A manifesto, in six chapters
The safe way to run apps you didn't write.
ME10 — the Momentum Era app format. One source, every OS, every web: signed, capability-bound, and verified before it runs.
Built on standard HTML5+WASM. No browser fork. No container. No app store. ME10 is a Momentum product, not a new version of HTML — the name marks a new era of apps, not a standard.
platform/ · spike/ — every claim on this page is backed by a script you can run.
I — The Inversion
This is the product.
Every HTML link is already becoming an app. Native app stores kept four things a bare URL still lacks: identity, review, revocation, payment. And HTML5 carries an original sin — ambient authority, where any <script> inherits the full power of its origin. Fifteen years of retrofits — CSP, SRI, sandbox, Trusted Types, COOP/COEP — narrowed the hole. None of them closed it, because none of them changed the default.
ME10 does not retrofit. It inverts the default.
An app declares its capabilities.
The runtime grants nothing else.
The declaration is re-derived from the compiled artifact and must match exactly, or the app does not run.
Fail closed.
Everything below this line is how it holds.
II — Two Proven Inventions
Provable, not aspirational.
Two claims carry the whole platform. Both are backed by a script that runs today, not a whitepaper.
Canonical AST, not source
The browser's own HTML parser is not even self-consistent: five parse entry points inside one Chromium disagree on 3 of 15 mXSS inputs. So ME10 never ships HTML source. It ships an AST that the runtime constructs into DOM. Verifier and runtime share one parser ME10 owns — the parse differential becomes structurally impossible, not merely unlikely.
Decidable capability derivation
Deciding an arbitrary program's capabilities is undecidable — Rice's theorem. ME10 escapes the theorem's jurisdiction by restricting the language so every effect is a statically-resolvable named import. Derivation is then a bounded walk, not a search. We gave up eval; we got a proof.
III — Four Layers, Four Proofs
Nothing here is a mockup.
Every guarantee below is backed by a script you can run against platform/ and spike/ — including real Chromium, not a simulated DOM.
| Layer | Guarantee | Proof |
|---|---|---|
| L0 · Distribution | Ed25519 sign the file over a domain-separated Merkle root | me10 pack → 64-byte sig, bundle round-trips✓ |
| L1 · Format | Canonical AST, deterministic serialization — no HTML source on the wire | me10 doctor — order-independent✓ |
| L2 · Verifier | Fail closed; declared == derived equality — over-declaration is a build error |
me10 verify — exit 1 on any mismatch✓ |
| L3 · Runtime | Render by DOM construction, no innerHTML; logic in a Worker with net globals deleted |
runtime.browser.mjs — real Chromium, exfil blocked✓ |
IV — Why This Matters Now
Nothing for an injected instruction to escalate to.
An AI node that was never handed a network or storage handle has nothing an injected instruction can escalate to. The payoff for the AI era
This is what kills an EchoLeak-class confused deputy — not a filter inspecting the prompt after the fact, but a runtime that never gave the model a handle worth stealing in the first place. Poison the input all you like; there is nowhere for the escalation to go before it starts.
V — The Honesty Charter
Equal billing with the pitch.
A platform that claims "secure by construction" earns that phrase only by naming, in public, what it does not secure. So we do.
We publish the residual risk on purpose.
A valid signature renders no badge.
The moment a green check means "trust," the signature becomes an attacker's asset.
Stuxnet, ASUS ShadowHammer, SolarWinds, and 3CX all shipped validly signed. A checkmark told their victims to trust the payload. ME10 refuses to make that mistake: there is no "verified / safe" badge to counterfeit, borrow, or launder — because there is no badge.
- 01The browser JIT is our trusted computing base. We build on Chromium's engine, not around it — its bugs are our bugs.
- 02Spectre reads across handles. Speculative-execution side channels are a hardware property, not something a runtime can fully close.
- 03The human can still be socially engineered. No capability model defends against a user persuaded to grant one.
- 04A validly-signed app can still be malicious. Signature proves authorship and integrity, not good intent — see
RESIDUAL-RISKS.md.
VI — Two Doors
Where to start.
ME10 Studio
Design apps that run everywhere, safe by construction. No browser fork, no container — just a capability manifest the runtime holds you to.
Momentum Era × Web4
The trust-native stack. Web4 decides who to trust; ME10 makes that trust physically binding at runtime.