# v86 vendored artifacts

Runtime-facing manifest for the browser-side v86 subprocess backend that
serves pylon's `v86:posix/process@0.1.0` WIT import. See
`docs/tier1-v86-integration.md` for the architectural framing (Path Y:
top-level import satisfied by an in-browser worker rather than a
compose-time stub).

All artifacts here are vendored — CI does not fetch them from the
network. To refresh, re-run `scripts/vendor-v86-assets.sh` after
rebuilding upstream, or copy manually from
`~/git/v86/demo/linux-shell/`.

## Files

Sha256s below are stable across rebuilds when the upstream sources
haven't changed. When you refresh a file, update BOTH this table AND
`../../../THIRD_PARTY_LICENSES.md`.

| File            | Size    | SHA-256                                                          | Upstream                                                | License      |
|-----------------|--------:|------------------------------------------------------------------|---------------------------------------------------------|--------------|
| `v86.core.wasm` | 2.6 MB  | 8475d34b2f68092c447e30a4196f2c75a815cdf29799c174b6822c40a5fb0b50 | github.com/tegmentum/wasm-machine `aecc7a6ea3` demo/linux-shell/gen/v86.core.wasm | BSD-2-Clause |
| `v86.core2.wasm`| 12 KB   | 1faa1b6737d896b5d0d2326bc742d5622654214da78f85daf32f6e4c771767e1 | same, gen/v86.core2.wasm                                | BSD-2-Clause |
| `v86.core3.wasm`| 1.7 KB  | 4ed0560e7e4d44513d01d3bb11d788729da6a8a9475055d77aad91d1a2ff2779 | same, gen/v86.core3.wasm                                | BSD-2-Clause |
| `v86.core4.wasm`| 726 B   | 3d40fb69c4276d54ad8f099e250fcc59b8fbad23100a095f39c36e4a1ed17dc5 | same, gen/v86.core4.wasm                                | BSD-2-Clause |
| `v86.js`        | 400 KB  | 1b7a5f8a2e081e66e953b6842054ef65299bf73c862c9bbd0f3e52b19ad15908 | same, gen/v86.js (jco-transpiled)                       | BSD-2-Clause |
| `loader.js`     | 21 KB   | (in-tree; regenerate sha256 with `shasum -a 256 loader.js`)      | same, demo/linux-shell/loader.js                        | BSD-2-Clause |
| `worker.js`     | ~7 KB   | pylon-authored (not vendored)                                    | this repo, `web/public/v86/worker.js`                   | Apache-2.0   |
| `seabios.bin`   | 128 KB  | 73e3f359102e3a9982c35fce98eb7cd08f18303ac7f1ba6ebfbe6cdc1c244d98 | github.com/coreboot/seabios via v86's vendor/          | LGPL-3.0     |
| `vgabios.bin`   | 36 KB   | a4bc0d80cc3ca028c73dafa8fee396b8d054ce87ebd8abfbd31b06b437607880 | github.com/coreboot/seabios (VGA BIOS) via v86 vendor/ | LGPL-3.0     |
| `bzImage`       | 1.3 MB  | 41970bd96aee882da22316c21a59f81faebe572a1f67ae023a5d6b5993c55928 | linux-6.8.12 minimal-direct-root config; artifact from v86 demo/linux-shell/assets/ | GPL-2.0-only |
| `busybox`       | 1.0 MB  | 645f090c12b8f1b74e86a004d44a7af618b3f1e7eb0dfb94e62da7655bca818f | busybox.net static build; artifact from v86 demo/linux-shell/assets/ | GPL-2.0-only |
| `disk.img`      | 4.0 MB  | b6a3c94b4f653048934668241ef92ade0c77a497c2c2d884967d7ca0ae8c738c | ext2 rootfs (busybox userspace) from v86 demo/linux-shell/assets/ | GPL-2.0-only (kernel headers via busybox); userspace tools mostly GPL-2.0/PD |
| `snapshot.bin`  | 3.1 MB  | 3401e2a8a7ddb4f7f39c881ea2626f99e5824a78caaa4a14dbb8724261065941 | post-boot memory + device snapshot of the same kernel + rootfs above; v86 demo/linux-shell/snapshot.bin | GPL-2.0-only (kernel memory state) |

**Total vendored bytes**: ~12.8 MB (below the 30 MB budget).

## Fast-boot notes

`worker.js` tries snapshot-restore first (2-5 s to shell prompt) using
`snapshot.bin`. If the bundle is missing or unpacks incorrectly, it
falls back to cold-boot (3-5 min). The snapshot is a captured memory
image of the guest at a busybox shell prompt; contents are entirely
derived from the kernel + rootfs listed above, so no additional
licensing obligation applies.

## Licensing summary

pylon top-level is Apache-2.0. This subdirectory ships GPL-2.0-only
(Linux kernel + busybox) and LGPL-3.0 (seabios/vgabios) alongside
BSD-2-Clause (v86). Aggregation semantics apply — the GPL binaries are
distributed unmodified alongside pylon's Apache-2.0 code the same way
any Linux distribution ships a GPLv2 kernel alongside permissively
licensed userspace. See `../../../THIRD_PARTY_LICENSES.md` for the
canonical audit trail and upstream sources.

## Explicitly out of scope (v0.1)

The subprocess bridge in `worker.js` implements a sequential
"one-command-at-a-time-over-the-shell" model. The following are
deferred:

- **Interactive TTY subprocess** — needs bidirectional streaming and a
  distinct pty-per-child; today's model reuses the boot shell.
- **Filesystem sharing between host and guest** — needs virtio-fs;
  known open bug in v86 snapshot restore (see the "v86 console over
  component" memory).
- **Networking from inside the guest** — no NIC wired; the browser
  worker has no bridge to `wasi:sockets` from inside v86.
- **Persistent state across page loads** — cold boot every visit;
  `disk.img` is loaded read-anew per session.
- **Concurrent subprocesses** — the shell bridge is sequential; a
  second `spawn` call while another is in-flight returns an "already
  running" error.

These are enumerated so callers can `try:/except:` around them with
open eyes rather than discovering the gap at runtime.