2026-10-14 00:37:32 +02:00
|
|
|
|
# Native WebTransport security observation
|
|
|
|
|
|
|
|
|
|
|
|
The private HTTP relay is the release boundary. Observation does not inspect
|
|
|
|
|
|
WebTransport payloads and cannot replace native transport containment.
|
|
|
|
|
|
|
|
|
|
|
|
Electron webRequest does not observe the tested Chromium WebTransport path.
|
|
|
|
|
|
The browser now subscribes privately to native Created, Established and Closed
|
|
|
|
|
|
events through the existing clipboard security owner's CDP connection.
|
|
|
|
|
|
The [Electron debugger API](https://www.electronjs.org/docs/latest/api/debugger)
|
|
|
|
|
|
and [Chromium Network protocol](https://chromedevtools.github.io/devtools-protocol/tot/Network/)
|
|
|
|
|
|
describe this instrumentation. No debugger port or protocol dispatcher is
|
|
|
|
|
|
exposed to websites, UI JavaScript or local agents.
|
|
|
|
|
|
|
|
|
|
|
|
## Ownership and lifecycle
|
|
|
|
|
|
|
|
|
|
|
|
The clipboard guard owns the only debugger attachment. Its fixed transport
|
|
|
|
|
|
lease can enable network observation, attach related targets and resume startup
|
|
|
|
|
|
targets; it cannot submit arbitrary commands or detach clipboard protection.
|
|
|
|
|
|
Initial about:blank navigation completes before setup commands, which Chromium
|
|
|
|
|
|
can otherwise defer indefinitely. Setup finishes before real page navigation.
|
|
|
|
|
|
Worker observation is queued before startup resume, covering the tested worker's
|
|
|
|
|
|
first statement. Disposal unsubscribes observation, resumes waiting targets and
|
|
|
|
|
|
releases auto-attachment while preserving clipboard protection.
|
|
|
|
|
|
|
|
|
|
|
|
Commands, targets, pending attempts and audit queues are bounded. Unexpected
|
|
|
|
|
|
detach, command timeout, overflow or audit failure makes the browser remain
|
|
|
|
|
|
quarantined until restart. Unexpected native establishment also quarantines
|
|
|
|
|
|
synchronously in the native event handler, before entering the serialized audit
|
|
|
|
|
|
queue. A held Created-audit regression verifies this ordering. This is a containment alarm;
|
|
|
|
|
|
it is not proof that an observer could prevent already transmitted bytes.
|
|
|
|
|
|
|
|
|
|
|
|
## Security records
|
|
|
|
|
|
|
|
|
|
|
|
`transport.created`, `transport.closed` and `transport.established` carry an
|
|
|
|
|
|
application-generated UUID, protocol, phase, realm, associated native tab UUID,
|
|
|
|
|
|
connection-established flag and canonical destination hostname. Creation policy
|
|
|
|
|
|
and owner context survive subsequent navigation or policy changes. Native CDP
|
|
|
|
|
|
identifiers, URLs, query strings, initiators, certificates, headers and bodies
|
|
|
|
|
|
are absent. Backend validation rejects contradictory phases, extra fields and
|
|
|
|
|
|
noncanonical host data. Monitor failures accept only fixed reason identifiers.
|
|
|
|
|
|
|
|
|
|
|
|
Records use the protected durable event pipeline. ECS and CEF preserve the
|
|
|
|
|
|
lifecycle facts as observations with unknown outcome: a Closed event is not
|
|
|
|
|
|
automatically claimed as an inspected or blocked payload. Operational traces
|
|
|
|
|
|
use fixed browser.transport stages and correlate audit encryption, persistence
|
|
|
|
|
|
and delivery without destination or content attributes. The signed diagnostics
|
|
|
|
|
|
switch still controls operational exports independently of security auditing.
|
|
|
|
|
|
|
|
|
|
|
|
## Actual Windows evidence
|
|
|
|
|
|
|
|
|
|
|
|
The current shared-owner native fixture proves Window and first-statement
|
|
|
|
|
|
dedicated Worker behavior through enrollment, reviewed DIRECT and fetched HTTPS
|
|
|
|
|
|
PAC→DIRECT policies. The unguarded control delivered 132 bytes. Managed cases
|
|
|
|
|
|
delivered zero packets or bytes, while three public HTTPS submissions worked.
|
|
|
|
|
|
Six Created and six Closed records reached the central backend; none Established.
|
|
|
|
|
|
All twelve exported phase traces have matching audit-stage parents. Ordinary
|
|
|
|
|
|
webRequest callbacks remain zero, so these are actual native observations.
|
|
|
|
|
|
|
|
|
|
|
|
Evidence: ignored `artifacts/fullmain-webtransport-native-proof.json`, source
|
|
|
|
|
|
hashes and `artifacts/cdp-webtransport-native-proof.json`. The latter additionally
|
|
|
|
|
|
checks real DevTools coexistence and verifies that observer disposal preserves
|
|
|
|
|
|
clipboard ownership. Earlier literal/restart and real local Gemma regressions
|
|
|
|
|
|
passed on the same source hashes. The later final-source literal/restart test
|
2026-10-14 01:18:23 +02:00
|
|
|
|
also passes. Historical semantic debug runs recorded three export timeouts and
|
|
|
|
|
|
one concurrency rejection. The latest semantic and audited transport runs now
|
|
|
|
|
|
pass with zero lifetime failures after bounded exports and policy continuity;
|
|
|
|
|
|
see [diagnostics evidence](diagnostics-backpressure.md). Historical failures
|
|
|
|
|
|
remain retained without retrospective causal claims. These scenarios do not prove every worker, iframe,
|
2026-10-14 00:37:32 +02:00
|
|
|
|
shared-worker attribution or future Chromium transport implementation.
|
|
|
|
|
|
|
|
|
|
|
|
## Measured limits
|
|
|
|
|
|
|
|
|
|
|
|
During concurrent native source checkout/build work, semantic paste took
|
|
|
|
|
|
2.9–3.7 seconds and public-file inspection 14.3 seconds. Protected audit fsync
|
|
|
|
|
|
reached 414 ms. These traces identify work to profile; they do not isolate an
|
|
|
|
|
|
observer regression or justify weakening scanning, isolation or persistence.
|
|
|
|
|
|
The separate initial-about:blank WebRTC engine crash remains unresolved until a
|
|
|
|
|
|
fixed native runtime is compiled and passes its paired receiver tests.
|
