S00-022: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-022. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Pinned libomemo.js@3.0.0 supplies real embedded WASM but is a different unaudited ratchet and excludes consumer SCE; no approved decision reconciles it with S00-022 retained audited engine/persistence requirement.

Task: S00-022
Agent: auto-crypto-bcd7f2a71667
Role: crypto
Action: claim
Status: blocked

Task title: Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint

planning/ROADMAP.md

@@ -6,7 +6,7 @@
 
 Зафиксировать Web scope, browser targets и проверенные кандидаты, не устанавливая непроверенный framework по догадке.
 
-Задач: 28; entry: нет; exit: S00-010.
+Задач: 29; entry: нет; exit: S00-010.
 
 ## [S01: Предметные контракты](stages/S01.md)
 

planning/TASK_MATRIX.md

@@ -1,6 +1,6 @@
 # Матрица задач
 
-Generated; state revision **89**. Canonical status: state/tasks.json.
+Generated; state revision **91**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -24,13 +24,14 @@ Generated; state revision **89**. Canonical status: state/tasks.json.
 | [S00-019](tasks/S00-019.md) | S00 | crypto | security | done | auto-crypto-c68801170fa4 | S00-001, S00-002, S00-017, S00-018 | Validate browser-compatible SCRAM-SHA-512 through a public mechanism API |
 | [S00-020](tasks/S00-020.md) | S00 | ci-cd | qa | done | auto-ci-cd-2a0186c54ce9 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-024 | Restore access to the pinned Linux XMPP experiment toolchain |
 | [S00-021](tasks/S00-021.md) | S00 | crypto | security | done | auto-crypto-fcef9b6781bf | S00-001, S00-002 | Устранить прерывание: Проверить browser OMEMO backend |
-| [S00-022](tasks/S00-022.md) | S00 | crypto | security | todo |  | S00-001, S00-002, S00-021, S00-027 | Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint |
+| [S00-022](tasks/S00-022.md) | S00 | crypto | security | blocked | auto-crypto-bcd7f2a71667 | S00-001, S00-002, S00-021, S00-027, S00-029 | Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint |
 | [S00-023](tasks/S00-023.md) | S00 | storage | qa | blocked | auto-storage-87486895c792 | S00-002, S00-025 | Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |
 | [S00-024](tasks/S00-024.md) | S00 | ci-cd | qa | done | auto-ci-cd-49907d48a6d1 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-026 | Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain |
 | [S00-025](tasks/S00-025.md) | S00 | storage | qa | blocked | auto-storage-ae5930b6fbdf | S00-002, S00-028 | Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |
 | [S00-026](tasks/S00-026.md) | S00 | ci-cd | qa | done | auto-ci-cd-4255c34da227 | S00-001, S00-002, S00-017, S00-018, S00-019 | Provide approved access to the pinned Linux experiment artifacts |
 | [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | done | auto-ci-cd-40ae46e8efe7 | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation |
 | [S00-028](tasks/S00-028.md) | S00 | ci-cd | qa | todo |  | S00-002 | Repair conflicting Codex harness sandbox arguments |
+| [S00-029](tasks/S00-029.md) | S00 | orchestrator | security | blocked |  | S00-001, S00-002, S00-021, S00-027 | Record an approved browser OMEMO backend sourcing strategy |
 | [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo |  | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
 | [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo |  | S00-010 | Описать identity/model contracts |
 | [S01-002](tasks/S01-002.md) | S01 | orchestrator | security | todo |  | S00-010, S01-001 | Описать async account context |

planning/TRACEABILITY.md

@@ -97,15 +97,15 @@ Allocated означает наличие плана/приёмки, а не р
 | MUC-008 | web | Web requirement; cross-platform clauses apply only in Web context. | S13-009, S21-003 |
 | ENC-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-018, S20-008, S21-003 |
 | ENC-002 | web | Web requirement; cross-platform clauses apply only in Web context. | S01-005, S08-004, S12-007, S12-008, S12-018, S12-020, S21-003 |
-| ENC-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S00-027, S12-005, S12-006, S12-007, S12-008, S12-009, S12-010, S12-011, S12-012, S12-014, S12-021, S21-003 |
+| ENC-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S00-027, S00-029, S12-005, S12-006, S12-007, S12-008, S12-009, S12-010, S12-011, S12-012, S12-014, S12-021, S21-003 |
 | ENC-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-015, S12-021, S13-006, S21-003 |
 | ENC-005 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-016, S12-021, S21-003 |
 | ENC-006 | web | Web requirement; cross-platform clauses apply only in Web context. | S01-005, S12-002, S12-003, S12-020, S21-003 |
 | ENC-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-004, S12-019, S21-003 |
 | ENC-008 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-019, S21-003 |
-| ENC-009 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S00-027, S12-001, S12-013, S12-017, S12-020, S21-003 |
+| ENC-009 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S00-027, S00-029, S12-001, S12-013, S12-017, S12-020, S21-003 |
 | ENC-010 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-020, S20-004, S21-003 |
-| ENC-011 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S00-027, S12-010, S12-011, S12-012, S12-013, S12-014, S21-003 |
+| ENC-011 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S00-027, S00-029, S12-010, S12-011, S12-012, S12-013, S12-014, S21-003 |
 | FILE-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S14-002, S21-004 |
 | FILE-002 | web | Web requirement; cross-platform clauses apply only in Web context. | S14-001, S14-011, S21-004 |
 | FILE-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S01-006, S14-001, S21-004 |

planning/stages/S00.md

@@ -26,13 +26,14 @@
 - [S00-019](../tasks/S00-019.md): Validate browser-compatible SCRAM-SHA-512 through a public mechanism API — crypto; done.
 - [S00-020](../tasks/S00-020.md): Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; done.
 - [S00-021](../tasks/S00-021.md): Устранить прерывание: Проверить browser OMEMO backend — crypto; done.
-- [S00-022](../tasks/S00-022.md): Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint — crypto; todo.
+- [S00-022](../tasks/S00-022.md): Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint — crypto; blocked.
 - [S00-023](../tasks/S00-023.md): Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.
 - [S00-024](../tasks/S00-024.md): Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; done.
 - [S00-025](../tasks/S00-025.md): Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.
 - [S00-026](../tasks/S00-026.md): Provide approved access to the pinned Linux experiment artifacts — ci-cd; done.
 - [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; done.
 - [S00-028](../tasks/S00-028.md): Repair conflicting Codex harness sandbox arguments — ci-cd; todo.
+- [S00-029](../tasks/S00-029.md): Record an approved browser OMEMO backend sourcing strategy — orchestrator; blocked.
 - [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
 
 ## Граница этапа

planning/task_matrix.csv

@@ -19,13 +19,14 @@ S00-018,S00,protocol,security,done,auto-protocol-89fe6563092c,"S00-001, S00-002,
 S00-019,S00,crypto,security,done,auto-crypto-c68801170fa4,"S00-001, S00-002, S00-017, S00-018",Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
 S00-020,S00,ci-cd,qa,done,auto-ci-cd-2a0186c54ce9,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-024",Restore access to the pinned Linux XMPP experiment toolchain
 S00-021,S00,crypto,security,done,auto-crypto-fcef9b6781bf,"S00-001, S00-002",Устранить прерывание: Проверить browser OMEMO backend
-S00-022,S00,crypto,security,todo,,"S00-001, S00-002, S00-021, S00-027",Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
+S00-022,S00,crypto,security,blocked,auto-crypto-bcd7f2a71667,"S00-001, S00-002, S00-021, S00-027, S00-029",Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
 S00-023,S00,storage,qa,blocked,auto-storage-87486895c792,"S00-002, S00-025",Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 S00-024,S00,ci-cd,qa,done,auto-ci-cd-49907d48a6d1,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-026",Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain
 S00-025,S00,storage,qa,blocked,auto-storage-ae5930b6fbdf,"S00-002, S00-028",Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 S00-026,S00,ci-cd,qa,done,auto-ci-cd-4255c34da227,"S00-001, S00-002, S00-017, S00-018, S00-019",Provide approved access to the pinned Linux experiment artifacts
 S00-027,S00,ci-cd,security,done,auto-ci-cd-40ae46e8efe7,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation
 S00-028,S00,ci-cd,qa,todo,,S00-002,Repair conflicting Codex harness sandbox arguments
+S00-029,S00,orchestrator,security,blocked,,"S00-001, S00-002, S00-021, S00-027",Record an approved browser OMEMO backend sourcing strategy
 S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
 S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts
 S01-002,S01,orchestrator,security,todo,,"S00-010, S01-001",Описать async account context

planning/tasks.json

@@ -1243,7 +1243,8 @@
         "S00-001",
         "S00-002",
         "S00-021",
-        "S00-027"
+        "S00-027",
+        "S00-029"
       ],
       "requirements": [
         "ENC-003",
@@ -1597,6 +1598,62 @@
       ],
       "context_budget_chars": 48000
     },
+    {
+      "id": "S00-029",
+      "stage": "S00",
+      "kind": "blocker",
+      "root_task": "S00-004",
+      "blocker_depth": 2,
+      "unblocks": [
+        "S00-022"
+      ],
+      "role": "orchestrator",
+      "reviewer_role": "security",
+      "title": "Record an approved browser OMEMO backend sourcing strategy",
+      "outcome": "One explicit architecture/security/product-owner sourcing decision naming the retained engine browser port or authorizing bounded evaluation of an alternative, with license/support/security-assessment and persistence compatibility requirements, without waiving ENC-003/009/011.",
+      "depends_on": [
+        "S00-001",
+        "S00-002",
+        "S00-021",
+        "S00-027"
+      ],
+      "requirements": [
+        "ENC-003",
+        "ENC-009",
+        "ENC-011"
+      ],
+      "scope": [
+        "docs/decisions/0003-browser-backend-decision.md"
+      ],
+      "inputs": [
+        "docs/WEB_PROFILE.md",
+        "docs/ARCHITECTURE.md",
+        "docs/CONTRACTS.md",
+        "docs/TESTING.md",
+        "roles/crypto.md",
+        "docs/decisions/README.md",
+        "state/blockers/S00-022.md",
+        "state/blockers/S00-029.md"
+      ],
+      "spec_sections": [],
+      "ui_sections": [],
+      "steps": [
+        "Obtain explicit owner input naming a backend strategy; do not infer approval from candidate availability.",
+        "Record traceable primary sources, exact target, license/support constraints and required independent security assessment and SCE path.",
+        "If alternative engine is selected, require separate reviewed plan change for preservation wording before S00-022 resumes implementation.",
+        "Submit only the bounded decision for independent security review; do not implement crypto."
+      ],
+      "acceptance": [
+        "Explicit owner decision is recorded; the candidate is not declared audited or interoperable without evidence.",
+        "Decision preserves ENC-003/009/011 and identifies remaining browser/SCE/vector/persistence checks.",
+        "Any engine replacement is contingent on reviewed plan change; no silent replacement or implementation occurs."
+      ],
+      "checks": [
+        "Verify owner input and primary-source traceability for named target/license/support/security and SCE boundaries.",
+        "Independent security review confirms decision addresses engine/persistence preservation and contains no requirement bypass."
+      ],
+      "context_budget_chars": 48000
+    },
     {
       "id": "S00-010",
       "stage": "S00",

planning/tasks/.S00-007.mdf8c1r9rh

@@ -0,0 +1,57 @@
+# S00-007: Утвердить password и crypto unlock модель
+
+> Generated from planning/tasks.json; status is in state/tasks.json.
+
+- Этап: S00
+- Оператор: security
+- Reviewer: orchestrator
+- Зависимости: S00-004, S00-005
+- Требования: STORE-003, LOCK-004, SEC-001
+
+## Один результат
+
+ADR отделяет session password в памяти от persisted crypto key wrapping и app lock verifier.
+
+## Разрешённые пути
+
+- `docs/decisions/0006-secret-model.md`
+- `experiments/0006-secret-model/**`
+
+Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
+
+## Прочитать
+
+- docs/WEB_PROFILE.md
+- docs/ARCHITECTURE.md
+- docs/CONTRACTS.md
+- docs/TESTING.md
+- roles/security.md
+- docs/decisions/README.md
+
+## Шаги
+
+1. Прочитать приведённые requirements, контракт через реестр и evidence прямых dependencies.
+2. До выбора стека: читать реальные первичные документы кандидатов, выполнить только разрешённый focused experiment, записать решение/ограничения. Не считать framework/backend уже принятым.
+3. Работать только над одним указанным outcome. Если для него нужен новый shared contract — создать отдельную remediation через escalate, заблокировать original и завершить запуск; не расширять текущий scope.
+4. ADR отделяет session password в памяти от persisted crypto key wrapping и app lock verifier.
+5. Добавить focused fixtures/checks из списка ниже, выполнить их и записать фактический результат.
+
+## Приёмка
+
+1. ADR отделяет session password в памяти от persisted crypto key wrapping и app lock verifier.
+2. Reload требует login при отсутствии persistent solution
+3. plaintext localStorage запрещён
+4. Нет изменений вне scope; реальный результат/evidence и handoff позволяют другому агенту продолжить.
+
+## Focused checks
+
+1. Reload требует login при отсутствии persistent solution
+2. plaintext localStorage запрещён
+
+## Блокер и завершение запуска
+
+Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
+
+## Передача
+
+Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.

planning/tasks/S00-022.md

@@ -7,7 +7,7 @@
 - Этап: S00
 - Оператор: crypto
 - Reviewer: security
-- Зависимости: S00-001, S00-002, S00-021, S00-027
+- Зависимости: S00-001, S00-002, S00-021, S00-027, S00-029
 - Требования: ENC-003, ENC-009, ENC-011
 
 ## Один результат

planning/tasks/S00-029.md

@@ -0,0 +1,58 @@
+# S00-029: Record an approved browser OMEMO backend sourcing strategy
+
+- Remediation для: S00-022; root: S00-004; depth: 2
+
+> Generated from planning/tasks.json; status is in state/tasks.json.
+
+- Этап: S00
+- Оператор: orchestrator
+- Reviewer: security
+- Зависимости: S00-001, S00-002, S00-021, S00-027
+- Требования: ENC-003, ENC-009, ENC-011
+
+## Один результат
+
+One explicit architecture/security/product-owner sourcing decision naming the retained engine browser port or authorizing bounded evaluation of an alternative, with license/support/security-assessment and persistence compatibility requirements, without waiving ENC-003/009/011.
+
+## Разрешённые пути
+
+- `docs/decisions/0003-browser-backend-decision.md`
+
+Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
+
+## Прочитать
+
+- docs/WEB_PROFILE.md
+- docs/ARCHITECTURE.md
+- docs/CONTRACTS.md
+- docs/TESTING.md
+- roles/crypto.md
+- docs/decisions/README.md
+- state/blockers/S00-022.md
+- state/blockers/S00-029.md
+
+## Шаги
+
+1. Obtain explicit owner input naming a backend strategy; do not infer approval from candidate availability.
+2. Record traceable primary sources, exact target, license/support constraints and required independent security assessment and SCE path.
+3. If alternative engine is selected, require separate reviewed plan change for preservation wording before S00-022 resumes implementation.
+4. Submit only the bounded decision for independent security review; do not implement crypto.
+
+## Приёмка
+
+1. Explicit owner decision is recorded; the candidate is not declared audited or interoperable without evidence.
+2. Decision preserves ENC-003/009/011 and identifies remaining browser/SCE/vector/persistence checks.
+3. Any engine replacement is contingent on reviewed plan change; no silent replacement or implementation occurs.
+
+## Focused checks
+
+1. Verify owner input and primary-source traceability for named target/license/support/security and SCE boundaries.
+2. Independent security review confirms decision addresses engine/persistence preservation and contains no requirement bypass.
+
+## Блокер и завершение запуска
+
+Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
+
+## Передача
+
+Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.