mirror of
https://github.com/Such-Software/adaptive-multi-protocol-browser.git
synced 2026-10-17 22:41:25 +02:00
Keep transports in one browser window
This commit is contained in:
jwinterm
+13
-16
@@ -14,13 +14,11 @@ isolation decisions outside the browser engine until those contracts are stable.
|
||||
4. Adopt healthy existing transports.
|
||||
5. If the selected transport is missing, show a first-use prompt before setup.
|
||||
6. Start or install managed transports only after user consent.
|
||||
7. Open the URL with the matching isolated profile.
|
||||
7. Continue in a tab carrying the matching transport context.
|
||||
|
||||
The clearnet entry profile is a broker, not a mixed-network profile. It uses direct
|
||||
clearnet networking. Its extension blocks all `.onion` and `.i2p` requests from that
|
||||
profile. For a top-level navigation, it asks a token-gated loopback helper to apply the
|
||||
normal route and consent policy, then opens the destination in a separate transport
|
||||
profile and browser process.
|
||||
AMPB has one visible browser window. Each web tab belongs to a named transport container.
|
||||
A top-level route change replaces that tab in the same window; subresources cannot change
|
||||
transport. The container controls site-data separation and fail-closed proxy policy.
|
||||
|
||||
## Main Components
|
||||
|
||||
@@ -28,8 +26,6 @@ profile and browser process.
|
||||
- `ampbrowser.adapters`: transport ownership, setup, inspection, and health contracts.
|
||||
- `ampbrowser.transports`: local readiness checks for Tor, I2P, IPFS, Reticulum, and Gemini.
|
||||
- `ampbrowser.plan`: dry-run action planner for browser launches.
|
||||
- `ampbrowser.broker`: validated handoff from the clearnet entry profile to an isolated
|
||||
transport profile.
|
||||
- `ampbrowser.launch`: side-effect-free launch specs and first-use consent state.
|
||||
- `ampbrowser.platforms`: platform capability matrix for desktop, Android, and iOS.
|
||||
- `ampbrowser.candidates`: evaluated transport candidates before active adapter support.
|
||||
@@ -48,9 +44,9 @@ Browser equivalence until it tracks the relevant Tor Browser hardening, fingerpr
|
||||
proxy, and update behavior. AMPB should not depend on system Firefox, system Chrome, or
|
||||
the user's default browser.
|
||||
|
||||
The long-term browser can become a deeper Firefox, GeckoView, or Tor Browser fork once
|
||||
the orchestration surface is reliable: profile isolation is predictable, transport adoption
|
||||
is boring, and generated fixtures from AMPG open without manual proxy setup.
|
||||
The release browser requires a reviewed Firefox/Gecko integration. Transport context must
|
||||
be carried below WebExtensions through origin attributes, channel load information,
|
||||
connection pools, storage, cache, service workers, and content-process selection.
|
||||
|
||||
Generated backend metadata lives in
|
||||
[generated browser strategy](generated/browser-strategy.md).
|
||||
@@ -59,16 +55,17 @@ The first implementation path is documented in [desktop vertical](desktop-vertic
|
||||
|
||||
## Isolation Boundaries
|
||||
|
||||
- Browser storage is isolated by transport profile.
|
||||
- The prototype isolates cookies and site data with Firefox transport containers.
|
||||
- Transport runtime state is isolated under AMPB-owned transport directories when AMPB
|
||||
manages the daemon.
|
||||
- A transport profile remains sticky: ordinary navigation stays in that profile and uses
|
||||
- A transport context remains sticky: ordinary navigation stays in that context and uses
|
||||
its configured proxy until the user explicitly starts a different context.
|
||||
- The loopback helper accepts a random per-launch token and recomputes the URL route before
|
||||
opening it. A caller cannot label an I2P URL as Tor or vice versa.
|
||||
managing it. Web content cannot invoke transport management directly.
|
||||
|
||||
These controls prevent accidental browser-state mixing. They do not by themselves provide
|
||||
Tor Browser fingerprinting resistance or make non-anonymous transports anonymous.
|
||||
Container controls do not separate all Firefox profile state and do not by themselves
|
||||
provide Tor Browser fingerprinting resistance. Release anonymity claims require the native
|
||||
Gecko boundary and tracked Tor Browser hardening.
|
||||
|
||||
## Relationship To AMPG
|
||||
|
||||
|
||||
+32
-25
@@ -1,39 +1,46 @@
|
||||
# Transport Broker
|
||||
# Transport Contexts
|
||||
|
||||
> Status: draft | Updated 2026-07-11 | Applies to: AMPB desktop users and implementers
|
||||
|
||||
The transport broker is AMPB's clearnet entry profile. It gives users one place to begin
|
||||
without combining clearnet, Tor, and I2P browser storage or proxy policy.
|
||||
AMPB presents clearnet, Tor, and I2P in one browser window. Every web tab has a visible
|
||||
transport container. Changing transports replaces the tab in the same position and window;
|
||||
it never opens a transport-specific browser window.
|
||||
|
||||
## Handoff
|
||||
## Tab Flow
|
||||
|
||||
1. The broker profile begins a top-level navigation.
|
||||
2. Its extension recognizes `.onion` or `.i2p` and cancels the request.
|
||||
3. A token-gated loopback helper independently routes the URL.
|
||||
4. If needed, AMPB asks for first-use consent and starts or adopts the transport.
|
||||
5. AMPB opens the URL in `.ampb/profiles/tor` or `.ampb/profiles/i2p` with that profile's
|
||||
proxy policy.
|
||||
6. The broker tab reports that the route opened in an isolated context.
|
||||
1. AMPB routes a top-level URL before it loads.
|
||||
2. The current tab continues when its transport context is compatible.
|
||||
3. A different transport is started or adopted only after first-use consent.
|
||||
4. AMPB creates the destination tab in the matching container and removes the old tab.
|
||||
5. Firefox displays the container name and color on the tab and address bar.
|
||||
|
||||
AMPB records the process it launches for each exact profile. Later handoffs reuse only a
|
||||
live process recorded for that profile; otherwise AMPB launches a new isolated process.
|
||||
Subresources cannot switch transports. A mismatched image, frame, script, WebSocket, or
|
||||
background request is blocked. Tor tabs may reach clearnet destinations through Tor. I2P
|
||||
tabs are restricted to I2P destinations unless the user explicitly approves a switch to
|
||||
clearnet.
|
||||
|
||||
The helper rejects a handoff when the supplied transport does not match the URL. It is
|
||||
tied to the broker browser process and stops when that process exits.
|
||||
## Network Policy
|
||||
|
||||
Subresources, frames, and background requests to alternate-network hosts are blocked in
|
||||
the clearnet broker and are not converted into handoffs. Only top-level navigation can
|
||||
open another transport context.
|
||||
- Clearnet containers use direct networking.
|
||||
- Tor containers use SOCKS with proxy-side DNS and a stable first-party isolation token.
|
||||
- I2P containers use the local I2P HTTP proxy and fail closed for non-I2P destinations.
|
||||
- No transport has a direct fallback when its proxy is unavailable.
|
||||
- Speculative connections, prefetching, WebRTC, HTTP/3, and browser DNS-over-HTTPS are
|
||||
disabled in the container prototype.
|
||||
|
||||
## Boundaries
|
||||
The token-gated loopback helper can inspect, start, or adopt transports. It cannot open
|
||||
browser windows or choose a tab's route.
|
||||
|
||||
The broker separates cookies, cache, history, service workers, and other profile storage
|
||||
by transport. AMPB-managed daemon state is separately stored under
|
||||
`.ampb/transports/<transport>`.
|
||||
## Security Boundary
|
||||
|
||||
Transport isolation is not an anonymity claim. Tor browsing still requires Tor Browser
|
||||
hardening and update parity before AMPB can claim equivalent fingerprinting resistance.
|
||||
I2P and Reticulum have different threat models and must be described on their own terms.
|
||||
Firefox containers separate cookies, logins, and site data, but they do not separate every
|
||||
piece of profile state. The one-window WebExtension implementation is therefore a UX and
|
||||
routing prototype, not a claim of Tor Browser anonymity equivalence.
|
||||
|
||||
The release-grade boundary belongs in Gecko. A native `TransportContextId` carried through
|
||||
origin attributes and channel load information must partition storage, cache, permissions,
|
||||
connections, DNS, service workers, and content processes while applying fail-closed network
|
||||
policy below extension code.
|
||||
|
||||
## Command
|
||||
|
||||
|
||||
@@ -28,9 +28,9 @@ artifacts are available for the selected checkout.
|
||||
|
||||
The first transport target is Tor through an AMPB-owned Arti/Tor runtime. The current
|
||||
desktop vertical can launch a bundled Gecko runtime, start the isolated transport broker,
|
||||
and keep its token-gated helper tied to the broker process. Tor and I2P destinations launch
|
||||
in their own browser profiles after route validation and consent. Reticulum follows after
|
||||
the resilient-network adapter and renderer handoff are concrete.
|
||||
and keep its token-gated helper tied to the browser process. Clearnet, Tor, and I2P remain
|
||||
in one visible window as transport container tabs. Reticulum follows after the
|
||||
resilient-network adapter and inert document renderer are concrete.
|
||||
|
||||
## Desktop Shell
|
||||
|
||||
|
||||
@@ -3,10 +3,14 @@
|
||||
> Status: draft | Updated 2026-07-11 | Applies to: AMPB and AMPG compatibility checks
|
||||
|
||||
AMPB can check AMPG fixture manifests without contacting any network. The check confirms
|
||||
that each generated fixture URL routes to the expected AMPB transport and profile, uses
|
||||
the declared transport-profile isolation contract, and fits that transport's interaction
|
||||
that each generated fixture URL routes to the expected AMPB transport context, uses
|
||||
the declared transport-context isolation contract, and fits that transport's interaction
|
||||
policy.
|
||||
|
||||
`ampg.fixture-manifest.v2` uses `checks.context` for the logical browser context. AMPB can
|
||||
still read v1 manifests for route compatibility, but v2 is required for the current
|
||||
one-window isolation contract.
|
||||
|
||||
Route-expanded fixtures may include `route.match` and `route.fixture_path`, which identify
|
||||
the route group that produced the fixture.
|
||||
|
||||
@@ -21,8 +25,8 @@ manifest.
|
||||
|
||||
## Scope
|
||||
|
||||
Fixture checks validate route selection, profile isolation expectations, and declared
|
||||
interaction policy only. They do not verify process separation, daemon health, hidden
|
||||
Fixture checks validate route selection, context isolation expectations, and declared
|
||||
interaction policy only. They do not verify engine-level partitioning, daemon health, hidden
|
||||
service reachability, IPFS pinning, TLS, or content freshness.
|
||||
|
||||
The manifest must not contain private deployment notes, service keys, credentials, or
|
||||
|
||||
@@ -6,8 +6,8 @@ This file is generated from code. Do not edit it by hand.
|
||||
|
||||
| Backend | Role | Status | Platforms | Launch Mode | Privacy Posture | Note |
|
||||
| --- | --- | --- | --- | --- | --- | --- |
|
||||
| `ampb-gecko-desktop` | primary desktop runtime | `planned` | desktop | bundled Firefox/Gecko-lineage app with AMPB-owned profiles and transports | no system browser dependency; track Firefox ESR, Tor Browser, and Mullvad hardening choices | Default desktop runtime; users should not need Firefox installed. |
|
||||
| `ampb-geckoview-android` | primary android runtime | `planned` | android | bundled GeckoView/Fenix/Tor Browser Android-lineage app with foreground transports | no system browser dependency; app owns profile, proxy policy, and transport lifecycle | Default Android runtime for real mobile AMPB. |
|
||||
| `ampb-gecko-desktop` | primary desktop runtime | `planned` | desktop | bundled Firefox/Gecko-lineage app with one window and AMPB-owned transport contexts | no system browser dependency; track Firefox ESR, Tor Browser, and Mullvad hardening choices | Default desktop runtime; users should not need Firefox installed. |
|
||||
| `ampb-geckoview-android` | primary android runtime | `planned` | android | bundled GeckoView/Fenix/Tor Browser Android-lineage app with foreground transports | no system browser dependency; app owns context, proxy policy, and transport lifecycle | Default Android runtime for real mobile AMPB. |
|
||||
| `ampb-webkit-ios` | ios runtime | `planned` | ios | bundled iOS app shell with WebKit views and embedded transport runtimes | platform constrained; avoid clearnet fallback and isolate transport state | Default iOS path unless alternate browser-engine entitlements become practical. |
|
||||
| `tor-browser-lineage` | tor-hardened target | `planned` | desktop, android | reuse or track Tor Browser patches after AMPB transport contracts are stable | highest Tor web target; do not claim equivalence until Tor Browser patches are tracked | Path toward real Tor Browser-grade behavior for .onion browsing. |
|
||||
| `gemini-native-viewer` | alternate-web viewer | `planned` | desktop, android, ios | built-in fetch and render path | no web engine or shared browser storage required | Used for Gemini and similar lightweight document transports. |
|
||||
|
||||
@@ -6,8 +6,8 @@ This file is generated from code. Do not edit it by hand.
|
||||
|
||||
| Transport | Platform | Browse | Adopt | Manage | Install | Note |
|
||||
| --- | --- | --- | --- | --- | --- | --- |
|
||||
| `clearnet` | `desktop` | `ready` | `ready` | `unsupported` | `unsupported` | Use bundled AMPB Gecko desktop runtime with isolated profile. |
|
||||
| `clearnet` | `android` | `ready` | `ready` | `unsupported` | `unsupported` | Use bundled AMPB GeckoView Android runtime with isolated profile. |
|
||||
| `clearnet` | `desktop` | `ready` | `ready` | `unsupported` | `unsupported` | Use one bundled AMPB Gecko window with isolated transport contexts. |
|
||||
| `clearnet` | `android` | `ready` | `ready` | `unsupported` | `unsupported` | Use one bundled GeckoView app with isolated transport sessions. |
|
||||
| `clearnet` | `ios` | `ready` | `ready` | `unsupported` | `unsupported` | Use bundled AMPB iOS shell with platform WebKit constraints. |
|
||||
| `tor` | `desktop` | `ready` | `ready` | `planned` | `planned` | Adopt local Tor or prompt before managed Arti SOCKS setup. |
|
||||
| `tor` | `android` | `planned` | `planned` | `planned` | `planned` | Use an app-owned foreground service; prefer Arti/Tor runtime integration where available. |
|
||||
|
||||
+5
-5
@@ -34,11 +34,11 @@ adopted daemon from an AMPB-owned managed process.
|
||||
through a desktop dialog when possible, falls back to a terminal prompt when needed, and
|
||||
launches through the same transport runner after approval.
|
||||
|
||||
`ampbrowser open <clearnet-url> --broker --launch` creates the desktop entry profile. The
|
||||
broker has direct clearnet networking and no mixed-transport PAC. Its extension cancels
|
||||
all `.onion` and `.i2p` requests before they leave the profile. For a top-level navigation,
|
||||
it asks a token-gated loopback helper to open the URL in the isolated Tor or I2P profile.
|
||||
Missing transports use the same first-use consent flow before the handoff. `--route-aware`
|
||||
`ampbrowser open <clearnet-url> --broker --launch` creates the single-window desktop entry
|
||||
profile. Its extension assigns every web tab to a visible clearnet, Tor, or I2P container.
|
||||
When a top-level URL needs another transport, AMPB starts or adopts it after first-use
|
||||
consent, creates the destination tab in the matching container at the same position, and
|
||||
removes the old tab. It never opens a transport-specific browser window. `--route-aware`
|
||||
remains a compatibility alias for `--broker`.
|
||||
|
||||
## Examples
|
||||
|
||||
@@ -22,7 +22,7 @@ user can install a missing provider. I2P currently reports Homebrew, apt, dnf, p
|
||||
or pkg guidance where applicable, plus the `AMPB_I2PD_BIN` and
|
||||
`transports.i2p.binary_path` override path.
|
||||
|
||||
Route-aware desktop launches add a local helper process for in-browser setup prompts. The
|
||||
Single-window desktop launches add a local helper process for in-browser setup prompts. The
|
||||
helper accepts token-gated loopback requests from the AMPB profile extension, reports
|
||||
transport status, and starts only supported AMPB-managed transports. It does not expose a
|
||||
public network listener or manage adopted daemons. The helper watches the browser process
|
||||
|
||||
Reference in New Issue
Block a user