Changes: Accept ADR 0002 for pinned Stanza with mandatory bounded transport, verified SASL and SHA512 composition; record independent review findings and handoff with external limits retained.
Validation: Fresh-cache pinned npm ci and browser build succeeded; all 112 tests passed. Verified 51 locked entries, 26 installed notices and 340 unchanged vendor files; six offer permutations and six adversarial XML checks passed; make check passed 72 tooling tests. No actual browser, independent full XMPP server/client, OMEMO or release readiness acceptance.
Task: S00-003
Agent: auto-qa-d49749753ac6
Role: qa
Action: review
Status: done
Task title: Проверить XMPP WSS/auth библиотеку
Changes: Document the coordinator-selected Codex 0.159.0 argv without conflicting sandbox flags; record parser and filesystem evidence plus QA handoff. Preserve existing local configuration and portable example.
Validation: Exact active argv help and approved host wrapper with inner workspace-write probe exited 0; project write/read/remove passed and outside write denied EROFS30. Final make check passed 72 tests after shortening the documentation to meet prompt budgets. No additional model or storage work ran.
Task: S00-028
Agent: auto-ci-cd-e3a716a94424
Role: ci-cd
Action: claim
Status: review
Task title: Repair conflicting Codex harness sandbox arguments
Changes:
- Re-ran both committed probes unchanged (smoke exit 0 SMOKE_PASS; wasm-unsupported exit 2 UNSUPPORTED_BLOCKER) and recorded actual outputs in state/evidence/S00-021-auto-crypto-fcef9b6781bf.md.
- Verified on the reachable npm proxy that no maintained browser/WASM-capable OMEMO2 package exists: @signalapp/libsignal-client 0.105.0 is native-only (zero .wasm); @signalapp/libsignal, omemo-client, omemo-top, omemo-wasm, @converse/omemo are all E404.
- Wrote docs/decisions/0003-crypto-library.md (proposed) documenting the verified audited session/ratchet + persistence capability and the honest blocker for the browser/worker/WASM endpoint and OMEMO2 wire layer, with traceable primary sources.
- Wrote state/handoffs/S00-021.md with the reproducible next step for the S00-004 continuation.
Validation:
- smoke.mjs -> exit 0 (SMOKE_PASS, 631-byte record byte-for-byte reload).
- wasm-unsupported.mjs -> exit 2 (wasmFiles 0, native prebuilds only).
- npm view E404s confirmed against the same proxy that returns @signalapp/libsignal-client 0.105.0, so responses are genuine.
- make check: 72 tooling tests passed (OK).
- No source changes outside scope: experiments/** unchanged; only state/tasks.json (workflow metadata) plus the in-scope ADR. S00-004 stays blocked (honest blocker), not bypassed.
Task: S00-021
Agent: auto-crypto-fcef9b6781bf
Role: crypto
Action: claim
Status: review
Task title: Устранить прерывание: Проверить browser OMEMO backend
Changes: Accept the bounded SHA-512 experiment and ADR, record independent security findings and review handoff, and retain all browser-runtime, WSS, parent-integration and production limitations.
Validation: Fresh-cache npm ci and browser build pass; 87 focused tests and 10 additional signature, verifier-flag and malformed-first checks pass. Newly installed hashed Scramp oracle verifies all three fixed exchanges. Dependency checks confirm 49 locked entries, 25 installed pins/notices and 340 unchanged Stanza files with matching artifact hashes. Canonical RFC digests and installed oracle notices agree; make check passes 72 tooling tests. Actual browser, WSS/live interoperability and release readiness remain untested.
Task: S00-019
Agent: auto-security-f465a677e48f
Role: security
Action: review
Status: done
Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
Changes: Add an isolated pinned mechanism wrapper using Stanza's public constructor and factory APIs, preserve the SCRAM-SHA-512 wire name and fail-closed final guard, and document the proposed ADR, browser bundle evidence, independent Scramp vectors, notices and limits. Leave parent selection, dependency experiments, specs and shared contracts unchanged.
Validation: Fresh-cache npm ci and Vite browser build pass; 87 focused tests pass, including RFC HMAC vectors, original defect reproduction, independent full SHA-512 exchanges and rejected invalid finals/order/reset paths. Hashed Scramp oracle fixture comparison passes. Dependency check verifies 49 locked entries, 25 installed pins/licenses and 340 unmodified Stanza files. make check passes 72 tooling tests. Native browsers, WSS/live server interoperability and production readiness are untested; independent security review remains pending.
Task: S00-019
Agent: auto-crypto-c68801170fa4
Role: crypto
Action: claim
Status: review
Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
Changes: Accept the isolated S00-018 ingress experiment and bounded ADR; record independent security findings and review handoff. Preserve all browser, live WSS, interoperability and production resource limitations.
Validation: Fresh-cache npm ci and all 55 integrated tests passed on Node 24.21.0/npm 11.19.0; six additional adversarial documents rejected before real JXT.parse with stale callback/fresh attempt checks. Verified ten dependency licenses/integrities, 340 unchanged Stanza files, upstream saxes license bytes and matching digests. Stock defects reproduced; make check passed 72 tooling tests. Initial getter-only tracing attempt failed and is recorded separately. Scope/whitespace inspected; no browser or live WSS test.
Task: S00-018
Agent: auto-security-64dc2d9fa232
Role: security
Action: review
Status: done
Task title: Validate bounded standalone XML ingress for the XMPP candidate
Changes: Add an isolated public transport integration with finite byte, depth, element and attribute budgets; validate complete text XML with pinned saxes before real JXT parsing/import. Add adversarial and boundary fixtures, terminal cleanup tests, dependency notices and a proposed parser ADR.
Validation: Fresh-cache npm ci and npm test passed all 55 tests with Node 24.21.0/npm 11.19.0. Reproduced three stock parser failures, checked ten exact dependency licenses/integrities and 340 unchanged Stanza files; make check passed 72 tooling tests. Scope and whitespace inspected. Browser runtime, live WSS and interoperability were not tested.
Task: S00-018
Agent: auto-protocol-89fe6563092c
Role: protocol
Action: claim
Status: review
Task title: Validate bounded standalone XML ingress for the XMPP candidate
Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review.
Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed.
Task: S00-002
Agent: auto-orchestrator-68a05c587e33
Role: orchestrator
Action: claim
Status: review
Task title: Выбрать framework и build runtime
Changes: Accept ADR 0000 and record the independent reviewer, acceptance findings and handoff. Confirm native exclusion reasons, retained Web obligations, conditional push lifecycle and provider secret/metadata boundaries; transition S00-001 through the review CLI.
Validation: Reviewed executor commit d5ed7eaaed and its message against scope and evidence. python3 experiments/0000-scope/check.py passed ten IDs, seven states and four negative mutations. make check passed validation and all 66 tooling tests. No live browser/provider integration or crypto implementation was tested or accepted.
Task: S00-001
Agent: auto-security-bff4cfd4d38e
Role: security
Action: review
Status: done
Task title: Утвердить Web-профиль
Changes: Add proposed scope ADR with reasons for all ten excluded IDs, retained Web obligations, lifecycle limits, external provider roles and deferred decisions. Add a document coverage/lifecycle checker with four negative mutations and executor evidence/handoff for security review.
Validation: python3 experiments/0000-scope/check.py passed for ten excluded IDs and seven lifecycle scenarios; all four negative mutations were rejected. make check passed validation and 66 tooling tests. Whitespace and allowed source paths checked. No live browser or provider integration was tested; ADR awaits independent review.
Task: S00-001
Agent: auto-orchestrator-48aab142ecde
Role: orchestrator
Action: claim
Status: review
Task title: Утвердить Web-профиль
wt