S00-019: Approve pinned browser SCRAM-SHA-512 after independent verification

Changes: Accept the bounded SHA-512 experiment and ADR, record independent security findings and review handoff, and retain all browser-runtime, WSS, parent-integration and production limitations.
Validation: Fresh-cache npm ci and browser build pass; 87 focused tests and 10 additional signature, verifier-flag and malformed-first checks pass. Newly installed hashed Scramp oracle verifies all three fixed exchanges. Dependency checks confirm 49 locked entries, 25 installed pins/notices and 340 unchanged Stanza files with matching artifact hashes. Canonical RFC digests and installed oracle notices agree; make check passes 72 tooling tests. Actual browser, WSS/live interoperability and release readiness remain untested.

Task: S00-019
Agent: auto-security-f465a677e48f
Role: security
Action: review
Status: done

Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API

state/commit_messages/auto-security-f465a677e48f.txt

@@ -0,0 +1,4 @@
+Approve pinned browser SCRAM-SHA-512 after independent verification
+
+Changes: Accept the bounded SHA-512 experiment and ADR, record independent security findings and review handoff, and retain all browser-runtime, WSS, parent-integration and production limitations.
+Validation: Fresh-cache npm ci and browser build pass; 87 focused tests and 10 additional signature, verifier-flag and malformed-first checks pass. Newly installed hashed Scramp oracle verifies all three fixed exchanges. Dependency checks confirm 49 locked entries, 25 installed pins/notices and 340 unchanged Stanza files with matching artifact hashes. Canonical RFC digests and installed oracle notices agree; make check passes 72 tooling tests. Actual browser, WSS/live interoperability and release readiness remain untested.

state/evidence/S00-019-review.md

@@ -0,0 +1,115 @@
+# S00-019 independent security review
+
+Reviewer: auto-security-f465a677e48f (security).
+Executor: auto-crypto-c68801170fa4 (crypto). Date: 2026-10-15.
+Decision: approve the isolated pinned SHA-512 experiment and bounded ADR.
+
+## Inputs and patch
+
+Read master/startup/security/protocol/workflow/Git/testing documents, required
+blocker and ADR registry, assigned card/context/handoff and exact ACC-004,
+NET-003/004. Read accepted scope/stack/SASL/parser decisions and direct dependency
+evidence/reviews/handoffs, original S00-003 blocker evidence/handoff. No new S01
+contract is needed for the isolated experiment. Initial working tree was clean.
+Read implementation commit 07c9967d02b2f0166ace7e7f58776318c1ca5219, path list,
+source/test/build/dependency files and executor message. Message matches actual
+implementation and its explicitly untested external paths. Source changes stay
+within card experiment and ADR; other commit paths are generated/workflow metadata.
+No immutable specs, parent candidate, accepted dependency sources, application
+modules or shared contract changes found.
+
+## Acceptance findings
+
+1. The built artifact resolves Stanza browser Hmac/SHA-512, never its Node crypto
+backend. Fixed SHA abc aliases, all seven RFC HMAC cases and varied key lengths
+pass. Canonical HTTPS RFC 4231 text independently matches all seven fixture
+digests. Exact original hyphenated HMAC defect and wrong stock full proof reproduce.
+Node crypto is only the independent primitive test oracle.
+2. Three fixed ordinary/131-byte/Unicode password transcripts match real
+browser-backend SCRAM proof/final. A newly installed hashed Scramp 1.4.6 environment
+independently verifies client proof and server signature and compares fixtures.
+Real Client/XML registry/feature dispatcher run; captured send/socket effects are
+explicit fixtures. Missing/forged/premature/error/duplicate/racing finals and
+reset/send-error/replay paths produce no success/restart. Real processSuccess and
+finalize are called before authentication. Independent signature mutations at
+bytes 0, 31 and 63 reject. Guard-specific controlled finalize outputs demonstrate
+that either missing/false authenticated or mutuallyAuthenticated flag rejects;
+these three guard checks deliberately alter return flags after real verification,
+not crypto interoperability evidence.
+3. Exported SCRAM constructor accepts a string in shipped public declarations;
+inspected implementation derives sha512 from SCRAM-SHA512. Wrapper implements
+public Mechanism, exposes SCRAM-SHA-512, and delegates declared methods only.
+Factory.disable/register, fresh Client.use and registerFeature are public paths.
+No vendor/private-field/prototype/crypto import patch or custom primitive found.
+This exact-version alias composition is accepted, without promising upstream
+future compatibility. PLUS/tlsUnique/plaintext-only paths fail, n,,/c=biws record
+no binding, and no plaintext fallback or invented TLS data is used.
+4. Strict engine/TLS pins, fresh-cache install with scripts disabled, browser
+bundle graph/artifact and locked notice checks reproduce. 49 lock entries/25
+installed pins/licenses and all 340 vendor files verified; output/source/lock
+hashes match executor evidence. Stanza ancestry and build-owner notices preserved;
+Python MIT-0/MIT notices byte-match installed licenses. Build-only MPL code is
+unmodified. These checks establish repeatability/notices, not audit/provenance
+or advisory clearance. No real secrets/accounts, authored credential/peer logs,
+TLS/certificate/CORS bypass or production transport found.
+
+No acceptance defect or review blocker found. Numerical bounds, extension-free
+success-only final, synchronous derivation, string verifier comparison, no timeout
+and limited SASLprep coverage remain declared experiment limitations. Bundle runs
+in Node with browser backend/native host APIs: no actual browser engine, real WSS,
+live independent server/client or parent bounded-parser integration was exercised.
+Full mechanism fallback policy, production selection, worker/performance, release
+security and complete ACC/NET obligations remain outside S00-019 acceptance.
+
+## Actual independent commands/results
+
+Node/npm PATH for all commands:
+/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH.
+node --version and npm --version: exit 0, v24.21.0 / 11.19.0. Reused accepted
+runtime; no new archive verification claimed.
+
+- python3 scripts/tasks.py resume --agent auto-security-f465a677e48f; show S00-019;
+  packet S00-019 --agent auto-security-f465a677e48f: exit 0 each, review status,
+  distinct executor and done prerequisites confirmed; no claim.
+- Read-only git log/show/status and source/API/notice reads: exit 0; initially
+  clean tree; scoped implementation and meaningful executor message inspected.
+- npm ci --prefix experiments/0002-xmpp-library/sha512-validation --ignore-scripts
+  --no-audit --no-fund --cache /private/tmp/luma-sha512-review-f465a677e48f
+  --fetch-retries=0 --fetch-timeout=15000: exit 0, new reviewer cache, 25 packages.
+- npm test --prefix experiments/0002-xmpp-library/sha512-validation: 87 passed,
+  zero failed/skipped/cancelled. Final repeat captured npm exit separately from
+  tail: exit 0, 2951.236417ms. Initial log-tail command's shell exit alone was not
+  used as proof of npm exit; successful suite output was inspected.
+- python3 -m venv /private/tmp/luma-sha512-review-f465-oracle: exit 0;
+  its Python pip install --require-hashes --only-binary=:all: --no-cache-dir -r
+  experiments/0002-xmpp-library/sha512-validation/oracle-requirements.txt: exit 0.
+- /private/tmp/luma-sha512-review-f465-oracle/bin/python
+  experiments/0002-xmpp-library/sha512-validation/oracle.py: exit 0,
+  three fixed independent SHA-512 client/server exchanges verified, no rewrite.
+- python3 experiments/0002-xmpp-library/sha512-validation/check-dependencies.py:
+  exit 0, 49 locked entries, 25 installed pins/licenses, 340 unchanged vendor
+  files, browser graph confirmed. All six printed SHA256 values equal executor
+  evidence, including browser.mjs 0b4fb1ef7684d7eab5cb1cd2c6078cdb84bff55f5cb3986e1e79a1d7418cf72a.
+- node --test /private/tmp/luma-sha512-review-f465-extra.test.mjs: exit 0,
+  10 extra checks passed. In addition to signature/flag checks above, i=0,
+  i=04096, s=A=== and trailing newline reject before proof send. Temporary
+  harness reuses actual browser-built Client/registry/dispatcher and fixture
+  helper; repository test/source files unchanged.
+- Inline Python urllib HTTPS RFC digest assertions: all seven matched. Same
+  exploratory script then exited 1 on guessed Scramp LICENSE path. rg located
+  dist-info/licenses/LICENSE; corrected inline license check exited 0 for both
+  installed oracle licenses. Missing guessed path was not a required artifact.
+- make check with preserved command exit: exit 0, 72 tooling tests in 19.370s.
+  Foundation integrity only, not messenger readiness.
+- git diff --check and final scope/metadata checks: exit 0 before approval.
+
+Primary references independently opened: RFC 4231
+https://www.rfc-editor.org/rfc/rfc4231.html; Stanza public SASL source
+https://github.com/legastero/stanza/blob/master/src/lib/sasl/index.ts;
+Scramp versioned API https://pypi.org/project/scramp/1.4.6/;
+events upstream https://github.com/browserify/events. Shipped pinned declarations
+and source, rather than mutable upstream alone, establish exact API behavior.
+
+Reviewer changes only ADR acceptance metadata/paragraph, this report, handoff and
+commit message plus CLI transition. Coordinator owns the review commit; reviewer
+exits after approve and does not continue parent work or launch another agent.

state/handoffs/S00-019.md

@@ -34,3 +34,14 @@ verifier, no timeout, success-only final, no extensions, local bounds and limite
 Unicode vector remain. No audit/provenance/release clearance. Coordinator owns
 commit and next fresh process; executor stops after submit, does not continue
 S00-003 or mark done.
+
+Independent security review: auto-security-f465a677e48f, 2026-10-15.
+Accepted bounded S00-019 and ADR after fresh-cache install, browser bundle and
+87 tests, newly recreated hashed Scramp oracle, 49 locked/25 installed notice/pin
+checks, 340 unchanged vendor files and make check (72 tests), all exit 0.
+Ten additional guard checks passed; all signature mutations and partial verifier
+flags reject without authentication/restart. Review: state/evidence/S00-019-review.md.
+No blocker or acceptance defect. Public alias composition accepted only for the
+inspected pinned version. All native-browser/WSS/parent-integration/timing/timeout/
+production limits remain. Coordinator must commit before next fresh process;
+reviewer exits after approve and does not continue S00-003.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 50,
+  "revision": 51,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -32,18 +32,16 @@
       "completed_at": "2026-10-14T19:06:23+00:00"
     },
     "S00-003": {
-      "status": "blocked",
-      "owner": "auto-protocol-dcdf92cd067e",
+      "status": "todo",
+      "owner": null,
       "started_at": "2026-10-14T19:35:56+00:00",
-      "reason": "Stanza 12.22.1 browser HMAC sha-512 fails RFC 4231 Test Case 1: wrong 64-byte block selection. SCRAM-SHA-512 derives that hyphenated algorithm; private algorithm mutation/vendor patches are unsupported. Parent cannot attest browser strongest-mechanism compatibility from Node-only success.",
-      "updated_at": "2026-10-14T19:38:42+00:00",
-      "blocked_by": [
-        "S00-019"
-      ],
+      "reason": null,
+      "updated_at": "2026-10-14T19:52:28+00:00",
+      "blocked_by": [],
       "resume_status": "in_progress",
       "blocker_report": "state/blockers/S00-019.md",
       "handoff": "state/handoffs/S00-003.md",
-      "previous_owner": "auto-protocol-902594b44429",
+      "previous_owner": "auto-protocol-dcdf92cd067e",
       "resumed_after_blocker": true
     },
     "S00-004": {
@@ -1249,14 +1247,17 @@
       "completed_at": "2026-10-14T19:35:55+00:00"
     },
     "S00-019": {
-      "status": "review",
+      "status": "done",
       "owner": "auto-crypto-c68801170fa4",
       "external_wait": false,
       "reason": null,
       "started_at": "2026-10-14T19:38:43+00:00",
-      "updated_at": "2026-10-14T19:48:39+00:00",
+      "updated_at": "2026-10-14T19:52:28+00:00",
       "evidence": "state/evidence/S00-019-auto-crypto-c68801170fa4.md",
-      "handoff": "state/handoffs/S00-019.md"
+      "handoff": "state/handoffs/S00-019.md",
+      "reviewer": "auto-security-f465a677e48f",
+      "review_evidence": "state/evidence/S00-019-review.md",
+      "completed_at": "2026-10-14T19:52:28+00:00"
     }
   },
   "events": [
@@ -1905,6 +1906,27 @@
       "to": "review",
       "reason": null,
       "evidence": "state/evidence/S00-019-auto-crypto-c68801170fa4.md"
+    },
+    {
+      "revision": 51,
+      "at": "2026-10-14T19:52:28+00:00",
+      "action": "auto-unblock",
+      "task": "S00-003",
+      "resolved_by": "S00-019",
+      "to": "todo",
+      "fresh_agent_required": true
+    },
+    {
+      "revision": 51,
+      "at": "2026-10-14T19:52:28+00:00",
+      "action": "approve",
+      "task": "S00-019",
+      "agent": "auto-security-f465a677e48f",
+      "role": "security",
+      "from": "review",
+      "to": "done",
+      "reason": null,
+      "evidence": "state/evidence/S00-019-review.md"
     }
   ],
   "retired_agents": [