# The verified client, in full Everything a browser runs for a Space is delivered from an origin, and an origin can be compromised — a popped hosting account, a bad deploy, a poisoned cache. The verified client closes that gap on **two orthogonal planes**, and a serious client needs both: - **Verification (integrity)** — *what code runs.* The browser refuses to run any byte that isn't the exact, platform-signed release. - **Confinement (custody)** — *who can touch the room key.* Key custody lives in an outer frame the app cannot read, so the browser's Same-Origin Policy — not the app's own discipline — is the wall. They compose: verification pins the loader so only approved code runs; confinement keeps the key out of that code's reach anyway. **Verify the prisoner and keep the cage.** From there this page climbs the ladder to the strongest tiers — a native [attested client](#the-attested-client), the [verifier extension](#the-verifier-extension) that forces verification on the real bytes, the [power-user stack](#the-power-user-stack) that removes Witbitz from the trust base, and the [certified app](#the-certified-app) that makes a *closed-source* app machine-auditable. > **Status.** The core chain — pinned key → signed cert → manifest → loader → `__vcImport`/`__vcFetch` → bundle + workers > + chunks + pinned assets — is **built and proven on staging** (`preview.witbitz-spaces.pages.dev`) **when forced by the > verifier extension / `?vc`** — the *verified client*, **Implemented**, not the default production boot. Its > extension-free, origin-served counterpart — [the pinned bundle](#the-pinned-bundle), a self-bootstrapping loader + a > signed client manifest that content-pins the shell's *imported module closure* — is **Design, not built**. The > confinement plane (vault sandwich + Kernel) is **live in production**. Where a piece is design or device-only it says so. ## The one problem it solves `script-src 'self'` — the normal same-origin policy — trusts **any** script the origin serves. That is exactly the wrong thing against a *compromised origin*: the evil script is same-origin, so `'self'` waves it through, and stripping the Subresource-Integrity attributes off the HTML disables the per-file checks. The verified client removes `'self'` and replaces "trust the origin" with "trust one small loader whose hash is pinned out-of-band, and let it check everything else." --- # Part 1 — Verification: what code runs ## The trust anchor and the chain Trust bottoms out at a **pinned platform public key** (P-256), published in [verify it yourself](./verify.md) and compiled into the loader and the verifier — never fetched from the app. From there, one signature covers the whole frontend: ```text PINNED platform key → signed /cert.json (frontendSha256, ES256) → sha256(/assets-manifest.json) → every file's hash ``` - **`/cert.json`** is a platform-signed commitment. Its `frontendSha256` is the SHA-256 of the served `/assets-manifest.json`; the signature is verified against the pinned key, and the cert is rejected if it embeds a *different* key (no key-swap). - **`/assets-manifest.json`** is a content-addressed map `{ path → sha256 }` of every served file. Because the cert signs its hash, the manifest — and every file hash in it — is trustworthy once the cert verifies. A compromised origin can serve an evil bundle, but it cannot forge a cert that verifies against the pinned key, so any swapped byte fails the chain and is refused. ## The loader — the small, stable, pinnable entry `spaces/public/space-loader.js` is the entry point. It is deliberately tiny and **stable across app releases** (it imports nothing versioned), so its hash is the one thing an extension has to pin. `space.html` loads it: ```html ``` Its exported `verifyRelease()` runs the chain above (pinned key → cert signature → `frontendSha256 == sha256(manifest)`) and returns run-or-exit. On a mismatch the app is **never imported** and the user sees a plain "couldn't verify this app" page instead of running unknown code. ## Two tiers Verification is opt-in per load, so the default path is byte-identical to a normal boot and a stray cert outage can never brick startup. | Tier | Trigger | What it guarantees | |---|---|---| | **A — verify-in-place** | `?vc=1` (or the verifier) | The served frontend matches the signed release (run-or-exit). The app still loads as normal ES modules under `script-src 'self'`. | | **B — loader-only CSP** | `?vcbundle=1` (or the verifier) | `script-src '' '' …` with **no `'self'`**. Evil same-origin JS cannot run at all. | Tier A answers "is this the right release?" Tier B additionally answers "can anything *else* run?" — no. The [verifier extension](#the-verifier-extension) is what *forces* either tier so the origin can't opt out. ## How Tier B runs a whole app under "no `'self'`" Under a loader-only CSP the browser won't load same-origin `