# Browser network runtime provenance

`build-wasm.sh` is the only deployable compilation entry. It runs Emscripten
4.0.18 in the Linux amd64 image pinned at
`sha256:2d8b929dad5198249c7ebef36856cab87760d8fc8671eb2633cb915c7696de2e`.
Upstream archives are verified against SHA-256 before extraction. Never reuse a
prebuilt POC `.wasm` or JavaScript loader.

| Component | Exact source | License |
|---|---|---|
| ZeroTier core | `899352e38405968516bb12a770f0ac02f6058fa8` | MPL-2.0 for node/osdep; ext retains its own notices |
| lwIP | `d08f4773edd0182b7910fc8f046eed82ffcd67c9` | BSD-3-Clause |
| Mbed TLS | official `mbedtls-3.6.7.tar.bz2` | Apache-2.0 OR GPL-2.0-or-later; distribution uses Apache-2.0 |

The exact archive hashes are checked in `compile.sh` and recorded in the generated
receipt. ZeroTier's nonfree source is neither linked nor included in the covered
source bundle. The covered-source archive includes all selected upstream code,
headers and license notices, our glue and both patches. Distribute this archive
and notices alongside the executable distribution to provide the MPL-covered
source. No source identities, runtime configuration or POC certificates are used.

The small original POC integration files `wasm/ztweb.cpp`, `wasm/lwipopts.h`,
`wasm/arch/cc.h` and `patches/zerotierone-wasm.patch` were selectively reused from
the user-supplied `zt-browser-final-poc` and modified for explicit network
binding, teardown, managed route gateways and identity proof. The JavaScript
runtime and TLS integration are new. The original POC's glue has no separate
license declaration; its authorship/licensing must be preserved when assigning
the new project's own license. Dependency licensing does not license that glue.

`zerotierone-wasm.patch` disables a metrics background thread and handles local
frame delivery synchronously in WASM; embedding queues frames to prevent
re-entrancy. `zerotier-json-iterators.patch` removes an incorrect pointer
assumption in the bundled nlohmann JSON serializer for modern libc++ iterators.

TLS uses Mbed TLS mandatory certificate-chain and hostname verification, SNI,
TLS >= 1.2, and HTTP/1.1 ALPN. Entropy comes from Emscripten's `getentropy`
(Web Crypto in browsers, cryptographic system RNG in Node). The default trust
bundle is `/etc/ssl/certs/ca-certificates.crt` from the pinned compiler image;
its hash is recorded. Browser trust stores cannot be queried by this runtime.
An explicit trusted CA bundle may be supplied by the portal configuration;
there is no certificate-verification bypass. Update the compiler/root bundle
and Mbed TLS security release pins through review, rebuilding and rerunning
TLS/protocol tests.

## Deliberate limits

Each socket is bound to one lwIP netif and therefore one ZeroTier network, in
both transmit and receive paths. IPv4 currently installs the first assigned
address per network; multiple assigned IPv4 aliases are reported as a stack
warning, not claimed to be usable. IPv6 has three assigned-address slots plus
link-local. Controller-provided managed route gateways use longest-prefix
selection within the chosen interface. No OS routes or DNS are changed.
DNS supports A/AAAA, CNAME, TTL caches partitioned by network, strict UDP source
and question checks, and TCP fallback for truncation. DNSSEC is not implemented.
The controller's DNS service remains part of the network trust model.

TCP receive windows reopen when the stream consumer reads, and TLS pauses
encrypted reads while its decrypted queue reaches a high water mark. Read and
write queues are bounded; excessive writes fail explicitly. This is not a
throughput/performance claim. Network leave and node stop close their sockets. Stop is terminal for a
node instance. A new node creates a new WASM instance.

The test-only WASM injects local frames/configuration without contacting a
controller. It is built under `build/tests/`, never under `web/`, and is not a
shipping artifact. Local tests cover actual TLS verification and core identity
proof, plus network-interface isolation. They do not prove production ZeroTier
connectivity, DNS configuration, MTU behavior or browser lifetime compatibility;
those remain pilot integration acceptance tests.