Updated 2026-10-25. The binding contract is ADR 0015; the browser consent authority is the canonical kotoba.app.client-runtime.v1 in kotoba-lang/wasm-webcomponent/src/kotoba-client-runtime.js. The Web Bridge described here is a design target, not an API that clients can call today.
1. Publish a static candidate
Build HTML/CSS/JavaScript/Wasm and Worker files from an immutable source revision. Record the bundle CID, per-file digests, builder/runtime identity, source and signature, and at least one independently checked pin. Serve candidate bytes through a preview location and compare every fetched file. The app origin serves static verified assets only. Treat the stable hostname as a pointer to a release, not as the identity of the bytes. Current component evidence is in node readiness; a Dougaka preview is an individual static-delivery pilot, not a network-wide release contract.
2. Declare browser operations
The shared descriptor names the browser entry, local-state schema, Workers/protocols and each external operation with service, endpoint origin, method/path or bounded route set, allowed query names/fixed values, data categories and each-operation consent. A product adapter checks the concrete request against that declaration. The canonical broker asks the person immediately before the request, starts with no approvals, rejects undeclared endpoints and redirects, and does not let app code mint approval. Model/artifact downloads are operations too; remote inference needs its own approval. Bot grants never substitute for browser consent. Shared runtime source is the implementation to integrate, not a template to fork.
3. Choose the correct data path
| Need | Path | Current qualification |
|---|---|---|
| Fetch immutable public bytes | CID-addressed Yataverse/IPFS gateway with digest verification; Kura tracks retention. | Pilots exist; check the selected gateway and CID. |
| Read a public app view | Future Awai Web Bridge GET/HEAD for a registered mon/Cell/interface and verified head. | No live integrated endpoint. Do not invent a URL or call an arbitrary node port. |
| Read Aozora social data | Aozora's declared PDS/AppView/XRPC API after operation consent where external. | Product-specific; not rehosted by the bridge. |
| Generate media or infer | Selected Murakumo service directly after operation consent and scoped caller authorization. | Product-specific; not routed through the static app origin or public read bridge. |
| Write, sign, pay or upload | The named service and its own identity/grant/transaction boundary, with a separate browser approval. | Never inferred from a public GET capability. |
4. Prepare a public view
Before an app can use the future bridge, register only explicitly public data. Specify owner, mon CID or non-Cell source, Cell/graph/domain identity, interface DefCID/revision, bounded inputs, visibility policy, verified-head selection, projection version, response schema, cache and provenance. Negative controls must reject private data, invalid CID/signature, unknown view, stale/forked head, unsupported codec, oversized query and a request that would cause a write. The published response must let a reader identify the source and exact version. Holo's Web Bridge is a read-gateway analogy, not an Awai API endpoint.
5. Promote only after proof
Check browser load, consent denial with zero request, real authorized service behavior, accessibility, rollback and independent host readback. Record what was checked from source, preview and public HTTPS separately. Production stable-name promotion needs a separate owner-approved cutover. Until Stage 2 of the roadmap passes, publish static apps and direct-service adapters without claiming a working Awai Web Bridge.