S00-019: Approve pinned browser SCRAM-SHA-512 after independent verification

Changes: Accept the bounded SHA-512 experiment and ADR, record independent security findings and review handoff, and retain all browser-runtime, WSS, parent-integration and production limitations.
Validation: Fresh-cache npm ci and browser build pass; 87 focused tests and 10 additional signature, verifier-flag and malformed-first checks pass. Newly installed hashed Scramp oracle verifies all three fixed exchanges. Dependency checks confirm 49 locked entries, 25 installed pins/notices and 340 unchanged Stanza files with matching artifact hashes. Canonical RFC digests and installed oracle notices agree; make check passes 72 tooling tests. Actual browser, WSS/live interoperability and release readiness remain untested.

Task: S00-019
Agent: auto-security-f465a677e48f
Role: security
Action: review
Status: done

Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API

docs/decisions/0002-xmpp-sha512-validation.md

@@ -1,10 +1,10 @@
 # ADR 0002 SHA-512 remediation: public mechanism composition
 
-- Status: proposed; independent security review required.
+- Status: accepted — independent security review of bounded S00-019; evidence: `state/evidence/S00-019-review.md`.
 - Task: S00-019, remediation of S00-003.
 - Date: 2026-10-15.
 - Owner: auto-crypto-c68801170fa4 (crypto).
-- Reviewer: pending, security role.
+- Reviewer: auto-security-f465a677e48f (security), 2026-10-15.
 - Requirements: ACC-004, NET-003, NET-004.
 
 Input: original SHA-512 blocker, accepted scope/stack/SASL/parser decisions,
@@ -127,3 +127,16 @@ fixture limits; separate final challenge conservatively rejects. Accepted
 S00-017/S00-018 source is untouched. Independent security reviewer must assess
 public alias composition and all limits, repeat commands and record acceptance
 before the coordinator resumes the parent in another fresh process.
+
+## Independent acceptance
+
+Security reviewer auto-security-f465a677e48f accepts this pinned, isolated public
+mechanism composition after independent fresh-cache install, browser build and
+87 tests, hashed Scramp oracle recreation, dependency/notice/vendor checks and
+10 additional adversarial guard tests. Both authentication flags are required;
+modified signatures and malformed first messages fail before success/restart.
+Public constructor alias use is acceptable for this exact inspected version;
+it is not a future upstream alias guarantee. All browser-runtime/WSS/parent
+integration, timing, timeout and release limitations above remain. No production
+library selection or complete ACC/NET product acceptance is granted here.
+Coordinator must commit this review before launching any fresh parent process.

planning/TASK_MATRIX.md

@@ -1,12 +1,12 @@
 # Матрица задач
 
-Generated; state revision **50**. Canonical status: state/tasks.json.
+Generated; state revision **51**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | done | auto-orchestrator-48aab142ecde |  | Утвердить Web-профиль |
 | [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | done | auto-orchestrator-68a05c587e33 | S00-001, S00-011, S00-012 | Выбрать framework и build runtime |
-| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | blocked | auto-protocol-dcdf92cd067e | S00-001, S00-002, S00-017, S00-018, S00-019 | Проверить XMPP WSS/auth библиотеку |
+| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | todo |  | S00-001, S00-002, S00-017, S00-018, S00-019 | Проверить XMPP WSS/auth библиотеку |
 | [S00-004](tasks/S00-004.md) | S00 | crypto | security | todo |  | S00-001, S00-002 | Проверить browser OMEMO backend |
 | [S00-005](tasks/S00-005.md) | S00 | storage | qa | todo |  | S00-002 | Выбрать IndexedDB wrapper и migration policy |
 | [S00-006](tasks/S00-006.md) | S00 | orchestrator | security | todo |  | S00-002 | Зафиксировать browser/reference matrix |
@@ -21,7 +21,7 @@ Generated; state revision **50**. Canonical status: state/tasks.json.
 | [S00-016](tasks/S00-016.md) | S00 | ci-cd | qa | done | auto-ci-cd-351a0cbbabef | S00-001, S00-011, S00-013, S00-014 | Restore reviewer model availability after provider capacity failure |
 | [S00-017](tasks/S00-017.md) | S00 | protocol | security | done | auto-protocol-599343cd9e3f | S00-001, S00-002 | Establish fail-closed SCRAM server-final validation |
 | [S00-018](tasks/S00-018.md) | S00 | protocol | security | done | auto-protocol-89fe6563092c | S00-001, S00-002, S00-017 | Validate bounded standalone XML ingress for the XMPP candidate |
-| [S00-019](tasks/S00-019.md) | S00 | crypto | security | review | auto-crypto-c68801170fa4 | S00-001, S00-002, S00-017, S00-018 | Validate browser-compatible SCRAM-SHA-512 through a public mechanism API |
+| [S00-019](tasks/S00-019.md) | S00 | crypto | security | done | auto-crypto-c68801170fa4 | S00-001, S00-002, S00-017, S00-018 | Validate browser-compatible SCRAM-SHA-512 through a public mechanism API |
 | [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo |  | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
 | [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo |  | S00-010 | Описать identity/model contracts |
 | [S01-002](tasks/S01-002.md) | S01 | orchestrator | security | todo |  | S00-010, S01-001 | Описать async account context |

planning/stages/S00.md

@@ -8,7 +8,7 @@
 
 - [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; done.
 - [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; done.
-- [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; blocked.
+- [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; todo.
 - [S00-004](../tasks/S00-004.md): Проверить browser OMEMO backend — crypto; todo.
 - [S00-005](../tasks/S00-005.md): Выбрать IndexedDB wrapper и migration policy — storage; todo.
 - [S00-006](../tasks/S00-006.md): Зафиксировать browser/reference matrix — orchestrator; todo.
@@ -23,7 +23,7 @@
 - [S00-016](../tasks/S00-016.md): Restore reviewer model availability after provider capacity failure — ci-cd; done.
 - [S00-017](../tasks/S00-017.md): Establish fail-closed SCRAM server-final validation — protocol; done.
 - [S00-018](../tasks/S00-018.md): Validate bounded standalone XML ingress for the XMPP candidate — protocol; done.
-- [S00-019](../tasks/S00-019.md): Validate browser-compatible SCRAM-SHA-512 through a public mechanism API — crypto; review.
+- [S00-019](../tasks/S00-019.md): Validate browser-compatible SCRAM-SHA-512 through a public mechanism API — crypto; done.
 - [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
 
 ## Граница этапа

planning/task_matrix.csv

@@ -1,7 +1,7 @@
 id,stage,operator,reviewer,status,owner,depends_on,title
 S00-001,S00,orchestrator,security,done,auto-orchestrator-48aab142ecde,,Утвердить Web-профиль
 S00-002,S00,orchestrator,security,done,auto-orchestrator-68a05c587e33,"S00-001, S00-011, S00-012",Выбрать framework и build runtime
-S00-003,S00,protocol,qa,blocked,auto-protocol-dcdf92cd067e,"S00-001, S00-002, S00-017, S00-018, S00-019",Проверить XMPP WSS/auth библиотеку
+S00-003,S00,protocol,qa,todo,,"S00-001, S00-002, S00-017, S00-018, S00-019",Проверить XMPP WSS/auth библиотеку
 S00-004,S00,crypto,security,todo,,"S00-001, S00-002",Проверить browser OMEMO backend
 S00-005,S00,storage,qa,todo,,S00-002,Выбрать IndexedDB wrapper и migration policy
 S00-006,S00,orchestrator,security,todo,,S00-002,Зафиксировать browser/reference matrix
@@ -16,7 +16,7 @@ S00-015,S00,ci-cd,qa,done,auto-ci-cd-84e209103f24,"S00-001, S00-011, S00-013, S0
 S00-016,S00,ci-cd,qa,done,auto-ci-cd-351a0cbbabef,"S00-001, S00-011, S00-013, S00-014",Restore reviewer model availability after provider capacity failure
 S00-017,S00,protocol,security,done,auto-protocol-599343cd9e3f,"S00-001, S00-002",Establish fail-closed SCRAM server-final validation
 S00-018,S00,protocol,security,done,auto-protocol-89fe6563092c,"S00-001, S00-002, S00-017",Validate bounded standalone XML ingress for the XMPP candidate
-S00-019,S00,crypto,security,review,auto-crypto-c68801170fa4,"S00-001, S00-002, S00-017, S00-018",Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
+S00-019,S00,crypto,security,done,auto-crypto-c68801170fa4,"S00-001, S00-002, S00-017, S00-018",Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
 S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
 S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts
 S01-002,S01,orchestrator,security,todo,,"S00-010, S01-001",Описать async account context

state/commit_messages/auto-security-f465a677e48f.txt

@@ -0,0 +1,4 @@
+Approve pinned browser SCRAM-SHA-512 after independent verification
+
+Changes: Accept the bounded SHA-512 experiment and ADR, record independent security findings and review handoff, and retain all browser-runtime, WSS, parent-integration and production limitations.
+Validation: Fresh-cache npm ci and browser build pass; 87 focused tests and 10 additional signature, verifier-flag and malformed-first checks pass. Newly installed hashed Scramp oracle verifies all three fixed exchanges. Dependency checks confirm 49 locked entries, 25 installed pins/notices and 340 unchanged Stanza files with matching artifact hashes. Canonical RFC digests and installed oracle notices agree; make check passes 72 tooling tests. Actual browser, WSS/live interoperability and release readiness remain untested.

state/evidence/S00-019-review.md

@@ -0,0 +1,115 @@
+# S00-019 independent security review
+
+Reviewer: auto-security-f465a677e48f (security).
+Executor: auto-crypto-c68801170fa4 (crypto). Date: 2026-10-15.
+Decision: approve the isolated pinned SHA-512 experiment and bounded ADR.
+
+## Inputs and patch
+
+Read master/startup/security/protocol/workflow/Git/testing documents, required
+blocker and ADR registry, assigned card/context/handoff and exact ACC-004,
+NET-003/004. Read accepted scope/stack/SASL/parser decisions and direct dependency
+evidence/reviews/handoffs, original S00-003 blocker evidence/handoff. No new S01
+contract is needed for the isolated experiment. Initial working tree was clean.
+Read implementation commit 07c9967d02b2f0166ace7e7f58776318c1ca5219, path list,
+source/test/build/dependency files and executor message. Message matches actual
+implementation and its explicitly untested external paths. Source changes stay
+within card experiment and ADR; other commit paths are generated/workflow metadata.
+No immutable specs, parent candidate, accepted dependency sources, application
+modules or shared contract changes found.
+
+## Acceptance findings
+
+1. The built artifact resolves Stanza browser Hmac/SHA-512, never its Node crypto
+backend. Fixed SHA abc aliases, all seven RFC HMAC cases and varied key lengths
+pass. Canonical HTTPS RFC 4231 text independently matches all seven fixture
+digests. Exact original hyphenated HMAC defect and wrong stock full proof reproduce.
+Node crypto is only the independent primitive test oracle.
+2. Three fixed ordinary/131-byte/Unicode password transcripts match real
+browser-backend SCRAM proof/final. A newly installed hashed Scramp 1.4.6 environment
+independently verifies client proof and server signature and compares fixtures.
+Real Client/XML registry/feature dispatcher run; captured send/socket effects are
+explicit fixtures. Missing/forged/premature/error/duplicate/racing finals and
+reset/send-error/replay paths produce no success/restart. Real processSuccess and
+finalize are called before authentication. Independent signature mutations at
+bytes 0, 31 and 63 reject. Guard-specific controlled finalize outputs demonstrate
+that either missing/false authenticated or mutuallyAuthenticated flag rejects;
+these three guard checks deliberately alter return flags after real verification,
+not crypto interoperability evidence.
+3. Exported SCRAM constructor accepts a string in shipped public declarations;
+inspected implementation derives sha512 from SCRAM-SHA512. Wrapper implements
+public Mechanism, exposes SCRAM-SHA-512, and delegates declared methods only.
+Factory.disable/register, fresh Client.use and registerFeature are public paths.
+No vendor/private-field/prototype/crypto import patch or custom primitive found.
+This exact-version alias composition is accepted, without promising upstream
+future compatibility. PLUS/tlsUnique/plaintext-only paths fail, n,,/c=biws record
+no binding, and no plaintext fallback or invented TLS data is used.
+4. Strict engine/TLS pins, fresh-cache install with scripts disabled, browser
+bundle graph/artifact and locked notice checks reproduce. 49 lock entries/25
+installed pins/licenses and all 340 vendor files verified; output/source/lock
+hashes match executor evidence. Stanza ancestry and build-owner notices preserved;
+Python MIT-0/MIT notices byte-match installed licenses. Build-only MPL code is
+unmodified. These checks establish repeatability/notices, not audit/provenance
+or advisory clearance. No real secrets/accounts, authored credential/peer logs,
+TLS/certificate/CORS bypass or production transport found.
+
+No acceptance defect or review blocker found. Numerical bounds, extension-free
+success-only final, synchronous derivation, string verifier comparison, no timeout
+and limited SASLprep coverage remain declared experiment limitations. Bundle runs
+in Node with browser backend/native host APIs: no actual browser engine, real WSS,
+live independent server/client or parent bounded-parser integration was exercised.
+Full mechanism fallback policy, production selection, worker/performance, release
+security and complete ACC/NET obligations remain outside S00-019 acceptance.
+
+## Actual independent commands/results
+
+Node/npm PATH for all commands:
+/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH.
+node --version and npm --version: exit 0, v24.21.0 / 11.19.0. Reused accepted
+runtime; no new archive verification claimed.
+
+- python3 scripts/tasks.py resume --agent auto-security-f465a677e48f; show S00-019;
+  packet S00-019 --agent auto-security-f465a677e48f: exit 0 each, review status,
+  distinct executor and done prerequisites confirmed; no claim.
+- Read-only git log/show/status and source/API/notice reads: exit 0; initially
+  clean tree; scoped implementation and meaningful executor message inspected.
+- npm ci --prefix experiments/0002-xmpp-library/sha512-validation --ignore-scripts
+  --no-audit --no-fund --cache /private/tmp/luma-sha512-review-f465a677e48f
+  --fetch-retries=0 --fetch-timeout=15000: exit 0, new reviewer cache, 25 packages.
+- npm test --prefix experiments/0002-xmpp-library/sha512-validation: 87 passed,
+  zero failed/skipped/cancelled. Final repeat captured npm exit separately from
+  tail: exit 0, 2951.236417ms. Initial log-tail command's shell exit alone was not
+  used as proof of npm exit; successful suite output was inspected.
+- python3 -m venv /private/tmp/luma-sha512-review-f465-oracle: exit 0;
+  its Python pip install --require-hashes --only-binary=:all: --no-cache-dir -r
+  experiments/0002-xmpp-library/sha512-validation/oracle-requirements.txt: exit 0.
+- /private/tmp/luma-sha512-review-f465-oracle/bin/python
+  experiments/0002-xmpp-library/sha512-validation/oracle.py: exit 0,
+  three fixed independent SHA-512 client/server exchanges verified, no rewrite.
+- python3 experiments/0002-xmpp-library/sha512-validation/check-dependencies.py:
+  exit 0, 49 locked entries, 25 installed pins/licenses, 340 unchanged vendor
+  files, browser graph confirmed. All six printed SHA256 values equal executor
+  evidence, including browser.mjs 0b4fb1ef7684d7eab5cb1cd2c6078cdb84bff55f5cb3986e1e79a1d7418cf72a.
+- node --test /private/tmp/luma-sha512-review-f465-extra.test.mjs: exit 0,
+  10 extra checks passed. In addition to signature/flag checks above, i=0,
+  i=04096, s=A=== and trailing newline reject before proof send. Temporary
+  harness reuses actual browser-built Client/registry/dispatcher and fixture
+  helper; repository test/source files unchanged.
+- Inline Python urllib HTTPS RFC digest assertions: all seven matched. Same
+  exploratory script then exited 1 on guessed Scramp LICENSE path. rg located
+  dist-info/licenses/LICENSE; corrected inline license check exited 0 for both
+  installed oracle licenses. Missing guessed path was not a required artifact.
+- make check with preserved command exit: exit 0, 72 tooling tests in 19.370s.
+  Foundation integrity only, not messenger readiness.
+- git diff --check and final scope/metadata checks: exit 0 before approval.
+
+Primary references independently opened: RFC 4231
+https://www.rfc-editor.org/rfc/rfc4231.html; Stanza public SASL source
+https://github.com/legastero/stanza/blob/master/src/lib/sasl/index.ts;
+Scramp versioned API https://pypi.org/project/scramp/1.4.6/;
+events upstream https://github.com/browserify/events. Shipped pinned declarations
+and source, rather than mutable upstream alone, establish exact API behavior.
+
+Reviewer changes only ADR acceptance metadata/paragraph, this report, handoff and
+commit message plus CLI transition. Coordinator owns the review commit; reviewer
+exits after approve and does not continue parent work or launch another agent.

state/handoffs/S00-019.md

@@ -34,3 +34,14 @@ verifier, no timeout, success-only final, no extensions, local bounds and limite
 Unicode vector remain. No audit/provenance/release clearance. Coordinator owns
 commit and next fresh process; executor stops after submit, does not continue
 S00-003 or mark done.
+
+Independent security review: auto-security-f465a677e48f, 2026-10-15.
+Accepted bounded S00-019 and ADR after fresh-cache install, browser bundle and
+87 tests, newly recreated hashed Scramp oracle, 49 locked/25 installed notice/pin
+checks, 340 unchanged vendor files and make check (72 tests), all exit 0.
+Ten additional guard checks passed; all signature mutations and partial verifier
+flags reject without authentication/restart. Review: state/evidence/S00-019-review.md.
+No blocker or acceptance defect. Public alias composition accepted only for the
+inspected pinned version. All native-browser/WSS/parent-integration/timing/timeout/
+production limits remain. Coordinator must commit before next fresh process;
+reviewer exits after approve and does not continue S00-003.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 50,
+  "revision": 51,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -32,18 +32,16 @@
       "completed_at": "2026-10-14T19:06:23+00:00"
     },
     "S00-003": {
-      "status": "blocked",
-      "owner": "auto-protocol-dcdf92cd067e",
+      "status": "todo",
+      "owner": null,
       "started_at": "2026-10-14T19:35:56+00:00",
-      "reason": "Stanza 12.22.1 browser HMAC sha-512 fails RFC 4231 Test Case 1: wrong 64-byte block selection. SCRAM-SHA-512 derives that hyphenated algorithm; private algorithm mutation/vendor patches are unsupported. Parent cannot attest browser strongest-mechanism compatibility from Node-only success.",
-      "updated_at": "2026-10-14T19:38:42+00:00",
-      "blocked_by": [
-        "S00-019"
-      ],
+      "reason": null,
+      "updated_at": "2026-10-14T19:52:28+00:00",
+      "blocked_by": [],
       "resume_status": "in_progress",
       "blocker_report": "state/blockers/S00-019.md",
       "handoff": "state/handoffs/S00-003.md",
-      "previous_owner": "auto-protocol-902594b44429",
+      "previous_owner": "auto-protocol-dcdf92cd067e",
       "resumed_after_blocker": true
     },
     "S00-004": {
@@ -1249,14 +1247,17 @@
       "completed_at": "2026-10-14T19:35:55+00:00"
     },
     "S00-019": {
-      "status": "review",
+      "status": "done",
       "owner": "auto-crypto-c68801170fa4",
       "external_wait": false,
       "reason": null,
       "started_at": "2026-10-14T19:38:43+00:00",
-      "updated_at": "2026-10-14T19:48:39+00:00",
+      "updated_at": "2026-10-14T19:52:28+00:00",
       "evidence": "state/evidence/S00-019-auto-crypto-c68801170fa4.md",
-      "handoff": "state/handoffs/S00-019.md"
+      "handoff": "state/handoffs/S00-019.md",
+      "reviewer": "auto-security-f465a677e48f",
+      "review_evidence": "state/evidence/S00-019-review.md",
+      "completed_at": "2026-10-14T19:52:28+00:00"
     }
   },
   "events": [
@@ -1905,6 +1906,27 @@
       "to": "review",
       "reason": null,
       "evidence": "state/evidence/S00-019-auto-crypto-c68801170fa4.md"
+    },
+    {
+      "revision": 51,
+      "at": "2026-10-14T19:52:28+00:00",
+      "action": "auto-unblock",
+      "task": "S00-003",
+      "resolved_by": "S00-019",
+      "to": "todo",
+      "fresh_agent_required": true
+    },
+    {
+      "revision": 51,
+      "at": "2026-10-14T19:52:28+00:00",
+      "action": "approve",
+      "task": "S00-019",
+      "agent": "auto-security-f465a677e48f",
+      "role": "security",
+      "from": "review",
+      "to": "done",
+      "reason": null,
+      "evidence": "state/evidence/S00-019-review.md"
     }
   ],
   "retired_agents": [