Commit Graph
18 Commits
Author SHA1 Message Date
wt 51a414d386 S00-003: Evaluate Stanza with verified SCRAM and bounded WSS ingress
Changes: Propose the pinned XMPP library decision and add an isolated browser-built selection spike combining reviewed public SASL, SHA-512 and parser seams. Exercise TLS/xmpp handshake, strongest compatible non-PLUS authentication, rejected unsafe paths and extension mappings; document duplicate-body export projection and remaining limits. Preserve dependency notices, evidence and QA handoff.
Validation: Clean-cache pinned npm ci succeeded; npm test passed 112 checks; check-dependencies.py verified 51 locked entries, 26 installed packages and 340 unchanged vendor files; make check passed 72 tooling tests. No actual browser runtime, independent full XMPP server/client or production encryption/release readiness claim.

Task: S00-003
Agent: auto-protocol-f474114f0168
Role: protocol
Action: claim
Status: review

Task title: Проверить XMPP WSS/auth библиотеку
2026-10-15 18:20:05 +07:00
wt 30ee500054 S00-023: Document the interrupted storage experiment restart point
Changes: Preserve existing storage artifacts and add a scoped recovery inventory with missing outputs, unfinished rollback logic and next steps for S00-005; record recovery evidence and handoff.
Validation: Assignment/packet, manifest-lock inventory assertions, both node --check commands and tasks.py validate passed. Storage runtime, quota and browser behavior were not tested; original storage task remains unaccepted.

Task: S00-023
Agent: auto-storage-e6946c6f94e3
Role: storage
Action: claim
Status: review

Task title: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
2026-10-15 18:06:23 +07:00
wt 8db4e4ef35 S00-020: Approve pinned Linux XMPP toolchain restoration
Changes: Accept S00-020 with independent QA evidence and handoff; refresh scoped runtime/cache result paths after fresh retrieval and installation.
Validation: verify.py passed official HTTPS checksum, Node 24.21.0/npm 11.19.0, isolated strict npm ci and Stanza import. Independent archive/input/eight-version/strict-setting assertions, tasks.py validate and diff/scope checks passed. Browser/WSS and product readiness remain untested.

Task: S00-020
Agent: auto-qa-9e1e289654ba
Role: qa
Action: review
Status: done

Task title: Restore access to the pinned Linux XMPP experiment toolchain
2026-10-15 17:09:30 +07:00
wt ae00f3502e S00-020: Verify pinned Linux XMPP toolchain restoration
Changes: Refresh the environment-access result and document S00-020 restoration, accepted prerequisites and independent QA handoff; preserve probe code and parent dependency graph.
Validation: verify.py passed official HTTPS vendor checksum, Node 24.21.0/npm 11.19.0, fresh-cache strict npm ci and Stanza import. Separate artifact/input/version/strict-setting assertions and tasks.py validate passed. No browser/WSS or product readiness check performed.

Task: S00-020
Agent: auto-ci-cd-2a0186c54ce9
Role: ci-cd
Action: claim
Status: review

Task title: Restore access to the pinned Linux XMPP experiment toolchain
2026-10-15 17:07:16 +07:00
wt 3b92736a99 S00-024: Approve restored Linux toolchain continuation checkpoint
Changes: Accept the bounded S00-024 restoration checkpoint, add independent QA evidence and handoff, and refresh successful probe runtime/cache paths.
Validation: Independently reran verify.py with official HTTPS checksum, Node 24.21.0/npm 11.19.0, fresh-cache locked npm ci and Stanza import; archive/input/installed-version/strict-config assertions, tasks.py validate and diff/scope/whitespace checks passed. Browser/WSS, interoperability and product readiness remain unverified.

Task: S00-024
Agent: auto-qa-e19cd93db255
Role: qa
Action: review
Status: done

Task title: Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain
2026-10-15 17:04:44 +07:00
wt 4bad1f228e S00-024: Verify restored pinned Linux XMPP environment access
Changes: Add the S00-024 continuation checkpoint, refresh verified runtime/cache paths, and replace the blocked handoff with QA and S00-020 restart instructions.
Validation: Existing verify.py passed official HTTPS/checksum retrieval, Node 24.21.0/npm 11.19.0, fresh-cache locked npm ci and Stanza import. Independent archive/input/version/config assertions, tasks.py validate and diff/scope/whitespace checks passed. Browser/WSS and product readiness remain unverified.

Task: S00-024
Agent: auto-ci-cd-49907d48a6d1
Role: ci-cd
Action: claim
Status: review

Task title: Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain
2026-10-15 17:02:37 +07:00
wt ca20031bf9 S00-026: Approve pinned Linux artifact access after independent verification
Changes: Accept the bounded S00-026 access probe; add independent QA evidence and refresh successful result runtime/cache paths. Preserve parent task incompleteness.
Validation: Repeat verify.py successfully with fresh official HTTPS downloads, matching vendor SHA256, exact Node 24.21.0/npm 11.19.0, eight locked packages and actual Stanza import. Independently check copied input bytes, installed versions, integrity and strict npm settings. tasks.py validate and git diff --check pass. Inspect executor patch/message and coordinator access confirmation. Browser/WSS and detached signature/provenance audits remain outside this review.

Task: S00-026
Agent: auto-qa-7d3de2e3c758
Role: qa
Action: review
Status: done

Task title: Provide approved access to the pinned Linux experiment artifacts
2026-10-15 17:00:17 +07:00
wt 2af4f143d8 S00-026: Verify pinned Linux runtime and isolated locked dependency access
Changes: Add a bounded reproducible HTTPS/checksum/runtime probe under environment-access, vendor checksums, unchanged parent manifest/lock copies, strict npm settings, result and reproduction notes. Record evidence and QA handoff; submit S00-026 without completing parent tasks.
Validation: Run verify.py twice successfully: vendor Linux archive SHA256 matched, Node 24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed eight integrity-locked packages with scripts disabled, parent bytes stayed unchanged and Stanza import passed. tasks.py validate, git diff --check and scoped file whitespace checks passed. No browser/WSS, detached signature or provenance audit performed.

Task: S00-026
Agent: auto-ci-cd-4255c34da227
Role: ci-cd
Action: claim
Status: review

Task title: Provide approved access to the pinned Linux experiment artifacts
2026-10-15 16:57:59 +07:00
wt 5f4d044444 S00-005: Record blocked task and remediation handoff
Changes: Preserve incomplete work and blocker metadata for S00-005. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Previous runner session was interrupted before submit/escalate; processes stopped. User now explicitly requests resuming development. Preserve partial artifacts, verify them in a fresh bounded remediation, and return original to a new executor only after independent review.

Task: S00-005
Agent: auto-storage-88c3286c6641
Role: storage
Action: claim
Status: blocked

Task title: Выбрать IndexedDB wrapper и migration policy
2026-10-15 16:32:52 +07:00
wt 71675b1cc0 S00-004: Record blocked task and remediation handoff
Changes: Preserve incomplete work and blocker metadata for S00-004. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Agent timed out; process terminated before escalation

Task: S00-004
Agent: auto-crypto-8bf3dcf711b9
Role: crypto
Action: claim
Status: blocked

Task title: Проверить browser OMEMO backend
2026-10-15 15:32:48 +07:00
wt 07c9967d02 S00-019: Validate browser SCRAM-SHA-512 through public mechanism composition
Changes: Add an isolated pinned mechanism wrapper using Stanza's public constructor and factory APIs, preserve the SCRAM-SHA-512 wire name and fail-closed final guard, and document the proposed ADR, browser bundle evidence, independent Scramp vectors, notices and limits. Leave parent selection, dependency experiments, specs and shared contracts unchanged.
Validation: Fresh-cache npm ci and Vite browser build pass; 87 focused tests pass, including RFC HMAC vectors, original defect reproduction, independent full SHA-512 exchanges and rejected invalid finals/order/reset paths. Hashed Scramp oracle fixture comparison passes. Dependency check verifies 49 locked entries, 25 installed pins/licenses and 340 unmodified Stanza files. make check passes 72 tooling tests. Native browsers, WSS/live server interoperability and production readiness are untested; independent security review remains pending.

Task: S00-019
Agent: auto-crypto-c68801170fa4
Role: crypto
Action: claim
Status: review

Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
2026-10-15 02:48:39 +07:00
wt e2b4dbdb76 S00-018: Bound standalone XML ingress before Stanza parsing and import
Changes: Add an isolated public transport integration with finite byte, depth, element and attribute budgets; validate complete text XML with pinned saxes before real JXT parsing/import. Add adversarial and boundary fixtures, terminal cleanup tests, dependency notices and a proposed parser ADR.
Validation: Fresh-cache npm ci and npm test passed all 55 tests with Node 24.21.0/npm 11.19.0. Reproduced three stock parser failures, checked ten exact dependency licenses/integrities and 340 unchanged Stanza files; make check passed 72 tooling tests. Scope and whitespace inspected. Browser runtime, live WSS and interoperability were not tested.

Task: S00-018
Agent: auto-protocol-89fe6563092c
Role: protocol
Action: claim
Status: review

Task title: Validate bounded standalone XML ingress for the XMPP candidate
2026-10-15 02:31:33 +07:00
wt f556fc0deb S00-003: Record blocked task and remediation handoff
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages.

Task: S00-003
Agent: auto-protocol-902594b44429
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку
2026-10-15 02:24:00 +07:00
wt 493fbaebe7 S00-017: Validate SCRAM server-final before authenticated SASL completion
Changes: Add an isolated Stanza 12.22.1 SASL feature replacement using existing SCRAM crypto, exact dependency lock and MIT notices, 44 integrated fixture checks, proposed ADR and review handoff. Leave production adapters and the original library experiment unchanged.
Validation: Fresh-cache npm ci and npm test passed on Node 24.21.0/npm 11.19.0; 44 tests cover RFC SHA-1/SHA-256 proofs and verified finals, stock defect reproduction, invalid/premature finals and async cleanup. make check passed 72 tooling tests. Pins/licenses/notices, unchanged vendor source and whitespace verified. Browser/WSS/server interoperability and constant-time assurance remain unverified; independent security review is pending.

Task: S00-017
Agent: auto-protocol-599343cd9e3f
Role: protocol
Action: claim
Status: review

Task title: Establish fail-closed SCRAM server-final validation
2026-10-15 02:17:46 +07:00
wt c73d9cef45 S00-003: Record blocked task and remediation handoff
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.

Task: S00-003
Agent: auto-protocol-826aa6bc12ef
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку
2026-10-15 02:09:23 +07:00
wt 59b9ff62fe S00-002: Propose a pinned React stack with a reproducible rendering spike
Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review.
Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed.

Task: S00-002
Agent: auto-orchestrator-68a05c587e33
Role: orchestrator
Action: claim
Status: review

Task title: Выбрать framework и build runtime
2026-10-15 01:18:53 +07:00
wt e4672fba91 S00-011: Verify public npm access and exact-version tarball integrity
Changes: Add a scoped fresh-cache registry probe, safe reproduction instructions and artifact ignore rule; record actual TLS-enabled metadata/download results and review handoff without selecting a stack or changing the harness.
Validation: Original npm view command and verify.py returned exit 0; react@19.3.1 tarball (26394 bytes) matched registry SHA-512. make check passed validation and 66 tooling tests. git diff --check passed. App install/build and different-harness connectivity remain unverified.

Task: S00-011
Agent: auto-ci-cd-d105e8027730
Role: ci-cd
Action: claim
Status: review

Task title: Restore verified npm registry access for the stack spike
2026-10-15 01:10:10 +07:00
wt d5ed7eaaed S00-001: Define the Web scope passport and native exclusion boundaries
Changes: Add proposed scope ADR with reasons for all ten excluded IDs, retained Web obligations, lifecycle limits, external provider roles and deferred decisions. Add a document coverage/lifecycle checker with four negative mutations and executor evidence/handoff for security review.
Validation: python3 experiments/0000-scope/check.py passed for ten excluded IDs and seven lifecycle scenarios; all four negative mutations were rejected. make check passed validation and 66 tooling tests. Whitespace and allowed source paths checked. No live browser or provider integration was tested; ADR awaits independent review.

Task: S00-001
Agent: auto-orchestrator-48aab142ecde
Role: orchestrator
Action: claim
Status: review

Task title: Утвердить Web-профиль
2026-10-15 01:01:57 +07:00