S00-003: Approve bounded XMPP selection after independent WSS and SCRAM checks

Changes: Accept ADR 0002 for pinned Stanza with mandatory bounded transport, verified SASL and SHA512 composition; record independent review findings and handoff with external limits retained.
Validation: Fresh-cache pinned npm ci and browser build succeeded; all 112 tests passed. Verified 51 locked entries, 26 installed notices and 340 unchanged vendor files; six offer permutations and six adversarial XML checks passed; make check passed 72 tooling tests. No actual browser, independent full XMPP server/client, OMEMO or release readiness acceptance.

Task: S00-003
Agent: auto-qa-d49749753ac6
Role: qa
Action: review
Status: done

Task title: Проверить XMPP WSS/auth библиотеку

docs/decisions/0002-xmpp-library.md

@@ -1,8 +1,8 @@
 # ADR 0002: XMPP library and required browser integration seams
 
-- Status: proposed; S00-003 independent QA review pending.
+- Status: accepted for bounded S00-003 library selection; independent QA: `state/evidence/S00-003-review.md`.
 - Date: 2026-10-15. Owner: auto-protocol-f474114f0168 (protocol).
-- Reviewer role: qa; no acceptance claimed by executor.
+- Reviewer: auto-qa-d49749753ac6 (qa), 2026-10-15.
 - Requirements: ACC-004, NET-003, NET-004.
 - Prerequisites: accepted scope/stack ADRs and bounded SASL, parser, SHA-512
   experiments (S00-017/018/019); independently reviewed Linux environment S00-020.
@@ -124,4 +124,22 @@ requires a new bounded decision, not a private patch or silent downgrade.
 QA should reproduce clean install/build/tests and dependency checks, inspect the
 stock defect controls, explicit extension projection and scope, then record an
 independent decision. Evidence: `state/evidence/S00-003-auto-protocol-f474114f0168.md`.
-Coordinator owns transition commits; this ADR remains proposed until review.
+Coordinator owns transition commits; independent acceptance is recorded below.
+
+
+## Independent acceptance
+
+QA reviewer auto-qa-d49749753ac6 accepts this exact-version library selection
+with all three integration seams mandatory. Fresh-cache locked installation,
+browser bundle and all 112 tests passed on reviewed Linux Node 24.21.0/npm
+11.19.0; 51 locked entries, 26 installed package notices and 340 unchanged vendor
+files verified. Lock, guard and bundle hashes match executor evidence. Additional
+six offer permutations selected SHA-512; six adversarial XML documents rejected
+before registry access and a valid body imported. make check passed 72 tooling
+tests. Public shipped APIs, composed guard diff, fixture trust boundary and
+extension projection were inspected. Report: `state/evidence/S00-003-review.md`.
+Acceptance covers the bounded combined spike and selection only. All native
+browser, independent server/client, OMEMO, aggregate resource, lifecycle,
+timeout/timing and release limitations above remain. Stock Stanza without the
+required seams is not accepted. Coordinator must commit the review transition
+before any subsequent fresh task session.

planning/TASK_MATRIX.md

@@ -1,12 +1,12 @@
 # Матрица задач
 
-Generated; state revision **114**. Canonical status: state/tasks.json.
+Generated; state revision **115**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | done | auto-orchestrator-48aab142ecde |  | Утвердить Web-профиль |
 | [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | done | auto-orchestrator-68a05c587e33 | S00-001, S00-011, S00-012 | Выбрать framework и build runtime |
-| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | review | auto-protocol-f474114f0168 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-020 | Проверить XMPP WSS/auth библиотеку |
+| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | done | auto-protocol-f474114f0168 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-020 | Проверить XMPP WSS/auth библиотеку |
 | [S00-004](tasks/S00-004.md) | S00 | crypto | security | blocked | auto-crypto-fe1c81c17ded | S00-001, S00-002, S00-021, S00-022 | Проверить browser OMEMO backend |
 | [S00-005](tasks/S00-005.md) | S00 | storage | qa | todo |  | S00-002, S00-023 | Выбрать IndexedDB wrapper и migration policy |
 | [S00-006](tasks/S00-006.md) | S00 | orchestrator | security | todo |  | S00-002 | Зафиксировать browser/reference matrix |

planning/stages/S00.md

@@ -8,7 +8,7 @@
 
 - [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; done.
 - [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; done.
-- [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; review.
+- [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; done.
 - [S00-004](../tasks/S00-004.md): Проверить browser OMEMO backend — crypto; blocked.
 - [S00-005](../tasks/S00-005.md): Выбрать IndexedDB wrapper и migration policy — storage; todo.
 - [S00-006](../tasks/S00-006.md): Зафиксировать browser/reference matrix — orchestrator; todo.

planning/task_matrix.csv

@@ -1,7 +1,7 @@
 id,stage,operator,reviewer,status,owner,depends_on,title
 S00-001,S00,orchestrator,security,done,auto-orchestrator-48aab142ecde,,Утвердить Web-профиль
 S00-002,S00,orchestrator,security,done,auto-orchestrator-68a05c587e33,"S00-001, S00-011, S00-012",Выбрать framework и build runtime
-S00-003,S00,protocol,qa,review,auto-protocol-f474114f0168,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-020",Проверить XMPP WSS/auth библиотеку
+S00-003,S00,protocol,qa,done,auto-protocol-f474114f0168,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-020",Проверить XMPP WSS/auth библиотеку
 S00-004,S00,crypto,security,blocked,auto-crypto-fe1c81c17ded,"S00-001, S00-002, S00-021, S00-022",Проверить browser OMEMO backend
 S00-005,S00,storage,qa,todo,,"S00-002, S00-023",Выбрать IndexedDB wrapper и migration policy
 S00-006,S00,orchestrator,security,todo,,S00-002,Зафиксировать browser/reference matrix

state/commit_messages/auto-qa-d49749753ac6.txt

@@ -0,0 +1,4 @@
+Approve bounded XMPP selection after independent WSS and SCRAM checks
+
+Changes: Accept ADR 0002 for pinned Stanza with mandatory bounded transport, verified SASL and SHA512 composition; record independent review findings and handoff with external limits retained.
+Validation: Fresh-cache pinned npm ci and browser build succeeded; all 112 tests passed. Verified 51 locked entries, 26 installed notices and 340 unchanged vendor files; six offer permutations and six adversarial XML checks passed; make check passed 72 tooling tests. No actual browser, independent full XMPP server/client, OMEMO or release readiness acceptance.

state/evidence/S00-003-review.md

@@ -0,0 +1,108 @@
+# S00-003 independent QA review
+
+Reviewer: auto-qa-d49749753ac6 (qa), 2026-10-15.
+Executor: auto-protocol-f474114f0168. Decision: approve bounded selection and spike.
+
+Input: master/startup/common/qa, profile/architecture/contracts/workflow/
+automation/Git, required TESTING/protocol/ADR registry; assigned resume/show/
+packet/card and handoff; exact immutable ACC-004, NET-003/004; accepted scope,
+stack, SASL/parser/SHA512 ADRs and direct dependency evidence/reviews/handoffs.
+Output: independent review report, ADR acceptance metadata, handoff note and
+review commit message. S01 shared contracts remain future work.
+
+## Patch and acceptance findings
+
+Latest executor commit 51a414d386975e2f1cc28a513708abd2fe77bffc, its path list,
+source/test/build/dependency content and commit message were inspected. Prior
+S00-003 blocker checkpoints c73d9ce/f556fc0/e69372c/452ec2f document SASL, parser,
+SHA512 and environment problems now addressed by reviewed prerequisites and
+the combined spike. Executor message accurately describes actual changes and
+limits. Initial working tree was clean. Source paths are confined to the card
+ADR and experiments/0002-xmpp-library; remaining paths are workflow/generated
+metadata. No app module, shared interface, accepted stack or spec edit found.
+
+1. Pass: actual browser-built Client/Registry/feature dispatcher composes the
+reviewed bounded transport and SHA512 alias with verified SASL. Diff against
+accepted SHA512 guard changes only mechanism allowlist/verifier lengths and
+safe policy diagnostics. Public shipped constructor registry, Transport,
+Client.use/registerFeature and Factory/SCRAM signatures support the seams;
+no private vendor field or primitive implementation is introduced.
+2. Pass: loopback TLS/WSS peer observes encrypted socket, xmpp subprotocol,
+framing open, fixed exact SCRAM-512/256/1 proof and restart after verified final.
+Forged/premature final cannot succeed/restart. Incomplete/oversized WSS XML
+rejects terminally. Native socket rejects untrusted certificate; ws endpoint
+rejects before socket creation. Fixture CA injection retains rejectUnauthorized
+and hostname checks; no system trust changes, committed keys or TLS/CORS bypass.
+3. Pass: unavailable channel binding is explicit in diagnostics; PLUS is filtered,
+synthetic tlsUnique rejected, n,,/c=biws verified, fallback disabled. Compatible
+non-PLUS mechanisms select 512 then 256 then 1. Additional independent ordering
+checks cover all six permutations of the three supported offers.
+4. Pass: finite byte precheck precedes SAX and actual JXT import; reviewed ingress
+source is byte-identical. Additional structural/token adversarial cases reject
+before registry access. Real Registry import/export preserves basic MAM IDs,
+MUC join, Jingle sid, upload download URL, legacy opaque bytes and invented
+extension namespace isolation. Raw dual-body duplication is preserved as a
+regression and explicitly projected for MAM export, not hidden as compatibility.
+5. Pass: fresh locked install, exact pins, inventories/notices, browser graph and
+all 340 unchanged vendor files verified. Local lock/guard/bundle hashes match
+executor evidence. Evidence and handoff allow scoped continuation with limits.
+
+## Actual commands and results
+
+All Node/npm commands used the independently reviewed existing Linux runtime:
+PATH=/tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin:$PATH.
+No new archive authentication or detached-signature verification claimed.
+
+- python3 scripts/tasks.py resume --agent auto-qa-d49749753ac6: exit 0, [].
+  show S00-003 and packet S00-003 --agent auto-qa-d49749753ac6: exit 0 each;
+  review status, distinct owner, done prerequisites confirmed; no claim.
+- Read-only git log --all --oneline --grep='^S00-003:', git show --stat 51a414d,
+  scoped diff/source reads and prior checkpoint summaries: exit 0.
+- node --version / npm --version: exit 0, v24.21.0 / 11.19.0.
+- npm ci --prefix experiments/0002-xmpp-library/selection-spike --ignore-scripts
+  --no-audit --no-fund --engine-strict=true --strict-ssl=true --fetch-retries=0
+  --fetch-timeout=15000 --cache /tmp/luma-S00-003-qa-d49749753ac6: exit 0,
+  new reviewer cache, 26 packages in 2s. Upgrade notice ignored.
+- npm test --prefix experiments/0002-xmpp-library/selection-spike redirected to
+  /tmp/luma-S00-003-qa-d49749753ac6-tests.log: exit 0, 171-module browser build,
+  112 passed, zero failed/skipped/cancelled, 3107.834263 ms.
+- python3 experiments/0002-xmpp-library/selection-spike/check-dependencies.py:
+  exit 0; 51 locked / 26 installed pins/licenses/notices, HTTPS/SHA512 lock,
+  340 unchanged Stanza files versus reviewed isolated vendor graph, unchanged
+  parser/alias/saxes license and browser backend verified.
+- Inline pinned node --input-type=module independent assertions: exit 0.
+  All six supported offer permutations select SHA512 and exact safe diagnostics.
+  Six XML inputs (17 attributes, 33 elements, 129-unit name, 257-unit attribute,
+  complete open plus unfinished second root, 257 decoded character references)
+  reject before registry access; a valid message imports exact review-fixture body.
+  This uses the built artifact, changes no source or crypto/verifier result.
+- make check redirected to /tmp/luma-S00-003-qa-d49749753ac6-check.log:
+  exit 0, 72 tooling tests in 18.929s; foundation validation only.
+- Final git diff --check and inline authored whitespace/scope assertions: exit 0.
+  Only ADR acceptance metadata and review workflow metadata changed.
+
+SHA256: package-lock.json 02bb48038b194b72efc688752927815e3de94bf589bfe1d2e5bcee68283c4abc;
+validated-sasl.mjs 42a7e751565c27b45eee371852973d3613d26981586b48271d78586141466d61;
+dist/browser.mjs b95b0ba5c2fbf5d52b5b1e62c40f6b4d5669d22499cbfef0fe3d88b6bf708cee.
+
+Independently opened primary RFC 7395, RFC 5802 and Stanza/xmpp.js upstream
+through web tools on 2026-10-15. RFC 7395 supplies xmpp text/standalone framing
+and TLS/restart requirements, not these numerical budgets. Version-specific
+behavior rests on shipped pinned source; xmpp.js was not installed/tested.
+Sources: https://www.rfc-editor.org/rfc/rfc7395.html,
+https://www.rfc-editor.org/rfc/rfc5802.html,
+https://github.com/legastero/stanza, https://github.com/xmppjs/xmpp.js.
+
+## Limits and handoff
+
+No actual Chrome/Firefox/Safari runtime, independent full XMPP server/client,
+OMEMO crypto/OMEMO2 wire, full XEP semantics, production provider, advisory/
+provenance audit or release readiness tested or accepted. Browser bundle runs
+in Node with host web APIs and fixture socket. Stock defects reproduce in control
+tests; acceptance requires all three seams. Parser checks start after network
+allocation; aggregate queues/rates remain unbounded. Strict success-only SCRAM
+layout, synchronous derivation, string equality, no timeout and minimal stream
+lifecycle remain disclosed. Prior standalone parser/oracle suites were not rerun;
+accepted evidence and byte-identical reuse are inputs, not new execution claims.
+No blocker or acceptance defect found within the assigned bounded outcome.
+Coordinator owns commit and next process; reviewer exits immediately on approve.

state/handoffs/S00-003.md

@@ -36,3 +36,16 @@ SCRAM layout/timeout/timing, minimal transport/lifecycle and aggregate queue
 limits remain. Source changes are only current task paths plus workflow metadata.
 ADR stays proposed until separate QA acceptance. Coordinator alone commits and
 launches new process; executor exits immediately after submit.
+
+
+## Independent QA acceptance
+
+Reviewer auto-qa-d49749753ac6, 2026-10-15: accepted bounded S00-003 and ADR 0002.
+Fresh-cache pinned npm ci, browser bundle and 112 tests, dependency/notices/vendor
+checks and make check (72 tooling tests) passed. Six additional offer permutations
+and six adversarial XML inputs passed independent assertions. Review evidence:
+state/evidence/S00-003-review.md. All documented external/browser/interoperability/
+crypto/timing/lifecycle/aggregate-resource limits remain. Future adapters must
+install the three required seams before connect and construct deliberate outbound
+body projections. Coordinator must commit review before any next fresh session;
+reviewer exits on approve without Git mutation or another task/agent launch.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 114,
+  "revision": 115,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -32,18 +32,21 @@
       "completed_at": "2026-10-14T19:06:23+00:00"
     },
     "S00-003": {
-      "status": "review",
+      "status": "done",
       "owner": "auto-protocol-f474114f0168",
       "started_at": "2026-10-15T11:10:08+00:00",
       "reason": null,
-      "updated_at": "2026-10-15T11:19:59+00:00",
+      "updated_at": "2026-10-15T11:25:55+00:00",
       "blocked_by": [],
       "resume_status": "in_progress",
       "blocker_report": "state/blockers/S00-020.md",
       "handoff": "state/handoffs/S00-003.md",
       "previous_owner": "auto-protocol-59f4d359b339",
       "resumed_after_blocker": true,
-      "evidence": "state/evidence/S00-003-auto-protocol-f474114f0168.md"
+      "evidence": "state/evidence/S00-003-auto-protocol-f474114f0168.md",
+      "reviewer": "auto-qa-d49749753ac6",
+      "review_evidence": "state/evidence/S00-003-review.md",
+      "completed_at": "2026-10-15T11:25:55+00:00"
     },
     "S00-004": {
       "status": "blocked",
@@ -2925,6 +2928,18 @@
       "to": "review",
       "reason": null,
       "evidence": "state/evidence/S00-003-auto-protocol-f474114f0168.md"
+    },
+    {
+      "revision": 115,
+      "at": "2026-10-15T11:25:55+00:00",
+      "action": "approve",
+      "task": "S00-003",
+      "agent": "auto-qa-d49749753ac6",
+      "role": "qa",
+      "from": "review",
+      "to": "done",
+      "reason": null,
+      "evidence": "state/evidence/S00-003-review.md"
     }
   ],
   "retired_agents": [