S00-001: Approve the Web scope passport after independent security review

Changes: Accept ADR 0000 and record the independent reviewer, acceptance findings and handoff. Confirm native exclusion reasons, retained Web obligations, conditional push lifecycle and provider secret/metadata boundaries; transition S00-001 through the review CLI.
Validation: Reviewed executor commit d5ed7eaaed and its message against scope and evidence. python3 experiments/0000-scope/check.py passed ten IDs, seven states and four negative mutations. make check passed validation and all 66 tooling tests. No live browser/provider integration or crypto implementation was tested or accepted.

Task: S00-001
Agent: auto-security-bff4cfd4d38e
Role: security
Action: review
Status: done

Task title: Утвердить Web-профиль

docs/decisions/0000-scope.md

@@ -1,10 +1,10 @@
 # ADR 0000: Паспорт scope Luma Web
 
-- Status: proposed — подлежит независимому security review S00-001; принятие не заявлено.
+- Status: accepted — независимое security review S00-001; evidence: `state/evidence/S00-001-review.md`.
 - Task: S00-001
 - Date: 2026-10-15
 - Decision owner: auto-orchestrator-48aab142ecde, orchestrator
-- Reviewer: security, отдельный процесс coordinator
+- Reviewer: auto-security-bff4cfd4d38e, security, 2026-10-15
 
 ## Вход, результат и критерии
 

planning/TASK_MATRIX.md

@@ -1,10 +1,10 @@
 # Матрица задач
 
-Generated; state revision **2**. Canonical status: state/tasks.json.
+Generated; state revision **3**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
-| [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | review | auto-orchestrator-48aab142ecde |  | Утвердить Web-профиль |
+| [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | done | auto-orchestrator-48aab142ecde |  | Утвердить Web-профиль |
 | [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | todo |  | S00-001 | Выбрать framework и build runtime |
 | [S00-003](tasks/S00-003.md) | S00 | protocol | qa | todo |  | S00-001, S00-002 | Проверить XMPP WSS/auth библиотеку |
 | [S00-004](tasks/S00-004.md) | S00 | crypto | security | todo |  | S00-001, S00-002 | Проверить browser OMEMO backend |

planning/stages/S00.md

@@ -6,7 +6,7 @@
 
 ## Задачи
 
-- [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; review.
+- [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; done.
 - [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; todo.
 - [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; todo.
 - [S00-004](../tasks/S00-004.md): Проверить browser OMEMO backend — crypto; todo.

planning/task_matrix.csv

@@ -1,5 +1,5 @@
 id,stage,operator,reviewer,status,owner,depends_on,title
-S00-001,S00,orchestrator,security,review,auto-orchestrator-48aab142ecde,,Утвердить Web-профиль
+S00-001,S00,orchestrator,security,done,auto-orchestrator-48aab142ecde,,Утвердить Web-профиль
 S00-002,S00,orchestrator,security,todo,,S00-001,Выбрать framework и build runtime
 S00-003,S00,protocol,qa,todo,,"S00-001, S00-002",Проверить XMPP WSS/auth библиотеку
 S00-004,S00,crypto,security,todo,,"S00-001, S00-002",Проверить browser OMEMO backend

state/commit_messages/auto-security-bff4cfd4d38e.txt

@@ -0,0 +1,4 @@
+Approve the Web scope passport after independent security review
+
+Changes: Accept ADR 0000 and record the independent reviewer, acceptance findings and handoff. Confirm native exclusion reasons, retained Web obligations, conditional push lifecycle and provider secret/metadata boundaries; transition S00-001 through the review CLI.
+Validation: Reviewed executor commit d5ed7eaaed54d39ae928698df7085b2d6b86c69a and its message against scope and evidence. python3 experiments/0000-scope/check.py passed ten IDs, seven states and four negative mutations. make check passed validation and all 66 tooling tests. No live browser/provider integration or crypto implementation was tested or accepted.

state/evidence/S00-001-review.md

@@ -0,0 +1,35 @@
+# S00-001 — independent security review
+
+Reviewer: auto-security-bff4cfd4d38e (security)
+Executor: auto-orchestrator-48aab142ecde (orchestrator)
+Date: 2026-10-15
+Decision: approve the bounded Web-scope passport; ADR 0000 accepted.
+
+Input: assigned review card/context packet, canonical applicability and exact requirements, executor patch d5ed7eaaed54d39ae928698df7085b2d6b86c69a, evidence and handoff. Output: this independent decision and accepted ADR metadata. No dependencies or previously accepted ADR/contracts apply; S01 schemas remain future work.
+
+## Acceptance and security findings
+
+- All ten excluded IDs match canonical applicability and have meaningful native-only reasons. Read their original clauses manually, including ACC-003, NET-002, DESK-001…003, AND-001…004 and STORE-002. NET-002's Web WSS clause remains explicitly mandatory; shared UI/accessibility/touch requirements remain applicable. No requirements snapshot or allocation was changed.
+- GEN-005 is preserved: advertised, configured and verified states are distinct; unavailable providers/permissions disable the dependent function with an explanation. GEN-006's delivery/read/retraction/metadata limitations are explicit.
+- WEB-002 is preserved in prose and the seven-state table. Closed-tab push is conditional and does not promise an XMPP session, continuous media or automatic fullscreen incoming UI. Hidden continuity is not guaranteed. Logout requires disable/revoke and rejects reactivation by late events; stale call notifications require current-state checking.
+- Provider inventory separates hosting, XMPP/WSS, upload, STUN/TURN, XMPP gateway, browser push service and maps. Password memory-only and explicit endpoint selection prevent silently treating a third-party gateway as trusted. OMEMO plaintext/file keys are excluded from gateway data; subscriptions are sensitive, private credentials/VAPID/TURN secrets stay outside repo/logs. Routing, timing/size, IP and coordinates remain disclosed metadata risks. No real credentials, subscriptions, JIDs or conversations found in reviewed task artifacts. TLS/CORS bypass, decrypting proxy and plaintext fallback are prohibited.
+- Executor commit/message accurately describes the actual scope ADR and dependency-free document checker. Full patch examined: other changes are only S00-001 workflow evidence, commit message, handoff and CLI-generated status/matrices. No app modules, shared contracts, planning definitions or immutable specs changed. Initial reviewer working tree was clean.
+
+## Independent checks
+
+| Command | Exit | Actual result |
+| --- | --- | --- |
+| `python3 scripts/tasks.py resume --agent auto-security-bff4cfd4d38e` | 0 | Empty owned-task list, expected for reviewer; did not claim. |
+| `python3 scripts/tasks.py show S00-001` | 0 | Assigned security review, status review, no dependencies. |
+| `python3 scripts/tasks.py packet S00-001 --agent auto-security-bff4cfd4d38e` | 0 | Exact requirements and handoff obtained. |
+| `git log --all --grep='^S00-001:' --format=fuller -n 3` and `git show d5ed7eaaed54d39ae928698df7085b2d6b86c69a` (scoped sections) | 0 | Executor message and all nine changed files examined. |
+| `python3 experiments/0000-scope/check.py` | 0 | 10 excluded IDs, 7 lifecycle states; all 4 negative mutations rejected. |
+| `make check` | 0 | Validated 275 tasks, 22 stages, 221 requirements, 211 allocated Web requirements, revision 2; 66 tooling tests passed in 10.024s. |
+
+The checker asserts document structure and forbidden lifecycle promises, not runtime behavior. Reason length alone cannot prove meaning; reasons and provider prose were reviewed manually. It must run without Python optimization.
+
+## Primary sources and limits
+
+Independently opened the ADR's sources with the web tool on 2026-10-15: [RFC 7395](https://www.rfc-editor.org/rfc/rfc7395.html) §6 for endpoint identity/TLS; [Push API](https://www.w3.org/TR/2026/WD-push-api-20261005/) §4 for visible metadata; [Service Workers](https://www.w3.org/TR/2026/CRD-service-workers-20260917/#service-worker-lifetime) §2.1.1 for event-bound lifetime/termination; [XEP-0357](https://xmpp.org/extensions/xep-0357.html) §2 for separate push actors; [XEP-0206](https://xmpp.org/extensions/xep-0206.html) for the BOSH alternative. The profile's continuous-session limitation is a conservative inference from worker lifetime, not a browser compatibility test.
+
+No browser/provider integration, live XMPP, encrypted interoperability, storage unlock or deployed topology was tested or accepted. S00-002…010 still own these decisions and experiments. This review accepts a scope document and focused document experiment only. Reviewer changes are ADR acceptance metadata, this report, handoff and mandatory review commit message; status transition uses tasks.py. Git mutation/commit remains coordinator-owned.

state/handoffs/S00-001.md

@@ -8,3 +8,5 @@ Ready for independent security reviewer. Read the ADR, canonical applicability,
 Checks passed: focused document experiment (10 excluded IDs, 7 scenarios, 4 rejected negative mutations), `make check` (validate + 66 tooling tests), whitespace/scope inspection. Evidence: `state/evidence/S00-001-auto-orchestrator-48aab142ecde.md`.
 
 Limits: no browser/provider runtime test; no chosen framework/library/browser versions, persistent unlock model or deployed topology. These remain S00-002…010 decisions, not missing implementation in S00-001. ADR status is proposed; reviewer should explicitly record acceptance or rejection through assigned workflow. Shared contracts/specs/plan definitions were not changed.
+
+Independent review: auto-security-bff4cfd4d38e (security), 2026-10-15. Accepted the bounded scope passport; ADR now records accepted status and reviewer. Review evidence: `state/evidence/S00-001-review.md`. Repeated focused check (10 IDs, 7 states, 4 rejected mutations) and `make check` (66 tests), all exit 0. All four acceptance criteria satisfied; no blocker. The runtime and deferred-decision limits above remain. Coordinator must commit this review transition before the next fresh session.

state/tasks.json

@@ -1,15 +1,18 @@
 {
   "schema_version": 1,
-  "revision": 2,
+  "revision": 3,
   "tasks": {
     "S00-001": {
-      "status": "review",
+      "status": "done",
       "owner": "auto-orchestrator-48aab142ecde",
       "started_at": "2026-10-14T17:57:54+00:00",
       "reason": null,
-      "updated_at": "2026-10-14T18:01:57+00:00",
+      "updated_at": "2026-10-14T18:03:56+00:00",
       "evidence": "state/evidence/S00-001-auto-orchestrator-48aab142ecde.md",
-      "handoff": "state/handoffs/S00-001.md"
+      "handoff": "state/handoffs/S00-001.md",
+      "reviewer": "auto-security-bff4cfd4d38e",
+      "review_evidence": "state/evidence/S00-001-review.md",
+      "completed_at": "2026-10-14T18:03:56+00:00"
     },
     "S00-002": {
       "status": "todo",
@@ -1131,6 +1134,18 @@
       "to": "review",
       "reason": null,
       "evidence": "state/evidence/S00-001-auto-orchestrator-48aab142ecde.md"
+    },
+    {
+      "revision": 3,
+      "at": "2026-10-14T18:03:56+00:00",
+      "action": "approve",
+      "task": "S00-001",
+      "agent": "auto-security-bff4cfd4d38e",
+      "role": "security",
+      "from": "review",
+      "to": "done",
+      "reason": null,
+      "evidence": "state/evidence/S00-001-review.md"
     }
   ]
 }