S00-004: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-004. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-004 acceptance requires establishing legacy/OMEMO2 AND worker/wasm AND persistence without a homegrown ratchet. Reproduced (this run) probes and live public-registry queries confirm only the audited session/ratchet engine + persistence are verified (@signalapp/libsignal-client@0.105.0, Node native addon, zero .wasm). The browser/worker/WASM deployment and the OMEMO/OMEMO2 wire layer are not available from any maintained package on the reachable registry (@signalapp/libsignal, @converse/omemo, @xmpp/omemo, omemo2, omemo-js, omemo-client, omemo-top, omemo-wasm all E404). ENC-009 forbids a homegrown algorithm/ratchet and ENC-011 forbids substituting media AES-GCM for the OMEMO2 wire format, so the spike cannot synthesize a browser backend inside S00-004 scope.

Task: S00-004
Agent: auto-crypto-fe1c81c17ded
Role: crypto
Action: claim
Status: blocked

Task title: Проверить browser OMEMO backend
This commit is contained in:
wt committed 2026-10-15 15:42:43 +07:00
1 parent a02412d7c7
commit 55d9c69a21
13 files changed
+356 -63

No files matched your search

+22
View File
@@ -0,0 +1,22 @@
# Blocker S00-022
- Original task: S00-004
- Root task: S00-004
- Reporter: auto-crypto-fe1c81c17ded
- Role: crypto
- Original owner: auto-crypto-fe1c81c17ded
- Waits for user/external condition: True
## Cause
S00-004 acceptance requires establishing legacy/OMEMO2 AND worker/wasm AND persistence without a homegrown ratchet. Reproduced (this run) probes and live public-registry queries confirm only the audited session/ratchet engine + persistence are verified (@signalapp/libsignal-client@0.105.0, Node native addon, zero .wasm). The browser/worker/WASM deployment and the OMEMO/OMEMO2 wire layer are not available from any maintained package on the reachable registry (@signalapp/libsignal, @converse/omemo, @xmpp/omemo, omemo2, omemo-js, omemo-client, omemo-top, omemo-wasm all E404). ENC-009 forbids a homegrown algorithm/ratchet and ENC-011 forbids substituting media AES-GCM for the OMEMO2 wire format, so the spike cannot synthesize a browser backend inside S00-004 scope.
## One remediation outcome
One independently reviewed, traceable primary-source outcome that establishes a verified browser/worker/WASM-capable OMEMO2 backend (a maintained library with a real web/WASM build and an OMEMO2/S ce-format mapping, or an approved external library/provider decision with license + support + browser constraints), preserving the verified audited session/ratchet engine and persistence from the existing spike, without a homegrown ratchet or ENC-009/ENC-011 bypass.
## Evidence / reproduction
cd experiments/0003-crypto-library && node session-probe/smoke.mjs (exit 0, SMOKE_PASS, 631-byte byte-for-byte session record) shows session/ratchet+persistence verified; node session-probe/wasm-unsupported.mjs (exit 2, wasmFiles:0, prebuilds native *.node only) shows browser/worker/WASM NOT established. npm view on live public registry: @signalapp/libsignal-client=0.105.0; @signalapp/libsignal=@converse/omemo=@xmpp/omemo=omemo2=omemo-js=omemo-client=omemo-top=omemo-wasm=E404. Details: see this run handoff and ADR 0003.
The reporting agent must stop now. A new agent implements only S00-022.
@@ -0,0 +1,98 @@
# S00-004 - Browser OMEMO backend spike - Evidence (this run)
- Agent: `auto-crypto-fe1c81c17ded`
- Role: crypto
- Task: S00-004 "Проверить browser OMEMO backend"
- Resumed after: S00-021 remediation (done) - S00-004 back in_progress
- Date-of-run: 2026-10-15
## 1. Reproduction of the two committed probes (from project root)
### 1a. Known-answer session/ratchet + persistence probe
Command:
```
node experiments/0003-crypto-library/session-probe/smoke.mjs
```
Actual result (exit code 0):
```
[log:3] Initializing libsignal version:0.105.0
...
KAS_OK known plaintext: known vector: OMEMO session smoke
KAS_OK established via sealed-sender PreKey session
KAS_OK bob stored session bytes: 631
SMOKE_PASS
smoke exit: 0
```
Verified: an audited session/ratchet engine (`@signalapp/libsignal-client` APIs)
establishes a sealed-sender PreKey session, round-trips the known plaintext, stores
a 631-byte session record and reloads it byte-for-byte. No homegrown ratchet.
### 1b. Unsupported browser/WASM backend probe
Command:
```
node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs
```
Actual result (exit code 2):
```
pkgPresent: true
wasmFiles: 0
prebuilds: darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64
UNSUPPORTED_BLOCKER: no .wasm asset ships in @signalapp/libsignal-client; the
distribution is a Node native addon (prebuilds/*/*.node). A browser worker/WASM
deployment is NOT established by this npm package and must be treated as a blocker
until a verified browser/WASM distribution is found.
wasm exit: 2
```
Verified: the shipped distribution is native-only (zero `.wasm` files; prebuilds
are `*.node`) and cannot run in a browser worker/WASM endpoint.
## 2. Live public-registry availability check (this run, npmjs.org)
Queried directly (`npm view <pkg> version`); actual responses:
| package | actual response |
| --- | --- |
| `@signalapp/libsignal-client` | 0.105.0 (exists; Node native addon; AGPL-3.0-only) |
| `@signalapp/libsignal` | E404 - Not Found |
| `@converse/omemo` | E404 - Not Found |
| `@xmpp/omemo` | E404 - Not Found |
| `omemo2` | E404 - Not Found |
| `omemo-js` | E404 - Not Found |
| `omemo-client` | E404 - Not Found |
| `omemo-top` | E404 - Not Found |
| `omemo-wasm` | E404 - Not Found |
Confirmed again: no maintained browser/worker/WASM-capable OMEMO/OMEMO2 package is
available on the reachable registry. `@signalapp/libsignal` (Signal's WASM web
distribution) is not published there. The registry is live (it returns the real
version 0.105.0 for `@signalapp/libsignal-client`), so the E404 responses are
genuine.
## 3. Scope
- Wrote `state/issues/S00-004-auto-crypto-fe1c81c17ded.json` (one atomac
remediation) and this evidence; updated `state/handoffs/S00-004.md`.
- No source edits outside scope. `docs/decisions/0003-crypto-library.md` and
`experiments/0003-crypto-library/**` unchanged (the ADR remains as recorded by
S00-021 and correctly lists the browser/WASM + OMEMO2 layer as a blocker).
## 4. Focused checks
1. Known-answer/library smoke -> smoke.mjs exit 0 (`SMOKE_PASS`, 631-byte
byte-for-byte session record). PASS.
2. Unsupported format recorded as blocker, not success -> wasm-unsupported.mjs
exit 2 (`UNSUPPORTED_BLOCKER`, `wasmFiles: 0`). PASS.
3. No out-of-scope edits -> only workflow metadata + this issue in working tree;
`experiments/**` unchanged.
## 5. Honest conclusion
The audited session/ratchet engine and persistence are established (verified via a
known-answer probe). The browser/worker/WASM endpoint and the OMEMO/OMEMO2 wire
layer are NOT available from any maintained package on the reachable registry,
confirmed independently on the live public registry this run, and are recorded as a
blocker (not success), consistent with ENC-009/ENC-011 and the crypto role rule
"unsupported backend - blocker". S00-004 is therefore escalated: the residual
blocker (absent verified browser/WASM-capable OMEMO2 backend) requires sourcing or
an external decision (requires_user_input). S00-004 is not declared done by
bypassing requirements.
+39 -44
View File
@@ -1,54 +1,49 @@
# Handoff S00-004 - Browser OMEMO backend spike
Agent: `auto-crypto-8bf3dcf711b9`
Agent: `auto-crypto-fe1c81c17ded`
Role: crypto
Status on handoff: escalated (blocker)
## Result
A focused spike established that an audited Signal session library can provide
the session/ratchet engine and session-record persistence **without a homegrown
ratchet** (known-answer sealed-sender roundtrip, 631-byte record, reload
byte-for-byte). However the same spike established that a browser/worker/WASM
deployment and the OMEMO2 wire-format layer are **not available** from any
maintained package on the reachable registry:
- `@signalapp/libsignal-client@0.105.0` is a Node native addon with zero `.wasm`
assets; it cannot run in the Web client endpoint.
- No maintained `omemo2-js`/`omemo-wasm`/`@signalapp/libsignal`/OMEMO2 package
exists on the registry.
## Result this run
Re-ran both committed probes unchanged from the S00-021 remediation and confirmed
the reproduced state. A verified audited session/ratchet engine and session-record
persistence are established (`@signalapp/libsignal-client@0.105.0`, known-answer
sealed-sender roundtrip, 631-byte session record reloaded byte-for-byte). The
browser/worker/WASM deployment and the legacy/OMEMO2 wire layer remain **not
available** from any maintained package on the reachable registry.
Per focused-check rule ("unsupported format recorded blocker, not success") and
the mandatory escalate protocol, the original task is blocked rather than
claimed done.
Per focused-check rule ("unsupported format recorded blocker, not success") and the
mandatory escalate protocol, S00-004 is escalated as blocked rather than claimed
done: the acceptance (legacy/OMEMO2 AND worker/wasm AND persistence) still lacks a
verified browser/WASM-capable OMEMO2 backend.
## Outputs produced (all inside accepted scope experiments/0003-crypto-library/**)
- `experiments/0003-crypto-library/package.json` (exact
`@signalapp/libsignal-client@0.105.0`, `--ignore-scripts`).
- `experiments/0003-crypto-library/session-probe/smoke.mjs` (known-answer probe,
mirrors Signal canonical stores).
- `experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs` (unsupported-format probe).
- `state/evidence/S00-004-auto-crypto-8bf3dcf711b9.md` (this run's evidence).
- ADR `docs/decisions/0003-crypto-library.md` was **not** written because the
decision would record an unverified/blocked majority of the acceptance (browser
WASM + legacy/OMEMO2) rather than a confirmed capability; the outcome must be
that a remediation establishes the browser-capable backend first.
## Reproduction this run (all from project root)
1. `node experiments/0003-crypto-library/session-probe/smoke.mjs` -> exit 0,
`SMOKE_PASS`, `KAS_OK bob stored session bytes: 631`.
2. `node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs`
-> exit 2, `UNSUPPORTED_BLOCKER`, `pkgPresent: true`, `wasmFiles: 0`, prebuilds
native `*.node` only.
3. Live public registry (`npm view <pkg> version`):
- `@signalapp/libsignal-client` = 0.105.0 (Node native addon, AGPL-3.0-only).
- `@signalapp/libsignal`, `@converse/omemo`, `@xmpp/omemo`, `omemo2`,
`omemo-js`, `omemo-client`, `omemo-top`, `omemo-wasm` -> all E404.
## Evidence
- Known-answer probe: PASS (exit 0), stored 631 bytes, byte-for-byte reload.
- Unsupported-format probe: exit 2 (no `.wasm`, native addon only).
## Outputs produced (all inside accepted scope)
- `state/issues/S00-004-auto-crypto-fe1c81c17ded.json` (one atomac remediation).
- `state/evidence/S00-004-auto-crypto-fe1c81c17ded.md` (this run's evidence).
- No source changes elsewhere; `docs/decisions/0003-crypto-library.md` and
`experiments/0003-crypto-library/**` unchanged (edits outside this escalation are
prohibited for this run).
## Next input for the remediation
Reproduce intent inside `experiments/0003-crypto-library/**`:
1. `node session-probe/smoke.mjs` (expect SMOKE_PASS).
2. `node session-probe/wasm-unsupported.mjs` (expect exit 2 / blocker line).
3. Establish a verified browser/worker/WASM-capable OMEMO2 backend (library with
a real `.wasm`/web build and an OMEMO2 wire mapping), or record with traceable
upstream primary sources why the browser endpoint must use a maintained
encryption layer consistent with ENC-009/ENC-011 client-endpoint encryption.
# Blocked handoff
Original: S00-004; reporter: auto-crypto-8bf3dcf711b9; resolution: S00-021.
Agent timed out; process terminated before escalation
Next: complete and review the remediation; only a fresh session may continue.
1. Confirm `node experiments/0003-crypto-library/session-probe/smoke.mjs` (0) and
`.../wasm-unsupported.mjs` (2) from project root.
2. Source or confirm a maintained browser/worker/WASM-capable OMEMO2 backend (real
web/WASM build + OMEMO2/S ce-format mapping from traceable primary sources,
license/support/browser constraints checked), or record the specific external
product/administrative decision (library/provider/license) needed to bring such
a backend in. Requires user/external input.
3. Run a focused known-answer OMEMO2 roundtrip in the web target and record actual
results; unsupported format remains a blocker, not success.
4. Only then may acceptance-1 (legacy/OMEMO2 AND worker/wasm AND persistence) be
re-evaluated; do not declare S00-004 done on the persistence+Ratchet part alone.
@@ -0,0 +1,29 @@
{
"title": "Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint",
"reason": "S00-004 acceptance requires establishing legacy/OMEMO2 AND worker/wasm AND persistence without a homegrown ratchet. Reproduced (this run) probes and live public-registry queries confirm only the audited session/ratchet engine + persistence are verified (@signalapp/libsignal-client@0.105.0, Node native addon, zero .wasm). The browser/worker/WASM deployment and the OMEMO/OMEMO2 wire layer are not available from any maintained package on the reachable registry (@signalapp/libsignal, @converse/omemo, @xmpp/omemo, omemo2, omemo-js, omemo-client, omemo-top, omemo-wasm all E404). ENC-009 forbids a homegrown algorithm/ratchet and ENC-011 forbids substituting media AES-GCM for the OMEMO2 wire format, so the spike cannot synthesize a browser backend inside S00-004 scope.",
"reproduction": "cd experiments/0003-crypto-library && node session-probe/smoke.mjs (exit 0, SMOKE_PASS, 631-byte byte-for-byte session record) shows session/ratchet+persistence verified; node session-probe/wasm-unsupported.mjs (exit 2, wasmFiles:0, prebuilds native *.node only) shows browser/worker/WASM NOT established. npm view on live public registry: @signalapp/libsignal-client=0.105.0; @signalapp/libsignal=@converse/omemo=@xmpp/omemo=omemo2=omemo-js=omemo-client=omemo-top=omemo-wasm=E404. Details: see this run handoff and ADR 0003.",
"role": "crypto",
"reviewer_role": "security",
"scope": [
"docs/decisions/0003-crypto-library.md"
],
"outcome": "One independently reviewed, traceable primary-source outcome that establishes a verified browser/worker/WASM-capable OMEMO2 backend (a maintained library with a real web/WASM build and an OMEMO2/S ce-format mapping, or an approved external library/provider decision with license + support + browser constraints), preserving the verified audited session/ratchet engine and persistence from the existing spike, without a homegrown ratchet or ENC-009/ENC-011 bypass.",
"steps": [
"Read S00-004 blocker evidence, ADR 0003, and accepted ENC-003/ENC-009/ENC-011 with ADRs 0000-0002.",
"Confirm the residual browser/worker/WASM OMEMO2 backend is unavailable from any maintained package on the reachable registry (reproduce wasm-unsupported probe and npm view queries).",
"Source or confirm a maintained browser/worker/WASM-capable OMEMO2 encryption layer: verify its web/WASM build, license, primary-source docs, support, and an OMEMO2 wire mapping against ENC-011; or record the concrete external product/administrative decision (library, provider, or license acceptance) required to bring such a backend in.",
"Run a focused known-answer OMEMO2 roundtrip in the web-compatible target and record actual results (or record an unsupported format blocker, not success) and update docs/decisions/0003-crypto-library.md; submit evidence and handoff for independent security review."
],
"acceptance": [
"A browser/worker/WASM-capable OMEMO2 backend is established with a real, verified web build and an OMEMO2 wire mapping from traceable primary sources, or an explicit external decision (with specific requested input) is recorded that unblocks sourcing it.",
"The OMEMO2 wire-format mapping does not bypass ENC-009/ENC-011 client-endpoint encryption.",
"No homegrown ratchet, no spec/plan/shared-contract change without plan, no secrets in evidence, and no out-of-scope edits; unsupported format recorded as blocker, not success."
],
"checks": [
"Known-answer OMEMO2 roundtrip in the web/WASM target, or a traceable upstream/external decision covering ENC-009/ENC-011.",
"Web/WASM asset presence verified (non-zero real footprint), license and support checked.",
"Independent security review confirms no bypass and no unsupported format counted as success."
],
"depends_on": [],
"requires_user_input": true
}
+41 -9
View File
@@ -1,6 +1,6 @@
{
"schema_version": 1,
"revision": 60,
"revision": 62,
"tasks": {
"S00-001": {
"status": "done",
@@ -47,14 +47,16 @@
"resumed_after_blocker": true
},
"S00-004": {
"status": "todo",
"owner": null,
"started_at": "2026-10-15T08:02:39+00:00",
"reason": null,
"updated_at": "2026-10-15T08:40:27+00:00",
"blocked_by": [],
"status": "blocked",
"owner": "auto-crypto-fe1c81c17ded",
"started_at": "2026-10-15T08:40:32+00:00",
"reason": "S00-004 acceptance requires establishing legacy/OMEMO2 AND worker/wasm AND persistence without a homegrown ratchet. Reproduced (this run) probes and live public-registry queries confirm only the audited session/ratchet engine + persistence are verified (@signalapp/libsignal-client@0.105.0, Node native addon, zero .wasm). The browser/worker/WASM deployment and the OMEMO/OMEMO2 wire layer are not available from any maintained package on the reachable registry (@signalapp/libsignal, @converse/omemo, @xmpp/omemo, omemo2, omemo-js, omemo-client, omemo-top, omemo-wasm all E404). ENC-009 forbids a homegrown algorithm/ratchet and ENC-011 forbids substituting media AES-GCM for the OMEMO2 wire format, so the spike cannot synthesize a browser backend inside S00-004 scope.",
"updated_at": "2026-10-15T08:42:33+00:00",
"blocked_by": [
"S00-022"
],
"resume_status": "in_progress",
"blocker_report": "state/blockers/S00-021.md",
"blocker_report": "state/blockers/S00-022.md",
"handoff": "state/handoffs/S00-004.md",
"previous_owner": "auto-crypto-8bf3dcf711b9",
"resumed_after_blocker": true
@@ -1290,6 +1292,12 @@
"reviewer": "auto-security-5d2ae592b569",
"review_evidence": "state/evidence/S00-021-review.md",
"completed_at": "2026-10-15T08:40:27+00:00"
},
"S00-022": {
"status": "blocked",
"owner": null,
"external_wait": true,
"reason": "S00-004 acceptance requires establishing legacy/OMEMO2 AND worker/wasm AND persistence without a homegrown ratchet. Reproduced (this run) probes and live public-registry queries confirm only the audited session/ratchet engine + persistence are verified (@signalapp/libsignal-client@0.105.0, Node native addon, zero .wasm). The browser/worker/WASM deployment and the OMEMO/OMEMO2 wire layer are not available from any maintained package on the reachable registry (@signalapp/libsignal, @converse/omemo, @xmpp/omemo, omemo2, omemo-js, omemo-client, omemo-top, omemo-wasm all E404). ENC-009 forbids a homegrown algorithm/ratchet and ENC-011 forbids substituting media AES-GCM for the OMEMO2 wire format, so the spike cannot synthesize a browser backend inside S00-004 scope."
}
},
"events": [
@@ -2068,6 +2076,29 @@
"to": "done",
"reason": null,
"evidence": "state/evidence/S00-021-review.md"
},
{
"revision": 61,
"at": "2026-10-15T08:40:32+00:00",
"action": "claim",
"task": "S00-004",
"agent": "auto-crypto-fe1c81c17ded",
"role": "crypto",
"from": "todo",
"to": "in_progress",
"reason": null
},
{
"revision": 62,
"at": "2026-10-15T08:42:33+00:00",
"action": "escalate",
"task": "S00-004",
"resolution_task": "S00-022",
"agent": "auto-crypto-fe1c81c17ded",
"role": "crypto",
"from": "in_progress",
"to": "blocked",
"reason": "S00-004 acceptance requires establishing legacy/OMEMO2 AND worker/wasm AND persistence without a homegrown ratchet. Reproduced (this run) probes and live public-registry queries confirm only the audited session/ratchet engine + persistence are verified (@signalapp/libsignal-client@0.105.0, Node native addon, zero .wasm). The browser/worker/WASM deployment and the OMEMO/OMEMO2 wire layer are not available from any maintained package on the reachable registry (@signalapp/libsignal, @converse/omemo, @xmpp/omemo, omemo2, omemo-js, omemo-client, omemo-top, omemo-wasm all E404). ENC-009 forbids a homegrown algorithm/ratchet and ENC-011 forbids substituting media AES-GCM for the OMEMO2 wire format, so the spike cannot synthesize a browser backend inside S00-004 scope."
}
],
"retired_agents": [
@@ -2081,6 +2112,7 @@
"auto-protocol-902594b44429",
"auto-protocol-dcdf92cd067e",
"auto-protocol-59f4d359b339",
"auto-crypto-8bf3dcf711b9"
"auto-crypto-8bf3dcf711b9",
"auto-crypto-fe1c81c17ded"
]
}