browser-compute — A browser computes for the project with the server's own code, and the server verifies every result

○PLANNED 0 of 1 issues done

ready

1

blocked

0

active

0

verify

0

done

0

cancelled

0

Problem

On 2026-10-16 the owner asked for a project's page to let a visitor lend their browser's computing to the project, inside the existing mesh, with every result verified and visible. The repository has one crate and no wasm32 build; canonical JSON is written twice; the mesh executes nothing a peer sends; a caller beyond loopback writes nothing and the server authenticates no caller (ADR 0126).

Outcome

One portable core runs on the host and as wasm32 in a browser, held by one executed fixture; the server verifies a browser's result by recomputing it; recording browser results, enrollment and community compute follow only once the owner decides how a remote browser is authenticated and narrowly granted a task (ADR 0170).

Current state

No portable core, no wasm32 target, no fixture shared by the runtimes; two canonical-JSON writers in the executable.

Desired state

apps/majordomus-core is linked by the executable and built for wasm32; the portable-core gate executes the module against the fixture (I2784). The server-side recompute and a same-origin Worker page (next slice) prove that a browser computes and the server agrees, recording nothing.

Scope

• apps/majordomus-core
• apps/majordomus-cli/Cargo.toml
• apps/majordomus-cli/Cargo.lock
• apps/majordomus-cli/build.rs
• apps/majordomus-cli/src/generation.rs
• apps/majordomus-cli/src/mesh/journal.rs
• apps/majordomus-cli/src/capability/executor.rs
• apps/majordomus-cli/tests/portable_core.rs
• .ai/repo/ci/gates.yaml
• .ai/repo/adrs
• .ai/repo/project
• scripts/ci/crate-boundary
• rust-toolchain.toml
• docs

Out of scope

• Writing anything on a browser's behalf before ADR 0170's open question is decided
• WebRTC, peer-to-peer transfer, reputation

Acceptance criteria

• The portable core reproduces the shared fixture on the host, in the executable and as an executed wasm32 module
• An edit to the core is a new generation of the executable
• Nothing a browser returns enters a record before the owner accepts how it is authenticated

Validation

• majordomus plan validate
• majordomus intent validate
• cargo test --manifest-path apps/majordomus-core/Cargo.toml
• cargo test --test portable_core

Risks

• The structure job installs the wasm32 target for the portable-core gate; a runner without network for rustup fails that gate loudly rather than skipping it.

Issues

Each one is an execution contract with its own acceptance criteria, validation command and required evidence. The wave column is the layer of the dependency graph it sits in.

The graph

flowchart LR
    I2784["I2784<br/>One portable core runs on the host and as wasm32, and one executed fixture holds both"]:::ready
    classDef done stroke:#16a34a,fill:#dcfce7,color:#14532d,stroke-width:2px
    classDef active stroke:#2563eb,fill:#eff6ff,color:#1e3a8a,stroke-width:2px
    classDef verify stroke:#7c3aed,fill:#f5f3ff,color:#4c1d95,stroke-width:2px
    classDef ready stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef planned stroke:#0891b2,fill:#ecfeff,color:#164e63,stroke-width:2px
    classDef blocked stroke:#b45309,fill:#fffbeb,color:#78350f,stroke-width:2px
    classDef cancelled stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px
    classDef superseded stroke:#6b7280,fill:#f9fafb,color:#374151,stroke-width:2px

Canonical record: .ai/repo/project/milestones/browser-compute.yaml. Read it back with majordomus plan show browser-compute.