced.
 - The default wasm cleanup policy remains fail-closed unless
   `allow-wasm32-best-effort-wipe` is explicitly enabled.
diff --git a/scripts/check_wasm_browser_dispatch.sh b/scripts/check_wasm_browser_dispatch.sh
@@ -0,0 +1,113 @@
+#!/usr/bin/env sh
+set -eu
+
+wasm_target="${1:-wasm32-unknown-unknown}"
+smoke_dir="target/wasm-runtime-smoke"
+wasm_file="$smoke_dir/target/$wasm_target/release/base64_ng_wasm_runtime_smoke.wasm"
+html_file="$smoke_dir/browser-smoke.html"
+browser_output="$smoke_dir/browser-smoke-output.html"
+
+find_browser() {
+    if [ -n "${BASE64_NG_BROWSER:-}" ]; then
+        printf '%s\n' "$BASE64_NG_BROWSER"
+        return
+    fi
+
+    for candidate in google-chrome chromium chromium-browser chrome microsoft-edge; do
+        if command -v "$candidate" >/dev/null 2>&1; then
+            command -v "$candidate"
+            return
+        fi
+    done
+
+    for candidate in \
+        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" \
+        "/Applications/Chromium.app/Contents/MacOS/Chromium" \
+        "/Applications/Microsoft Edge.app/Contents/MacOS/Microsoft Edge"
+    do
+        if [ -x "$candidate" ]; then
+            printf '%s\n' "$candidate"
+            return
+        fi
+    done
+
+    printf '%s\n' ""
+}
+
+if ! rustup target list --installed 2>/dev/null | grep -F -x -q "$wasm_target"; then
+    echo "wasm browser dispatch: skipping $wasm_target; Rust target is not installed"
+    exit 0
+fi
+
+if [ ! -s "$wasm_file" ]; then
+    echo "wasm browser dispatch: smoke module missing; building through runtime smoke"
+    scripts/check_wasm_runtime_dispatch.sh "$wasm_target"
+fi
+
+browser_bin="$(find_browser)"
+if [ -z "$browser_bin" ]; then
+    echo "wasm browser dispatch: skipping browser smoke; set BASE64_NG_BROWSER=/path/to/chrome-or-chromium"
+    exit 0
+fi
+
+wasm_base64="$(base64 <"$wasm_file" | tr -d '\n')"
+
+cat >"$html_file" <<EOF
+<!doctype html>
+<html>
+<head><meta charset="utf-8"><title>base64-ng wasm browser smoke</title></head>
+<body data-base64-ng-wasm-smoke="pending">
+<pre id="result">pending</pre>
+<script>
+const wasmBase64 = "$wasm_base64";
+
+function decodeBase64(input) {
+  const binary = atob(input);
+  const bytes = new Uint8Array(binary.length);
+  for (let index = 0; index < binary.length; index += 1) {
+    bytes[index] = binary.charCodeAt(index);
+  }
+  return bytes;
+}
+
+try {
+  const module = new WebAssembly.Module(decodeBase64(wasmBase64));
+  const instance = new WebAssembly.Instance(module, {});
+  const result = instance.exports.base64_ng_wasm_runtime_smoke();
+  if (result === 0) {
+    document.body.setAttribute("data-base64-ng-wasm-smoke", "pass");
+    document.getElementById("result").textContent = "BASE64_NG_BROWSER_WASM_SMOKE_PASS";
+  } else {
+    document.body.setAttribute("data-base64-ng-wasm-smoke", "fail-" + result);
+    document.getElementById("result").textContent = "BASE64_NG_BROWSER_WASM_SMOKE_FAIL_" + result;
+  }
+} catch (error) {
+  document.body.setAttribute("data-base64-ng-wasm-smoke", "exception");
+  document.getElementById("result").textContent = "BASE64_NG_BROWSER_WASM_SMOKE_EXCEPTION " + error;
+}
+</script>
+</body>
+</html>
+EOF
+
+case "$html_file" in
+    /*) html_url="file://$html_file" ;;
+    *) html_url="file://$(pwd)/$html_file" ;;
+esac
+
+echo "wasm browser dispatch: running Chromium-family browser smoke with $browser_bin"
+"$browser_bin" \
+    --headless=new \
+    --disable-gpu \
+    --no-sandbox \
+    --disable-dev-shm-usage \
+    --dump-dom \
+    "$html_url" >"$browser_output" 2>&1
+
+if ! grep -F -q "BASE64_NG_BROWSER_WASM_SMOKE_PASS" "$browser_output"; then
+    echo "wasm browser dispatch: browser smoke failed" >&2
+    cat "$browser_output" >&2
+    exit 1
+fi
+
+echo "wasm browser dispatch: ok"
diff --git a/scripts/checks.sh b/scripts/checks.sh
@@ -48,6 +48,9 @@ scripts/generate_wasm_simd_evidence.sh
 echo "checks: wasm SIMD runtime dispatch"
 scripts/check_wasm_runtime_dispatch.sh
 
+echo "checks: wasm SIMD browser dispatch"
+scripts/check_wasm_browser_dispatch.sh
+
 echo "checks: SIMD admission policy"
 scripts/validate-simd-admission.sh
 
diff --git a/scripts/validate-simd-admission.sh b/scripts/validate-simd-admission.sh
@@ -154,8 +154,13 @@ if ! printf '%s\n' "$wasm_row" | grep '| admitted backend |' >/dev/null 2>&1; th
     exit 1
 fi
 
-if ! grep -q 'Node/V8 and Wasmtime runtime smoke evidence' docs/SIMD_ADMISSION.md docs/SIMD.md; then
-    echo "simd admission: wasm admission must name Node/V8 and Wasmtime runtime smoke evidence" >&2
+if ! grep -q 'Node/V8, Wasmtime, and Chromium-family browser runtime smoke evidence' docs/SIMD_ADMISSION.md docs/SIMD.md; then
+    echo "simd admission: wasm admission must name Node/V8, Wasmtime, and Chromium-family browser runtime smoke evidence" >&2
+    exit 1
+fi
+
+if ! grep -q 'Chromium-family browser runtime smoke evidence' docs/SIMD_ADMISSION.md docs/SIMD.md; then
+    echo "simd admission: wasm admission must name Chromium-family browser runtime smoke evidence" >&2
     exit 1
 fi
 
diff --git a/scripts/validate-wasm-posture.sh b/scripts/validate-wasm-posture.sh
