4.6 KiB
Native WebTransport security observation
The private HTTP relay is the release boundary. Observation does not inspect WebTransport payloads and cannot replace native transport containment.
Electron webRequest does not observe the tested Chromium WebTransport path. The browser now subscribes privately to native Created, Established and Closed events through the existing clipboard security owner's CDP connection. The Electron debugger API and Chromium Network protocol describe this instrumentation. No debugger port or protocol dispatcher is exposed to websites, UI JavaScript or local agents.
Ownership and lifecycle
The clipboard guard owns the only debugger attachment. Its fixed transport lease can enable network observation, attach related targets and resume startup targets; it cannot submit arbitrary commands or detach clipboard protection. Initial about:blank navigation completes before setup commands, which Chromium can otherwise defer indefinitely. Setup finishes before real page navigation. Worker observation is queued before startup resume, covering the tested worker's first statement. Disposal unsubscribes observation, resumes waiting targets and releases auto-attachment while preserving clipboard protection.
Commands, targets, pending attempts and audit queues are bounded. Unexpected detach, command timeout, overflow or audit failure makes the browser remain quarantined until restart. Unexpected native establishment also quarantines synchronously in the native event handler, before entering the serialized audit queue. A held Created-audit regression verifies this ordering. This is a containment alarm; it is not proof that an observer could prevent already transmitted bytes.
Security records
transport.created, transport.closed and transport.established carry an
application-generated UUID, protocol, phase, realm, associated native tab UUID,
connection-established flag and canonical destination hostname. Creation policy
and owner context survive subsequent navigation or policy changes. Native CDP
identifiers, URLs, query strings, initiators, certificates, headers and bodies
are absent. Backend validation rejects contradictory phases, extra fields and
noncanonical host data. Monitor failures accept only fixed reason identifiers.
Records use the protected durable event pipeline. ECS and CEF preserve the lifecycle facts as observations with unknown outcome: a Closed event is not automatically claimed as an inspected or blocked payload. Operational traces use fixed browser.transport stages and correlate audit encryption, persistence and delivery without destination or content attributes. The signed diagnostics switch still controls operational exports independently of security auditing.
Actual Windows evidence
The current shared-owner native fixture proves Window and first-statement dedicated Worker behavior through enrollment, reviewed DIRECT and fetched HTTPS PAC→DIRECT policies. The unguarded control delivered 132 bytes. Managed cases delivered zero packets or bytes, while three public HTTPS submissions worked. Six Created and six Closed records reached the central backend; none Established. All twelve exported phase traces have matching audit-stage parents. Ordinary webRequest callbacks remain zero, so these are actual native observations.
Evidence: ignored artifacts/fullmain-webtransport-native-proof.json, source
hashes and artifacts/cdp-webtransport-native-proof.json. The latter additionally
checks real DevTools coexistence and verifies that observer disposal preserves
clipboard ownership. Earlier literal/restart and real local Gemma regressions
passed on the same source hashes. The later final-source literal/restart test
also passes; the later semantic DLP checks pass but its debug acceptance records
three export timeouts and one concurrency rejection. Those failures remain
open and are separate from receiver containment. These scenarios do not prove every worker, iframe,
shared-worker attribution or future Chromium transport implementation.
Measured limits
During concurrent native source checkout/build work, semantic paste took 2.9–3.7 seconds and public-file inspection 14.3 seconds. Protected audit fsync reached 414 ms. These traces identify work to profile; they do not isolate an observer regression or justify weakening scanning, isolation or persistence. The separate initial-about:blank WebRTC engine crash remains unresolved until a fixed native runtime is compiled and passes its paired receiver tests.