Remote-State-Welded Capabilities

Public browser applications expose their client software to adversarial inspection and execution. A non-exportable browser key prevents direct key export but remains a stateless signing oracle under control of the page. A remote service can maintain monotonic state, consume nonces, serialize transitions, and revoke sessions, but cannot alone establish continuing possession of a particular browser-held key. This work defines a Remote-State-Welded Capability (RSWC), a distributed capability in which a client-held non-exportable signing key and authoritative remote monotonic state are jointly necessary for every accepted transition. It further defines Post-Separation Non-Transferability (PSNT): after an adversary loses access to the original signing oracle, copied code, storage, transcripts, and previously obtained signatures do not enable a fresh accepted transition. The control-plane construction uses canonical transcript commitments, unpredictable single-use challenges, atomic compare-and-swap state transitions, epochs, and lease-aware reconnection. Under signature unforgeability, challenge unpredictability, collision resistance, and atomic server state, a post-separation continuation reduces to a signature forgery, challenge prediction, hash collision, or violation of the compare-and-swap invariant. For real-time streams, the work defines a deployable Signed Serial Block Chain using a non-exportable sign-only ECDSA key. It provides Per-Block Oracle Dependence while explicitly not claiming microphone provenance, trusted-pipeline transit, Sybil resistance, or relay prevention. The central result: a browser-held key and remote monotonic state can be welded into a capability that cannot be independently continued after separation, while a serial block chain can require continuing adaptive access to the live signing oracle.