S00-027: Approve registry connectivity after independent HTTPS checks
Changes: Accept the bounded S00-027 connectivity record and add independent security review evidence and handoff. Validation: Fresh-cache control, candidate and pinned npm queries exited 0; fresh HTTPS artifact SHA512 SRI, size and SHA256 matched. make check exited 0 with 72 tests; executor patch/message, owner confirmation, scope and whitespace checked. No crypto/backend or distribution acceptance. Task: S00-027 Agent: auto-security-ccce71646176 Role: security Action: review Status: done Task title: Restore approved npm registry connectivity for the OMEMO2 backend investigation
This commit is contained in:
wt committed
1 parent
0b60f3d84e
commit
8bfaa06e64
8 files changed
+93
-20
No files matched your search
@@ -1,6 +1,7 @@
|
||||
# S00-027: Approved npm registry connectivity record
|
||||
|
||||
- Status: proposed; awaiting independent security review.
|
||||
- Status: accepted — independent security review S00-027; evidence: `state/evidence/S00-027-review.md`.
|
||||
- Reviewer: auto-security-ccce71646176 (security), 2026-10-15.
|
||||
- Executor: auto-ci-cd-40ae46e8efe7 (ci-cd), 2026-10-15.
|
||||
- Input: S00-027 card, S00-022/S00-027 blockers, accepted ADR 0000/0001 and direct dependency evidence.
|
||||
- Output: connectivity evidence only for resuming the separate OMEMO2 investigation.
|
||||
@@ -55,3 +56,7 @@ Both required live metadata queries and the pinned artifact/SRI verification suc
|
||||
No crypto/backend decision, browser/WASM/worker execution, SCE mapping, audited interoperability, persistence compatibility, application build or release readiness was tested or accepted. ENC-003/009/011 remain obligations of the original investigation. The existing crypto ADR and experiments, specs, contracts and plan definitions are unchanged.
|
||||
|
||||
The assigned independent security reviewer should repeat both queries with a new empty cache, repeat pinned metadata/download/SHA512 comparison under normal TLS and the approved environment, inspect scope and evidence, then record the review through tasks.py. Only reviewed resolver completion may return S00-022 to the queue for a new agent. Coordinator owns Git commits.
|
||||
|
||||
## Independent acceptance
|
||||
|
||||
Security reviewer auto-security-ccce71646176 reproduced both live metadata queries with a new empty temporary cache and the pinned metadata/download/SHA512 check under normal TLS. Responses, 1,061,939-byte archive and SHA256 matched the executor record. No package scripts were executed. `make check` passed 72 tooling tests. This accepts registry connectivity only; all crypto/backend and distribution limits above remain. Coordinator owns the review commit.
|
||||
@@ -1,6 +1,6 @@
|
||||
# Матрица задач
|
||||
|
||||
Generated; state revision **88**. Canonical status: state/tasks.json.
|
||||
Generated; state revision **89**. Canonical status: state/tasks.json.
|
||||
|
||||
| ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
|
||||
| --- | --- | --- | --- | --- | --- | --- | --- |
|
||||
@@ -24,12 +24,12 @@ Generated; state revision **88**. Canonical status: state/tasks.json.
|
||||
| [S00-019](tasks/S00-019.md) | S00 | crypto | security | done | auto-crypto-c68801170fa4 | S00-001, S00-002, S00-017, S00-018 | Validate browser-compatible SCRAM-SHA-512 through a public mechanism API |
|
||||
| [S00-020](tasks/S00-020.md) | S00 | ci-cd | qa | done | auto-ci-cd-2a0186c54ce9 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-024 | Restore access to the pinned Linux XMPP experiment toolchain |
|
||||
| [S00-021](tasks/S00-021.md) | S00 | crypto | security | done | auto-crypto-fcef9b6781bf | S00-001, S00-002 | Устранить прерывание: Проверить browser OMEMO backend |
|
||||
| [S00-022](tasks/S00-022.md) | S00 | crypto | security | blocked | auto-crypto-316a193d6c3e | S00-001, S00-002, S00-021, S00-027 | Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint |
|
||||
| [S00-022](tasks/S00-022.md) | S00 | crypto | security | todo | | S00-001, S00-002, S00-021, S00-027 | Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint |
|
||||
| [S00-023](tasks/S00-023.md) | S00 | storage | qa | blocked | auto-storage-87486895c792 | S00-002, S00-025 | Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |
|
||||
| [S00-024](tasks/S00-024.md) | S00 | ci-cd | qa | done | auto-ci-cd-49907d48a6d1 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-026 | Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain |
|
||||
| [S00-025](tasks/S00-025.md) | S00 | storage | qa | blocked | auto-storage-ae5930b6fbdf | S00-002, S00-028 | Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |
|
||||
| [S00-026](tasks/S00-026.md) | S00 | ci-cd | qa | done | auto-ci-cd-4255c34da227 | S00-001, S00-002, S00-017, S00-018, S00-019 | Provide approved access to the pinned Linux experiment artifacts |
|
||||
| [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | review | auto-ci-cd-40ae46e8efe7 | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation |
|
||||
| [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | done | auto-ci-cd-40ae46e8efe7 | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation |
|
||||
| [S00-028](tasks/S00-028.md) | S00 | ci-cd | qa | todo | | S00-002 | Repair conflicting Codex harness sandbox arguments |
|
||||
| [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo | | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
|
||||
| [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo | | S00-010 | Описать identity/model contracts |
|
||||
|
||||
@@ -26,12 +26,12 @@
|
||||
- [S00-019](../tasks/S00-019.md): Validate browser-compatible SCRAM-SHA-512 through a public mechanism API — crypto; done.
|
||||
- [S00-020](../tasks/S00-020.md): Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; done.
|
||||
- [S00-021](../tasks/S00-021.md): Устранить прерывание: Проверить browser OMEMO backend — crypto; done.
|
||||
- [S00-022](../tasks/S00-022.md): Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint — crypto; blocked.
|
||||
- [S00-022](../tasks/S00-022.md): Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint — crypto; todo.
|
||||
- [S00-023](../tasks/S00-023.md): Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.
|
||||
- [S00-024](../tasks/S00-024.md): Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; done.
|
||||
- [S00-025](../tasks/S00-025.md): Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.
|
||||
- [S00-026](../tasks/S00-026.md): Provide approved access to the pinned Linux experiment artifacts — ci-cd; done.
|
||||
- [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; review.
|
||||
- [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; done.
|
||||
- [S00-028](../tasks/S00-028.md): Repair conflicting Codex harness sandbox arguments — ci-cd; todo.
|
||||
- [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
|
||||
|
||||
|
||||
@@ -19,12 +19,12 @@ S00-018,S00,protocol,security,done,auto-protocol-89fe6563092c,"S00-001, S00-002,
|
||||
S00-019,S00,crypto,security,done,auto-crypto-c68801170fa4,"S00-001, S00-002, S00-017, S00-018",Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
|
||||
S00-020,S00,ci-cd,qa,done,auto-ci-cd-2a0186c54ce9,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-024",Restore access to the pinned Linux XMPP experiment toolchain
|
||||
S00-021,S00,crypto,security,done,auto-crypto-fcef9b6781bf,"S00-001, S00-002",Устранить прерывание: Проверить browser OMEMO backend
|
||||
S00-022,S00,crypto,security,blocked,auto-crypto-316a193d6c3e,"S00-001, S00-002, S00-021, S00-027",Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
|
||||
S00-022,S00,crypto,security,todo,,"S00-001, S00-002, S00-021, S00-027",Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
|
||||
S00-023,S00,storage,qa,blocked,auto-storage-87486895c792,"S00-002, S00-025",Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
|
||||
S00-024,S00,ci-cd,qa,done,auto-ci-cd-49907d48a6d1,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-026",Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain
|
||||
S00-025,S00,storage,qa,blocked,auto-storage-ae5930b6fbdf,"S00-002, S00-028",Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
|
||||
S00-026,S00,ci-cd,qa,done,auto-ci-cd-4255c34da227,"S00-001, S00-002, S00-017, S00-018, S00-019",Provide approved access to the pinned Linux experiment artifacts
|
||||
S00-027,S00,ci-cd,security,review,auto-ci-cd-40ae46e8efe7,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation
|
||||
S00-027,S00,ci-cd,security,done,auto-ci-cd-40ae46e8efe7,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation
|
||||
S00-028,S00,ci-cd,qa,todo,,S00-002,Repair conflicting Codex harness sandbox arguments
|
||||
S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
|
||||
S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts
|
||||
|
||||
|
@@ -0,0 +1,4 @@
|
||||
Approve registry connectivity after independent HTTPS checks
|
||||
|
||||
Changes: Accept the bounded S00-027 connectivity record and add independent security review evidence and handoff.
|
||||
Validation: Fresh-cache control, candidate and pinned npm queries exited 0; fresh HTTPS artifact SHA512 SRI, size and SHA256 matched. make check exited 0 with 72 tests; executor patch/message, owner confirmation, scope and whitespace checked. No crypto/backend or distribution acceptance.
|
||||
@@ -0,0 +1,38 @@
|
||||
# S00-027 independent security review
|
||||
|
||||
Reviewer: auto-security-ccce71646176 (security). Executor: auto-ci-cd-40ae46e8efe7 (ci-cd).
|
||||
Date: 2026-10-15. Decision: APPROVE connectivity record only.
|
||||
|
||||
Input: assigned card/packet, required startup/workflow/TESTING/crypto/ADR index reads, both blocker reports, exact ENC-003/009/011, accepted ADR 0000/0001 and all direct dependency evidence/reviews/handoffs. Output: accepted connectivity metadata and this independent report. Focused acceptance: actual control/candidate registry responses, pinned HTTPS download with matching SRI, no policy bypass or crypto/backend acceptance.
|
||||
|
||||
## Patch and boundaries
|
||||
|
||||
Read implementation commit 0b60f3d84e860cb71ae783d820ebd726bbad76ad and external-input checkpoint 927728daf1f8661ba05114800a36e0dfe5066e2f. Executor message accurately describes the document, live probes, checks and limits. The implementation changes only the allowed connectivity document plus workflow/generated artifacts. Initial working tree was clean. Revision 74 of canonical history confirms approved sandbox outbound access while retaining configured proxy, TLS and filesystem restrictions; supplied prior caches/archives were not reused.
|
||||
|
||||
No credentials, private proxy details or real conversations appear in the task artifacts. Metadata was treated as data; pinned URL was asserted to the official HTTPS tarball before retrieval and final URL remained identical. TLS verification stayed enabled (npm strict-ssl=true, Python default SSL context). No install, extraction, package execution, custom crypto, system/network/Git configuration change, plaintext fallback, immutable spec or shared contract edit occurred. Host Node/npm were used solely for metadata connectivity, with accepted build pins unchanged.
|
||||
|
||||
## Independent commands and actual results
|
||||
|
||||
- `python3 scripts/tasks.py resume --agent auto-security-ccce71646176`, `show S00-027`, `packet S00-027 --agent auto-security-ccce71646176`: exit 0 each. Reviewer did not claim; owner differs and direct prerequisites are done.
|
||||
- Read-only git log/show/status and canonical history inspection: exit 0; patch and executor message agree.
|
||||
- `node --version`: exit 0.
|
||||
- `npm --version`: exit 0.
|
||||
- `npm config get strict-ssl`: exit 0.
|
||||
- `npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-review-4ngu6s8g/cache --strict-ssl=true`: exit 0.
|
||||
- `npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-review-4ngu6s8g/cache --strict-ssl=true`: exit 0.
|
||||
- `npm view libomemo.js@3.0.0 version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-review-4ngu6s8g/pinned-cache --registry=https://registry.npmjs.org/ --strict-ssl=true`: exit 0.
|
||||
|
||||
Python tempfile/subprocess/urllib/ssl/hashlib/base64 wrapper: exit 0. Fresh root `/tmp/luma-s00-027-review-4ngu6s8g`; cache absent before first query, separate pinned-cache also new. Control returned 0.105.0; candidate and pinned candidate returned 3.0.0, GPL-3.0 and the documented official tarball/SRI. No EAI_AGAIN or E404. Wrapper asserted metadata version and exact public HTTPS URL, required HTTP 200 and unchanged final URL, downloaded using ssl.create_default_context(), computed SHA512 SRI and asserted equality with registry metadata. Archive and public verification.json were saved only under the fresh temporary root; no package code ran.
|
||||
|
||||
- Archive size: 1,061,939 bytes.
|
||||
- SHA512 SRI: `sha512-B4he9DOS+1LQrut+b2xjOjuSkKMAkZGes7ckB5JgVk/EHVNyxLIHx6NvQ3eJVaT1XeNJaWZBonXw3Nl5YKEbig==`.
|
||||
- SHA256: `be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8`.
|
||||
|
||||
These results match the executor record exactly.
|
||||
|
||||
- `make check > /tmp/luma-s00-027-review-check.log 2>&1`: exit 0, 72 tests in 18.796s, OK. Foundation integrity only.
|
||||
- `git diff --check`: exit 0 before report; final authored metadata/diff inspected for whitespace and scope before approval.
|
||||
|
||||
## Acceptance and limits
|
||||
|
||||
All three card acceptance conditions pass independently. Registry SRI proves agreement between retrieved bytes and registry metadata, not independent provenance, vulnerability clearance, license distribution approval or crypto suitability. Browser/WASM/worker execution, OMEMO2/SCE mapping, interoperability, audited engine/persistence compatibility and application readiness were not checked or accepted. Existing crypto ADR and experiments remain unchanged. Approval permits only S00-022 to return to the queue for a fresh executor through CLI workflow. Coordinator must commit this review transition; reviewer ends after approve.
|
||||
@@ -7,3 +7,5 @@ Result: fresh-cache live npm metadata queries succeeded for @signalapp/libsignal
|
||||
Output: docs/decisions/0003-registry-connectivity.md. Exact commands/results and limits: state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md. Temporary archive/verification: /tmp/luma-s00-027-kdeu0fv9. make check exit 0, 72 tests. Host Node 24.1.0/npm 11.3.0 were used only for connectivity metadata probes, not project build or replacement of accepted pins.
|
||||
|
||||
Next: assigned fresh security reviewer repeats both queries with a new empty cache, pinned artifact download and SRI check under approved HTTPS/TLS; reviews scope, evidence and commit message. Record review via tasks.py. Coordinator commits; executor exits after submit. Only reviewed resolver completion returns S00-022 for a new executor. This record accepts no crypto/backend/library, license distribution, browser/WASM/worker/SCE, audited interoperability or persistence compatibility result.
|
||||
|
||||
Independent security review: auto-security-ccce71646176, 2026-10-15. Approved bounded registry connectivity after new-cache live control/candidate/pinned queries and fresh validated HTTPS artifact retrieval; SHA512 SRI, size and SHA256 match executor record. make check exit 0, 72 tests. Report: state/evidence/S00-027-review.md. No blocker. Crypto/backend/browser/WASM/worker/SCE/interoperability and license distribution remain unaccepted. Coordinator commits this review transition before a new executor resumes S00-022; reviewer exits after approve.
|
||||
+36
-12
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"revision": 88,
|
||||
"revision": 89,
|
||||
"tasks": {
|
||||
"S00-001": {
|
||||
"status": "done",
|
||||
@@ -1311,18 +1311,18 @@
|
||||
"completed_at": "2026-10-15T08:40:27+00:00"
|
||||
},
|
||||
"S00-022": {
|
||||
"status": "blocked",
|
||||
"owner": "auto-crypto-316a193d6c3e",
|
||||
"status": "todo",
|
||||
"owner": null,
|
||||
"external_wait": false,
|
||||
"reason": "All ten live npm metadata queries fail with EAI_AGAIN resolving the configured proxy, including the known libsignal-client control. Required release and artifact verification for S00-022 cannot proceed; failures are not E404 evidence.",
|
||||
"reason": null,
|
||||
"started_at": "2026-10-15T09:39:15+00:00",
|
||||
"updated_at": "2026-10-15T09:41:11+00:00",
|
||||
"blocked_by": [
|
||||
"S00-027"
|
||||
],
|
||||
"updated_at": "2026-10-15T10:14:41+00:00",
|
||||
"blocked_by": [],
|
||||
"resume_status": "in_progress",
|
||||
"blocker_report": "state/blockers/S00-027.md",
|
||||
"handoff": "state/handoffs/S00-022.md"
|
||||
"handoff": "state/handoffs/S00-022.md",
|
||||
"previous_owner": "auto-crypto-316a193d6c3e",
|
||||
"resumed_after_blocker": true
|
||||
},
|
||||
"S00-023": {
|
||||
"status": "blocked",
|
||||
@@ -1384,14 +1384,17 @@
|
||||
"completed_at": "2026-10-15T10:00:12+00:00"
|
||||
},
|
||||
"S00-027": {
|
||||
"status": "review",
|
||||
"status": "done",
|
||||
"owner": "auto-ci-cd-40ae46e8efe7",
|
||||
"external_wait": false,
|
||||
"reason": null,
|
||||
"started_at": "2026-10-15T10:09:30+00:00",
|
||||
"updated_at": "2026-10-15T10:12:28+00:00",
|
||||
"updated_at": "2026-10-15T10:14:41+00:00",
|
||||
"evidence": "state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md",
|
||||
"handoff": "state/handoffs/S00-027.md"
|
||||
"handoff": "state/handoffs/S00-027.md",
|
||||
"reviewer": "auto-security-ccce71646176",
|
||||
"review_evidence": "state/evidence/S00-027-review.md",
|
||||
"completed_at": "2026-10-15T10:14:41+00:00"
|
||||
},
|
||||
"S00-028": {
|
||||
"status": "todo",
|
||||
@@ -2513,6 +2516,27 @@
|
||||
"to": "review",
|
||||
"reason": null,
|
||||
"evidence": "state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md"
|
||||
},
|
||||
{
|
||||
"revision": 89,
|
||||
"at": "2026-10-15T10:14:41+00:00",
|
||||
"action": "auto-unblock",
|
||||
"task": "S00-022",
|
||||
"resolved_by": "S00-027",
|
||||
"to": "todo",
|
||||
"fresh_agent_required": true
|
||||
},
|
||||
{
|
||||
"revision": 89,
|
||||
"at": "2026-10-15T10:14:41+00:00",
|
||||
"action": "approve",
|
||||
"task": "S00-027",
|
||||
"agent": "auto-security-ccce71646176",
|
||||
"role": "security",
|
||||
"from": "review",
|
||||
"to": "done",
|
||||
"reason": null,
|
||||
"evidence": "state/evidence/S00-027-review.md"
|
||||
}
|
||||
],
|
||||
"retired_agents": [
|
||||
|
||||
Reference in new issue
Block a user