S00-019: Validate browser SCRAM-SHA-512 through public mechanism composition

Changes: Add an isolated pinned mechanism wrapper using Stanza's public constructor and factory APIs, preserve the SCRAM-SHA-512 wire name and fail-closed final guard, and document the proposed ADR, browser bundle evidence, independent Scramp vectors, notices and limits. Leave parent selection, dependency experiments, specs and shared contracts unchanged.
Validation: Fresh-cache npm ci and Vite browser build pass; 87 focused tests pass, including RFC HMAC vectors, original defect reproduction, independent full SHA-512 exchanges and rejected invalid finals/order/reset paths. Hashed Scramp oracle fixture comparison passes. Dependency check verifies 49 locked entries, 25 installed pins/licenses and 340 unmodified Stanza files. make check passes 72 tooling tests. Native browsers, WSS/live server interoperability and production readiness are untested; independent security review remains pending.

Task: S00-019
Agent: auto-crypto-c68801170fa4
Role: crypto
Action: claim
Status: review

Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API

state/commit_messages/auto-crypto-c68801170fa4.txt

@@ -0,0 +1,4 @@
+Validate browser SCRAM-SHA-512 through public mechanism composition
+
+Changes: Add an isolated pinned mechanism wrapper using Stanza's public constructor and factory APIs, preserve the SCRAM-SHA-512 wire name and fail-closed final guard, and document the proposed ADR, browser bundle evidence, independent Scramp vectors, notices and limits. Leave parent selection, dependency experiments, specs and shared contracts unchanged.
+Validation: Fresh-cache npm ci and Vite browser build pass; 87 focused tests pass, including RFC HMAC vectors, original defect reproduction, independent full SHA-512 exchanges and rejected invalid finals/order/reset paths. Hashed Scramp oracle fixture comparison passes. Dependency check verifies 49 locked entries, 25 installed pins/licenses and 340 unmodified Stanza files. make check passes 72 tooling tests. Native browsers, WSS/live server interoperability and production readiness are untested; independent security review remains pending.

state/evidence/S00-019-auto-crypto-c68801170fa4.md

@@ -0,0 +1,157 @@
+# S00-019 executor evidence
+
+Agent: auto-crypto-c68801170fa4 (crypto), 2026-10-15.
+Result: isolated SCRAM-SHA-512 experiment and proposed ADR; security review pending.
+
+## Input/output and scope
+
+Read master/startup/common/crypto/protocol/workflow/testing/Git instructions;
+assigned resume/show/context and required blocker; accepted scope/stack/SASL/
+parser ADRs, direct prerequisite evidence/reviews/handoffs, original S00-003
+blocked evidence/handoff and exact ACC-004/NET-003/NET-004. No earlier S00-019
+handoff existed. No new shared S01 contract is needed for this isolated experiment.
+
+Only source changes: experiments/0002-xmpp-library/sha512-validation/** and
+ docs/decisions/0002-xmpp-sha512-validation.md. Evidence/handoff/commit message
+are workflow metadata. Initial Git status showed only coordinator state claim.
+Original candidate, accepted S00-017/018 source, specs, planning definitions,
+shared interfaces and application modules unchanged. No Git mutations, other
+task selection, agent spawn, secrets/real accounts or TLS/CORS bypass.
+
+Public Mechanism wrapper composes exported SCRAM constructor with SHA512 alias;
+wire name stays SCRAM-SHA-512. Factory.disable/register and Client.use/
+registerFeature are public shipped APIs. No library private field/method is
+accessed/mutated; no vendor/prototype/crypto import patch. All primitives,
+SCRAM derivation, proof and verifier stay in existing unmodified Stanza. This
+is pinned version-specific alias composition, not upstream endorsement of a
+nonstandard wire name or future API stability. Reviewer must assess it explicitly.
+
+Guard is an isolated copy of accepted S00-017 narrowed to SHA-512/88-byte-base64
+verifier text length and new registration. Actual processSuccess/finalize both
+flags precede authenticated state/success/restart. No cache persistence/emission;
+no invented channel binding/plaintext fallback. Non-PLUS-only fixture profile.
+
+## Actual commands and exit codes
+
+All npm/Node commands use
+PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH.
+Reused accepted runtime; no new runtime download/checksum verification claimed.
+Source inspections/rg/web reads supplied exact declarations and primary docs.
+
+- python3 scripts/tasks.py resume --agent auto-crypto-c68801170fa4; show S00-019;
+  packet S00-019 --agent auto-crypto-c68801170fa4: each exit 0. Assignment,
+  dependencies done, scope and exact requirements confirmed; no repeat claim.
+- npm install --prefix experiments/0002-xmpp-library/sha512-validation
+  --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-sha512-install
+  --fetch-retries=0 --fetch-timeout=15000: exit 0, initially 24 packages;
+  exact events 3.3.0 added to manifest and same command exit 0, one added.
+- npm view events@3.3.0 version license engines repository --json
+  --cache /private/tmp/luma-sha512-install --strict-ssl=true: exit 0, MIT,
+  Node >=0.8.x; shipped README/public API/browser constraints inspected before use.
+- npm run build --prefix experiments/0002-xmpp-library/sha512-validation:
+  corrected build exit 0, 166 modules, self-contained ESM 637.01 kB / gzip
+  128.84 kB; module graph 8.04 kB. Browser HMAC/SHA512 resolved, no Node backend,
+  builtin or browser external. Output ignored; repeatable via locked build.
+- python3 -m venv /private/tmp/luma-sha512-oracle: exit 0. Its Python is 3.9.6.
+- /private/tmp/luma-sha512-oracle/bin/python -m pip install --require-hashes
+  --only-binary=:all: --no-cache-dir -r
+  experiments/0002-xmpp-library/sha512-validation/oracle-requirements.txt:
+  exit 0, exact Scramp 1.4.6/asn1crypto 1.5.1 wheels. No scripts/system install.
+- /private/tmp/luma-sha512-oracle/bin/python
+  experiments/0002-xmpp-library/sha512-validation/oracle.py --write: exit 0,
+  three independent client/server verified fixed SHA-512 transcripts generated.
+  Same oracle.py without --write: exit 0, fixed fixture comparison passed.
+- Python urllib canonical RFC 4231 .txt retrieval/vector extraction: exit 0;
+  all seven HMAC SHA512 expected outputs copied from RFC, not generated by target.
+- npm test --prefix experiments/0002-xmpp-library/sha512-validation:
+  exit 0 after harness correction, 87 tests passed, zero fail/skip/cancel.
+- npm ci --prefix experiments/0002-xmpp-library/sha512-validation
+  --ignore-scripts --no-audit --no-fund
+  --cache /private/tmp/luma-sha512-clean-c68801170fa4
+  --fetch-retries=0 --fetch-timeout=15000: exit 0, new empty cache, 25 packages.
+  Strict HTTPS/engine settings retained; lifecycle scripts disabled.
+- npm test after clean install, output /private/tmp/luma-sha512-final-tests.log:
+  exit 0, rebuilt and 87 passed, duration 3049.997417ms. Added exact original
+  broken-digest assertion afterward, reran npm test with output
+  /private/tmp/luma-sha512-submit-tests.log: exit 0, 87 passed. No implementation
+  changes after clean install; final source/test suite now fixed.
+- python3 experiments/0002-xmpp-library/sha512-validation/check-dependencies.py:
+  exit 0, 49 locked entries, 25 installed exact pins/licenses, all 340 Stanza
+  files byte-match original candidate, browser graph verified. Repeated after
+  final test assertion; exit 0 and artifact/source hashes unchanged.
+- Corrected npm notice collector and independent Python oracle notice collector:
+  exit 0; full installed texts including Stanza NOTICE ancestry and rolldown
+  third-party licenses preserved. Scramp MIT-0 and asn1crypto MIT preserved.
+- make check > /private/tmp/luma-S00-019-check.log 2>&1: exit 0,
+  284 tasks / 22 stages / 221 requirements, 72 tooling tests, 19.252s.
+  Foundation integrity only; does not prove messenger readiness.
+- git diff --check; git status --short --untracked-files=all;
+  git rev-parse --show-toplevel: exit 0, project is independent Git root,
+  scoped source plus allowed state metadata. Authored untracked files separately
+  checked for final newline/trailing whitespace before submit.
+
+Exploratory/development failures are not passed checks. Initial guessed
+SCRAM.js/browser/Hmac.js paths were absent (cat exit 1), located actual index.js
+and browser/crypto files. rg /private/tmp hit one unrelated permission-denied
+socket directory, found accepted runtime; no required artifact inaccessible.
+First build exit 1: evidence writer attempted nonexistent dist/modules.json;
+changed to public bundler emitFile. It also exposed unresolved events builtin;
+resolved with pinned existing browser polyfill, not a crypto backend patch.
+Initial integration run exit 1: 51/53 passed, two stock baseline cases lacked
+SHA512 factory registration (stock Client doesn't register it by default);
+corrected fixtures to register original SCRAM through public API, then reproduced
+premature acceptance. Initial npm license collector asserted missing optional
+native binding license, inner Python failed but following oracle collector made
+combined shell exit 0; corrected collector preserves owning rolldown notices.
+Some primary registry/GitHub pages failed web retrieval; normal HTTPS registry
+metadata/local pinned source supplied exact facts. No unresolved blocker.
+
+## Demonstrated checks and backend separation
+
+32 backend checks plus 55 feature-dispatcher cases = 87. Seven RFC 4231 cases
+including short/25-byte/131-byte keys and truncation match sha512/SHA512. Fixed
+SHA512 abc matches four hash spellings. Additional 0/1/63/64/65/127/128/129/131/256
+key lengths match independent Node crypto. Exact original sha-512 broken digest
+and wrong stock browser SCRAM proof reproduce. Selected mechanism matches three
+Scramp fixed full exchanges including long and Unicode synthetic passwords.
+Scramp server verifies proof and Scramp client verifies server-final independently.
+
+All integration imports are from the Vite browser artifact. Backend name and
+module graph confirm browser code; artifact has no external runtime imports or
+require. Node native crypto is test-only independent primitive oracle. Browser
+RNG path calls host getRandomValues. XML registry/parser and feature dispatcher
+are real. Only send/transport/disconnect effects are explicit fixtures. Public
+verification-method tracing calls real delegate methods and records order.
+
+Missing/forged/premature/error/conflicting/duplicate/bad-base64/oversized finals,
+invalid first/nonce/iteration, duplicate challenges, pending sends/credentials,
+reset, send errors and replay fail without authentication/restart. Correct wire
+name and mixed-offer SHA512 selection pass. PLUS/plaintext/empty-only offers
+fail; synthetic tlsUnique fails. Silence never authenticates; reset cancels it.
+No derived cache is persisted/emitted.
+
+## SHA256 artifacts
+
+- package-lock.json: e0e129e46d3f8f86f39895a9c5fb73de761eae59108122d3684a35ab60bce399
+- sha512-mechanism.mjs: f8afc29ff467c947942495eca59ec9078e32f00448b7838da39e819b8360aaeb
+- validated-sasl.mjs: 7d2ba7c4e7033e844a6604ec899604cb9542ab57a55ea892c1e2ac474885c7d9
+- test/scramp-vectors.json: fbf8c17b3e45c0a9a88bf6f01ba63ff91b6e51a22097af6ce2f6e3de898b8321
+- dist/browser.mjs: 0b4fb1ef7684d7eab5cb1cd2c6078cdb84bff55f5cb3986e1e79a1d7418cf72a
+- dist/modules.json: c07df6bb81f9adafe4b3d5df71454f282bd115f369005b91f46ddb0c003119e6
+
+## Limits and next input
+
+Browser-built backend executes in Node with host native web APIs. No actual
+Chrome/Firefox/Safari run, WSS/TLS/server/live independent client, parent parser
+integration, complete fallback policy, worker/performance, constant-time,
+exhaustive SASLprep, advisory/provenance or release readiness result claimed.
+No new primitive audit: existing library code is vetted here by source/API and
+known/interoperability vectors, not certified audited. String verifier equality,
+synchronous derivation, success-only final layout, no extensions, fixture byte/
+iteration ceilings and no timeout remain explicit limits. See README/ADR.
+
+Independent security reviewer must inspect actual diff/message, public alias
+composition, graph/pins/notices, rerun README clean install/build/tests, oracle
+fixture comparison and vendor checks, assess limits, then accept/reject ADR via
+separate workflow. This executor submits for review and stops; coordinator alone
+commits/launches fresh review or parent continuation. No done/acceptance claimed.

state/handoffs/S00-019.md

@@ -0,0 +1,36 @@
+# S00-019 handoff for independent security review
+
+Executor: auto-crypto-c68801170fa4 (crypto), 2026-10-15.
+Outcome: isolated pinned browser-compatible SCRAM-SHA-512 experiment and proposed
+ docs/decisions/0002-xmpp-sha512-validation.md. No blocker; acceptance pending.
+
+Public Mechanism composition uses exported SCRAM('SCRAM-SHA512') constructor to
+select existing browser HMAC alias while wrapper wire name stays SCRAM-SHA-512.
+Factory.disable/register and fresh Client.use/registerFeature only; no library
+private-field/vendor/primitive patch. S00-017 guard copied/narrowed inside scope;
+accepted parent/dependency sources remain unchanged.
+
+Clean-cache npm ci and actual browser bundle/build + 87 tests passed. Seven RFC
+HMAC cases and key-length boundaries pass, exact old hyphenated HMAC/full proof
+defects reproduce, three fixed independent Scramp client/server SHA512 exchanges
+match, final/order/error/reset/replay cases reject before auth/restart. 49 locked
+entries/25 installed pins/notices and 340 unchanged Stanza files verified.
+make check: exit 0, 72 tests. Detailed commands/hashes/development failures:
+state/evidence/S00-019-auto-crypto-c68801170fa4.md.
+
+Reviewer: inspect executor diff/message and public constructor alias composition
+explicitly. Follow experiment README with accepted Node 24.21.0/npm 11.19.0 and
+new cache, run npm test and check-dependencies.py; independently recreate hashed
+Python oracle environment and run oracle.py (default compares fixed fixtures).
+Parent installed pinned candidate is read-only vendor comparison input. Review
+licenses including Stanza browser ancestry, build binding owner notices and
+separate MIT-0/MIT oracle, actual feature dispatcher and both verifier flags.
+ADR must remain proposed until your separate acceptance decision.
+
+Limits: browser bundle executes in Node, no native-browser/WSS/live-server/client
+run or parent parser integration; no full fallback policy/production selection.
+No invented binding/plaintext downgrade. Synchronous derivation, string equality
+verifier, no timeout, success-only final, no extensions, local bounds and limited
+Unicode vector remain. No audit/provenance/release clearance. Coordinator owns
+commit and next fresh process; executor stops after submit, does not continue
+S00-003 or mark done.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 48,
+  "revision": 50,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -1249,10 +1249,14 @@
       "completed_at": "2026-10-14T19:35:55+00:00"
     },
     "S00-019": {
-      "status": "todo",
-      "owner": null,
+      "status": "review",
+      "owner": "auto-crypto-c68801170fa4",
       "external_wait": false,
-      "reason": null
+      "reason": null,
+      "started_at": "2026-10-14T19:38:43+00:00",
+      "updated_at": "2026-10-14T19:48:39+00:00",
+      "evidence": "state/evidence/S00-019-auto-crypto-c68801170fa4.md",
+      "handoff": "state/handoffs/S00-019.md"
     }
   },
   "events": [
@@ -1878,6 +1882,29 @@
       "from": "in_progress",
       "to": "blocked",
       "reason": "Stanza 12.22.1 browser HMAC sha-512 fails RFC 4231 Test Case 1: wrong 64-byte block selection. SCRAM-SHA-512 derives that hyphenated algorithm; private algorithm mutation/vendor patches are unsupported. Parent cannot attest browser strongest-mechanism compatibility from Node-only success."
+    },
+    {
+      "revision": 49,
+      "at": "2026-10-14T19:38:43+00:00",
+      "action": "claim",
+      "task": "S00-019",
+      "agent": "auto-crypto-c68801170fa4",
+      "role": "crypto",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 50,
+      "at": "2026-10-14T19:48:39+00:00",
+      "action": "submit",
+      "task": "S00-019",
+      "agent": "auto-crypto-c68801170fa4",
+      "role": null,
+      "from": "in_progress",
+      "to": "review",
+      "reason": null,
+      "evidence": "state/evidence/S00-019-auto-crypto-c68801170fa4.md"
     }
   ],
   "retired_agents": [