S00-003: Approve bounded XMPP selection after independent WSS and SCRAM checks

Changes: Accept ADR 0002 for pinned Stanza with mandatory bounded transport, verified SASL and SHA512 composition; record independent review findings and handoff with external limits retained.
Validation: Fresh-cache pinned npm ci and browser build succeeded; all 112 tests passed. Verified 51 locked entries, 26 installed notices and 340 unchanged vendor files; six offer permutations and six adversarial XML checks passed; make check passed 72 tooling tests. No actual browser, independent full XMPP server/client, OMEMO or release readiness acceptance.

Task: S00-003
Agent: auto-qa-d49749753ac6
Role: qa
Action: review
Status: done

Task title: Проверить XMPP WSS/auth библиотеку

state/commit_messages/auto-qa-d49749753ac6.txt

@@ -0,0 +1,4 @@
+Approve bounded XMPP selection after independent WSS and SCRAM checks
+
+Changes: Accept ADR 0002 for pinned Stanza with mandatory bounded transport, verified SASL and SHA512 composition; record independent review findings and handoff with external limits retained.
+Validation: Fresh-cache pinned npm ci and browser build succeeded; all 112 tests passed. Verified 51 locked entries, 26 installed notices and 340 unchanged vendor files; six offer permutations and six adversarial XML checks passed; make check passed 72 tooling tests. No actual browser, independent full XMPP server/client, OMEMO or release readiness acceptance.

state/evidence/S00-003-review.md

@@ -0,0 +1,108 @@
+# S00-003 independent QA review
+
+Reviewer: auto-qa-d49749753ac6 (qa), 2026-10-15.
+Executor: auto-protocol-f474114f0168. Decision: approve bounded selection and spike.
+
+Input: master/startup/common/qa, profile/architecture/contracts/workflow/
+automation/Git, required TESTING/protocol/ADR registry; assigned resume/show/
+packet/card and handoff; exact immutable ACC-004, NET-003/004; accepted scope,
+stack, SASL/parser/SHA512 ADRs and direct dependency evidence/reviews/handoffs.
+Output: independent review report, ADR acceptance metadata, handoff note and
+review commit message. S01 shared contracts remain future work.
+
+## Patch and acceptance findings
+
+Latest executor commit 51a414d386975e2f1cc28a513708abd2fe77bffc, its path list,
+source/test/build/dependency content and commit message were inspected. Prior
+S00-003 blocker checkpoints c73d9ce/f556fc0/e69372c/452ec2f document SASL, parser,
+SHA512 and environment problems now addressed by reviewed prerequisites and
+the combined spike. Executor message accurately describes actual changes and
+limits. Initial working tree was clean. Source paths are confined to the card
+ADR and experiments/0002-xmpp-library; remaining paths are workflow/generated
+metadata. No app module, shared interface, accepted stack or spec edit found.
+
+1. Pass: actual browser-built Client/Registry/feature dispatcher composes the
+reviewed bounded transport and SHA512 alias with verified SASL. Diff against
+accepted SHA512 guard changes only mechanism allowlist/verifier lengths and
+safe policy diagnostics. Public shipped constructor registry, Transport,
+Client.use/registerFeature and Factory/SCRAM signatures support the seams;
+no private vendor field or primitive implementation is introduced.
+2. Pass: loopback TLS/WSS peer observes encrypted socket, xmpp subprotocol,
+framing open, fixed exact SCRAM-512/256/1 proof and restart after verified final.
+Forged/premature final cannot succeed/restart. Incomplete/oversized WSS XML
+rejects terminally. Native socket rejects untrusted certificate; ws endpoint
+rejects before socket creation. Fixture CA injection retains rejectUnauthorized
+and hostname checks; no system trust changes, committed keys or TLS/CORS bypass.
+3. Pass: unavailable channel binding is explicit in diagnostics; PLUS is filtered,
+synthetic tlsUnique rejected, n,,/c=biws verified, fallback disabled. Compatible
+non-PLUS mechanisms select 512 then 256 then 1. Additional independent ordering
+checks cover all six permutations of the three supported offers.
+4. Pass: finite byte precheck precedes SAX and actual JXT import; reviewed ingress
+source is byte-identical. Additional structural/token adversarial cases reject
+before registry access. Real Registry import/export preserves basic MAM IDs,
+MUC join, Jingle sid, upload download URL, legacy opaque bytes and invented
+extension namespace isolation. Raw dual-body duplication is preserved as a
+regression and explicitly projected for MAM export, not hidden as compatibility.
+5. Pass: fresh locked install, exact pins, inventories/notices, browser graph and
+all 340 unchanged vendor files verified. Local lock/guard/bundle hashes match
+executor evidence. Evidence and handoff allow scoped continuation with limits.
+
+## Actual commands and results
+
+All Node/npm commands used the independently reviewed existing Linux runtime:
+PATH=/tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin:$PATH.
+No new archive authentication or detached-signature verification claimed.
+
+- python3 scripts/tasks.py resume --agent auto-qa-d49749753ac6: exit 0, [].
+  show S00-003 and packet S00-003 --agent auto-qa-d49749753ac6: exit 0 each;
+  review status, distinct owner, done prerequisites confirmed; no claim.
+- Read-only git log --all --oneline --grep='^S00-003:', git show --stat 51a414d,
+  scoped diff/source reads and prior checkpoint summaries: exit 0.
+- node --version / npm --version: exit 0, v24.21.0 / 11.19.0.
+- npm ci --prefix experiments/0002-xmpp-library/selection-spike --ignore-scripts
+  --no-audit --no-fund --engine-strict=true --strict-ssl=true --fetch-retries=0
+  --fetch-timeout=15000 --cache /tmp/luma-S00-003-qa-d49749753ac6: exit 0,
+  new reviewer cache, 26 packages in 2s. Upgrade notice ignored.
+- npm test --prefix experiments/0002-xmpp-library/selection-spike redirected to
+  /tmp/luma-S00-003-qa-d49749753ac6-tests.log: exit 0, 171-module browser build,
+  112 passed, zero failed/skipped/cancelled, 3107.834263 ms.
+- python3 experiments/0002-xmpp-library/selection-spike/check-dependencies.py:
+  exit 0; 51 locked / 26 installed pins/licenses/notices, HTTPS/SHA512 lock,
+  340 unchanged Stanza files versus reviewed isolated vendor graph, unchanged
+  parser/alias/saxes license and browser backend verified.
+- Inline pinned node --input-type=module independent assertions: exit 0.
+  All six supported offer permutations select SHA512 and exact safe diagnostics.
+  Six XML inputs (17 attributes, 33 elements, 129-unit name, 257-unit attribute,
+  complete open plus unfinished second root, 257 decoded character references)
+  reject before registry access; a valid message imports exact review-fixture body.
+  This uses the built artifact, changes no source or crypto/verifier result.
+- make check redirected to /tmp/luma-S00-003-qa-d49749753ac6-check.log:
+  exit 0, 72 tooling tests in 18.929s; foundation validation only.
+- Final git diff --check and inline authored whitespace/scope assertions: exit 0.
+  Only ADR acceptance metadata and review workflow metadata changed.
+
+SHA256: package-lock.json 02bb48038b194b72efc688752927815e3de94bf589bfe1d2e5bcee68283c4abc;
+validated-sasl.mjs 42a7e751565c27b45eee371852973d3613d26981586b48271d78586141466d61;
+dist/browser.mjs b95b0ba5c2fbf5d52b5b1e62c40f6b4d5669d22499cbfef0fe3d88b6bf708cee.
+
+Independently opened primary RFC 7395, RFC 5802 and Stanza/xmpp.js upstream
+through web tools on 2026-10-15. RFC 7395 supplies xmpp text/standalone framing
+and TLS/restart requirements, not these numerical budgets. Version-specific
+behavior rests on shipped pinned source; xmpp.js was not installed/tested.
+Sources: https://www.rfc-editor.org/rfc/rfc7395.html,
+https://www.rfc-editor.org/rfc/rfc5802.html,
+https://github.com/legastero/stanza, https://github.com/xmppjs/xmpp.js.
+
+## Limits and handoff
+
+No actual Chrome/Firefox/Safari runtime, independent full XMPP server/client,
+OMEMO crypto/OMEMO2 wire, full XEP semantics, production provider, advisory/
+provenance audit or release readiness tested or accepted. Browser bundle runs
+in Node with host web APIs and fixture socket. Stock defects reproduce in control
+tests; acceptance requires all three seams. Parser checks start after network
+allocation; aggregate queues/rates remain unbounded. Strict success-only SCRAM
+layout, synchronous derivation, string equality, no timeout and minimal stream
+lifecycle remain disclosed. Prior standalone parser/oracle suites were not rerun;
+accepted evidence and byte-identical reuse are inputs, not new execution claims.
+No blocker or acceptance defect found within the assigned bounded outcome.
+Coordinator owns commit and next process; reviewer exits immediately on approve.

state/handoffs/S00-003.md

@@ -36,3 +36,16 @@ SCRAM layout/timeout/timing, minimal transport/lifecycle and aggregate queue
 limits remain. Source changes are only current task paths plus workflow metadata.
 ADR stays proposed until separate QA acceptance. Coordinator alone commits and
 launches new process; executor exits immediately after submit.
+
+
+## Independent QA acceptance
+
+Reviewer auto-qa-d49749753ac6, 2026-10-15: accepted bounded S00-003 and ADR 0002.
+Fresh-cache pinned npm ci, browser bundle and 112 tests, dependency/notices/vendor
+checks and make check (72 tooling tests) passed. Six additional offer permutations
+and six adversarial XML inputs passed independent assertions. Review evidence:
+state/evidence/S00-003-review.md. All documented external/browser/interoperability/
+crypto/timing/lifecycle/aggregate-resource limits remain. Future adapters must
+install the three required seams before connect and construct deliberate outbound
+body projections. Coordinator must commit review before any next fresh session;
+reviewer exits on approve without Git mutation or another task/agent launch.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 114,
+  "revision": 115,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -32,18 +32,21 @@
       "completed_at": "2026-10-14T19:06:23+00:00"
     },
     "S00-003": {
-      "status": "review",
+      "status": "done",
       "owner": "auto-protocol-f474114f0168",
       "started_at": "2026-10-15T11:10:08+00:00",
       "reason": null,
-      "updated_at": "2026-10-15T11:19:59+00:00",
+      "updated_at": "2026-10-15T11:25:55+00:00",
       "blocked_by": [],
       "resume_status": "in_progress",
       "blocker_report": "state/blockers/S00-020.md",
       "handoff": "state/handoffs/S00-003.md",
       "previous_owner": "auto-protocol-59f4d359b339",
       "resumed_after_blocker": true,
-      "evidence": "state/evidence/S00-003-auto-protocol-f474114f0168.md"
+      "evidence": "state/evidence/S00-003-auto-protocol-f474114f0168.md",
+      "reviewer": "auto-qa-d49749753ac6",
+      "review_evidence": "state/evidence/S00-003-review.md",
+      "completed_at": "2026-10-15T11:25:55+00:00"
     },
     "S00-004": {
       "status": "blocked",
@@ -2925,6 +2928,18 @@
       "to": "review",
       "reason": null,
       "evidence": "state/evidence/S00-003-auto-protocol-f474114f0168.md"
+    },
+    {
+      "revision": 115,
+      "at": "2026-10-15T11:25:55+00:00",
+      "action": "approve",
+      "task": "S00-003",
+      "agent": "auto-qa-d49749753ac6",
+      "role": "qa",
+      "from": "review",
+      "to": "done",
+      "reason": null,
+      "evidence": "state/evidence/S00-003-review.md"
     }
   ],
   "retired_agents": [