Merge branch 'docs/e6-done' into develop

Author: jagottsicher

README.md

@@ -98,6 +98,18 @@ every commitment and every proof itself.
 
 Nine sections, explained one by one in [`demo/README.md`](demo/README.md).
 
+### Try the browser verifier against a real node
+
+```sh
+go run ./demo -serve
+```
+
+Runs the same demonstration, then keeps the node up and prints a ready link — build the WASM
+verifier once (`client/wasm/build.sh`), open `client/web/index.html`, paste the link's node URL and
+subject in, and watch the same checks the demo just ran happen again independently, this time in
+the browser rather than the CLI. Details, including what the page deliberately does not trust:
+[`client/README.md`](client/README.md), [OWM-8](spec/owm-8-client.md).
+
 ## How it works
 
 ### Entry, leaf, tree
@@ -253,7 +265,7 @@ wants to pull in `core/` on its own.
 | [`trust/`](trust/) | entity trust levels from attestation chains | Apache-2.0 |
 | [`node/`](node/) | node server and `owmnode` | AGPL-3.0-only |
 | [`monitor/`](monitor/) | independent log monitor | AGPL-3.0-only |
-| [`client/`](client/) | WASM verifier and web app (planned) | Apache-2.0 |
+| [`client/`](client/) | WASM verifier and web app | Apache-2.0 |
 | [`demo/`](demo/) | end-to-end demonstration against a real node | Apache-2.0 |
 | [`testdata/`](testdata/) | test vectors for third-party implementations | Apache-2.0 |
 
@@ -274,7 +286,7 @@ far is meant for production use.
 | E4 | federation: DNS discovery, gossip, `monitor/` | done |
 | E5 | trust levels, attestations, sensor certificates | done |
 | — | ten further schema profiles across other industries (see the table above) | done |
-| E6 | web app and WASM verifier | next |
+| E6 | web app and WASM verifier | done |
 | E7/E8 | deposit system and dispute resolution | deliberately deferred |
 
 E7/E8 wait until at least two independently operated nodes carry real data. Only then can cap
@@ -292,6 +304,7 @@ deliberately built so that it does not depend on them.
 | [OWM-5](spec/owm-5-federation.md) | federation: DNS discovery, gossip, the independent monitor's contract |
 | [OWM-6](spec/owm-6-trust.md) | trust levels, attestation entries, sensor certificates |
 | [OWM-7](spec/owm-7-node-api.md) | node API: submitting, reading, proofs, administration |
+| [OWM-8](spec/owm-8-client.md) | client and verifier: fetch-then-verify contract, CORS, addressing |
 | [OWM-9](spec/owm-9-threat-model.md) | threat model, limits of the system |
 
 Package-level explanations live in the README files of the directories

demo/README.md

@@ -21,6 +21,7 @@ It needs no outside network and touches nothing that is not its own.
 | `-keep` | keep the working directory (database, identity, configuration) |
 | `-work DIR` | parent directory for the throwaway data |
 | `-repo DIR` | repository root, if it cannot be derived from the module |
+| `-serve` | after the demonstration, keep the node running and print how to try the [browser verifier](../client/) against it — stop with Ctrl+C |
 
 The output is plain text: no ANSI colours, no box drawing, no emoji, no typographic arrows — it
 looks the same in every terminal and can be copied unchanged into a file, a ticket or a mail. The
@@ -53,6 +54,7 @@ single signature.
 | 8 Tampering | A flipped byte, a swapped leaf, an STH signed with a foreign key — and a split view that the node signs validly with its own key. Only someone who sees both trees finds that one. |
 | 9 Balance sheet | Sizes: 3407 bytes per entry on average against 488 bytes of payload on average. The lion's share is the post-quantum signature. |
 
-Section 8 is the only one that runs ahead of the code: the split view is constructed and detected
-by hand here. What notices it in production is the [monitor](../spec/owm-9-threat-model.md), which
-has yet to be built.
+Section 8 is the only one that runs ahead of a live deployment: the split view here is constructed
+and detected by hand, in one process, to show the mechanism. What notices it between independently
+operated nodes in production is the [monitor](../monitor/) — polling STHs from outside any business
+relationship, exactly the gap partner gossip alone cannot close (OWM-9 A1).