Run safely in browsers and at the edge

Supported scope

Runifold's provider-neutral model protocol and selected runtime components can target WASM. Platform support still depends on the enabled features, executor, clock, randomness, persistence, and networking available in the host.

Start from the smallest feature set. Native database drivers, process-based MCP transports, and some observability exporters do not belong in a browser bundle.

Compile the minimal kernel

Install the target and compile the provider-neutral core before adding a browser or edge adapter:

rustup target add wasm32-unknown-unknown
cargo check --target wasm32-unknown-unknown \
  --no-default-features

For an application crate, add only the runifold-providers adapter whose implementation is documented for your target. Run cargo tree -e features and reject accidental native dependencies such as process spawning, native TLS, or database drivers. Compilation is the first gate, not the final compatibility claim.

Credential boundary

Never ship long-lived provider API keys to browser code. Put provider access behind an application gateway that authenticates the user, enforces tenant policy, attaches budgets, and restricts models and features.

Short-lived scoped tokens can reduce exposure, but they do not replace server-side authorization or usage controls.

Browser transports

Browser requests are subject to CORS, proxy buffering, connection lifetime, and tab suspension. Use streaming fetch or SSE only after verifying the target runtime preserves event boundaries and cancellation.

Treat a disconnect as an explicit product decision: cancel the run, persist and resume it, or let a bounded background task finish.

Verified behavior

“Compiles to WASM” is weaker than “works on this edge platform.” Test the exact target triple and deployment runtime for timers, streaming, abort propagation, payload limits, and cold starts.

Record the platform, runtime version, enabled features, and test date alongside the claim.

Recommended browser architecture

Browser/WASM → your authenticated gateway → Runifold service → model provider
             ↘ short-lived app session     ↘ budgets, policy, audit

The browser sends user input and receives application events. The gateway owns provider credentials, translates user identity into capabilities, creates the root budget/deadline, and decides whether disconnect cancels or detaches work. Do not make a long-lived provider key, database credential, MCP stdio process, or unrestricted model choice part of the WASM artifact.

Platform verification checklist

Test on the exact deployed runtime—not only a local browser:

1. cold start and module size with release optimization;
2. DNS/TLS/fetch behavior and required CORS headers;
3. stream event boundaries through every proxy;
4. AbortSignal propagation into Run cancellation;
5. timer precision and maximum request lifetime;
6. random source and UUID behavior;
7. payload, memory, CPU, and subrequest limits;
8. tab suspension, reconnect, duplicate submission, and offline transitions.

If a stream appears only after completion, check proxy buffering and content encoding first. If cancellation works locally but not remotely, confirm the gateway closes or aborts the upstream request and that background policy does not intentionally detach the run.