# WASM Blob Provenance

> Target location: repository root (`WASM-PROVENANCE.md`). Added by audit
> fix LV-9.

The following packages ship prebuilt `.wasm` blobs that have **not** been
byte-verified against a reproducible build:

- `@bokuweb/zstd-wasm@0.0.27` — zstd compression (Codex / PeachScript payloads)
- `@subspace/reed-solomon-erasure.wasm@0.2.5` — Codex erasure coding
- `hash-wasm@4.12.0` — Argon2id KDF (**crypto-critical**)
- vendored `public/ggwave/ggwave.js` + `ggwave.wasm` — ultrasonic pairing
  (carries local patch PEACH-PATCH LV-7; see `src/drafts/AUDIT-FIXES/patches/LV-7-ggwave-newfunction-proto.md`)

These are pinned to exact versions in `package.json` (audit fix LV-9). Any
version bump requires, before merge:

1. Manual review of the upstream diff/release notes.
2. SHA-256 of the shipped `.wasm` blob recorded below, verified against the
   upstream release artifact (or a local reproducible build where upstream
   provides one).
3. Re-application of any local patches (currently: ggwave LV-7).

## Recorded digests

Populate at integration time (`shasum -a 256 <blob>`), one line per blob:

```
<sha256>  node_modules/hash-wasm/dist/... (argon2id wasm)
<sha256>  node_modules/@bokuweb/zstd-wasm/dist/... (zstd wasm)
<sha256>  node_modules/@subspace/reed-solomon-erasure.wasm/... (rs wasm)
<sha256>  public/ggwave/ggwave.wasm
```

Audit reference: peach-browser-security-audit.md, Open Question 3.