S00-003: Record blocked task and remediation handoff
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution. Task: S00-003 Agent: auto-protocol-826aa6bc12ef Role: protocol Action: claim Status: blocked Task title: Проверить XMPP WSS/auth библиотеку
This commit is contained in:
wt committed
1 parent
f12a71df49
commit
c73d9cef45
15 files changed
+409
-14
No files matched your search
+99
@@ -0,0 +1,99 @@
|
||||
{
|
||||
"name": "luma-xmpp-library-spike",
|
||||
"version": "0.0.0",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "luma-xmpp-library-spike",
|
||||
"version": "0.0.0",
|
||||
"dependencies": {
|
||||
"stanza": "12.22.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": "24.21.0",
|
||||
"npm": "11.19.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@types/node": {
|
||||
"version": "22.20.5",
|
||||
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
|
||||
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"undici-types": "~6.21.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@types/punycode": {
|
||||
"version": "2.1.4",
|
||||
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
|
||||
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/@types/ws": {
|
||||
"version": "8.18.2",
|
||||
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
|
||||
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@types/node": "*"
|
||||
}
|
||||
},
|
||||
"node_modules/punycode": {
|
||||
"version": "2.3.1",
|
||||
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
|
||||
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=6"
|
||||
}
|
||||
},
|
||||
"node_modules/sdp": {
|
||||
"version": "3.2.2",
|
||||
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
|
||||
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/stanza": {
|
||||
"version": "12.22.1",
|
||||
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
|
||||
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@types/node": "^22.0.0",
|
||||
"@types/punycode": "^2.1.0",
|
||||
"@types/ws": "^8.18.1",
|
||||
"punycode": "^2.1.1",
|
||||
"sdp": "^3.0.2",
|
||||
"ws": "^8.18.2"
|
||||
}
|
||||
},
|
||||
"node_modules/undici-types": {
|
||||
"version": "6.21.0",
|
||||
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
|
||||
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/ws": {
|
||||
"version": "8.22.0",
|
||||
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
|
||||
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=10.0.0"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"bufferutil": "^4.0.1",
|
||||
"utf-8-validate": ">=5.0.2"
|
||||
},
|
||||
"peerDependenciesMeta": {
|
||||
"bufferutil": {
|
||||
"optional": true
|
||||
},
|
||||
"utf-8-validate": {
|
||||
"optional": true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
{
|
||||
"name": "luma-xmpp-library-spike",
|
||||
"version": "0.0.0",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"engines": {"node": "24.21.0", "npm": "11.19.0"},
|
||||
"packageManager": "npm@11.19.0",
|
||||
"scripts": {"test": "node --test test/*.test.mjs"},
|
||||
"dependencies": {"stanza": "12.22.1"}
|
||||
}
|
||||
+1
-1
@@ -6,7 +6,7 @@
|
||||
|
||||
Зафиксировать Web scope, browser targets и проверенные кандидаты, не устанавливая непроверенный framework по догадке.
|
||||
|
||||
Задач: 16; entry: нет; exit: S00-010.
|
||||
Задач: 17; entry: нет; exit: S00-010.
|
||||
|
||||
## [S01: Предметные контракты](stages/S01.md)
|
||||
|
||||
|
||||
@@ -1,12 +1,12 @@
|
||||
# Матрица задач
|
||||
|
||||
Generated; state revision **36**. Canonical status: state/tasks.json.
|
||||
Generated; state revision **38**. Canonical status: state/tasks.json.
|
||||
|
||||
| ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
|
||||
| --- | --- | --- | --- | --- | --- | --- | --- |
|
||||
| [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | done | auto-orchestrator-48aab142ecde | | Утвердить Web-профиль |
|
||||
| [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | done | auto-orchestrator-68a05c587e33 | S00-001, S00-011, S00-012 | Выбрать framework и build runtime |
|
||||
| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | todo | | S00-001, S00-002 | Проверить XMPP WSS/auth библиотеку |
|
||||
| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | blocked | auto-protocol-826aa6bc12ef | S00-001, S00-002, S00-017 | Проверить XMPP WSS/auth библиотеку |
|
||||
| [S00-004](tasks/S00-004.md) | S00 | crypto | security | todo | | S00-001, S00-002 | Проверить browser OMEMO backend |
|
||||
| [S00-005](tasks/S00-005.md) | S00 | storage | qa | todo | | S00-002 | Выбрать IndexedDB wrapper и migration policy |
|
||||
| [S00-006](tasks/S00-006.md) | S00 | orchestrator | security | todo | | S00-002 | Зафиксировать browser/reference matrix |
|
||||
@@ -19,6 +19,7 @@ Generated; state revision **36**. Canonical status: state/tasks.json.
|
||||
| [S00-014](tasks/S00-014.md) | S00 | ci-cd | qa | done | auto-ci-cd-14343249da62 | S00-001, S00-011, S00-013 | Fix repeated runner cleanup after a submitted parent is reaped |
|
||||
| [S00-015](tasks/S00-015.md) | S00 | ci-cd | qa | done | auto-ci-cd-84e209103f24 | S00-001, S00-011, S00-013, S00-014, S00-016 | Устранить прерывание: Fix runner prompt delivery after partial stdin timeout |
|
||||
| [S00-016](tasks/S00-016.md) | S00 | ci-cd | qa | done | auto-ci-cd-351a0cbbabef | S00-001, S00-011, S00-013, S00-014 | Restore reviewer model availability after provider capacity failure |
|
||||
| [S00-017](tasks/S00-017.md) | S00 | protocol | security | todo | | S00-001, S00-002 | Establish fail-closed SCRAM server-final validation |
|
||||
| [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo | | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
|
||||
| [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo | | S00-010 | Описать identity/model contracts |
|
||||
| [S01-002](tasks/S01-002.md) | S01 | orchestrator | security | todo | | S00-010, S01-001 | Описать async account context |
|
||||
|
||||
@@ -14,7 +14,7 @@ Allocated означает наличие плана/приёмки, а не р
|
||||
| ACC-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-003, S21-001 |
|
||||
| ACC-002 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-001, S21-001 |
|
||||
| ACC-003 | out_of_scope | Native host/port TCP configuration; Web uses ACC-004 WSS. | |
|
||||
| ACC-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S05-001, S06-003, S21-001 |
|
||||
| ACC-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S05-001, S06-003, S21-001 |
|
||||
| ACC-005 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-001, S06-011, S21-001 |
|
||||
| ACC-006 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-003, S06-004, S21-001 |
|
||||
| ACC-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-002, S06-009, S20-008, S21-001 |
|
||||
@@ -27,8 +27,8 @@ Allocated означает наличие плана/приёмки, а не р
|
||||
| ACC-014 | web | Web requirement; cross-platform clauses apply only in Web context. | S01-002, S02-010, S06-006, S06-010, S21-001 |
|
||||
| NET-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S02-008, S05-001, S05-002, S05-009, S21-001 |
|
||||
| NET-002 | out_of_scope | Native transport discovery; Web WSS addressed by ACC-004/NET-001. | |
|
||||
| NET-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S05-003, S21-001 |
|
||||
| NET-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S05-003, S05-009, S21-001 |
|
||||
| NET-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S05-003, S21-001 |
|
||||
| NET-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S05-003, S05-009, S21-001 |
|
||||
| NET-005 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-004, S21-001 |
|
||||
| NET-006 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-002, S05-010, S06-004, S20-002, S21-001 |
|
||||
| NET-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-007, S21-001 |
|
||||
|
||||
@@ -8,7 +8,7 @@
|
||||
|
||||
- [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; done.
|
||||
- [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; done.
|
||||
- [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; todo.
|
||||
- [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; blocked.
|
||||
- [S00-004](../tasks/S00-004.md): Проверить browser OMEMO backend — crypto; todo.
|
||||
- [S00-005](../tasks/S00-005.md): Выбрать IndexedDB wrapper и migration policy — storage; todo.
|
||||
- [S00-006](../tasks/S00-006.md): Зафиксировать browser/reference matrix — orchestrator; todo.
|
||||
@@ -21,6 +21,7 @@
|
||||
- [S00-014](../tasks/S00-014.md): Fix repeated runner cleanup after a submitted parent is reaped — ci-cd; done.
|
||||
- [S00-015](../tasks/S00-015.md): Устранить прерывание: Fix runner prompt delivery after partial stdin timeout — ci-cd; done.
|
||||
- [S00-016](../tasks/S00-016.md): Restore reviewer model availability after provider capacity failure — ci-cd; done.
|
||||
- [S00-017](../tasks/S00-017.md): Establish fail-closed SCRAM server-final validation — protocol; todo.
|
||||
- [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
|
||||
|
||||
## Граница этапа
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
id,stage,operator,reviewer,status,owner,depends_on,title
|
||||
S00-001,S00,orchestrator,security,done,auto-orchestrator-48aab142ecde,,Утвердить Web-профиль
|
||||
S00-002,S00,orchestrator,security,done,auto-orchestrator-68a05c587e33,"S00-001, S00-011, S00-012",Выбрать framework и build runtime
|
||||
S00-003,S00,protocol,qa,todo,,"S00-001, S00-002",Проверить XMPP WSS/auth библиотеку
|
||||
S00-003,S00,protocol,qa,blocked,auto-protocol-826aa6bc12ef,"S00-001, S00-002, S00-017",Проверить XMPP WSS/auth библиотеку
|
||||
S00-004,S00,crypto,security,todo,,"S00-001, S00-002",Проверить browser OMEMO backend
|
||||
S00-005,S00,storage,qa,todo,,S00-002,Выбрать IndexedDB wrapper и migration policy
|
||||
S00-006,S00,orchestrator,security,todo,,S00-002,Зафиксировать browser/reference matrix
|
||||
@@ -14,6 +14,7 @@ S00-013,S00,ci-cd,qa,done,auto-ci-cd-5f68f03dd33b,"S00-001, S00-011",Bound overs
|
||||
S00-014,S00,ci-cd,qa,done,auto-ci-cd-14343249da62,"S00-001, S00-011, S00-013",Fix repeated runner cleanup after a submitted parent is reaped
|
||||
S00-015,S00,ci-cd,qa,done,auto-ci-cd-84e209103f24,"S00-001, S00-011, S00-013, S00-014, S00-016",Устранить прерывание: Fix runner prompt delivery after partial stdin timeout
|
||||
S00-016,S00,ci-cd,qa,done,auto-ci-cd-351a0cbbabef,"S00-001, S00-011, S00-013, S00-014",Restore reviewer model availability after provider capacity failure
|
||||
S00-017,S00,protocol,security,todo,,"S00-001, S00-002",Establish fail-closed SCRAM server-final validation
|
||||
S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
|
||||
S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts
|
||||
S01-002,S01,orchestrator,security,todo,,"S00-010, S01-001",Описать async account context
|
||||
|
||||
|
+56
-1
@@ -267,7 +267,8 @@
|
||||
"outcome": "Spike подтверждает WSS stream, SCRAM, parser limits и нужные module extension points выбранной библиотеки.",
|
||||
"depends_on": [
|
||||
"S00-001",
|
||||
"S00-002"
|
||||
"S00-002",
|
||||
"S00-017"
|
||||
],
|
||||
"requirements": [
|
||||
"ACC-004",
|
||||
@@ -940,6 +941,60 @@
|
||||
],
|
||||
"context_budget_chars": 48000
|
||||
},
|
||||
{
|
||||
"id": "S00-017",
|
||||
"stage": "S00",
|
||||
"kind": "blocker",
|
||||
"root_task": "S00-003",
|
||||
"blocker_depth": 1,
|
||||
"unblocks": [
|
||||
"S00-003"
|
||||
],
|
||||
"role": "protocol",
|
||||
"reviewer_role": "security",
|
||||
"title": "Establish fail-closed SCRAM server-final validation",
|
||||
"outcome": "One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.",
|
||||
"depends_on": [
|
||||
"S00-001",
|
||||
"S00-002"
|
||||
],
|
||||
"requirements": [
|
||||
"ACC-004",
|
||||
"NET-003",
|
||||
"NET-004"
|
||||
],
|
||||
"scope": [
|
||||
"experiments/0002-xmpp-library/sasl-validation/**",
|
||||
"docs/decisions/0002-xmpp-sasl-validation.md"
|
||||
],
|
||||
"inputs": [
|
||||
"docs/WEB_PROFILE.md",
|
||||
"docs/ARCHITECTURE.md",
|
||||
"docs/CONTRACTS.md",
|
||||
"docs/TESTING.md",
|
||||
"roles/protocol.md",
|
||||
"docs/decisions/README.md",
|
||||
"state/blockers/S00-017.md"
|
||||
],
|
||||
"spec_sections": [],
|
||||
"ui_sections": [],
|
||||
"steps": [
|
||||
"Read S00-003 blocker evidence and reproduce the missing/forged/premature success defect with exact candidate versions.",
|
||||
"Evaluate supported SASL feature replacement or a maintained alternative; reuse vetted library crypto, never implement crypto primitives or modify ignored vendor source as the deliverable.",
|
||||
"Build only a fixture-bound SASL validation experiment with exact dependency pins and document how S00-003 can integrate it through supported extension points; do not build production adapters/shared contracts.",
|
||||
"Test valid RFC SCRAM transcript and missing/forged/premature server-final; record actual commands and limitations for independent security review."
|
||||
],
|
||||
"acceptance": [
|
||||
"Missing, forged and premature SCRAM server-final cannot emit auth:success or request authenticated restart in the demonstrated integration.",
|
||||
"A valid primary-spec SCRAM fixture is accepted only after server signature verification, with no handwritten crypto primitives, stub-success or plaintext fallback.",
|
||||
"A supported integration path and pinned dependencies/licenses are documented; original library/WSS/parser/extension task remains separate."
|
||||
],
|
||||
"checks": [
|
||||
"Reproduce original missing/forged/premature success rejection through the integrated SASL handler, not only a standalone mechanism.",
|
||||
"Execute valid RFC SCRAM transcript and negative server-final cases with actual vetted implementation; do not log real credentials."
|
||||
],
|
||||
"context_budget_chars": 48000
|
||||
},
|
||||
{
|
||||
"id": "S00-010",
|
||||
"stage": "S00",
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
- Этап: S00
|
||||
- Оператор: protocol
|
||||
- Reviewer: qa
|
||||
- Зависимости: S00-001, S00-002
|
||||
- Зависимости: S00-001, S00-002, S00-017
|
||||
- Требования: ACC-004, NET-003, NET-004
|
||||
|
||||
## Один результат
|
||||
|
||||
@@ -0,0 +1,58 @@
|
||||
# S00-017: Establish fail-closed SCRAM server-final validation
|
||||
|
||||
- Remediation для: S00-003; root: S00-003; depth: 1
|
||||
|
||||
> Generated from planning/tasks.json; status is in state/tasks.json.
|
||||
|
||||
- Этап: S00
|
||||
- Оператор: protocol
|
||||
- Reviewer: security
|
||||
- Зависимости: S00-001, S00-002
|
||||
- Требования: ACC-004, NET-003, NET-004
|
||||
|
||||
## Один результат
|
||||
|
||||
One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.
|
||||
|
||||
## Разрешённые пути
|
||||
|
||||
- `experiments/0002-xmpp-library/sasl-validation/**`
|
||||
- `docs/decisions/0002-xmpp-sasl-validation.md`
|
||||
|
||||
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
|
||||
|
||||
## Прочитать
|
||||
|
||||
- docs/WEB_PROFILE.md
|
||||
- docs/ARCHITECTURE.md
|
||||
- docs/CONTRACTS.md
|
||||
- docs/TESTING.md
|
||||
- roles/protocol.md
|
||||
- docs/decisions/README.md
|
||||
- state/blockers/S00-017.md
|
||||
|
||||
## Шаги
|
||||
|
||||
1. Read S00-003 blocker evidence and reproduce the missing/forged/premature success defect with exact candidate versions.
|
||||
2. Evaluate supported SASL feature replacement or a maintained alternative; reuse vetted library crypto, never implement crypto primitives or modify ignored vendor source as the deliverable.
|
||||
3. Build only a fixture-bound SASL validation experiment with exact dependency pins and document how S00-003 can integrate it through supported extension points; do not build production adapters/shared contracts.
|
||||
4. Test valid RFC SCRAM transcript and missing/forged/premature server-final; record actual commands and limitations for independent security review.
|
||||
|
||||
## Приёмка
|
||||
|
||||
1. Missing, forged and premature SCRAM server-final cannot emit auth:success or request authenticated restart in the demonstrated integration.
|
||||
2. A valid primary-spec SCRAM fixture is accepted only after server signature verification, with no handwritten crypto primitives, stub-success or plaintext fallback.
|
||||
3. A supported integration path and pinned dependencies/licenses are documented; original library/WSS/parser/extension task remains separate.
|
||||
|
||||
## Focused checks
|
||||
|
||||
1. Reproduce original missing/forged/premature success rejection through the integrated SASL handler, not only a standalone mechanism.
|
||||
2. Execute valid RFC SCRAM transcript and negative server-final cases with actual vetted implementation; do not log real credentials.
|
||||
|
||||
## Блокер и завершение запуска
|
||||
|
||||
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
|
||||
|
||||
## Передача
|
||||
|
||||
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
|
||||
@@ -0,0 +1,22 @@
|
||||
# Blocker S00-017
|
||||
|
||||
- Original task: S00-003
|
||||
- Root task: S00-003
|
||||
- Reporter: auto-protocol-826aa6bc12ef
|
||||
- Role: protocol
|
||||
- Original owner: auto-protocol-826aa6bc12ef
|
||||
- Waits for user/external condition: False
|
||||
|
||||
## Cause
|
||||
|
||||
StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.
|
||||
|
||||
## One remediation outcome
|
||||
|
||||
One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.
|
||||
|
||||
## Evidence / reproduction
|
||||
|
||||
Run the pinned-node parsed-event reproduction in state/evidence/S00-003-auto-protocol-826aa6bc12ef.md; both invalid server-final cases emit auth:success and request restart (wrapper exit 0 confirms defect). Exact installed source: stanza/plugins/sasl.js success branch.
|
||||
|
||||
The reporting agent must stop now. A new agent implements only S00-017.
|
||||
@@ -0,0 +1,69 @@
|
||||
# S00-003 blocked executor evidence
|
||||
|
||||
Agent: auto-protocol-826aa6bc12ef / protocol. Date: 2026-10-15 (local).
|
||||
Outcome: incomplete library evaluation; no library ADR accepted or proposed. Blocker: candidate SASL success paths do not establish SCRAM server authentication.
|
||||
|
||||
## Inputs and scope
|
||||
|
||||
Read master_prompt, AGENTS, README, protocol/common roles, WEB_PROFILE, ARCHITECTURE, CONTRACTS, WORKFLOW, AUTOMATION, GIT_WORKFLOW, required TESTING and decisions/README; assigned resume/show/packet/card, exact ACC-004/NET-003/NET-004, accepted scope and stack ADRs, direct dependency executor/review evidence and handoffs. No previous S00-003 handoff existed in packet. S01 shared schemas are future work; none created.
|
||||
Input: accepted browser stack and exact auth/WSS requirements. Intended output: one library-selection ADR and focused runnable WSS/SCRAM/parser/extension spike. Acceptance remains incomplete.
|
||||
|
||||
Only source writes before discovering blocker: experiments/0002-xmpp-library/package.json and package-lock.json. These pin exploratory stanza 12.22.1 with accepted Node 24.21.0/npm 11.19.0. npm installed 8 packages. node_modules is ignored. The manifest is unfinished (test script points to tests not yet authored); no successful test suite, production adapter, or library selection is implied. Source edits stopped at blocker. Reports/issue/handoff are workflow metadata. No Git mutations, shared contracts, specs or app modules changed.
|
||||
|
||||
## Commands/results
|
||||
|
||||
- python3 scripts/tasks.py resume --agent auto-protocol-826aa6bc12ef; show S00-003; packet S00-003 --agent auto-protocol-826aa6bc12ef: exit 0 each, correctly assigned in_progress, prerequisites done, no second claim.
|
||||
- npm view stanza version license engines dependencies --json --cache /private/tmp/luma-xmpp-cache --fetch-retries=0 --fetch-timeout=15000 --registry=https://registry.npmjs.org/ --strict-ssl=true: exit 0; 12.22.1, MIT. @xmpp/client metadata query: exit 0; 0.14.0, ISC, stock SCRAM-SHA-1 module only. These queries used host npm; installation used pinned tools below.
|
||||
- PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH npm install --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-xmpp-cache --fetch-retries=0 --fetch-timeout=15000 --prefix experiments/0002-xmpp-library: exit 0, 8 installed packages. No lifecycle scripts, TLS bypass or system changes. No clean-install/build/security audit claimed.
|
||||
- npm view @xmpp/sasl-scram-sha-256 version and @xmpp/sasl-scram-sha-512 version with same registry/cache/timeout/strict-ssl flags: each exit 1, E404. Not evidence that no other implementation exists. npm view @xmpp/sasl-scram-sha-1@0.14.0 dependencies: exit 0, sasl-scram-sha-1 ^1.3.0.
|
||||
- Source inspection: stanza/Client.js registers PLUS by priority without checking credentials; plugins/sasl.js success branch emits auth:success and requests restart without processSuccess/finalize. lib/sasl/index.js has verifier checking in finalize, but plugin never invokes it. Parser/StreamParser source has no configurable size/depth limits; not yet tested, not a second remediation. Browser platform advertises SHA-512 but default factory registers only SHA-256/SHA-1. No production readiness inference.
|
||||
- Negative auth-path reproduction below: exit 0; assertions confirmed BOTH missing and forged server-final accepted before any server challenge/client proof, auth:success emitted and restart requested. Also confirmed factory chooses SCRAM-SHA-256-PLUS without checking TLS binding availability. This is an injected parsed-event unit reproduction using the actual installed Client and registered SASL handler, with outgoing send captured. It is NOT a WSS handshake, server interoperability or browser test.
|
||||
- Initial exploratory glob rg command returned exit 1 because zsh could not expand stanza/sasl*; retried using rg --files and actual package paths. Web requests for stanzajs.org, guessed docs paths and mistaken xmpp.org RFC path failed; canonical RFC Editor and installed source supplied relevant facts.
|
||||
|
||||
## Exact security reproduction
|
||||
|
||||
Run from project root with pinned Node:
|
||||
|
||||
```sh
|
||||
PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH node --input-type=module <<'JS'
|
||||
import assert from 'node:assert/strict';
|
||||
import {createRequire} from 'node:module';
|
||||
const require = createRequire(process.cwd() + '/experiments/0002-xmpp-library/package.json');
|
||||
const Client = require('stanza/Client').default;
|
||||
for (const value of [Buffer.alloc(0), Buffer.from('v=AAAAAAAAAAAAAAAAAAAAAAAAAAA=')]) {
|
||||
const client = new Client({jid:'fixture@example.invalid', password:'fixture-only'});
|
||||
const sent = [];
|
||||
client.send = async (kind, stanza) => {sent.push({kind, stanza});};
|
||||
let accepted = false;
|
||||
let command;
|
||||
client.on('auth:success', () => {accepted = true;});
|
||||
await client.features.handlers.sasl({sasl:{mechanisms:['SCRAM-SHA-256']}}, c => {command=c;});
|
||||
assert.equal(sent[0].stanza.mechanism, 'SCRAM-SHA-256');
|
||||
client.emit('sasl', {type:'success', value});
|
||||
assert.equal(accepted, true);
|
||||
assert.equal(command, 'restart');
|
||||
console.log('REPRODUCED: ' + (value.length ? 'forged' : 'missing') + ' server-final accepted before any challenge/proof');
|
||||
}
|
||||
const client = new Client({jid:'fixture@example.invalid', password:'fixture-only'});
|
||||
assert.equal(client.sasl.createMechanism(['SCRAM-SHA-256','SCRAM-SHA-256-PLUS']).name, 'SCRAM-SHA-256-PLUS');
|
||||
console.log('CONFIRMED: default factory selects PLUS without checking TLS binding availability');
|
||||
JS
|
||||
```
|
||||
|
||||
Fixture credentials are invented and never sent over a network. No crypto primitives written. Expected secure behavior would reject the success event; exit 0 here means the insecure behavior was reproduced, not that authentication passed acceptance.
|
||||
|
||||
## Primary sources read 2026-10-15
|
||||
|
||||
- https://github.com/legastero/stanza — upstream TypeScript/JSON API, WSS configuration and MIT notice. Installed 12.22.1 source is the exact reproduction basis; homepage is not version-pinned evidence.
|
||||
- https://registry.npmjs.org/stanza/12.22.1 — metadata resolved by npm and exact tarball/integrity locked locally; installed MIT LICENSE and browser/platform implementation inspected. Full transitive licensing review unfinished.
|
||||
- https://github.com/xmppjs/xmpp.js and https://github.com/xmppjs/xmpp.js/blob/main/packages/client/index.js — alternative architecture.
|
||||
- https://raw.githubusercontent.com/xmppjs/xmpp.js/main/packages/sasl/index.js — current upstream success path also returns done() without passing success payload to mechanism validation. Documentation/source comparison only, not an installed pinned xmpp.js reproduction.
|
||||
- https://raw.githubusercontent.com/xmppjs/xmpp.js/main/packages/sasl-scram-sha-1/index.js — stock mechanism registration.
|
||||
- https://www.rfc-editor.org/rfc/rfc7395.html — XMPP WebSocket subprotocol/framing/TLS.
|
||||
- https://www.rfc-editor.org/rfc/rfc5802.html — SCRAM mutual authentication and server-final semantics.
|
||||
|
||||
## Remaining acceptance and remediation
|
||||
|
||||
WSS handshake, valid SCRAM transcript, bounded parser behavior, extension roundtrip, browser build/execution and independent-server interoperability were NOT run. make check was not run for this incomplete evaluation. Source review is not a browser compatibility test. No certificate/CORS/channel-binding bypass, mock encryption or plaintext fallback was introduced.
|
||||
|
||||
Need one separately reviewed fail-closed SASL validation experiment before continuing original selection. It must use vetted library crypto (or a different maintained implementation), reject missing/forged/premature server-final, prove valid RFC fixtures and document integration through supported extension points. No upstream publication or private credentials required. Original retains WSS/parser/mechanism policy work after remediation; no need to expand into app/shared contracts.
|
||||
@@ -0,0 +1,11 @@
|
||||
# S00-003 blocked handoff
|
||||
|
||||
Executor: auto-protocol-826aa6bc12ef, protocol. Original scope: library selection and WSS/auth/parser/extension spike.
|
||||
|
||||
Reached: inspected StanzaJS 12.22.1 and xmpp.js primary sources; created an exploratory pinned Stanza manifest/lock under experiments/0002-xmpp-library. Stanza's actual registered SASL handler was reproduced accepting empty and forged server-final before challenge/proof and requesting restart. See state/evidence/S00-003-auto-protocol-826aa6bc12ef.md for exact runnable reproduction/commands and limitations.
|
||||
|
||||
Blocker: cannot attest safe SCRAM authentication with the candidate's unverified server-final success path. Its SCRAM implementation exposes finalize verification but its feature handler never calls it. Alternative xmpp.js upstream source likewise completes on success without verifier processing; this alternative was not installed/tested. A separately reviewed fail-closed SASL validation experiment is required; no handwritten cryptographic primitives or upstream source patch should be improvised in original selection.
|
||||
|
||||
Source edits stopped. Manifest/lock are an unaccepted exploratory checkpoint, not a complete spike; npm test points at future tests. No ADR 0002 selection written. WSS, parser bounds, extension roundtrip, browser support and valid SCRAM are unverified. No make check result or release readiness claimed. Secrets/account fixtures are invented; no network auth was sent.
|
||||
|
||||
Next input: new resolver agent implements only the atomic server-final validation outcome in the issue, with actual negative and valid-vector evidence; independent security reviewer validates it. After reviewed done, a fresh original executor resumes library selection and completes all original focused checks. Reporter must exit after escalate; coordinator owns commits/process launches.
|
||||
@@ -0,0 +1,29 @@
|
||||
{
|
||||
"title": "Establish fail-closed SCRAM server-final validation",
|
||||
"reason": "StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.",
|
||||
"reproduction": "Run the pinned-node parsed-event reproduction in state/evidence/S00-003-auto-protocol-826aa6bc12ef.md; both invalid server-final cases emit auth:success and request restart (wrapper exit 0 confirms defect). Exact installed source: stanza/plugins/sasl.js success branch.",
|
||||
"role": "protocol",
|
||||
"reviewer_role": "security",
|
||||
"scope": [
|
||||
"experiments/0002-xmpp-library/sasl-validation/**",
|
||||
"docs/decisions/0002-xmpp-sasl-validation.md"
|
||||
],
|
||||
"outcome": "One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.",
|
||||
"steps": [
|
||||
"Read S00-003 blocker evidence and reproduce the missing/forged/premature success defect with exact candidate versions.",
|
||||
"Evaluate supported SASL feature replacement or a maintained alternative; reuse vetted library crypto, never implement crypto primitives or modify ignored vendor source as the deliverable.",
|
||||
"Build only a fixture-bound SASL validation experiment with exact dependency pins and document how S00-003 can integrate it through supported extension points; do not build production adapters/shared contracts.",
|
||||
"Test valid RFC SCRAM transcript and missing/forged/premature server-final; record actual commands and limitations for independent security review."
|
||||
],
|
||||
"acceptance": [
|
||||
"Missing, forged and premature SCRAM server-final cannot emit auth:success or request authenticated restart in the demonstrated integration.",
|
||||
"A valid primary-spec SCRAM fixture is accepted only after server signature verification, with no handwritten crypto primitives, stub-success or plaintext fallback.",
|
||||
"A supported integration path and pinned dependencies/licenses are documented; original library/WSS/parser/extension task remains separate."
|
||||
],
|
||||
"checks": [
|
||||
"Reproduce original missing/forged/premature success rejection through the integrated SASL handler, not only a standalone mechanism.",
|
||||
"Execute valid RFC SCRAM transcript and negative server-final cases with actual vetted implementation; do not log real credentials."
|
||||
],
|
||||
"depends_on": [],
|
||||
"requires_user_input": false
|
||||
}
|
||||
+43
-4
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"revision": 36,
|
||||
"revision": 38,
|
||||
"tasks": {
|
||||
"S00-001": {
|
||||
"status": "done",
|
||||
@@ -32,8 +32,17 @@
|
||||
"completed_at": "2026-10-14T19:06:23+00:00"
|
||||
},
|
||||
"S00-003": {
|
||||
"status": "todo",
|
||||
"owner": null
|
||||
"status": "blocked",
|
||||
"owner": "auto-protocol-826aa6bc12ef",
|
||||
"started_at": "2026-10-14T19:06:24+00:00",
|
||||
"reason": "StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.",
|
||||
"updated_at": "2026-10-14T19:09:23+00:00",
|
||||
"blocked_by": [
|
||||
"S00-017"
|
||||
],
|
||||
"resume_status": "in_progress",
|
||||
"blocker_report": "state/blockers/S00-017.md",
|
||||
"handoff": "state/handoffs/S00-003.md"
|
||||
},
|
||||
"S00-004": {
|
||||
"status": "todo",
|
||||
@@ -1210,6 +1219,12 @@
|
||||
"reviewer": "auto-qa-309d45d4fd4b",
|
||||
"review_evidence": "state/evidence/S00-016-review.md",
|
||||
"completed_at": "2026-10-14T18:58:04+00:00"
|
||||
},
|
||||
"S00-017": {
|
||||
"status": "todo",
|
||||
"owner": null,
|
||||
"external_wait": false,
|
||||
"reason": null
|
||||
}
|
||||
},
|
||||
"events": [
|
||||
@@ -1678,6 +1693,29 @@
|
||||
"to": "done",
|
||||
"reason": null,
|
||||
"evidence": "state/evidence/S00-002-review.md"
|
||||
},
|
||||
{
|
||||
"revision": 37,
|
||||
"at": "2026-10-14T19:06:24+00:00",
|
||||
"action": "claim",
|
||||
"task": "S00-003",
|
||||
"agent": "auto-protocol-826aa6bc12ef",
|
||||
"role": "protocol",
|
||||
"from": "todo",
|
||||
"to": "in_progress",
|
||||
"reason": null
|
||||
},
|
||||
{
|
||||
"revision": 38,
|
||||
"at": "2026-10-14T19:09:23+00:00",
|
||||
"action": "escalate",
|
||||
"task": "S00-003",
|
||||
"resolution_task": "S00-017",
|
||||
"agent": "auto-protocol-826aa6bc12ef",
|
||||
"role": "protocol",
|
||||
"from": "in_progress",
|
||||
"to": "blocked",
|
||||
"reason": "StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution."
|
||||
}
|
||||
],
|
||||
"retired_agents": [
|
||||
@@ -1686,6 +1724,7 @@
|
||||
"manual-ci-cd-stdin-20261015b",
|
||||
"auto-ci-cd-28868645424b",
|
||||
"auto-qa-98b05bd56c25",
|
||||
"auto-ci-cd-5475930af078"
|
||||
"auto-ci-cd-5475930af078",
|
||||
"auto-protocol-826aa6bc12ef"
|
||||
]
|
||||
}
|
||||
Reference in new issue
Block a user