Wrap third-party software as capsules served over Carrier; never download from other servers #217

Part of #87.

Browser producer: one signed payload closure per supported host

The release build produces one verified ARM64 Browser guest image and matching Mac Apple Silicon and Linux ARM64 helpers, including crosvm and kernel. Both hosts use this same Chromium + Selkies + network-wrapper guest; other hosts use an approved remote Engine. Signed release admission accepts the complete compatible set with provenance, licences, sizes and hashes. Normal setup or first launch obtains the image through the existing streaming file transfer, with progress and the same 30-seconds-without-data limit as other downloads.

Current Browser delivery record — 3 November 2026

Current work. #87 owns Apple Silicon Mac's signed installed proof. #90 owns the proposed 2.1.0 Jetson slice and current target evidence. Main's local 3a8f41c62 source binds Linux ARM64 to the shared ARM64 guest and matching qcow-capable crosvm, vsock and native owner helpers. The guest bytes are shared by content identity while per-host manifest rows select their own dependencies. Source wiring is available; the signed matching package, installer/update proof and release CI for that candidate remain pending. PR #349 is the existing x86 source candidate, with separate qualification under #293.

Next proof. Freeze the compatible manifest and exact native/package inputs after the #90 run and review. Produce, admit and stream the signed image/helper set through the existing installer and #89 update transaction. Prove checksum/size/CID binding, missing/wrong/interrupted payload handling and update/Undo with a surviving profile. Coordinate #406's privileged helper integrity gate. #475 owns the host/guest Node and Chromium freshness follow-up; use its reviewed inputs and #293 maintenance evidence without introducing another producer or install path. The 26 October source and artifact history follows.

Historical ARM artifact and x86 handoff — 26 October

Frozen October ARM artifact: the one matching 4096 MiB guest build and packaging passed on Namespace ARM64. CID QmX9oNy93DBpRNBs7cKNYjRiCZP5S38u7Widr6fbRNYdUo; archive SHA-256 a275c5316b83bced6d6e66c9d188884f5a4810ba8f440ec96fd240693af9807c; size 908320179 bytes; 78-input hash f769b88527b8d5fb7b9b29bb0d2c5ad4553f8b74f5191754251a1fb75da03f1b. The original build receipt has SHA-256 94305bf85e09fe3d25812958091cc369fe5dd458543d57f9d30096b780a81bde. It binds source 703af8d10; the subsequent two-line CI correction preserves all image/helper inputs. The original receipt, input manifest and package record are retained privately. CID uses checksum-pinned Kubo offline, CIDv0, SHA-256, 262144-byte chunks and non-raw leaves. The producer instance has ended and its owned volume remains. Original receipts/input hashes were rechecked on 26 October; recover and rehash archive bytes before reuse. The Mac reserve blocker is cleared. Current develop has newer Chromium/Node pins, so this frozen image is diagnostic provenance rather than the integrated release image. This is a qualification artifact; signed admission and installed acceptance remain open.

Current target proof: Anders completed the one-time root setup. Ordinary-user checks pass KVM API 12, VM descriptor creation, all four slot/filter receipts and 26 root-free network tests. The real Jetson crosvm fault was reproduced and repaired: stopped writable disk workers now retain slot/profile/rootfs leases after leader death, releasing them only after the last writer exits. Cleanup and an independent process scan report zero owned processes. The original and repaired receipts, exact helper hash and independent review are in #90. Faster Close has 17 passing focused tests; installed timings remain pending.

Pending: the complete isolated Jetson Home journey, matching native Runtime/owner installation, actual startup/Close measurements, native-owner shutdown/crash/restart, profile reopen/update and normal signed delivery. Main-disk free space is about 19.5 GiB; the existing sparse-copy path may fit one bounded session after measuring the fresh artifact allocation. External-drive preparation was cancelled. The Mac reserve blocker is cleared; integration and installed proof are the next work. Full acceptance, B01–B16, hardware/media/soak/manual/human review remain open.

Premortem applied: explicit host arguments; preservation of existing tests; every touched target and call site; real module/entrypoint fixtures; identity-bound owned removal. Lessons 740–744 retain the late fixture/CI omissions for integrator triage. Lesson 744's expanded scratch run lacked a committed HEAD and hit a watcher timeout; its GNU timeout explanation is unproven. The focused CI trigger regression passed and the real committed Linux run supplies full-suite evidence.

Next experiment: integrate current develop while preserving its Chromium/Node pins, freeze one candidate, then prepare it on the Ubuntu 22.04 ARM baseline, install into the isolated Jetson Home within its measured disk allowance, then run the #90 page/input/Close/profile journey with timings and screenshots. Anders's root step is complete. The existing prepared removal command applies after qualification. OMP owns reviewed integration, seed staging, signing and release.

Original artifact and primitive receipts (historical): The original 4 GiB ARM guest matches all 78 develop recipe inputs and options, input hash 22b6daeed8fc6cd674b237d9e128bb79077d0afa68b9ae205d0cfe65b4822035. Alpha.15 package run 38241639459 passed on exact develop; proof artifact 11750184041 binds native artifact 11746097793 and image SHA-256 537139b8b03fb899276d53c7a370aeba76eb08bda2ea0787275c57d1e299226f, size 908283362, CID QmPAyAFZ85hQzocVJbzqyTcnKBWfJfNeKady3YtrJ8Go1P. These original bytes remain diagnostic provenance; the current Close input is bound by the new artifact above. The revised setup helper passes 24 focused tests on Mac and all 24 on Jetson (0.415 s), plus independent source review. Its staged SHA-256 is 8cf026e9b31e9caf59ba7855b6810e3d6e628d2cbef367dfb3bc2e898d496cfe; target bytes/help match. Actual Jetson sandbox preflight passed private user/PID/network/filesystem namespaces, host Home exclusion, loopback-only networking, zero effective capabilities, and memory/event descriptor exchange through a pathname Unix socket. This proves those sandbox primitives only. One pinned static ARM vhost-device-vsock experiment built in 64 seconds on an owned Namespace producer: source 4fe41e353a005b1b7163f3f38efde3523f3b160c, binary SHA-256 423d8b4f479c6ef8f73a8bb940e68facd2c33c3b6db48f205c8e9c5d74f503f9, size 3600152. Original build/input receipt, linkage, source/lock/vendor closure and bytes were copied back and verified. The producer and its owned volume were destroyed; operator caches remain.

Prior source handoff: The reviewed amd64 producer repair, exact release-command proof, full Linux slot-2 pass and original artifact receipts remain in the previous source handoff. OMP now owns subsequent PR #349 correction and integration. The earlier ARM recipe mismatch belonged to that amd64 working branch; it does not apply to the approved develop qualification base above.

• Service result — saved-profile audio failed: Clean scratch b390bdef0956e360d021827d2e76d9d3f07c400f, tree c462947dbb5ae67eb1781b9b32c1931cd6bc927e, combines published service 553b471b4 and reviewed producer repair e89b30271. Canonical source-Home installation and its actual generated systemd user unit passed source/installed Runtime parity, MainPID/cgroup ownership, sudo-free PATH and the empty installed setuid/capability scan. Runtime SHA-256 is b9183ae139aeb5c9a9d6cc079ce8d7f49f1ebe0e6b9613698e73d146c6ffaf11; unit SHA-256 is 42a71b09a006669c67b1b4281b5849fad6be8fe878a7e9dfbf1efded316549ef. The write journey passed: first presented frame 32,579 ms, controlled page 33,843 ms, tone 40/40, navigation/type/click/scroll/reload and committed storage. Two reopen runs restored both documents and passed decoded video, typing and clicking, then failed audio continuity before scroll/reload: tone 24/40 and 9/40, with RTP receive/loss deltas 19/213 and 10/276. Close passed 13/13 terminal effects and zero Runtime counts each time, in 4.918 / 5.178 / 5.371 s. Independent installed-evidence review confirms these bounds; the complete read/media journey and Gateway SIGTERM leaves orphan browser-vm-control-service #131 active shutdown/crash/restart/orphan gates stay open. The evidence does not identify a systemd directive as the cause. Fixture image metadata, viewer preparation and PATH issues were corrected without guest changes; their lessons are retained. Home stopped, host setup removal and ACL restoration passed, owned staging was removed, and the disposable machine was destroyed. Original guest inputs remain 23a95d6dab4cf45844f20982807c4f3d45fc4afb1bdfef251d52d8e0b70f3cd6; the guest was reused. Private service-result receipt SHA-256 is b5b0bd31ce70fcd88bdae11fad6a2250552c7dbfdb28039b50bb1df46ce6bc5b. The operator cache retains current helper archives with original receipts. Scratch archive was refused by Codex pinned-task/workspace protection; its clean source and cleanup condition remain in the lifecycle inventory. Earlier source handoff — full-test failure retained: Browser on Linux x86: restore the qualified VM Engine with private boot input and expiring TURN credentials (#217) #349 remains published at 619b641df; clean local e89b302719a7ccaa36f341ef24be22266164c714, tree e3876dfb0a2271593c9c7e855ab8be74da78166e, is 0 behind / 1 ahead. git show --stat records three files, 33 insertions and 20 deletions: the upstream builder, its tests and recipe notices. Independent producer review, 13 helper tests, 23 package fixtures (two recorded Mac skips), diff checks and the Mac source gate passed. The leased Mac behavior suite passed 1537/1537 tests, with zero failures/skips/cancellations, in 200,387 ms. Final Linux result: FAIL. Source/pre-push gate passed 25m26s, including 1502 behavior tests plus one skip and 3478 Rust test executions plus 23 ignored cases. Full Runtime failed 12m30s, with 4164 passed / one failed / 29 ignored: linux::tests::delayed_retirement_keeps_owner_and_writer_lock_until_settlement failed the final exclusive-lock assertion at linux.rs:739. That same case passed in the earlier parallel source gate and then passed alone on the unchanged cached binary in 0.04s; its SHA-256 is 917600ec4a556be2e647ab8155cf22519034f1b3489788d3b9e5cbd5c865c473. Capsule workspaces passed 8m03s, with 914 test executions and three ignored cases, before the stop request; the request made no change. These are execution counts, not unique acceptance criteria. The full-PASS gate remains open. Read-only review found no deterministic production writer-retention defect in the observed join/remove/drop path. Concurrent fork-before-exec descriptor inheritance is a hypothesis; an isolated pass does not prove the cause or replace the failed full run. Automatic lesson 180 records this missed case; local lessons 164–167, 171, 173, 175, 176 and 179 also await integrator triage. Mac free space is now 73 GiB of 460 GiB, above the 10% floor. The Linux check finished and destroyed its owned machine; the operator cache remains. Private source-failure receipt SHA-256 is 80ecad56de018f1687679db9756aa406690712c50771132672757ac87c9e36b6. Handoff and next experiment: OMP receives the exact prepared source, passing and failed checks, installed media failure, helper provenance and cleanup receipts. Queue publication waits for a complete Linux PASS and integrator triage. Capture the remaining lock descriptor owner/reference at the failed parallel assertion, then assess an isolated child-process fixture that preserves both pre-settlement refusal and immediate post-join acquisition. The current source is unchanged and unqueued. A later installed read with existing Engine audio diagnostics retains its separate G5 Private Browser: Browser on Apple Silicon Mac #87 ownership. That earlier handoff removed its heartbeat and stopped; the resumed work and current gates are recorded above. All B01–B16, installed release/update, hardware, media, soak, manual and human-review gates remain unchanged.
• PR Browser on Linux x86: restore the qualified VM Engine with private boot input and expiring TURN credentials (#217) #349 status: see G5 Private Browser: Browser on Apple Silicon Mac #87.
• ARM handoff and CI: The completed ARM handoff binds source c1b99a62f259adb52e445140b92f316927e47fcf, tree c98e1d5700c70fa36350217a16f57c971dde3523. The shared 4096M archive has CID QmPAyAFZ85hQzocVJbzqyTcnKBWfJfNeKady3YtrJ8Go1P, SHA-256 537139b8b03fb899276d53c7a370aeba76eb08bda2ea0787275c57d1e299226f, size 908283362, input hash 22b6daeed8fc6cd674b237d9e128bb79077d0afa68b9ae205d0cfe65b4822035. CI 38072589817 passed all ten jobs on exact c1b99a62; its Mac pre-push gate passed 4050 Rust executions, 1481 behavior tests and 63 gate fixtures. The producer and owned volume were removed. The published x86 review head is 619b641df in Browser on Linux x86: restore the qualified VM Engine with private boot input and expiring TURN credentials (#217) #349; current local 5e8556e92 passed the complete Linux slot-2 run and remains unqueued for integrator lesson triage; its CI is pending publication.
• x86 image and helpers: The one 4096M amd64 guest archive has CID QmRzmE1wGzXU2H7qQ5tqhUx3aJKxZTFHYBdQESch2Y28Y3, SHA-256 3d006e0decfa8bb19995bf1a7ac9544408e1b66834dca232e98bb551ae79ee3c, size 959977870, input hash 23a95d6dab4cf45844f20982807c4f3d45fc4afb1bdfef251d52d8e0b70f3cd6. Original producer source is a8eea5b39f08449d895f95c1bbc1960fec34d6f8, tree 2bf7da5292aebdf66b11b5c8e94ad230822c795a. Image bytes, original receipt and input manifest are copied back and verified. The producer and volume are removed; the operator cache is preserved. Node, Python, debugfs and TURN retain original verified producer receipts. The corrected crosvm archive binds source 646c5d6f005eeae6e559fa33bca7c031399ba4b5, tree 99f23eb563a39d38c8178736ae4edf269284bd98: SHA-256 f97b8e4f05edec3ac3e1d15ead30f96d63e5812a059252708802cf9b2d6c9a01, size 78107999, binary SHA-256 0ae059df137321137527e788e46a6d6d168a6ee66dd9a7c14e2173be058797a6, recipe SHA-256 13f5dc0ee99c97663442afa2fddaca4fa17207c72829fa6533082a3110199330. Its original receipt and copied bytes match the recorded producer recipe. The transplanted native builder now includes current develop fixes and private boot input; OMP builds and admits the current helper recipes. The earlier crosvm receipt remains historical and keeps its original binding. Other four archives retain their original builder receipts; OMP builds and admits those current recipes rather than relabeling old archives. Guest inputs stayed unchanged through all host repairs. The retained archive bytes and full input manifest were rechecked against final 550f60aa and match exactly; the guest was reused.
• Installed Linux journey — PASS: The separate fresh Namespace KVM host uses unmodified canonical source-Home setup and gateway restart under an ordinary user. The installation receipt binds exact 36571a53961f0476f35ef842981be2a1bfd9ff1b, tree 53eac68ee148f5f77c1ea436b366d449e7de4f7f; built/installed Runtime SHA-256 is 53c67d2ffa7643a96a7704f45dd8abf4badbeddf6feda8ff52e81f3703bb0538, native supervisor SHA-256 cc9fe28c8edbbe894ed5ee250d7cbc9f6ec17ee2718e5be7898b2e5f19bb7590, manifest SHA-256 abe2581a908318c4069df2f92a5b070263aac83b8330a9f695d09711139837cc. Served Home/Services bytes match installed/source bytes. Home registration and sign-out/sign-in passed on the preceding unchanged auth source. The final runs reuse that signed Home. Actual Dock click → controlled Chromium/Selkies page → presented 1920×1080 WebRTC frame takes 28,594 ms for write and 29,735 ms for reopen/read. Decoded audio, navigation, typing, clicking, scrolling and toolbar website Reload pass in both runs. Reload frames grow 205→214 and 213→223. Close returns terminal results in 4,824 ms and 4,867 ms, within the unchanged eight-second bound; both prove all thirteen terminal effects and profile durability. Runtime session/launch/cleanup/reconciliation counts return to zero. Reopen reads matching cookies, localStorage and committed IndexedDB from both controlled documents. Private installed-journey receipt SHA-256 is 2bb743a6d9c8635b06eef80eb51a0a30fbfb2aa0fd1346b0e11ba2cc2425e614; raw write/read evidence hashes are 092da155d257a1feb2b0f6304d69da0fd481dab94618166e82a1d72d2f27a053 and 64cf8b40365da5eff479bab342f44a2568c24c2e73a0bbdee7580c4c669294c0. Independent installed evidence review passes and confirms the selected VM Engine and matching component/crosvm receipts. Later 1f36ad20 changes only a test fixture; 550f60aa adds the bounded retirement deadline correction described below. The installed normal journey stays bound to 36571a53; late-patch target fault proof remains open.
• Historical source checks on 550f60aa — PASS: On exact 550f60aa, the full source gate passes and the full behavior suite passes 1524/1524 tests, with zero failures, cancellations or skips, run alone in 205,538 ms. The source gate retains its one explicit fixture skip. Diff/public-copy checks, chain-provider formatting, all 30 retirement/readiness focused tests and the autostart, persistent and settlement ownership smokes pass. Independent final diff review passes SHA-256 bdccb9eef0c4a0167f1527d1bc5962bb59c09cdec4beda688849b9ee63721a0c. Unchanged Rust paths retain the 36571a53 VZ formatting/Clippy and 206 test executions, plus 646c5d6f server/crosvm all-target formatting/Clippy and 3143 executions, with 28 explicitly ignored cases; four actual Linux backend tests also pass. The supplied home-entropy-check.mjs command names a retired file; the current product-data, Home source and public-copy gates cover this tree.
• First failures and scoped repairs: Target proof identified fixed-raster boot arguments, KVM udev ordering, legacy TAP media receipts, static-musl ioctl encodings, retiring control ownership and a Close proof that checked disabled TCP relays. The adapter now reuses the common fixed-vsock Engine transport, Runtime TURN policy, profile and settlement contracts. The authority cause and filtered static-helper repair remain linked. Final behavior checks found an extracted-module fixture syntax error and a real retirement deadline edge; reviewed 1f36ad20 fixes the test fixture and 550f60aa checks deadline expiry before and after the final control probe. The seven-second limit and foreign-owner barriers remain enforced. Deterministic expired-sleep and late-ready-response tests pass with unchanged socket identity. Guest inputs stayed unchanged.
• History disposition: The transplant approval and the current human instruction settle the earlier history gate. The new candidate starts on the rewritten develop history and carries only the reviewed Browser delta. The final canonical python3 scripts/ci-local-prepush.py gate follows the bounded Installer: run the Runtime as a limited service on Linux and macOS #183 Linux security repairs. OMP performs the exact Linux check and cross-family review through the queue.
• Historical published source checks — PASS: Head 619b641df4f6cee48dd8d911c0c85b7aabfcc6a5, tree b0cc2a93cb909971352a604d7b498942e4001d28, passed the refreshed Mac source gate and 1537/1537 behavior tests (174,238 ms; zero failures, cancellations or skips), under the shared lease with the required protected interpreter. The real signing fixture passed alone before that batch. All Rust/Cargo files remain byte-identical to reviewed repair 74ccf27263ea101e88acaef064aab326da2ffa90, tree 208e5da65ad82cd992262180282135e1352cc531; its full Linux slot-2 receipt is reused: source/pre-push gate 28m23s, full Runtime 9m32s, all capsule workspaces 4m39s. That run passed Linux behavior 1514 tests (one recorded skip), all-target check/Clippy, eight common Rust removal tests and the server library (2686 passed, 22 ignored). The three actual Linux TURN cases passed in 0.289 s, including the two Mac pidfd skips. Ten focused Python helper tests and fourteen source-upstream fixtures passed on the repair; those files remain unchanged. Diff, formatting, shell syntax and independent source review pass. Final premortem checked merge/test preservation, complete fixtures, explicit platform inputs, identity-bound removal and every affected test target. All eleven prior Browser configuration tests remain. The full-PASS Linux machine was destroyed and the shared cache preserved. Current guest input hash remains 23a95d6dab4cf45844f20982807c4f3d45fc4afb1bdfef251d52d8e0b70f3cd6; the 78-file guest is reused. All 22 host recipes retain their payload pins; eleven notices bind the merged builder. The existing upstream-asset matrix now includes the release’s Linux x86 runner/target, with guest production unchanged. Captured lessons 132/133/141 cover resolved review findings, 139 the corrected remote probe scope, 148 the corrected merge fail-stop, 150 matrix coverage, and 151 the corrected Mac interpreter setup. Every source correction was resolved before enqueue. Fixture lesson 158 records a corrected confirmation-command quoting error; host setup/check pass after the command correction, with source unchanged. The queue owns the canonical full Mac gate.
• Linux authority and service: Both adapters publish engine_relay_only receipts; Runtime owns the viewer ICE credentials and keeps strict validation. Linux VM boot inputs use private per-session files, session TURN uses expiring REST credentials in private configuration, and source-Home TURN binds declared addresses with a peer allowlist. The fixed-vsock Engine needs read/write /dev/kvm and /dev/vhost-vsock, AF_UNIX/AF_VSOCK plus Runtime AF_INET/AF_INET6, and crosvm user/PID/mount/network namespaces. This zero-NIC launch uses the admitted data root, image/pool/profile paths, owned process checks and temporary control sockets. The retained readiness check also requires /dev/net/tun, the root-owned helper /usr/local/lib/elastos/browser-vm-linux-network.py, /var/lib/elastos-browser/<uid>.json, /run/elastos-browser/<uid>.json, the four UID-owned slot lock files under /run/elastos-browser, and ip on service PATH. Native VM launch attaches zero network devices. Mutable paths stay in the owned data root (profiles, bvm, vz-browser, rootfs-cache and lifetime locks); control sockets and scoped staging use /tmp. The tested unit supplies these paths and permissions with ordinary user authority. The retained TAP helper serves setup/removal compatibility. Published origin/feat/183-service at 553b471b4 is merged into the separate scratch candidate. Its actual generated unit passed the installed write journey; the two saved-profile reopen media failures above keep complete service acceptance open. The Linux fixture's real systemd user manager is ready. Installer host setup and ordinary-user check pass; the account opens KVM and vhost-vsock under the proposed unit limits, and KVM reports API 12. This preflight does not substitute for the actual generated-unit Browser journey. The guest archive is staged with its original receipt; copied SHA-256/size and current input hash match exactly. The preflight machine was destroyed after exact helper cleanup, and the shared cache is preserved. The installed result above binds that exact published service ref, privilege scan, Close and incomplete profile-read/media proof.
• Host setup/removal preflight: The Linux fixture now passes actual host setup, ordinary-user check and removal: four owned TAPs/filter chains and setup records are absent after removal, and the recorded KVM/vhost-vsock user ACLs are restored. Setup was then restored for the service journey. This binds the helper source to 619b641df; it is a host-step proof, while installed Runtime sudo-free/setuid/capability and Jetson/reboot gates remain open.
• Cleanup: Deleted obsolete fix/browser-launch-settlement and fix/browser-vz-vsock-transport with their clean worktrees; their experiments are superseded by the accepted fixed-vsock transport. A useful Wallet harness patch from the latter is preserved privately for Browser mission: complete stable local and remote browsing with human and agent parity #283. Kept fix/87-browser-journey-harness for its unique gateway crash/shutdown/profile lifecycle tests. Removed the merged maturity worktree after retaining its exact uncommitted updater patch and file. Retired the unused historical 8 GiB unpinned guest, preserving provenance; the current 4 GiB image archives remain intact. The operator cache is preserved.
• Next step: OMP receives the exact installed service result and the repeated audio failure; full lifecycle and media acceptance remain open. The exact source handoff is blocked by the failed full Linux native test and lesson triage; OMP owns its next bounded repair and the queue. Next: Jetson test install (G5 Private Browser: Jetson support #90). Browser: prepare the selected local Engine during normal installation and repair #288 delivery and Linux Browser launcher must not need passwordless sudo #165 installer integration are implemented in source; ordinary signed install/update and actual Jetson acceptance stay open. Gateway SIGTERM leaves orphan browser-vm-control-service #131 retains its accepted Mac lifecycle proof; Deliver the shared ARM64 Browser VM through normal setup #307 is merged, and fresh release/current Linux service and fault proofs retain their exact gates. Published, hardware/media/manual, latency/cycle/soak and required human-review gates remain open. B01–B16 remain unchanged.

Jetson one-time host access for the qualification test

Completed by Anders on 22 October. The installed helper SHA-256 is 235a0feca7e4e49d4123e96cf781a70e56845955e7f70d6386115597e3da4d3c; host receipt SHA-256 is 091542484fbbe599264b32721037415343ff0a76606307333973e21af5070e92, as recorded in #90. Private staging configuration supplies BROWSER_STAGE and BROWSER_TEST_USER; the operator receives the exact values privately. The completed command was:

sudo /usr/bin/env PATH=/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/python3 -I "$BROWSER_STAGE/browser-vm-linux-network.py" setup --user "$BROWSER_TEST_USER" --transport userspace-vsock

It copies the helper into /usr/local/lib/elastos, grants this user's KVM ACL, installs this UID's device rule and boot service, and prepares four owned TAPs with the existing TURN peer filter. The selected userspace transport skips the unavailable kernel vsock device. Runtime keeps ordinary user authority. Setup is host preparation; the native transport and installed journey remain pending. The user-side check after setup is:

/usr/bin/python3 -I /usr/local/lib/elastos/browser-vm-linux-network.py check

After all test Browser sessions settle, exact removal is:

sudo /usr/bin/env PATH=/usr/sbin:/usr/bin:/sbin:/bin /usr/bin/python3 -I /usr/local/lib/elastos/browser-vm-linux-network.py remove --user "$BROWSER_TEST_USER"

Removal restores the prior KVM ACL and removes this setup's TAPs, filters, rule, service and receipts. It refuses occupied slots. The native owner retains its slot lease through VM/backend settlement; the repaired disk worker primitive is verified in #90. Fresh image allocation and the one-session disk budget are checked before installed qualification.

Browser release checks (original boxes 5–6)

• The release build produces the Browser image and required matching host helpers, with platform/Runtime/Engine compatibility, full input provenance/licenses, sizes and hashes. PR build(browser): install Selkies 1.6.1 from identified, licensed source; no Selkies download (#87, #217) #249 supplies the identified Selkies source; record remaining build inputs and maintenance ownership.
• Signed release/component records include browser-vm-image and every required role payload with usable content identity and checksums. The image and helper bytes match those records.

#288 owns empty-Home acquisition, configuration/progress, reopen and update. Remote role delivery and broader fault qualification are preserved under #283/#293. Existing non-Browser delivery acceptance remains below; model content stays with #105/#102.

Existing signed software delivery acceptance

• Kubo, llama-server and cloudflared are wrapped as capsules in our signed release: the capsule pins the upstream checksum, carries its license, and is delivered over Carrier by CID. Test: a normal install and an update succeed with every third-party host blocked.
• Setup and update never contact a third-party host for software, and CI does so only through the pinned build-time recipes: no upstream URLs remain in components.json, and ci: seed pinned Kubo from its GitHub release when dist.ipfs.tech is down #216's temporary GitHub fallback in CI is removed. Test: a repository check finds no third-party download URL in the install, update or CI paths outside the build-time recipes.
• Licenses and notices for redistributed binaries (for example Kubo, llama.cpp, cloudflared) ship with the release. Proof: the release lists them.
• Decision recorded here: keep Kubo as an external process, or replace it with an embedded Rust content layer (the Runtime already uses iroh for Carrier). The decision weighs size, IPFS compatibility and confinement.

One lead (Codex) and at most one read-only reviewer. Fast local checks per change, one CI run per coherent batch, failed-job reruns only. OMP integrates the reviewed branch, performs cross-family review and publishes the release. Runtime owns signed artifact admission, configuration and lifecycle; Engine owns website execution and rendering; Exit owns authorized website networking; Carrier carries delivery below Runtime authority.