wt/LumaWeb
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: wt/LumaWeb:522311022f9cec1d13de3551e46b181d3ac005de
wt/LumaWeb:main
...
compare: wt/LumaWeb:e39724f215411fc92aef5f5ca6d13f50fca0ed65
wt/LumaWeb:main
32 Commits
522311022f ... e39724f215
Author SHA1 Message Date
wt e39724f215 S00-019: Approve pinned browser SCRAM-SHA-512 after independent verification
Foundation checks / foundation (push) Successful in 46s
Details 
Changes: Accept the bounded SHA-512 experiment and ADR, record independent security findings and review handoff, and retain all browser-runtime, WSS, parent-integration and production limitations.
Validation: Fresh-cache npm ci and browser build pass; 87 focused tests and 10 additional signature, verifier-flag and malformed-first checks pass. Newly installed hashed Scramp oracle verifies all three fixed exchanges. Dependency checks confirm 49 locked entries, 25 installed pins/notices and 340 unchanged Stanza files with matching artifact hashes. Canonical RFC digests and installed oracle notices agree; make check passes 72 tooling tests. Actual browser, WSS/live interoperability and release readiness remain untested.

Task: S00-019
Agent: auto-security-f465a677e48f
Role: security
Action: review
Status: done

Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
 2026-10-15 02:52:28 +07:00
wt 07c9967d02 S00-019: Validate browser SCRAM-SHA-512 through public mechanism composition 
Changes: Add an isolated pinned mechanism wrapper using Stanza's public constructor and factory APIs, preserve the SCRAM-SHA-512 wire name and fail-closed final guard, and document the proposed ADR, browser bundle evidence, independent Scramp vectors, notices and limits. Leave parent selection, dependency experiments, specs and shared contracts unchanged.
Validation: Fresh-cache npm ci and Vite browser build pass; 87 focused tests pass, including RFC HMAC vectors, original defect reproduction, independent full SHA-512 exchanges and rejected invalid finals/order/reset paths. Hashed Scramp oracle fixture comparison passes. Dependency check verifies 49 locked entries, 25 installed pins/licenses and 340 unmodified Stanza files. make check passes 72 tooling tests. Native browsers, WSS/live server interoperability and production readiness are untested; independent security review remains pending.

Task: S00-019
Agent: auto-crypto-c68801170fa4
Role: crypto
Action: claim
Status: review

Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
 2026-10-15 02:48:39 +07:00
wt e69372c6db S00-003: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Stanza 12.22.1 browser HMAC sha-512 fails RFC 4231 Test Case 1: wrong 64-byte block selection. SCRAM-SHA-512 derives that hyphenated algorithm; private algorithm mutation/vendor patches are unsupported. Parent cannot attest browser strongest-mechanism compatibility from Node-only success.

Task: S00-003
Agent: auto-protocol-dcdf92cd067e
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку
 2026-10-15 02:38:42 +07:00
wt 74e1fd87d9 S00-018: Approve bounded XML ingress after independent framing checks 
Changes: Accept the isolated S00-018 ingress experiment and bounded ADR; record independent security findings and review handoff. Preserve all browser, live WSS, interoperability and production resource limitations.
Validation: Fresh-cache npm ci and all 55 integrated tests passed on Node 24.21.0/npm 11.19.0; six additional adversarial documents rejected before real JXT.parse with stale callback/fresh attempt checks. Verified ten dependency licenses/integrities, 340 unchanged Stanza files, upstream saxes license bytes and matching digests. Stock defects reproduced; make check passed 72 tooling tests. Initial getter-only tracing attempt failed and is recorded separately. Scope/whitespace inspected; no browser or live WSS test.

Task: S00-018
Agent: auto-security-64dc2d9fa232
Role: security
Action: review
Status: done

Task title: Validate bounded standalone XML ingress for the XMPP candidate
 2026-10-15 02:35:56 +07:00
wt e2b4dbdb76 S00-018: Bound standalone XML ingress before Stanza parsing and import 
Changes: Add an isolated public transport integration with finite byte, depth, element and attribute budgets; validate complete text XML with pinned saxes before real JXT parsing/import. Add adversarial and boundary fixtures, terminal cleanup tests, dependency notices and a proposed parser ADR.
Validation: Fresh-cache npm ci and npm test passed all 55 tests with Node 24.21.0/npm 11.19.0. Reproduced three stock parser failures, checked ten exact dependency licenses/integrities and 340 unchanged Stanza files; make check passed 72 tooling tests. Scope and whitespace inspected. Browser runtime, live WSS and interoperability were not tested.

Task: S00-018
Agent: auto-protocol-89fe6563092c
Role: protocol
Action: claim
Status: review

Task title: Validate bounded standalone XML ingress for the XMPP candidate
 2026-10-15 02:31:33 +07:00
wt f556fc0deb S00-003: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages.

Task: S00-003
Agent: auto-protocol-902594b44429
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку
 2026-10-15 02:24:00 +07:00
wt 1850dbc39f S00-017: Approve fail-closed SCRAM validation after independent integration checks 
Changes: Accept the bounded S00-017 fixture experiment and ADR; record independent security review and handoff with remaining browser, WSS, mechanism-policy and timing limits.
Validation: Fresh-cache npm ci and npm test passed on Node 24.21.0/npm 11.19.0 with 44 integrated tests. Verify exact installed pins, eight MIT notices, HTTPS/integrity and unchanged vendor files. make check passed 72 tooling tests; inspect executor scope/message and review metadata whitespace. No browser/server interoperability or constant-time assurance claimed.

Task: S00-017
Agent: auto-security-9ab954f6e021
Role: security
Action: review
Status: done

Task title: Establish fail-closed SCRAM server-final validation
 2026-10-15 02:20:57 +07:00
wt 493fbaebe7 S00-017: Validate SCRAM server-final before authenticated SASL completion 
Changes: Add an isolated Stanza 12.22.1 SASL feature replacement using existing SCRAM crypto, exact dependency lock and MIT notices, 44 integrated fixture checks, proposed ADR and review handoff. Leave production adapters and the original library experiment unchanged.
Validation: Fresh-cache npm ci and npm test passed on Node 24.21.0/npm 11.19.0; 44 tests cover RFC SHA-1/SHA-256 proofs and verified finals, stock defect reproduction, invalid/premature finals and async cleanup. make check passed 72 tooling tests. Pins/licenses/notices, unchanged vendor source and whitespace verified. Browser/WSS/server interoperability and constant-time assurance remain unverified; independent security review is pending.

Task: S00-017
Agent: auto-protocol-599343cd9e3f
Role: protocol
Action: claim
Status: review

Task title: Establish fail-closed SCRAM server-final validation
 2026-10-15 02:17:46 +07:00
wt c73d9cef45 S00-003: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.

Task: S00-003
Agent: auto-protocol-826aa6bc12ef
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку
 2026-10-15 02:09:23 +07:00
wt f12a71df49 S00-002: Approve the pinned UI stack after independent clean build checks 
Changes: Accept ADR 0001 for the bounded React/TypeScript/Vite and Node/npm choice; record independent security findings and update S00-002 handoff. Preserve browser interaction and release/interoperability limits.
Validation: Fresh-cache npm ci and strict npm run build passed on Node 24.21.0/npm 11.19.0; lock and artifact SHA256 matched executor evidence. Verified exact pins, 67 locked license/integrity entries and installed runtime license notices. HTTP preview matched built HTML/JS; make check passed 72 tooling tests; scoped diff and whitespace checked. No DOM interaction, vulnerability/provenance or product readiness acceptance is claimed.

Task: S00-002
Agent: auto-security-bd73f4f80779
Role: security
Action: review
Status: done

Task title: Выбрать framework и build runtime
 2026-10-15 02:06:24 +07:00
wt e4defcd371 S00-012: Approve complete runner prompt delivery after lifecycle checks 
Changes: Accept the preserved S00-012 stdin correction and descendant regressions; record independent QA evidence. No source changes.
Validation: Reproduced the legacy 140000-byte delayed-reader timeout and reaped the child. All 28 automation tests and 72 make check tests passed, including complete UTF-8/EOF, submit/timeout descendant cleanup, fresh sessions, scope and snapshots. Reviewed executor message and cumulative patches; git diff --check passed. No Windows, live model or application readiness claim.

Task: S00-012
Agent: auto-qa-04bdb7324ecc
Role: qa
Action: review
Status: done

Task title: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 02:03:50 +07:00
wt 6ec97125ae S00-015: Approve interruption recovery after independent readiness checks 
Changes: Accept only S00-015 observed provider recovery and readiness for a fresh S00-012 review; add independent QA evidence. No source or harness changes; parent implementation acceptance remains separate.
Validation: Four focused automation tests passed in 4.585s; tasks.py validate passed at revision 33 for 281 tasks. Verified original capacity failure, committed recovered executor/QA transitions, five distinct shared-model sessions, scoped executor patch/message and unaccepted parents. Whitespace checks passed. Future provider capacity is not guaranteed.

Task: S00-015
Agent: auto-qa-1d6e76a1728f
Role: qa
Action: review
Status: done

Task title: Устранить прерывание: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 02:01:28 +07:00
wt 18442e9522 S00-015: Verify recovered execution path for interrupted review 
Changes: Record S00-015 readiness after independently reviewed S00-016 provider recovery; replace blocked handoff with concrete QA next steps. No runner or test source changes; parent acceptance remains separate.
Validation: Four focused automation tests passed in 4.560s; tasks.py validate passed for 281 tasks at revision 32. Read-only assertions verified the original capacity failure, committed successful resolver/QA transitions, fresh shared-model sessions and unaccepted parents. Git diff whitespace and scope checks passed. Future provider capacity and parent implementation acceptance are not guaranteed.

Task: S00-015
Agent: auto-ci-cd-84e209103f24
Role: ci-cd
Action: claim
Status: review

Task title: Устранить прерывание: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 02:00:06 +07:00
wt 944f399c95 S00-016: Approve recovered reviewer availability after fresh QA tool checks 
Changes: Accept only S00-016 readiness and add independent QA evidence after verifying coordinator release, executor patch and fresh reviewer tool use.
Validation: Read-only readiness assertions passed; tasks.py validate passed for 281 tasks at revision 30; git diff --check passed. Verified distinct same-model sessions and preserved parent acceptance boundaries. Future provider capacity and parent implementation reviews remain separate.

Task: S00-016
Agent: auto-qa-309d45d4fd4b
Role: qa
Action: review
Status: done

Task title: Restore reviewer model availability after provider capacity failure
 2026-10-15 01:58:04 +07:00
wt 83404f9c8a S00-016: Record recovered fresh reviewer execution path 
Changes: Document coordinator-authorized external readiness and successful post-release tool use through the shared reviewer/executor harness; add S00-016 evidence and handoff. No source or harness configuration changes.
Validation: Read-only readiness assertions passed with exit 0; tasks.py validate passed for 281 tasks at revision 29; git diff --check passed. Parent tasks remain blocked and unaccepted. Future provider capacity and S00-012 acceptance require separate fresh review.

Task: S00-016
Agent: auto-ci-cd-351a0cbbabef
Role: ci-cd
Action: claim
Status: review

Task title: Restore reviewer model availability after provider capacity failure
 2026-10-15 01:56:00 +07:00
wt b282b0b367 S00-016: Release recovered model capacity for fresh verification 
Changes: Release the transient provider wait after a later fresh session successfully used the same model and CLI. Preserve parent blocking and independent review.
Validation: Compared failed capacity log with later successful tool execution in state/runs/auto-ci-cd-5475930af078/output.log; no role command overrides are configured. Future availability and parent acceptance remain unverified.

Task: S00-016
Agent: coordinator-capacity-b12fb7abdd2d
Role: orchestrator
Action: release-external
Status: todo

Task title: Restore reviewer model availability after provider capacity failure
 2026-10-15 01:54:04 +07:00
wt c35046a675 S00-015: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-015. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-012 fresh reviewer exited before review because its execution provider returned HTTP 503 and Selected model is at capacity. Provider availability or operator-authorized local harness model configuration is external to S00-015 source scope.

Task: S00-015
Agent: auto-ci-cd-5475930af078
Role: ci-cd
Action: claim
Status: blocked

Task title: Устранить прерывание: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 01:52:29 +07:00
wt d80f20e650 S00-012: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-012. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Agent exited with code 1

Task: S00-012
Agent: auto-qa-98b05bd56c25
Role: qa
Action: review
Status: blocked

Task title: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 01:51:14 +07:00
wt adb152fdd0 S00-012: Verify runner prompt delivery and lifecycle regressions 
Changes: Record verification evidence and replace the blocked S00-012 handoff with independent QA review instructions. Retain the existing stdin implementation and regressions from prior checkpoints; no new source changes.
Validation: Reproduced the legacy partial stdin timeout on Python 3.9.6 and reaped the child. All 28 automation tests passed, including exact 140024-byte UTF-8/EOF and timeout/submit descendant cleanup. make check passed all 72 tests; git diff --check passed. No live model, application readiness or Windows cleanup check is claimed.

Task: S00-012
Agent: auto-ci-cd-f101e40d9902
Role: ci-cd
Action: claim
Status: review

Task title: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 01:50:53 +07:00
wt bdfde480d4 S00-014: Approve runner cleanup idempotence after independent lifecycle checks 
Changes: Accept the bounded S00-014 cleanup correction and record independent QA evidence and handoff; no reviewer source changes.
Validation: Four focused signal/descendant tests and make check passed (72 tests); prior function independently fails the injected repeated-signal regression in memory. Inspected executor patch/message and scope; git diff --check passed. Natural EPERM, Windows and parent-task acceptance are not claimed.

Task: S00-014
Agent: auto-qa-0c2d58e2382e
Role: qa
Action: review
Status: done

Task title: Fix repeated runner cleanup after a submitted parent is reaped
 2026-10-15 01:48:36 +07:00
wt 7a737eeb49 S00-014: Make successful runner process-tree cleanup idempotent 
Changes: Record completed termination on the Popen instance after all cleanup steps succeed; avoid repeated signals to the reaped group. Add deterministic repeated-EPERM and failed-descendant-kill retry regressions without suppressing permission errors.
Validation: Four focused cleanup tests passed; make check passed 72 tests and plan/snapshot validation. git diff --check passed. Natural prior EPERM did not recur; injected EPERM reproduced the pre-fix failure. No application or parent-task acceptance is claimed.

Task: S00-014
Agent: auto-ci-cd-14343249da62
Role: ci-cd
Action: claim
Status: review

Task title: Fix repeated runner cleanup after a submitted parent is reaped
 2026-10-15 01:47:20 +07:00
wt 49c054aaf9 S00-012: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-012. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Submit-transition descendant regression fails: repeated stop_process_tree after parent reap raises EPERM at os.killpg; launch OSError handling then attempts invalid escalation from review state.

Task: S00-012
Agent: auto-ci-cd-28868645424b
Role: ci-cd
Action: claim
Status: blocked

Task title: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 01:45:17 +07:00
wt b6691d9c8b S00-013: Approve bounded runner prompts after independent context checks 
Changes: Accept S00-013 with an independent QA report and review handoff; no source edits. Confirm exact packets and mandatory supplementary reads remain available within the unchanged prompt budget.
Validation: make check passed all 68 tests, including UTF-8 stdin/EOF, timeout and terminal-transition regressions. Independently checked all 556 prompts: maximum 77693 characters; S21-006 retains 26 exact UI sections. Root escape and oversized-budget rejection checks passed; git diff --check passed. No application or parent-task acceptance claimed.

Task: S00-013
Agent: auto-qa-869b22acd478
Role: qa
Action: review
Status: done

Task title: Bound oversized S21-006 runner context without truncating requirements
 2026-10-15 01:42:03 +07:00
wt b1014f36c9 S00-013: Bound runner prompts with explicit required task input reads 
Changes: Keep startup instructions and exact context packets inline while listing supplementary task inputs as mandatory project reads. Preserve root containment, missing-artifact guidance and budget failures. Add S21-006 exact UI context regression and cover claim/review budgets for all tasks; leave stdin delivery unchanged.
Validation: make check passed all 68 tests, including delayed UTF-8 stdin/EOF, timeout and terminal-transition checks. All 556 current prompts fit 80000 characters; largest 77693. git diff --check passed. Foundation checks do not establish application readiness.

Task: S00-013
Agent: auto-ci-cd-5f68f03dd33b
Role: ci-cd
Action: claim
Status: review

Task title: Bound oversized S21-006 runner context without truncating requirements
 2026-10-15 01:40:32 +07:00
wt c28412ae8f S00-012: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-012. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: Required automation suite fails in existing all-prompts budget test: S21-006 exceeds even a diagnostic 90000-character prompt limit. This blocks verification of the stdin remediation; production limit remains 80000.

Task: S00-012
Agent: manual-ci-cd-stdin-20261015b
Role: ci-cd
Action: escalate
Status: blocked

Task title: Fix runner prompt delivery after partial stdin timeout
 2026-10-15 01:37:36 +07:00
wt 59b9ff62fe S00-002: Propose a pinned React stack with a reproducible rendering spike 
Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review.
Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed.

Task: S00-002
Agent: auto-orchestrator-68a05c587e33
Role: orchestrator
Action: claim
Status: review

Task title: Выбрать framework и build runtime
 2026-10-15 01:18:53 +07:00
wt 06f353b214 S00-011: Approve verified npm access after independent TLS and integrity checks 
Changes: Accept the bounded S00-011 registry remediation; record independent security evidence and review handoff. Source probe and stack remain unchanged by review.
Validation: Original npm view and fresh-cache verify.py returned exit 0; 26394-byte react@19.3.1 matched registry SHA-512. Disabled TLS was refused with exit 1. make check passed 66 tests; executor patch/message, scope, ignore rules and whitespace checked. App build, provenance and future harness connectivity remain unverified.

Task: S00-011
Agent: auto-security-1e9200de1765
Role: security
Action: review
Status: done

Task title: Restore verified npm registry access for the stack spike
 2026-10-15 01:11:33 +07:00
wt e4672fba91 S00-011: Verify public npm access and exact-version tarball integrity 
Changes: Add a scoped fresh-cache registry probe, safe reproduction instructions and artifact ignore rule; record actual TLS-enabled metadata/download results and review handoff without selecting a stack or changing the harness.
Validation: Original npm view command and verify.py returned exit 0; react@19.3.1 tarball (26394 bytes) matched registry SHA-512. make check passed validation and 66 tooling tests. git diff --check passed. App install/build and different-harness connectivity remain unverified.

Task: S00-011
Agent: auto-ci-cd-d105e8027730
Role: ci-cd
Action: claim
Status: review

Task title: Restore verified npm registry access for the stack spike
 2026-10-15 01:10:10 +07:00
wt b8afc70e5f S00-011: Release the npm access remediation for independent verification 
Changes: Record user-authorized network configuration and release S00-011 external wait. Keep S00-002 blocked pending resolver implementation and independent security review.
Validation: Public npm metadata returned React 19.3.1 and MIT over TLS in a Codex sandbox allowing project and temporary writes plus network access. Actual runner connectivity and tarball integrity remain S00-011 acceptance checks.

Task: S00-011
Agent: coordinator-network-0bc0fcf09c86
Role: orchestrator
Action: release-external
Status: todo

Task title: Restore verified npm registry access for the stack spike
 2026-10-15 01:07:56 +07:00
wt f1d707264e S00-002: Record blocked task and remediation handoff 
Changes: Preserve incomplete work and blocker metadata for S00-002. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-002 cannot verify versions/licenses or run its required clean install/build: local npm lookup fails with getaddrinfo ENOTFOUND registry.npmjs.org. Restricted network and never-approval execution policy cannot be changed by this agent. External owner must supply registry-capable execution while preserving TLS validation and project-only writes.

Task: S00-002
Agent: auto-orchestrator-3a4f07103316
Role: orchestrator
Action: claim
Status: blocked

Task title: Выбрать framework и build runtime
 2026-10-15 01:05:01 +07:00
wt d91103ea1c S00-001: Approve the Web scope passport after independent security review 
Changes: Accept ADR 0000 and record the independent reviewer, acceptance findings and handoff. Confirm native exclusion reasons, retained Web obligations, conditional push lifecycle and provider secret/metadata boundaries; transition S00-001 through the review CLI.
Validation: Reviewed executor commit d5ed7eaaed and its message against scope and evidence. python3 experiments/0000-scope/check.py passed ten IDs, seven states and four negative mutations. make check passed validation and all 66 tooling tests. No live browser/provider integration or crypto implementation was tested or accepted.

Task: S00-001
Agent: auto-security-bff4cfd4d38e
Role: security
Action: review
Status: done

Task title: Утвердить Web-профиль
 2026-10-15 01:03:56 +07:00
wt d5ed7eaaed S00-001: Define the Web scope passport and native exclusion boundaries 
Changes: Add proposed scope ADR with reasons for all ten excluded IDs, retained Web obligations, lifecycle limits, external provider roles and deferred decisions. Add a document coverage/lifecycle checker with four negative mutations and executor evidence/handoff for security review.
Validation: python3 experiments/0000-scope/check.py passed for ten excluded IDs and seven lifecycle scenarios; all four negative mutations were rejected. make check passed validation and 66 tooling tests. Whitespace and allowed source paths checked. No live browser or provider integration was tested; ADR awaits independent review.

Task: S00-001
Agent: auto-orchestrator-48aab142ecde
Role: orchestrator
Action: claim
Status: review

Task title: Утвердить Web-профиль
 2026-10-15 01:01:57 +07:00
167 changed files with 15044 additions and 39 deletions
Expand all files Collapse all files

No files matched your search

docs/decisions/0000-scope.md
+94
View File
@@ -0,0 +1,94 @@
# ADR 0000: Паспорт scope Luma Web
- Status: accepted — независимое security review S00-001; evidence: `state/evidence/S00-001-review.md`.
- Task: S00-001
- Date: 2026-10-15
- Decision owner: auto-orchestrator-48aab142ecde, orchestrator
- Reviewer: auto-security-bff4cfd4d38e, security, 2026-10-15
## Вход, результат и критерии
Вход: неизменяемые `specs/tz_clear.md` (§3, §20, §21, §27; GEN-005, GEN-006, WEB-002), `specs/uikit_clear.md`, applicability из `planning/requirements.json` и Web-профиль основы. Результат: один паспорт Web-scope с причинами исключений и перечнем внешних сервисов. Проверка: исключённые ID полностью совпадают с реестром, у каждого есть содержательная причина, lifecycle не обещает closed-tab XMPP или постоянное медиа через push. Прямых зависимостей и ранее принятых ADR нет; schemas из S01 пока не приняты.
## Решение и объём
Реализуется браузерное приложение для телефона и компьютера: compact navigation и wide sidebar/detail, keyboard/IME, accessibility, safe areas и адаптивный UI Kit. Desktop native package, Android native package, tray, foreground services, APNs/Android SDK и companion/Watch не входят в эту основу. Браузер на Android относится к Web и сохраняет Web-ограничения.
Из 221 ID реестр относит 211 к Web и 10 к out_of_scope. Все 211 остаются обязательствами плана, а не отчётом о готовности. Общие cross-platform требования применяются в Web-контексте; native-примеры UI Kit не исключают общую семантику, accessibility, tokens или touch-сценарии.
Базовый Web-объём сохраняет несколько конфигураций аккаунтов и один активный XMPP-контекст; login/logout/switch, контакты/presence, личные чаты/self-chat, MUC, текст/replies/reactions/correction/retraction/local deletion, selection/forwarding, OMEMO legacy и OMEMO 2 с доверием устройствам, файлы/фото/видео/музыку/voice/video notes/геоточки, локальную историю/MAM/Carbons/receipts/read state, личные аудио-/видеозвонки и их историю, аватары, уведомления/app lock, доступную защищённую биометрию и диагностику сервера.
За базовым объёмом остаются регистрация XMPP-аккаунтов, восстановление серверного пароля, групповые звонки, MIX/каналы, боты, платежи, истории, live location, полнотекстовый поиск всей истории и обязательная одновременная online-сессия всех аккаунтов (§3.2). Развёртывание XMPP-провайдера не является функцией клиента; необходимый push/relay — отдельный поставляемый либо явно подключённый компонент решения.
### Исключённые ID и сохранённые Web-обязательства
| Excluded ID | Причина исключения из этой основы | Web-замена / сохранённая часть |
| --- | --- | --- |
| ACC-003 | Настройка native TCP host/port, STARTTLS/direct TLS и native discovery не является браузерным транспортом. | ACC-004/005: WSS endpoint с видимым доменом и явным выбором неизвестного сервера. |
| NET-002 | Native DNS discovery и ручные параметры транспорта исключены. ID реестра исключён целиком, но его Web-оговорка остаётся обязательной. | WSS endpoint утверждается для выбранного сервера; ACC-004 и NET-001 сохраняются. |
| DESK-001 | Tray, native автозапуск и различие native hide/window quit относятся к устанавливаемому Desktop. | WEB-001/002: различать активную, скрытую и закрытую страницу. |
| DESK-002 | Живой native фоновый процесс и его incoming calls не поставляются браузерной основой. | WEB-002/003: уведомление и открытие страницы с проверкой актуальности вызова. |
| DESK-003 | Native sleep/wake и tray call icon не являются Web-интеграцией. | Web reconnect и push logout/revoke остаются по NET, PUSH и WEB; tray отсутствует. |
| AND-001 | Native Android push/call delivery и выбор системного provider требуют Android-приложения. | Browser Web Push с permission, gateway и проверенной регистрацией. |
| AND-002 | Native lifecycle/permissions и системный фоновый режим Android находятся вне Web-target. | WEB-001/002: скрытая страница может быть приостановлена; фонового socket SLA нет. |
| AND-003 | Android foreground/call service и управление ongoing call из native notification не поставляются. | Звонок в живой Web-сессии при доступных media permissions, без гарантии closed-tab call. |
| AND-004 | Force stop и native battery lifecycle проверяются у Android-приложения, не у этой основы. | Denied permissions, offline, browser termination и sleep требуют честной Web-деградации. |
| STORE-002 | Native secure vault и device key wrapping не предоставляются браузерным storage. | STORE-003/004: password в памяти, повторный вход, отдельное решение crypto unlock и честные quota/eviction. |
## Lifecycle и честные capability states
Закрытая страница не считается постоянно подключённой XMPP-сессией. Service worker notification не гарантирует непрерывный microphone, медиазвонок или автоматический показ полноэкранного incoming UI (WEB-002). Установленная PWA сохраняет эти ограничения. Скрытая страница может быть заморожена или выгружена; состояние connection/call после возвращения сверяется с реальностью (WEB-001). Push может вызвать обработку события/уведомление, но не заменяет постоянно живой socket. После перехода из уведомления выполняются unlock/login при необходимости, синхронизация и проверка срока/состояния вызова (WEB-003).
Таблица ниже — нормативные пределы обещаний, не результаты browser/runtime тестов. `conditional` означает только возможность после проверки prerequisites; `not-guaranteed` запрещает гарантию непрерывности; `none` означает отсутствие соответствующего пути.
| State | XMPP session | Push notification | Continuous media | Automatic fullscreen incoming |
| --- | --- | --- | --- | --- |
| foreground | conditional | conditional | conditional | not-guaranteed |
| hidden | not-guaranteed | conditional | not-guaranteed | not-guaranteed |
| closed-tab | none | conditional | none | none |
| browser-terminated | none | not-guaranteed | none | none |
| permission-denied | conditional | none | none | none |
| offline | none | not-guaranteed | none | none |
| logged-out | none | none | none | none |
Строка permission-denied предполагает отказ и notification, и media permissions; XMPP не требует этих разрешений. Logged-out требует disable/revoke регистрации, поздние события не восстанавливают аккаунт. Offline push может быть отложен/истечь, browser termination зависит от ОС/provider; доставки не обещаем. Реальные проверки foreground/hidden/closed-tab/denied/sleep/rotation/logout/stale notification относятся к будущей приёмке интеграции (§20.4).
GEN-005: различать advertised capability, configured integration и verified usable state. Если сервис/permission/registration недоступен, отключать только зависимую функцию с причиной, сохраняя остальные сценарии. Например, отсутствие TURN ограничивает достижимость звонка, upload — вложения, push — фоновые уведомления; наличие server feature само по себе не доказывает работу интеграции.
GEN-006: не обещать гарантированные delivery/read, отзыв чужих копий, работу закрытого процесса или скрытие metadata. TLS, OMEMO payload, file encryption, DTLS-SRTP, local protection и UI lock имеют разные границы. Gateway не получает decrypted messages или file keys; plaintext fallback, decrypting proxy и обход TLS/CORS недопустимы.
## Внешние providers и границы данных
Ни vendor, ни рабочий URL, ни SLA здесь не выбраны. Это обязательный inventory для topology S00-008 и последующей интеграции; наличие строки не означает подключённый сервис.
| Сервис / provider | Требуемая роль и публичная конфигурация | Данные / секреты и деградация |
| --- | --- | --- |
| HTTPS hosting / origin | Поставка Web assets и service worker через доверенный origin. | Видит сетевые metadata; не получает пароль/ключи через analytics. Hosting и release channels ещё не утверждены. |
| XMPP provider + WSS endpoint | Auth, stanza routing, capability discovery, MUC/MAM/Carbons и поддержанные XEP. Домен endpoint виден пользователю. | Пароль используется только выбранным transport auth; OMEMO plaintext серверу недоступен. Сервер видит routing metadata. При отсутствии WSS соединение недоступно. |
| HTTPS upload provider | Upload slot, разрешённые origin/CORS, size/expiry policy. | Encrypted attachment bytes; file key передаётся в защищённом сообщении. Ошибка/quota отключает upload с объяснением. |
| STUN/TURN provider | NAT traversal/relay для WebRTC; публичные server URLs в runtime config. | IP/время/объём relay видимы provider; TURN secrets отдельно, без committed примеров. Недоступность не выдаётся за успешный звонок. |
| XMPP push service / gateway | Связать XMPP enable/disable с браузерной subscription, update/expiry/logout/revoke. | Минимальные registration metadata; без body/file key/password. Gateway private credentials и VAPID private key вне repo/logs. |
| Browser-selected Web Push service | Доставка к user agent, permission и subscription endpoint; это отдельная роль от gateway. | Timing/size metadata видимы provider; subscription — чувствительные данные, не public config. Без permission/registration нет «Push работает». |
| Maps / tiles / geocoding provider | Явно подключённые карты для геоточек, утверждённые endpoints и политика доступа. | Coordinates/IP могут раскрыться provider, требуется минимизация/объяснение; live location исключён. При отсутствии сервиса не выдавать карту за загруженную. |
Публичные URLs и несекретные capabilities идут в runtime config. Password только в памяти; постоянный login/crypto unlock остаётся отдельным ADR S00-007. Browser quota/очистка не эквивалентны hardware-backed vault. Secrets, реальные JID, subscriptions и переписки не входят в fixtures/evidence/environment examples.
## Рассмотренные варианты и первичные источники
Проверено 2026-10-15; sources подтверждают границы механизма, не совместимость конкретных браузеров.
- Выбранный WSS путь: [RFC 7395, §3 и §6](https://www.rfc-editor.org/rfc/rfc7395.html) определяет XMPP WebSocket binding и защиту endpoint через TLS. Native TCP не переносится в Web controls. Браузер проверяет TLS; обход сертификатов не разрешён.
- Альтернатива HTTPS BOSH: [XEP-0206](https://xmpp.org/extensions/xep-0206.html) описывает XMPP поверх BOSH. В этом профиле не требуется и не включается; возможное включение требует отдельного решения по ACC-004.
- Event-driven push: [W3C Push API, introduction и §4](https://www.w3.org/TR/2026/WD-push-api-20261005/) описывает push service, delivery к worker и видимые provider metadata. Working Draft не является обещанием поддержки всех browser features.
- Предел worker lifetime: [W3C Service Workers, §2.1.1](https://www.w3.org/TR/2026/CRD-service-workers-20260917/#service-worker-lifetime) связывает lifetime с обработкой событий и допускает прекращение worker. Вывод для профиля: worker нельзя считать непрерывной XMPP/media-сессией.
- Раздельные push роли: [XEP-0357, §2 и §5](https://xmpp.org/extensions/xep-0357.html) описывает XMPP push service и внешнюю delivery service с отдельным enable. Одного advertised XMPP feature недостаточно.
Отклонены обещание native transport в браузере, «вечная» PWA socket/media-сессия и автоматически подключённые providers. Повод пересмотра — новая утверждённая версия требований или проверяемая platform integration через отдельный ADR/plan change; исходные snapshots сохраняются.
## Проверка, ограничения и следующие решения
Focused experiment: `python3 experiments/0000-scope/check.py` проверяет полное покрытие excluded IDs по canonical registry/specs, содержательные причины и нормативные lifecycle limits; отрицательные мутации подтверждают обнаружение пропуска/ложной closed-tab гарантии. Это проверка паспорта, без сетевой интеграции, browser spike или runtime implementation.
Новых dependencies и library licenses нет. Выбор framework/runtime и проверка лицензий — S00-002; XMPP и crypto libraries/interoperability — S00-003/004; IndexedDB — S00-005; browser/reference matrix и PWA mode — S00-006; unlock — S00-007; конкретная topology/providers — S00-008; совместный gate — S00-009/010. До их принятия отсутствуют browser versions, file/cache/pending limits, performance reference devices, server/client wire-format evidence и release hosting/update policy. Их отсутствие явно ограничивает текущий паспорт и запрещает обещать готовность релиза; для bounded S00-001 эти решения не выбираются.
Shared contracts из реестра остаются задачами S01. Этот паспорт не задаёт новые поля интерфейсов и не меняет план/applicability. Security reviewer проверяет причины, lifecycle, provider data boundaries, scope и evidence перед принятиями coordinator workflow.
docs/decisions/0001-stack.md
+81
View File
@@ -0,0 +1,81 @@
# ADR 0001: Framework and build runtime for Luma Web
- Status: accepted — independent security review of S00-002; evidence: `state/evidence/S00-002-review.md`.
- Task / requirement: S00-002 / NFR-007.
- Date: 2026-10-15.
- Decision owner: auto-orchestrator-68a05c587e33 (orchestrator).
- Reviewer: auto-security-bd73f4f80779 (security), 2026-10-15.
## Context and required capabilities
Input: immutable NFR-007, accepted ADR 0000, architecture/contract registry and reviewed S00-011 registry remediation. Output: this bounded stack decision and one isolated rendering spike in `experiments/0001-stack`. Acceptance is exact versions, lockfile, actual clean install/build and documented license/runtime/browser limits. This selects browser UI and its build tooling, without selecting XMPP/OMEMO/media libraries, backend providers, routing/state libraries or shared schemas.
Luma needs a client-rendered UI, typed application/adapter boundaries, static deployment and eventual browser workers. An SSR application server is unnecessary for this experiment: secrets and OMEMO remain in their separately defined client boundaries. A UI library does not validate those boundaries or guarantee encrypted interoperability. S01 still owns exact contracts; S00-003…010 retain their existing decisions.
## Candidates and primary sources
Primary documentation and public registry metadata read on 2026-10-15. Versions below were retrieved with `npm view`; only the selected stack was installed/built. No performance comparison is claimed.
| Criterion | React + TypeScript + Vite | Vue + TypeScript + Vite |
| --- | --- | --- |
| Candidate UI | React / React DOM 19.3.1, MIT | Vue 3.5.44, MIT |
| Typed UI | TSX, `react-jsx`, native TypeScript JSX checking; React types 19.3.0 | Composition API / SFC; official Vite plugin 6.0.10 and vue-tsc 3.3.13, both MIT |
| Build / language | Vite 8.3.4, TypeScript 7.0.2 | Same Vite/TypeScript candidates; plugin peer range includes Vite 8 and Vue 3.5 |
| Application model | Explicit state updates and render functions; suitable for future typed commands/view models | Reactive refs and templates; also compatible with the architecture |
| Tooling tradeoff | One TypeScript checker for `.ts` and `.tsx`; plain Vite can build this spike without a React plugin | SFC compilation and template checking add separate tooling; Vue can also use render functions |
| Static hosting | Client bundle, no runtime Node server required | Client bundle, no runtime Node server required |
| Browser limits | Modern ESM browser target inherited from Vite; API support needs feature checks | Vue 3 targets modern browsers and excludes IE11; Vite limits also apply |
| Actual experiment | Clean install and strict typecheck/production build completed | Documentation/metadata comparison only; not installed or benchmarked |
Sources:
- [React's from-scratch setup](https://react.dev/learn/build-a-react-app-from-scratch) documents Vite as a build option and the additional application responsibilities of that approach. [createRoot](https://react.dev/reference/react-dom/client/createRoot) defines the DOM mounting API used here.
- [Vue quick start](https://vuejs.org/guide/quick-start.html) documents a Vite-based SPA, SFCs and optional TypeScript. [Vue FAQ](https://vuejs.org/about/faq.html) covers MIT licensing and modern-browser constraints. [Vue TypeScript tooling](https://vuejs.org/guide/typescript/overview.html) describes vue-tsc/template checking.
- [TypeScript JSX](https://www.typescriptlang.org/docs/handbook/jsx.html) defines TSX and automatic JSX runtime/type checking.
- [Vite getting started](https://vite.dev/guide/) documents framework templates and Node requirements. [Production build](https://vite.dev/guide/build.html) documents static output, browser targets and absence of automatic API polyfills.
- [Node release lifecycle](https://nodejs.org/en/about/previous-releases) identifies Node 24 as LTS and Node 26 as Current on this date. [Official Node 24.21.0 distribution](https://nodejs.org/dist/v24.21.0/) supplies runtime and checksums.
- [npm ci](https://docs.npmjs.com/cli/v11/commands/npm-ci/) defines lockfile-based clean installation, mismatch failure and removal of existing node_modules.
- Exact primary registry records: [React](https://registry.npmjs.org/react/19.3.1), [React DOM](https://registry.npmjs.org/react-dom/19.3.1), [Vue](https://registry.npmjs.org/vue/3.5.44), [Vite](https://registry.npmjs.org/vite/8.3.4), [TypeScript](https://registry.npmjs.org/typescript/7.0.2), [npm](https://registry.npmjs.org/npm/11.19.0), [Vue plugin](https://registry.npmjs.org/@vitejs%2fplugin-vue/6.0.10), [vue-tsc](https://registry.npmjs.org/vue-tsc/3.3.13). React type packages are pinned and their licenses recorded in the inventory.
## Decision
Select React 19.3.1 / React DOM 19.3.1, TypeScript 7.0.2 and Vite 8.3.4, built with Node 24.21.0 LTS and its bundled npm 11.19.0. Use `.ts` for non-UI typed modules and `.tsx` for React UI; ESM imports and strict TypeScript checking. This is a project engineering choice, not a requirement imposed by the product specification. TSX keeps ordinary typed module imports and UI checks on the same compiler path, fitting the existing domain/application/ports boundaries. Vue is viable; no claim of React performance/security superiority is made.
The six direct dependencies have exact versions, with no range operators. `package-lock.json` version 3 locks transitive/optional platform packages with registry URLs and integrity. `.nvmrc`, exact engines, packageManager and the build runtime guard establish tool pins; `.npmrc` requires strict engines and verified HTTPS. Node and npm are build tools; they are not a browser runtime or a selected push gateway stack. Lockfile updates require explicit review, not automatic floating upgrades.
No React Compiler, Babel, React refresh plugin, router, state store, service worker or polyfill is introduced. Vite's built-in TSX transform is sufficient for this spike, as verified by the build. Production development tooling and CI are subsequent scoped tasks; adding plugins requires license/API/browser checks. TypeScript 7 installs a platform compiler package; unsupported build-host platforms need a separate verified runtime/tooling decision.
## Focused experiment and actual result
The spike mounts a heading, an explicit local-experiment notice, an Increment button and a live counter through createRoot/useState. It contains no account fixture or transport and has no external runtime asset/CDN requests. See its README for exact reproduction and manual browser procedure.
Verified on macOS ARM64 using the official Node tarball downloaded over normal HTTPS and matched against SHASUMS256.txt. The tarball SHA-256 is `bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057`. This is checksum verification against the same vendor HTTPS origin, not detached-signature verification. Node was unpacked only under `/private/tmp`; system tools/configuration were unchanged.
- `npm install --ignore-scripts --no-audit --no-fund` generated the lockfile (24 installed packages).
- `npm ci --ignore-scripts --no-audit --no-fund` with a new empty cache performed the actual clean install; exit 0, 24 packages. Existing node_modules was replaced by npm ci. Optional native packages supplied prebuilt binaries; lifecycle scripts stayed disabled.
- `npm run build` with the exact pinned tools performed strict `tsc --noEmit` and Vite production build; exit 0 before and after clean install. Output: 14 transformed modules; index HTML 0.29 kB, JavaScript 219.87 kB (68.75 kB gzip). These sizes describe this spike, not a product budget.
- The two build outputs and lockfile had identical SHA-256 hashes on this host. This demonstrates a local repeated build, not cross-OS bit-for-bit reproducibility.
- Loopback `npm run preview` served HTML and the byte-matching JavaScript artifact with HTTP 200; this was an HTTP smoke check, not browser execution. The preview process was stopped.
- `make check`: exit 0, 276 tasks / 22 stages / 221 requirements / 211 Web requirements; 66 tooling tests passed. It verifies the foundation, not the application.
No browser was available: in-app browser creation returned unavailable and browser inventory was empty. Interactive DOM rendering/click behavior is therefore an external check, not reported as passed. The card's mandatory clean install/build checks passed; release browser functionality still needs actual browser evidence in its assigned tasks. No XMPP/crypto/media/provider interoperability is implied.
## License / security / browser constraints
React, React DOM, their type packages and Vite use MIT; TypeScript uses Apache-2.0; Node uses MIT with bundled third-party notices; npm uses Artistic-2.0 with its own dependency licenses. React DOM requires React ^19.3.1; the selected exact version satisfies it. Vite 8.3.4 requires Node ^20.19.0 or >=22.12.0, TypeScript requires >=16.20.0, and npm 11.19.0 requires ^20.17.0 or >=22.9.0. Node 24.21.0 meets all selected requirements; do not choose EOL Node 20 merely because an engine range permits it.
The full locked inventory is in `experiments/0001-stack/LICENSE_INVENTORY.md`, including uninstalled optional platforms. Transitives include ISC, BSD-3-Clause, Apache-2.0 and MPL-2.0 (Lightning CSS build-time binaries). Build tools are not browser runtime dependencies; modified MPL-covered files would require their applicable source obligations on distribution. Browser-bundled React/React DOM/Scheduler copyright/license texts are preserved in `THIRD_PARTY_NOTICES.md`. Runtime distributions retain their original Node/npm notices. Future release packaging must collect notices for its actual full dependency graph; this inventory is not a license approval for future libraries.
The explicit syntax target is Chrome/Edge 111, Firefox 114, Safari 16.4, matching the documented Vite 8 baseline. These are compiler floors, not the accepted product test matrix (S00-006). There are no API polyfills: ESM/dynamic import/import.meta, DOM and appropriate JS built-ins must be available. WebCrypto/IndexedDB/WebRTC/notifications/permissions/storage quota must be checked independently; HTTPS/WSS and secure contexts remain mandatory in deployed use. Neither UI library makes closed-tab sockets or continuous media possible.
The loopback HTTP dev/preview server serves only this synthetic local UI. It does not connect to production endpoints and is not a workaround for TLS, certificates, crypto or CORS. No unsafe HTML insertion, secrets, environment credentials, analytics or real conversation data is present. Lock integrity does not prove provenance or absence of vulnerabilities; dependency monitoring/advisory review remains a continuing release responsibility.
## Consequences and migration triggers
After separate acceptance, downstream tasks may create stack-specific `.ts`/`.tsx` modules within their own cards, establish application CI/build and implement reviewed S01 contracts. No other module, plan definition, requirement snapshot or shared contract is changed here. The reviewed registry-access probe is retained unchanged.
A need for validated older browsers, unavailable native build-host packages, an incompatible required crypto/protocol dependency, or unacceptable measured UI behavior triggers a new bounded ADR/plan change and experiment. Do not replace this stack or introduce plaintext/stub fallbacks silently. A future revision may select Vue after real evidence; the unbuilt candidate is not represented as tested. Reviewer should verify exact pins/lock integrity/license notices, reproduce clean install/build, assess stated limits and record acceptance before consumers treat this ADR as accepted.
## Independent acceptance
Security reviewer auto-security-bd73f4f80779 repeated fresh-cache npm ci and strict typecheck/build on Node 24.21.0/npm 11.19.0, verified manifest/lock pins, all 67 locked license/integrity entries and runtime notice texts, and matched executor artifact hashes. Loopback preview served identical HTML/JS; make check passed 72 tooling tests. The bounded stack decision is accepted. DOM interaction was not executed in this review; product browser matrix, interoperability, vulnerability/provenance assessment and release readiness remain outside this acceptance. Review evidence records commands and limits; coordinator owns the review commit.
docs/decisions/0002-xmpp-parser-validation.md
+116
View File
@@ -0,0 +1,116 @@
# ADR 0002 parser remediation: bounded standalone XML ingress
- Status: accepted for the bounded S00-018 fixture experiment; independent review: `state/evidence/S00-018-review.md`.
- Task: S00-018 (remediation of S00-003).
- Date: 2026-10-15.
- Owner: auto-protocol-89fe6563092c (protocol).
- Reviewer: auto-security-64dc2d9fa232 (security), 2026-10-15.
Input: reviewed scope/stack/SASL ADRs, S00-003 parser blocker and bounded probe,
shipped Stanza parser/transport declarations and RFC 7395. Output: one isolated
runnable ingress experiment in experiments/0002-xmpp-library/parser-validation.
It does not select Stanza for the product, define production limits/shared
contracts, change authentication, or replace remaining S00-003 evidence.
The stock 12.22.1 transport keeps a StreamParser across WebSocket messages and
converts payloads to text. The finite diagnostic reproduced a 1 MiB body, depth
256 and 18 separate writes forming one 64 KiB body without errors. StreamParser
has no supported resource-budget options. The standalone-frame obligation is
[RFC 7395 §3.2/3.3.3](https://www.rfc-editor.org/rfc/rfc7395.html#section-3.3.3).
Inference from the shipped transport: stock parser reassembly violates that
obligation when each probe write represents a separate WebSocket message.
The RFC does not prescribe our numerical limits.
Propose a new public Client.transports constructor registration, selected alone
through config. The public Transport interface lists connect/disconnect/restart/
send; Client.connect instantiates the registered constructor with Client,
StreamManagement and Registry. This is a supported shipped integration surface,
not a private subclass override or ignored vendor patch. Exact shipped API:
node_modules/stanza/Client.d.ts, index.d.ts, Client.js, jxt/index.d.ts,
jxt/Parser.js and jxt/Registry.js. Upstream [Client source](https://github.com/legastero/stanza/blob/master/src/Client.ts)
is supporting context; installed 12.22.1 declarations/behavior are authoritative
for this experiment. Future stability is not promised.
Before any JXT tree/import, require text and finite bytes, then use a new
namespace-aware saxes XML 1.0 document parser and close it for completeness.
Throw on malformed input or exceeded event counters, reject restricted constructs,
and only then run the actual JXT.parse and Registry.import. Local ceilings:
| Resource | Maximum, inclusive | Enforcement |
| --- | --- | --- |
| Encoded message | 4096 UTF-8 bytes | Unit precheck, bounded TextEncoder, before SAX |
| Depth including root | 8 | SAX opentagstart |
| Elements including root | 32 | SAX opentagstart |
| Attributes including xmlns | 16 total/document | SAX attribute |
| Attribute name+decoded value units | 1024 total/document | SAX attribute |
| Element/attribute name units | 128 each | SAX event |
| Decoded attribute value units | 256 each | SAX attribute |
SAX itself stores tokens/namespaces before callbacks; their worst-case source
is capped by bytes first. No handwritten XML security parser or regex syntax
approximation is introduced. XML declarations, comments, PI and DTDs are
conservatively rejected; CDATA/built-in/numeric entities work. No entity fetch
or expansion extension is enabled. The entire document is validated before
any earlier root can emit. Incomplete documents/multiple roots/binary messages
are terminal and cannot be completed by subsequent messages. Close detaches
callbacks, clears attempt stream/config state and rejects stale callbacks.
Fresh connect creates a fresh transport. No payload is logged or raw-evented.
Alternatives rejected: post-import counters (too late), stock persistent parser
(no budgets/framing), regex or custom security parser (incorrect/unvetted),
DOMParser (tree allocated before structural checks), private source patches
(unsupported integration). A strict event parser plus byte ceiling provides a
bounded preflight without authoring XML syntax. Double parsing retains actual
candidate behavior, with bounded cost; complete normalization equivalence is
not established and is not claimed.
New exact dependencies: saxes 6.0.0 (ISC), xmlchars 2.2.0 (MIT); Stanza remains
12.22.1 (MIT). Ten exact installed packages are locked with HTTPS registry URLs,
SHA512 integrity, full license inventory and notices. Saxes published tarball
omits LICENSE; preserved upstream [v6.0.0 license](https://raw.githubusercontent.com/lddubeau/saxes/v6.0.0/LICENSE)
includes ISC lineage and an historical MIT notice. Public API/browser constraints
were checked against [versioned saxes README](https://raw.githubusercontent.com/lddubeau/saxes/v6.0.0/README.md)
and installed saxes.d.ts/source, not assumptions about a parser's strict mode.
Sources inspected 2026-10-15. Saxes has an older release; maintenance/advisory
clearance is not inferred from version pinning. README conformance claims are
upstream claims; our evidence is the bounded tests.
Verification: pinned Node 24.21.0/npm 11.19.0, fresh-cache npm ci, 55 integrated
tests passing; aggregate boundary document and Unicode boundary actually
import; all original failure categories and adversarial cases reject without
stanza emission/late revival. Registry tracing calls the real import. All 340
installed Stanza files byte-match the original candidate; no vendor edits.
make check passes 72 tooling tests (foundation only). Commands and setup details
are in the experiment README and state/evidence/S00-018-auto-protocol-89fe6563092c.md.
Browser use requires a CommonJS-capable bundler, native WebSocket/URL/TextEncoder
and private fields. Default uses browser WebSocket, fixture injection captures
socket effects only; actual Client.connect and its queue/registry/parser execute.
No browser build/runtime, actual WSS/TLS handshake, independent server/client
interoperability or exhaustion benchmark was run. Byte checks begin after
browser message allocation, and do not bound aggregate traffic/Client queues or
downstream work. This minimal transport does not implement all error reporting,
close negotiation, redirect, keepalive, language inheritance or XMPP sequencing.
No TLS/CORS bypass, invented channel binding, crypto primitive, production policy
or shared contract is added. ACC-004/NET-003/NET-004 remain obligations of the
original selection/product work; existing accepted SASL experiment is unchanged.
Independent security reviewer must inspect enforcement order/API integration,
repeat clean install/tests/license/vendor checks and record acceptance before
this ADR or S00-018 is accepted. Coordinator alone commits/launches further work.
## Independent acceptance
Security reviewer auto-security-64dc2d9fa232 independently repeated fresh-cache
npm ci and all 55 integrated tests on Node 24.21.0/npm 11.19.0. Ten exact
installed dependency licenses/integrities and all 340 unchanged Stanza files
were checked; the preserved saxes license byte-matches the versioned upstream
HTTPS source. Additional six adversarial inputs rejected before traced real
JXT.parse, all four stale socket callbacks left fresh attempts unaffected, and
fresh attempts imported the exact aggregate-boundary body. make check passed
72 tooling tests. Public shipped constructor/Transport APIs and enforcement
order were inspected. The bounded experiment is accepted; every browser,
WSS/interoperability, aggregate resource, sequencing and production-policy
limitation above remains. Report records commands and the failed initial tracing
attempt. Coordinator owns the review commit and subsequent fresh assignment.
docs/decisions/0002-xmpp-sasl-validation.md
+124
View File
@@ -0,0 +1,124 @@
# ADR 0002-SASL: Fail-closed SCRAM server-final experiment
- Status: accepted for the bounded S00-017 fixture experiment; independent review: `state/evidence/S00-017-review.md`.
- Task: S00-017, remediation for S00-003.
- Date: 2026-10-15.
- Owner: auto-protocol-599343cd9e3f (protocol).
- Reviewer: auto-security-9ab954f6e021 (security), 2026-10-15.
- Requirements: ACC-004, NET-003, NET-004; accepted ADR 0000/0001 preserved.
## Question and bounded result
Can the pinned StanzaJS candidate validate SCRAM server authentication before
emitting success/restarting without modifying vendor source or implementing
cryptographic primitives? Output is one isolated, runnable feature experiment,
not selection of Stanza as the production library. S01 shared contracts remain
unaccepted; no application adapter or interface is created here.
The original blocker is reproducible in 12.22.1: its SASL success branch marks
negotiation/transport authenticated, emits auth:success and requests restart
without processing additional-data or calling the SCRAM verifier. Empty and
forged success before challenge/proof are accepted. The isolated tests retain
this baseline reproduction and exercise the replacement through the real XML
registry and feature dispatcher.
## Options and proposed decision
1. **Replace the named SASL feature through public APIs.** Chosen for this bounded
experiment. `Client.use` and `registerFeature` are exposed in installed package
declarations; the registry assigns handlers by name. SCRAM already exposes
`processSuccess` and `finalize`. Keep all crypto in that existing implementation
and add fail-closed ordering, strict fixture-profile input and cleanup.
2. **Patch ignored vendor code or intercept success after emission.** Rejected:
ignored patches are not reproducible deliverables, and a post-success listener
cannot prevent earlier authenticated effects. No upstream patch is required.
3. **Replace the entire client/mechanism stack.** Deferred to S00-003. The original
evidence's xmpp.js source comparison also lacked server-final processing;
no installed/tested alternative or maintenance/security superiority is claimed.
Install the proposed plugin on a fresh Client before connect/feature events;
never permit the stock SASL handler to start first. The named registration
replaces its callback without editing registry internals. The API appends an
order entry; the actual dispatcher exits on restart/disconnect, with tests
confirming one completion and successful later negotiation after reset.
Only after proof send completes does success data reach library `processSuccess`
and `finalize`; both authenticated and mutuallyAuthenticated must be true before
any authenticated flag, event or restart. Missing, forged, erroneous, duplicated,
malformed or premature final is terminal failure. Reset removes attempt listeners
and cancels asynchronous continuation. Proof/credential/send exceptions fail
without logging credentials, peer data or crypto state. No cache is persisted.
## Sources, pins and licenses
Primary sources inspected on 2026-10-15:
- [RFC 5802 §5](https://www.rfc-editor.org/rfc/rfc5802.html#section-5): mutual
authentication and SHA-1 exchange; the public user/pencil fixture is copied as
test data, not used as an account. Invalid verifier must fail the exchange.
- [RFC 7677 §3](https://www.rfc-editor.org/rfc/rfc7677.html#section-3): SHA-256
exchange used as a second fixed primary-spec transcript.
- [Stanza 12.22.1 registry record](https://registry.npmjs.org/stanza/12.22.1):
exact package provenance location/license and locked tarball. Installed shipped
`Client.js/.d.ts`, `plugins/features.js/.d.ts`, `plugins/sasl.js` and
`lib/sasl/index.js/.d.ts` are the exact API/implementation evidence. Upstream
[Client source](https://github.com/legastero/stanza/blob/master/src/Client.ts)
corroborates plugin usage, but is not version-pinned acceptance evidence.
Dependency: stanza 12.22.1, MIT. Exact transitive pins: @types/node 22.20.5,
@types/punycode 2.1.4, @types/ws 8.18.2, punycode 2.3.1, sdp 3.2.2,
undici-types 6.21.0, ws 8.22.0; all MIT. Separate manifest/lock under
`experiments/0002-xmpp-library/sasl-validation` does not alter the parent's
unaccepted exploratory graph. Every locked package has HTTPS registry URL,
SHA512 integrity and inspected installed license text; inventory and notices
are preserved. Runtime stays Node 24.21.0/npm 11.19.0 from accepted ADR 0001.
No new crypto dependency, crypto primitive or vendor-source edit is introduced.
## Runnable evidence and constraints
See experiment README and `state/evidence/S00-017-auto-protocol-599343cd9e3f.md`.
Clean npm ci with an empty cache and npm test passed: 44 tests, including two
RFC client proofs/verified finals, original insecure baseline, missing/forged/
premature rejection, duplicate/out-of-order inputs, send/credential failure,
asynchronous reset and replay rejection. Tests observe real feature-dispatcher
restart/disconnect calls and transport/negotiation flags; they are local parsed
XML integration tests with captured outbound effects, not WSS/server tests.
The experiment accepts only non-PLUS SHA-256/SHA-1, selecting the strongest of
those offered and failing if neither is available. No plaintext fallback or
invented browser TLS binding. SHA-512, complete mechanism policy and compatibility
remain S00-003. Server-final is accepted only as success additional-data; separate
final challenge, SCRAM extensions and extra challenge round trips are rejected.
Decoded-data and iteration bounds (4096 bytes / 100000) are local experiment
limits. A success racing a pending send is conservatively rejected. These
restrictions can reduce availability and need explicit future integration review.
Node exercises Stanza's SCRAM composition and Node crypto primitives. Browser
Stanza uses bundled synchronous hashing/HMAC, global crypto RNG, WebSocket and
fetch; its backend/build is not tested in this task. No browser support matrix,
constant-time comparison guarantee (Stanza compares verifier strings), advisory/
provenance clearance, WSS/TLS/channel-binding test, independent-client/server
interoperability or production readiness is implied. No live credentials,
network authentication, certificate/CORS bypass or persisted secrets are used.
## Handoff and consequences
Independent security reviewer must reproduce the integrated positive/negative
cases and assess extension API, cleanup, license/pin evidence and the stated
restrictions. This ADR stays proposed until review. Reviewed acceptance permits
a fresh S00-003 executor to evaluate this approach in its own experiment; it does
not implement that original task or change the accepted stack/shared contracts.
Any required broader policy/interface or vendor replacement is a separately
scoped plan decision. Coordinator owns transition commits and fresh processes.
## Independent acceptance
Security reviewer auto-security-9ab954f6e021 independently repeated fresh-cache
npm ci and all 44 integrated tests on Node 24.21.0/npm 11.19.0. Exact installed
pins, all eight MIT notices, HTTPS/integrity entries, shipped public extension
APIs and unchanged vendor files were verified. RFC proofs/finals match primary
examples; forged/missing/premature final cannot authenticate in the demonstrated
handler. make check passed 72 tooling tests. This bounded experiment is accepted;
Stanza selection, complete mechanism policy, browser crypto/build, WSS/server
interoperability, parser certification, timeout and constant-time assurance remain
unverified. S00-003 must evaluate integration in a new assigned session.
docs/decisions/0002-xmpp-sha512-validation.md
+142
View File
@@ -0,0 +1,142 @@
# ADR 0002 SHA-512 remediation: public mechanism composition
- Status: accepted — independent security review of bounded S00-019; evidence: `state/evidence/S00-019-review.md`.
- Task: S00-019, remediation of S00-003.
- Date: 2026-10-15.
- Owner: auto-crypto-c68801170fa4 (crypto).
- Reviewer: auto-security-f465a677e48f (security), 2026-10-15.
- Requirements: ACC-004, NET-003, NET-004.
Input: original SHA-512 blocker, accepted scope/stack/SASL/parser decisions,
exact pinned Stanza browser source/public declarations and primary vectors.
Output is one isolated runnable experiment in
experiments/0002-xmpp-library/sha512-validation. No production library selection,
parent WSS work, shared contract, stack change or original spec change.
## Defect and options
The built Stanza 12.22.1 browser backend reproduces the RFC 4231 case 1 failure
for createHmac('sha-512'). Source chooses 128-byte blocks only for sha512;
SCRAM's normal wire name derives sha-512. The browser digest implementation
already accepts both spellings; HMAC does not normalize the hyphen. Direct
public SCRAM('SCRAM-SHA-512') produces the wrong full client proof as well.
1. Compose the existing exported SCRAM through its public constructor with the
working algorithm alias, expose the correct independent wire name, and
register the wrapper through public Factory APIs. Proposed for this exact
version, with complete browser-backend vectors guarding the alias behavior.
2. Replace crypto or the complete mechanism with another library. Not needed
for this outcome: introduces new runtime crypto/dependency/API assumptions.
Scramp is used only as an independent test oracle, not a browser candidate.
3. Patch private algorithm/vendor HMAC, mutate vendor prototypes, rewrite imports
to a replacement crypto backend, rename the wire mechanism or downgrade.
Rejected; no such patch/workaround is used.
## Proposed integration
Sha512Mechanism implements the shipped public Mechanism interface and delegates
all crypto to a new public SCRAM('SCRAM-SHA512'). Constructor typing accepts a
string; exact shipped source derives sha512, supported by createHash/Hmac. The
wrapper exposes SCRAM-SHA-512 on the wire and never accesses/changes a Stanza
private field. The delegate retains its internal alias name throughout. This
uses documented public constructor/method signatures and version-inspected alias
behavior, not an upstream promise of a named SCRAM-SHA512 wire mechanism.
Future upgrades must revalidate this composition; an incompatible API is a new
blocker, not permission for a private patch.
Public Factory.disable/register replaces SHA-512 before negotiation; fresh
Client.use installs the isolated S00-017 guard copy. Guard is narrowed to SHA-512
and its 88-character verifier, while preserving strict validation, ordering,
mutual authentication, cancellation and no-success-on-error behavior. Delegate
processSuccess/finalize must confirm both flags before auth event/flags/restart.
Library-derived keys remain attempt-local, getCacheableCredentials returns null;
no storage/cache update path is added. Crypto primitives, SCRAM composition,
SASLprep and verifier remain entirely existing library code.
Only non-PLUS SHA-512 is permitted by this fixture profile. PLUS-only/plaintext/
unsupported offers fail; compatible mixed offers select SHA-512. tlsUnique input
fails. GS2 n,, and c=biws reflect no channel binding. Full NET-003 fallback policy
and real WSS ACC-004 stay with S00-003; this experiment makes no complete product
requirement or library-selection claim.
## Pins, public API and sources
Inspected primary sources on 2026-10-15:
- [RFC 4231 sections 4.2–4.8](https://www.rfc-editor.org/rfc/rfc4231.html#section-4.2)
supplies seven fixed HMAC-SHA-512 cases, including 131-byte keys and truncation.
- [RFC 6234 test driver](https://www.rfc-editor.org/rfc/rfc6234.html#section-8.5)
supplies SHA-512 abc digest. No primitive code is copied from the RFC.
- [Stanza source](https://github.com/legastero/stanza/blob/master/src/lib/sasl/index.ts)
supplies public API context; exact shipped 12.22.1 lib/sasl/index.d.ts/.js,
Client.d.ts/.js, plugins/features.d.ts/.js and platform/browser/crypto files
are authoritative version-specific evidence. Factory accepts a constructor;
wrapper calls only declared public methods. Stanza license is MIT with bundled
browser crypto ancestry notices preserved.
- [events upstream](https://github.com/browserify/events) documents browser
EventEmitter API, ES5 support, MIT license and limited maintainer resources.
events 3.3.0 supplies the explicit polyfill required by Stanza's browser graph.
- [Vite build](https://vite.dev/guide/build.html) supports library output/browser
targets; accepted Vite 8.3.4 is reused, not a new stack selection.
- [Scramp 1.4.6 API](https://pypi.org/project/scramp/1.4.6/) documents SHA-512
and public client/server methods. Test oracle pins Scramp 1.4.6 (MIT-0) and
asn1crypto 1.5.1 (MIT), exact wheel SHA256 hashes, Python >=3.8. Version selected
for available Python 3.9 host compatibility; not a latest-version/audit claim.
Direct npm pins: stanza 12.22.1, events 3.3.0 (MIT), Vite 8.3.4 (MIT, build only).
49 exact locked entries, 25 installed on this macOS ARM64 host. All lock entries
have HTTPS registry URL, SHA512 integrity and license inventory; installed
notices include Stanza NOTICE browser code lineage and build third-party texts.
Native rolldown binding omits a license file; owning rolldown MIT/third-party
licenses preserved. Optional platform entries are inventory-only. Build graph
includes MIT/ISC/BSD/Apache/MPL packages; no modified covered vendor source.
Neither pins nor these checks certify advisory/provenance/security clearance.
Runtime remains accepted Node 24.21.0/npm 11.19.0. Normal HTTPS, strict engines,
disabled install scripts; no global configuration change. Browser bundle uses
package browser mapping and explicit events alias, with no Node crypto/backend
or external builtin. Build graph assertions and executed artifact supply backend
evidence; Node crypto appears only as the separate primitive oracle in tests.
## Actual validation and limits
Fresh-cache npm ci, browser library build and 87 tests passed. All seven fixed
RFC HMAC cases match sha512/SHA512; SHA digest aliases match abc, varied HMAC keys
0..256 bytes match independent Node crypto. Stock hyphenated HMAC/full SCRAM
failures reproduce. Three full fixed SHA-512 exchanges match independent Scramp
client/server output (ordinary/131-byte/Unicode passwords). Scramp regeneration
verifies client proof and server-final independently before comparing fixtures.
Actual browser-built Client, XML registry, feature dispatcher and mechanism run
positive and missing/forged/premature/malformed/duplicate/racing-final checks.
Fixture send/transport effects are captured explicitly; crypto is never stubbed.
Fail never authenticates/restarts; reset/error/replay cannot revive it. Server
silence after proof remains unauthenticated until external reset. All 340 Stanza
files byte-match original pinned candidate. Detailed commands, checks and hashes
are in README and executor evidence; independent review remains mandatory.
Bundle execution host is Node, using browser backend and host native web APIs.
Actual Chrome/Firefox/Safari runtime, WSS/TLS, live independent server/client,
parent parser integration, workers/performance and production readiness are not
claimed. Targets Chrome/Edge 111, Firefox 114, Safari 16.4 are accepted build
floors, not a certified product matrix; native crypto RNG/fetch/WebSocket needed.
Synchronous SCRAM derivation can block UI; no constant-time verifier guarantee
(Stanza compares strings), timeout or exhaustive SASLprep claim. Only success
additional-data final, extension-free syntax, 4096 decoded bytes/100000 iteration
fixture limits; separate final challenge conservatively rejects. Accepted
S00-017/S00-018 source is untouched. Independent security reviewer must assess
public alias composition and all limits, repeat commands and record acceptance
before the coordinator resumes the parent in another fresh process.
## Independent acceptance
Security reviewer auto-security-f465a677e48f accepts this pinned, isolated public
mechanism composition after independent fresh-cache install, browser build and
87 tests, hashed Scramp oracle recreation, dependency/notice/vendor checks and
10 additional adversarial guard tests. Both authentication flags are required;
modified signatures and malformed first messages fail before success/restart.
Public constructor alias use is acceptable for this exact inspected version;
it is not a future upstream alias guarantee. All browser-runtime/WSS/parent
integration, timing, timeout and release limitations above remain. No production
library selection or complete ACC/NET product acceptance is granted here.
Coordinator must commit this review before launching any fresh parent process.
experiments/0000-scope/check.py
+69
View File
@@ -0,0 +1,69 @@
"""Check the scope passport against canonical applicability and WEB-002 limits.
Document-only experiment; no product runtime or provider connection is simulated.
"""
import json
import re
from pathlib import Path
ROOT = Path(__file__).resolve().parents[2]
ID = re.compile(r"\| ((?:[A-Z]+-)+\d{3}) \| (.+?) \| (.+?) \|")
STATES = {"foreground", "hidden", "closed-tab", "browser-terminated",
"permission-denied", "offline", "logged-out"}
def check(document, requirements):
excluded = {r["id"] for r in requirements if r["applicability"] == "out_of_scope"}
rows = ID.findall(document)
assert len(rows) == len({r[0] for r in rows}), "Duplicate excluded ID"
assert {r[0] for r in rows} == excluded, "Excluded coverage differs from canonical registry"
for rid, reason, retained in rows:
assert len(reason.strip()) >= 40, f"Missing substantive reason: {rid}"
assert len(retained.strip()) >= 30, f"Missing Web boundary: {rid}"
entry = next(r for r in requirements if r["id"] == rid)
assert f"**{rid}.**" in (ROOT / entry["source"]).read_text(), rid
lifecycle = {}
for line in document.splitlines():
cells = [c.strip() for c in line.split("|")[1:-1]]
if cells and cells[0] in STATES:
assert len(cells) == 5 and cells[0] not in lifecycle, "Malformed lifecycle row"
lifecycle[cells[0]] = cells[1:]
assert set(lifecycle) == STATES, "Incomplete lifecycle scenarios"
assert all(v in {"conditional", "none", "not-guaranteed"}
for row in lifecycle.values() for v in row), "Unsupported guarantee"
for state in {"closed-tab", "browser-terminated", "offline", "logged-out"}:
row = lifecycle[state]
assert row[0] == "none" and row[2:] == ["none", "none"], f"False session/media promise: {state}"
assert lifecycle["hidden"][0] == "not-guaranteed", "Hidden socket continuity promise"
assert lifecycle["closed-tab"][1] == "conditional", "Push confused with session or guaranteed delivery"
assert lifecycle["permission-denied"][1:] == ["none"] * 3, "Denied permissions bypassed"
assert lifecycle["logged-out"] == ["none"] * 4, "Logout reactivation promise"
return len(excluded), len(lifecycle)
def main():
document = (ROOT / "docs/decisions/0000-scope.md").read_text()
requirements = json.loads((ROOT / "planning/requirements.json").read_text())
counts = check(document, requirements)
mutations = [
re.sub(r"^\| ACC-003 \|.*\n", "", document, flags=re.M),
re.sub(r"^\| ACC-003 \|.*$", "| ACC-003 | | |", document, flags=re.M),
document.replace("| closed-tab | none | conditional | none | none |",
"| closed-tab | conditional | conditional | none | none |"),
document.replace("| closed-tab | none | conditional | none | none |",
"| closed-tab | none | conditional | conditional | none |"),
]
for index, mutant in enumerate(mutations, 1):
assert mutant != document, "Negative fixture did not mutate document"
try:
check(mutant, requirements)
except AssertionError:
continue
raise AssertionError(f"False passport accepted: mutation {index}")
print(f"PASS: {counts[0]} excluded IDs match registry/specs with reasons; "
f"{counts[1]} lifecycle scenarios; {len(mutations)} negative mutations rejected.")
print("LIMIT: document validation only; browser/provider behavior is untested.")
if __name__ == "__main__":
main()
experiments/0001-stack/.gitignore
+2
View File
@@ -0,0 +1,2 @@
node_modules/
dist/
experiments/0001-stack/.npmrc
+4
View File
@@ -0,0 +1,4 @@
engine-strict=true
save-exact=true
registry=https://registry.npmjs.org/
strict-ssl=true
experiments/0001-stack/.nvmrc
+1
View File
@@ -0,0 +1 @@
24.21.0
experiments/0001-stack/LICENSE_INVENTORY.md
+73
View File
@@ -0,0 +1,73 @@
# Locked dependency license inventory
Registry/package metadata inspected on 2026-10-15. Exact versions and integrity are in package-lock.json. Optional platform packages are included here even when not installed on macOS ARM64.
| Package | Version | SPDX license |
| --- | --- | --- |
| @oxc-project/types | 0.154.0 | MIT |
| @rolldown/binding-android-arm-eabi | 1.2.14 | MIT |
| @rolldown/binding-android-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-x64 | 1.2.14 | MIT |
| @rolldown/binding-freebsd-x64 | 1.2.14 | MIT |
| @rolldown/binding-linux-arm-gnueabihf | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-musl | 1.2.14 | MIT |
| @rolldown/binding-linux-ppc64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-s390x-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-musl | 1.2.14 | MIT |
| @rolldown/binding-openharmony-arm64 | 1.2.14 | MIT |
| @rolldown/binding-win32-arm64-msvc | 1.2.14 | MIT |
| @rolldown/binding-win32-x64-msvc | 1.2.14 | MIT |
| @rolldown/pluginutils | 1.0.1 | MIT |
| @types/react | 19.3.0 | MIT |
| @types/react-dom | 19.3.0 | MIT |
| @typescript/typescript-aix-ppc64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-darwin-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-darwin-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-freebsd-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-freebsd-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-arm | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-loong64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-mips64el | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-ppc64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-riscv64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-s390x | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-netbsd-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-netbsd-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-openbsd-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-openbsd-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-sunos-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-win32-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-win32-x64 | 7.0.2 | Apache-2.0 |
| csstype | 3.2.3 | MIT |
| detect-libc | 2.1.2 | Apache-2.0 |
| fdir | 6.5.0 | MIT |
| fsevents | 2.3.3 | MIT |
| lightningcss | 1.33.0 | MPL-2.0 |
| lightningcss-android-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-freebsd-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm-gnueabihf | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-win32-arm64-msvc | 1.33.0 | MPL-2.0 |
| lightningcss-win32-x64-msvc | 1.33.0 | MPL-2.0 |
| nanoid | 3.3.20 | MIT |
| picocolors | 1.1.1 | ISC |
| picomatch | 4.0.7 | MIT |
| postcss | 8.5.30 | MIT |
| react | 19.3.1 | MIT |
| react-dom | 19.3.1 | MIT |
| rolldown | 1.2.14 | MIT |
| scheduler | 0.28.0 | MIT |
| source-map-js | 1.2.2 | BSD-3-Clause |
| tinyglobby | 0.2.17 | MIT |
| typescript | 7.0.2 | Apache-2.0 |
| vite | 8.3.4 | MIT |
experiments/0001-stack/README.md
+45
View File
@@ -0,0 +1,45 @@
# S00-002 rendering spike
One local React/TypeScript/Vite experiment for ADR 0001. The registry-access/
subdirectory belongs to the reviewed S00-011 probe and is retained unchanged.
No account, network messaging, crypto, media, service worker or application
scaffold is implemented here.
## Reproduce
Use Node **24.21.0** with bundled npm **11.19.0**. `.nvmrc` is a pin for an
existing version manager; installing the spike never changes system runtimes.
Official binaries: https://nodejs.org/dist/v24.21.0/ — verify the selected archive
against SHASUMS256.txt with normal TLS trust. On this executor, the verified
macOS ARM64 runtime was unpacked at
`/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64`.
From this directory with the pinned runtime's bin directory first on PATH:
```sh
node --version
npm --version
npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-review-cache --fetch-retries=0 --fetch-timeout=15000
npm run build
npm run preview -- --port 4173 --strictPort
```
Use a new cache path for a network/clean-cache check. npm ci itself removes old
node_modules and fails on lock/manifest mismatch. Keep optional platform packages
enabled; TypeScript/Vite use platform binaries and build succeeds without
lifecycle scripts. TLS verification and exact engine checks remain enabled.
The private package is not published. npm install is only for explicitly reviewed
lockfile updates, not normal reproduction.
Open `http://127.0.0.1:4173` locally: expect “Luma rendering spike” and “Count: 0”.
Click Increment twice: expect Count: 2. This is the manual DOM/interaction check;
it was **not run** because this harness exposes no browsers. Build/typechecking
were run successfully. Stop the server with Ctrl-C. `npm run dev` is available
for source development; no React refresh plugin is installed.
Build output/node_modules are ignored. The browser bundle is static and requires
no Node server. Explicit compiler floors: Chrome/Edge 111, Firefox 114, Safari
16.4, with no API polyfills; the product browser matrix is a later decision.
Preserve THIRD_PARTY_NOTICES.md when distributing this bundle; full lock graph
licenses are in LICENSE_INVENTORY.md. CI, release notice automation, app tests
and cryptographic/protocol compatibility remain subsequent tasks.
experiments/0001-stack/THIRD_PARTY_NOTICES.md
+78
View File
@@ -0,0 +1,78 @@
# Third-party notices for the rendering bundle
The browser bundle contains React, React DOM and Scheduler. Build-tool licenses are listed in LICENSE_INVENTORY.md; installed packages retain their license files. No build tool is shipped as a browser runtime. Preserve these notices when distributing this spike.
## react 19.3.1
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## react-dom 19.3.1
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## scheduler 0.28.0
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
experiments/0001-stack/index.html
+5
View File
@@ -0,0 +1,5 @@
<!doctype html>
<html lang="en">
<head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Luma stack spike</title></head>
<body><div id="root"></div><script type="module" src="/src/main.tsx"></script></body>
</html>
experiments/0001-stack/package-lock.json
Generated
+1268
View File
File diff suppressed because it is too large. Load diff
experiments/0001-stack/package.json
+26
View File
@@ -0,0 +1,26 @@
{
"name": "luma-stack-rendering-spike",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
},
"packageManager": "npm@11.19.0",
"scripts": {
"build": "node tools/check-runtime.mjs && tsc --noEmit && vite build",
"dev": "vite --host 127.0.0.1",
"preview": "vite preview --host 127.0.0.1"
},
"dependencies": {
"react": "19.3.1",
"react-dom": "19.3.1"
},
"devDependencies": {
"@types/react": "19.3.0",
"@types/react-dom": "19.3.0",
"typescript": "7.0.2",
"vite": "8.3.4"
}
}
experiments/0001-stack/registry-access/.gitignore
+1
View File
@@ -0,0 +1 @@
artifacts/
experiments/0001-stack/registry-access/README.md
+79
View File
@@ -0,0 +1,79 @@
# Verified public npm registry path — S00-011
Input: S00-002 failed to resolve registry.npmjs.org. Output: a repeatable public
metadata and exact-version tarball probe in the current executor harness.
This is connectivity evidence, not a framework choice or an application build.
## Execution environment and reproduction
Verified in the fresh auto-ci-cd-d105e8027730 executor on 2026-10-15:
Node v26.3.0, npm 11.16.0, Python 3, macOS paths. These are observed tools,
not accepted project runtime versions. The supplied harness has network access
enabled, workspace-write sandboxing and approval policy never. No harness,
runner, DNS, proxy, certificate or Git configuration was changed by this task.
The initial working tree contained only the coordinator's state/tasks.json claim.
The next fresh executor must retain network-enabled execution, working DNS and
HTTPS egress to registry.npmjs.org:443, normal certificate trust, and project-only
source writes with temporary writes under /private/tmp. No credentials are needed.
Do not disable TLS or relax the write sandbox. The previous DNS failure was not
reproduced here; its external correction mechanism is unknown. This report does
not promise network availability in a different or future harness.
From the project root:
```sh
npm view react version license engines --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000
python3 experiments/0001-stack/registry-access/verify.py
```
The first command exactly repeats the original failure. It returned exit 0:
```json
{"version":"19.3.1","license":"MIT","engines":{"node":">=0.10.0"}}
```
`npm config get strict-ssl` returned `true` (exit 0). The second command uses a
new TemporaryDirectory under /private/tmp with empty user/global npmrc files
and a fresh cache, runs from there to avoid project npmrc, and removes that
temporary directory after execution. It refuses NODE_TLS_REJECT_UNAUTHORIZED=0.
It invokes these argument arrays via subprocess, without a shell:
```text
npm view react@19.3.1 version license engines dist --json <common-options>
npm pack react@19.3.1 --ignore-scripts --json --pack-destination=<absolute-scope>/artifacts <common-options>
```
The exact common options are:
```text
--registry=https://registry.npmjs.org/ --strict-ssl=true
--fetch-retries=0 --fetch-timeout=15000
--cache=<fresh-temp>/cache --userconfig=<fresh-temp>/user.npmrc
--globalconfig=<fresh-temp>/global.npmrc
```
The probe installs no dependencies, extracts no archive, runs no package scripts
and adds no package manifest/lockfile. React is only a public connectivity sample.
It checks the metadata version and exact HTTPS tarball URL, downloads through
npm, and independently compares Python hashlib SHA-512/base64 with dist.integrity
and npm pack's integrity. It uses standard libraries, not custom cryptography.
Errors/mismatches exit nonzero. Do not print private environment/configuration.
## Actual result
Both child npm commands and verify.py returned exit 0, using the fresh cache:
- Package: react@19.3.1; metadata license MIT.
- URL: https://registry.npmjs.org/react/-/react-19.3.1.tgz
- Retrieved size: 26394 bytes.
- Registry and independently computed integrity:
`sha512-QNhWdt7nrgVWWQG58QuGsAR3jv3Hbe4mb4vz7w2csnHavciZJgda1CPNaldF6eVxv90ud3jUXpKlHL69gO38yw==`
The local `artifacts/` directory contains the tarball, public metadata.json and
result.json; it is deliberately ignored by Git. Rerun the probe for independent
review instead of trusting an archived result. No secrets are recorded. Registry
signature/provenance verification is not claimed; the acceptance check is registry
integrity over verified HTTPS. Browser/CORS, dependency install, build, framework
compatibility and license acceptance remain outside this task. S00-002 must run
its own clean install/build and make its own stack/runtime decision after review.
experiments/0001-stack/registry-access/verify.py
+68
View File
@@ -0,0 +1,68 @@
#!/usr/bin/env python3
"""Fetch public npm metadata/tarball without installing or running package code."""
import base64
import hashlib
import json
import os
from pathlib import Path
import subprocess
import tempfile
ROOT = Path(__file__).resolve().parent
PACKAGE = "react@19.3.1" # Connectivity sample only; not a stack decision.
def main():
if os.environ.get("NODE_TLS_REJECT_UNAUTHORIZED") == "0":
raise SystemExit("Refusing disabled Node TLS verification")
artifacts = ROOT / "artifacts"
artifacts.mkdir(exist_ok=True)
# Empty configuration files prevent inherited npm credentials/config from
# being needed for this public probe. Never print the process environment.
with tempfile.TemporaryDirectory(prefix="luma-registry-", dir="/private/tmp") as temp:
temp = Path(temp)
for name in ("user.npmrc", "global.npmrc"):
(temp / name).write_text("", encoding="utf-8")
common = [
"--registry=https://registry.npmjs.org/", "--strict-ssl=true",
"--fetch-retries=0", "--fetch-timeout=15000",
f"--cache={temp / 'cache'}", f"--userconfig={temp / 'user.npmrc'}",
f"--globalconfig={temp / 'global.npmrc'}",
]
def npm(args):
# Run outside the project so no project .npmrc is inherited.
result = subprocess.run(["npm", *args, *common], cwd=temp,
check=True, capture_output=True, text=True,
timeout=60)
print("npm " + " ".join(args) + " [isolated TLS/cache options]: exit 0")
return json.loads(result.stdout)
metadata = npm(["view", PACKAGE, "version", "license", "engines", "dist", "--json"])
if metadata["version"] != "19.3.1":
raise SystemExit("Unexpected package version")
if metadata["dist"]["tarball"] != "https://registry.npmjs.org/react/-/react-19.3.1.tgz":
raise SystemExit("Unexpected tarball origin/path")
integrity = metadata["dist"]["integrity"]
algorithm, expected = integrity.split("-", 1)
if algorithm != "sha512":
raise SystemExit("Expected SHA-512 registry integrity")
base64.b64decode(expected, validate=True)
packed = npm(["pack", PACKAGE, "--ignore-scripts", "--json",
f"--pack-destination={artifacts}"])
if len(packed) != 1 or packed[0]["filename"] != "react-19.3.1.tgz":
raise SystemExit("Unexpected pack output")
tarball = artifacts / "react-19.3.1.tgz"
actual = "sha512-" + base64.b64encode(hashlib.sha512(tarball.read_bytes()).digest()).decode("ascii")
if actual != integrity or packed[0]["integrity"] != integrity:
raise SystemExit("Tarball integrity mismatch")
(artifacts / "metadata.json").write_text(json.dumps(metadata, indent=2) + "\n", encoding="utf-8")
result = {"package": PACKAGE, "bytes": tarball.stat().st_size,
"integrity": actual, "registry_integrity_match": True}
print(json.dumps(result, indent=2))
(artifacts / "result.json").write_text(json.dumps(result, indent=2) + "\n", encoding="utf-8")
if __name__ == "__main__":
main()
experiments/0001-stack/src/main.tsx
+20
View File
@@ -0,0 +1,20 @@
import { useState } from 'react';
import { createRoot } from 'react-dom/client';
function RenderingSpike() {
const [count, setCount] = useState(0);
return (
<main>
<h1>Luma rendering spike</h1>
<p>Local UI experiment; no account or transport.</p>
<button type="button" onClick={() => setCount(value => value + 1)}>
Increment
</button>
<output aria-live="polite">Count: {count}</output>
</main>
);
}
const root = document.getElementById('root');
if (!root) throw new Error('Missing rendering root');
createRoot(root).render(<RenderingSpike />);
experiments/0001-stack/tools/check-runtime.mjs
+6
View File
@@ -0,0 +1,6 @@
if (process.versions.node !== '24.21.0') {
throw new Error(`Expected Node 24.21.0, got ${process.versions.node}`);
}
if (!process.env.npm_config_user_agent?.startsWith('npm/11.19.0 ')) {
throw new Error('Run build with npm 11.19.0');
}
experiments/0001-stack/tsconfig.json
+19
View File
@@ -0,0 +1,19 @@
{
"compilerOptions": {
"target": "ES2022",
"lib": [
"ES2022",
"DOM",
"DOM.Iterable"
],
"module": "ESNext",
"moduleResolution": "Bundler",
"jsx": "react-jsx",
"strict": true,
"noEmit": true,
"skipLibCheck": false
},
"include": [
"src"
]
}
experiments/0001-stack/vite.config.js
+1
View File
@@ -0,0 +1 @@
export default { build: { target: ['chrome111', 'edge111', 'firefox114', 'safari16.4'] } };
experiments/0002-xmpp-library/package-lock.json
Generated
+99
View File
@@ -0,0 +1,99 @@
{
"name": "luma-xmpp-library-spike",
"version": "0.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "luma-xmpp-library-spike",
"version": "0.0.0",
"dependencies": {
"stanza": "12.22.1"
},
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
}
},
"node_modules/@types/node": {
"version": "22.20.5",
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
"license": "MIT",
"dependencies": {
"undici-types": "~6.21.0"
}
},
"node_modules/@types/punycode": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
"license": "MIT"
},
"node_modules/@types/ws": {
"version": "8.18.2",
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
"license": "MIT",
"dependencies": {
"@types/node": "*"
}
},
"node_modules/punycode": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
"license": "MIT",
"engines": {
"node": ">=6"
}
},
"node_modules/sdp": {
"version": "3.2.2",
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
"license": "MIT"
},
"node_modules/stanza": {
"version": "12.22.1",
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
"license": "MIT",
"dependencies": {
"@types/node": "^22.0.0",
"@types/punycode": "^2.1.0",
"@types/ws": "^8.18.1",
"punycode": "^2.1.1",
"sdp": "^3.0.2",
"ws": "^8.18.2"
}
},
"node_modules/undici-types": {
"version": "6.21.0",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
"license": "MIT"
},
"node_modules/ws": {
"version": "8.22.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
},
"peerDependencies": {
"bufferutil": "^4.0.1",
"utf-8-validate": ">=5.0.2"
},
"peerDependenciesMeta": {
"bufferutil": {
"optional": true
},
"utf-8-validate": {
"optional": true
}
}
}
}
}
experiments/0002-xmpp-library/package.json
+10
View File
@@ -0,0 +1,10 @@
{
"name": "luma-xmpp-library-spike",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {"node": "24.21.0", "npm": "11.19.0"},
"packageManager": "npm@11.19.0",
"scripts": {"test": "node --test test/*.test.mjs"},
"dependencies": {"stanza": "12.22.1"}
}
experiments/0002-xmpp-library/parser-probe/reproduce.mjs
+57
View File
@@ -0,0 +1,57 @@
// Bounded diagnostic of the stock parser; passing means the defect reproduced.
// No network, credentials, vendor patch, or production implementation.
import assert from 'node:assert/strict';
import {createRequire} from 'node:module';
const require = createRequire(import.meta.url);
const Client = require('stanza/Client').default;
const {StreamParser} = require('stanza/jxt');
assert.equal(require('stanza/package.json').version, '12.22.1');
const tick = () => new Promise(resolve => setImmediate(resolve));
function harness() {
const client = new Client({autoReconnect: false});
// Same parser options as shipped transports/websocket.js.
const parser = new StreamParser({registry: client.stanzas,
wrappedStream: false, allowComments: false});
const received = [], errors = [];
parser.on('data', value => received.push(value));
parser.on('error', error => errors.push(error));
return {parser, received, errors};
}
const opening = '<message xmlns="jabber:client"><body>';
const closing = '</body></message>';
const split = harness();
split.parser.write(opening);
for (let i = 0; i < 16; i++) split.parser.write('a'.repeat(4096));
await tick();
assert.equal(split.errors.length, 0);
assert.equal(split.received.length, 0);
assert.equal(split.parser.destroyed, false);
split.parser.write(closing);
await tick();
assert.equal(split.errors.length, 0);
assert.equal(split.received.length, 1);
assert.equal(split.received[0].stanza.body.length, 65536);
split.parser.destroy();
console.log('stock: 18 separate writes reassembled into one 65536-byte body; no error');
const large = harness();
large.parser.write(opening + 'b'.repeat(1048576) + closing);
await tick();
assert.equal(large.errors.length, 0);
assert.equal(large.received.length, 1);
assert.equal(large.received[0].stanza.body.length, 1048576);
large.parser.destroy();
console.log('stock: 1048576-byte body accepted; no error');
const deep = harness();
deep.parser.write('<message xmlns="jabber:client">' + '<x>'.repeat(256) +
'</x>'.repeat(256) + '</message>');
await tick();
assert.equal(deep.errors.length, 0);
assert.equal(deep.received.length, 1);
let element = deep.received[0].xml, depth = 0;
while (element.children[0]) {element = element.children[0]; depth++;}
assert.equal(depth, 256);
deep.parser.destroy();
console.log('stock: 256 nested child elements accepted; no error');
experiments/0002-xmpp-library/parser-validation/.npmrc
+3
View File
@@ -0,0 +1,3 @@
engine-strict=true
strict-ssl=true
registry=https://registry.npmjs.org/
experiments/0002-xmpp-library/parser-validation/LICENSE_INVENTORY.md
+16
View File
@@ -0,0 +1,16 @@
# Exact dependency license inventory
Inspected 2026-10-15. Node 24.21.0 / npm 11.19.0. Saxes tarball omits its license text: preserved upstream v6.0.0 LICENSE in licenses/saxes-6.0.0-LICENSE, retrieved via verified HTTPS. Other texts are shipped installed files. No advisory/provenance clearance is claimed.
| Package | Version | SPDX | License/notice source |
| --- | --- | --- | --- |
| @types/node | 22.20.5 | MIT | LICENSE |
| @types/punycode | 2.1.4 | MIT | LICENSE |
| @types/ws | 8.18.2 | MIT | LICENSE |
| punycode | 2.3.1 | MIT | LICENSE-MIT.txt |
| saxes | 6.0.0 | ISC | saxes-6.0.0-LICENSE |
| sdp | 3.2.2 | MIT | LICENSE |
| stanza | 12.22.1 | MIT | LICENSE.md, NOTICE.md |
| undici-types | 6.21.0 | MIT | LICENSE |
| ws | 8.22.0 | MIT | LICENSE |
| xmlchars | 2.2.0 | MIT | LICENSE |
experiments/0002-xmpp-library/parser-validation/README.md
+96
View File
@@ -0,0 +1,96 @@
# Bounded standalone XML ingress experiment (S00-018)
This fixture experiment uses real Stanza 12.22.1 Client dispatch, JXT.parse and
registry.import, preceded by saxes 6.0.0 XML 1.0 namespace-aware validation.
It adds a constructor to the public Client.transports registry and selects only
that transport via configuration. It does not use the stock persistent parser,
subclass private transport fields, intercept already imported events, or patch
vendor files. It is not a production transport or a library selection.
From project root, reuse the reviewed isolated Node runtime (macOS ARM64):
```sh
export PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH
npm ci --prefix experiments/0002-xmpp-library/parser-validation --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-parser-review-cache --fetch-retries=0 --fetch-timeout=15000
npm test --prefix experiments/0002-xmpp-library/parser-validation
python3 experiments/0002-xmpp-library/parser-validation/check-dependencies.py
node experiments/0002-xmpp-library/parser-probe/reproduce.mjs
```
The last command reproduces stock defects; exit 0 is NOT safe parsing.
The dependency checker also requires the original candidate already installed in
experiments/0002-xmpp-library/node_modules for byte comparison. It checks all 340
Stanza files and ten exact locked installed package licenses/integrities. The
saxes tarball omits LICENSE: the upstream v6.0.0 license is preserved locally,
with source https://raw.githubusercontent.com/lddubeau/saxes/v6.0.0/LICENSE.
## Enforcement order and local policy
1. Require primitive string. Reject Blob/ArrayBuffer/typed arrays before coercion.
2. Reject more than 4096 UTF-16 units without encoding; then reject more than
4096 UTF-8 bytes using TextEncoder. The temporary encoding buffer is bounded
by the unit check (at most 12288 bytes for any input); it is not an unbounded
copy. First character must be `<` as required by RFC 7395.
3. New saxes parser per message, fragment=false, xmlns=true, XML 1.0 forced,
no inherited namespace resolver. Throw on the first error; close() checks
document completion. No tree is built during this phase.
4. At opentagstart reject depth >8 (including root), elements >32, name >128
UTF-16 units. At attribute reject total attributes >16 (including xmlns),
name >128, decoded value >256, or aggregate decoded attribute name+value
units >1024. Checks occur before JXT tree construction/import. Saxes has
already stored one completed attribute at its callback; lexical tokens,
namespace tables and DTD buffers before callbacks are bounded by 4096 input
bytes. No claim of allocation-free SAX processing is made.
5. Reject DTDs, comments, processing instructions and XML declarations. Only
built-in/numeric entities are available; no DTD fetching/entity expansion is
enabled. CDATA is accepted. Declaration rejection is local conservative
policy; RFC 7395 discourages but does not forbid declarations.
6. Only after complete validation call real JXT.parse and registry.import. An
unknown top-level root or candidate parser/import error closes the attempt.
Parsed output is delivered through Client stream:data only after import
succeeds. No invalid document's earlier root is emitted.
7. On rejection close the socket, detach all four callbacks, clear config and
stream references before emitting a payload-free error code. Every old
captured callback checks the terminal flag. Parsers/trees are synchronous
function locals, never retained between messages. A fresh Client.connect
creates another transport; restart on a failed transport cannot revive it.
The combined boundary fixture hits 4096 bytes, depth 8, 32 elements,
16 attributes and 1024 attribute units simultaneously and imports a real body.
Separate tests cover name/value equality, multibyte byte equality, one-over
bounds, stock 1 MiB/depth-256/18-message cases, malformed tails, incomplete XML,
binary, duplicate attributes/namespaces/entities/invalid characters, callback
replay, fresh connect, stream open/close/restart and outgoing registry export.
Tracing registry.import calls the real implementation; it never fakes success.
FixtureSocket replaces only browser socket effects; tests use actual Client
connect/transport selection and stanza queue events.
## Constraints
The default socket constructor is globalThis.WebSocket; browser use requires a
CommonJS-capable bundler for Stanza/saxes/xmlchars, native WebSocket, URL and
TextEncoder plus support for private class fields. The injected fixture socket
is explicitly separate and never chosen by the default path. Only explicit
wss URLs and the xmpp subprotocol are allowed. TLS/CORS/binding are unchanged;
no real WSS handshake is exercised here. Browser build/runtime and selected
browser versions are NOT verified. Node tests run 24.21.0/npm 11.19.0.
Limits protect application parsing after the browser delivers a complete message.
They cannot prevent the browser/network stack from allocating a huge inbound
message, nor bound total traffic, Client queue growth, CPU rate, reconnect
policy or downstream extension work. Those need separate product/provider
policies. The experiment closes locally on violations rather than implementing
full XMPP stream-error reporting/close negotiation/redirect/keepalive behavior.
It does not enforce complete XMPP stream sequencing or preserve inherited stream
language. JXT interpretation/normalization is retained; SAX and JXT equivalence
for all accepted XML forms is not established. No auth/crypto changes, complete
NET-003 policy, OMEMO, independent server/client interoperability, exhaustion
benchmark, advisory/provenance audit, or release acceptance is claimed.
All ten package license texts/notices are in THIRD_PARTY_NOTICES.md and exact
versions in LICENSE_INVENTORY.md/package-lock.json. Saxes is a mature existing
strict parser with documented XML/namespace conformance and public event APIs;
6.0.0 is an older release, and no ongoing-maintenance SLA is assumed. Its
absence of built-in token limits is why the mandatory byte precheck comes first.
See proposed docs/decisions/0002-xmpp-parser-validation.md. Independent security
review is required; S00-003 remains a separate assignment after reviewed done.
experiments/0002-xmpp-library/parser-validation/THIRD_PARTY_NOTICES.md
+637
View File
@@ -0,0 +1,637 @@
# Third-party notices
Verbatim license/notice texts for this isolated experiment.
## @types/node 22.20.5 — LICENSE
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
## @types/punycode 2.1.4 — LICENSE
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
## @types/ws 8.18.2 — LICENSE
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
## punycode 2.3.1 — LICENSE-MIT.txt
Copyright Mathias Bynens <https://mathiasbynens.be/>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## saxes 6.0.0 — saxes-6.0.0-LICENSE
The ISC License
Copyright (c) Contributors
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
====
The following license is the one that governed sax, from which saxes
was forked. Isaac Schlueter is not *directly* involved with saxes so
don't go bugging him for saxes issues.
The ISC License
Copyright (c) Isaac Z. Schlueter and Contributors
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
====
`String.fromCodePoint` by Mathias Bynens is no longer used, but it can
still be found in old commits. It was once used according to terms of
MIT License, as follows:
Copyright Mathias Bynens <https://mathiasbynens.be/>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## sdp 3.2.2 — LICENSE
Copyright (c) 2017 Philipp Hancke
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## stanza 12.22.1 — LICENSE.md
The MIT License (MIT)
Copyright © 2013-2019 Lance Stout
Copyright © 2013-2019 &yet <https://andyet.com>
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## stanza 12.22.1 — NOTICE.md
# StanzaJS
Copyright © 2013-2019 Lance Stout
Copyright © 2013-2019 &yet <https://andyet.com>
Portions of this code were adapted from existing projects:
## SASL
- saslmechanisms
- sasl-anonymous
- sasl-digest-md5
- sasl-external
- sasl-plain
- sasl-x-oauth2
(The MIT License)
Copyright © 2012-2013 Jared Hanson
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## ltx
Copyright © 2010 Stephan Maka
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
## xhtml-im.js
The MIT License (MIT)
Copyright © 2013 Waqas Hussain
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## wildemitter
The MIT License (MIT)
Copyright © 2012 Henrik Joreteg
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## hash-base
The MIT License (MIT)
Copyright (c) 2016 Kirill Fomichev
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
## cipher-base
The MIT License (MIT)
Copyright (c) 2017 crypto-browserify contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## sha.js
Copyright (c) 2013-2018 sha.js contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
Copyright (c) 1998 - 2009, Paul Johnston & Contributors
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
Redistributions in binary form must reproduce the above copyright notice, this
list of conditions and the following disclaimer in the documentation and/or
other materials provided with the distribution.
Neither the name of the author nor the names of its contributors may be used to
endorse or promote products derived from this software without specific prior
written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
## md5.js
The MIT License (MIT)
Copyright (c) 2016 Kirill Fomichev
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.
## create-hash
The MIT License (MIT)
Copyright (c) 2017 crypto-browserify contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## create-hmac
The MIT License (MIT)
Copyright (c) 2017 crypto-browserify contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## randombytes
MIT License
Copyright (c) 2017 crypto-browserify
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## uuid
The MIT License (MIT)
Copyright (c) 2010-2016 Robert Kieffer and other contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## strict-event-emitter-types
ISC License (ISC)
Copyright 2018 Brian Terlson
Permission to use, copy, modify, and/or distribute this software for any purpose
with or without fee is hereby granted, provided that the above copyright notice
and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
THIS SOFTWARE.
## capsdb
capsdb - A collection of XMPP caps with hashes
Written in 2015 by Thijs Alkemade me@thijsalkema.de
To the extent possible under law, the author(s) have dedicated all copyright and
related and neighboring rights to this software to the public domain worldwide.
This software is distributed without any warranty.
You should have received a copy of the CC0 Public Domain Dedication along with
this software. If not, see http://creativecommons.org/publicdomain/zero/1.0/.
## undici-types 6.21.0 — LICENSE
MIT License
Copyright (c) Matteo Collina and Undici contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## ws 8.22.0 — LICENSE
Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
Copyright (c) 2013 Arnout Kazemier and contributors
Copyright (c) 2016 Luigi Pinca and contributors
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
## xmlchars 2.2.0 — LICENSE
Copyright Louis-Dominique Dubeau and contributors to xmlchars
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
experiments/0002-xmpp-library/parser-validation/bounded-ingress.mjs
+146
View File
@@ -0,0 +1,146 @@
import {SaxesParser} from 'saxes';
import jxt from 'stanza/jxt/index.js';
// Experiment policy only. The byte ceiling bounds SAX token/namespace storage
// even before callbacks can inspect a completed name or attribute value.
export const LIMITS = Object.freeze({bytes: 4096, depth: 8, elements: 32,
attributes: 16, attributeChars: 1024, nameChars: 128, valueChars: 256});
class IngressError extends Error {
constructor(code) { super(code); this.code = code; }
}
const fail = code => { throw new IngressError(code); };
export function validateMessage(data) {
if (typeof data !== 'string') fail('text-required');
// Avoid encoding an attacker-sized string. UTF-8 bytes >= UTF-16 units for
// valid XML; isolated surrogates are subsequently rejected by saxes.
if (data.length > LIMITS.bytes) fail('bytes');
if (new TextEncoder().encode(data).length > LIMITS.bytes) fail('bytes');
if (!data.startsWith('<')) fail('framing');
let depth = 0, elements = 0, attributes = 0, attributeChars = 0, ended = false;
const parser = new SaxesParser({xmlns: true, fragment: false,
defaultXMLVersion: '1.0', forceXMLVersion: true});
parser.on('error', () => fail('invalid-xml'));
for (const event of ['doctype', 'comment', 'processinginstruction', 'xmldecl']) {
parser.on(event, () => fail('restricted-xml'));
}
parser.on('opentagstart', tag => {
if (++depth > LIMITS.depth) fail('depth');
if (++elements > LIMITS.elements) fail('elements');
if (tag.name.length > LIMITS.nameChars) fail('name');
});
parser.on('attribute', attr => {
if (++attributes > LIMITS.attributes) fail('attributes');
if (attr.name.length > LIMITS.nameChars) fail('name');
if (attr.value.length > LIMITS.valueChars) fail('attribute-value');
attributeChars += attr.name.length + attr.value.length;
if (attributeChars > LIMITS.attributeChars) fail('attribute-chars');
});
parser.on('closetag', () => { depth--; });
parser.on('end', () => { ended = true; });
// close() detects unfinished XML. Throwing from callbacks aborts immediately;
// there is no recovery listener, DTD fetch, custom entity or tree construction.
parser.write(data).close();
if (!ended || depth !== 0 || elements === 0) fail('framing');
}
export function importMessage(data, registry, config) {
validateMessage(data);
// Only bounded, complete documents reach the actual candidate parser/import.
const xml = jxt.parse(data, {allowComments: false});
if (!xml) fail('invalid-xml');
const kind = registry.getImportKey(xml);
const stanza = registry.import(xml, {lang: config.lang,
acceptLanguages: config.acceptLanguages});
if (!kind || !stanza) fail('unknown-root');
return {kind, stanza};
}
// Public Transport interface and Client.transports constructor registry.
// Socket injection is solely for finite fixtures; default is browser WebSocket.
export function installBoundedTransport(client, Socket = globalThis.WebSocket) {
class BoundedTransport {
#client; #registry; #sm; #socket; #config; #closed = true;
hasStream = false;
stream;
constructor(agent, sm, registry) {
this.#client = agent; this.#sm = sm; this.#registry = registry;
}
connect(config) {
if (this.#socket || !this.#closed) throw new Error('Fresh transport required');
if (new URL(config.url).protocol !== 'wss:') throw new Error('WSS required');
this.#config = config;
this.#closed = false;
const socket = this.#socket = new Socket(config.url, 'xmpp');
socket.onopen = () => {
if (this.#closed) return;
if (socket.protocol !== 'xmpp') return this.#reject('subprotocol');
this.#sm.started = false;
this.#client.emit('connected');
this.restart();
};
socket.onmessage = event => {
if (this.#closed) return;
let parsed;
try { parsed = importMessage(event.data, this.#registry, this.#config); }
catch (error) { return this.#reject(error instanceof IngressError ? error.code : 'invalid-xml'); }
// No raw payload event/log or async parser continuation escapes ingress.
if (parsed.kind === 'stream') {
if (parsed.stanza.action === 'open') {
this.hasStream = true;
this.stream = parsed.stanza;
this.#client.emit('stream:start', parsed.stanza);
} else {
this.#client.emit('stream:end');
this.disconnect(false);
}
} else {
this.#client.emit('stream:data', parsed.stanza, parsed.kind);
}
};
socket.onerror = () => this.#reject('socket-error');
socket.onclose = () => this.disconnect(false);
}
#reject(code) {
if (this.#closed) return;
// Close/clear before notifying consumers; a reentrant callback cannot
// revive the attempt. Never expose parser error text containing input.
this.disconnect(false);
this.#client.emit('ingress:rejected', code);
}
disconnect(clean = true) {
if (this.#closed) return;
this.#closed = true;
const socket = this.#socket;
this.#socket = undefined;
if (socket) {
socket.onopen = socket.onmessage = socket.onerror = socket.onclose = null;
if (clean && this.hasStream && socket.readyState === 1) {
socket.send(this.#registry.export('stream', {action: 'close'}).toString());
}
socket.close();
}
this.hasStream = false;
this.stream = undefined;
this.#config = undefined;
if (this.#client.transport === this) this.#client.emit('--transport-disconnected');
}
restart() {
if (this.#closed) return;
this.hasStream = false;
this.stream = undefined;
this.#write(this.#registry.export('stream', {action: 'open',
lang: this.#config.lang, to: this.#config.server, version: '1.0'}).toString());
}
#write(data) {
if (this.#closed || this.#socket?.readyState !== 1) throw new Error('Socket closed');
this.#socket.send(data);
}
async send(name, data) {
const xml = this.#registry.export(name, data);
if (!xml) throw new Error('Unknown outgoing stanza');
this.#write(xml.toString());
}
}
client.transports['bounded-websocket'] = BoundedTransport;
}
experiments/0002-xmpp-library/parser-validation/check-dependencies.py
+42
View File
@@ -0,0 +1,42 @@
"""Check exact installed graph, preserved notices, and unchanged candidate files."""
import hashlib
import json
from pathlib import Path
root = Path(__file__).resolve().parent
lock = json.loads((root / 'package-lock.json').read_text())
manifest = json.loads((root / 'package.json').read_text())
assert manifest['engines'] == {'node': '24.21.0', 'npm': '11.19.0'}
assert manifest['dependencies'] == {'saxes': '6.0.0', 'stanza': '12.22.1', 'xmlchars': '2.2.0'}
notices = (root / 'THIRD_PARTY_NOTICES.md').read_text()
inventory = (root / 'LICENSE_INVENTORY.md').read_text()
count = 0
for key, entry in lock['packages'].items():
if not key:
continue
count += 1
assert entry['resolved'].startswith('https://registry.npmjs.org/')
assert entry['integrity'].startswith('sha512-')
installed = root / key
meta = json.loads((installed / 'package.json').read_text())
assert meta['version'] == entry['version']
assert meta['license'] == entry['license']
assert f"| {meta['name']} | {meta['version']} | {meta['license']} |" in inventory
files = [p for p in installed.iterdir() if p.is_file() and
(p.name.lower().startswith('license') or p.name.lower().startswith('notice'))]
if meta['name'] == 'saxes':
files = [root / 'licenses/saxes-6.0.0-LICENSE']
assert files
for path in files:
assert path.read_text().strip() in notices
assert count == 10
# Independent previously installed candidate; no ignored vendor patches.
candidate = root / 'node_modules/stanza'
original = root.parent / 'node_modules/stanza'
files = [p for p in candidate.rglob('*') if p.is_file()]
assert files
for path in files:
assert path.read_bytes() == (original / path.relative_to(candidate)).read_bytes(), path
print(f'{count} exact dependency licenses/integrities; {len(files)} unchanged Stanza files')
for name in ['package-lock.json', 'bounded-ingress.mjs', 'licenses/saxes-6.0.0-LICENSE']:
print(f'{name} SHA256 {hashlib.sha256((root / name).read_bytes()).hexdigest()}')
experiments/0002-xmpp-library/parser-validation/licenses/saxes-6.0.0-LICENSE
+64
View File
@@ -0,0 +1,64 @@
The ISC License
Copyright (c) Contributors
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
====
The following license is the one that governed sax, from which saxes
was forked. Isaac Schlueter is not *directly* involved with saxes so
don't go bugging him for saxes issues.
The ISC License
Copyright (c) Isaac Z. Schlueter and Contributors
Permission to use, copy, modify, and/or distribute this software for any
purpose with or without fee is hereby granted, provided that the above
copyright notice and this permission notice appear in all copies.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
====
`String.fromCodePoint` by Mathias Bynens is no longer used, but it can
still be found in old commits. It was once used according to terms of
MIT License, as follows:
Copyright Mathias Bynens <https://mathiasbynens.be/>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
experiments/0002-xmpp-library/parser-validation/package-lock.json
Generated
+119
View File
@@ -0,0 +1,119 @@
{
"name": "luma-bounded-xml-ingress-experiment",
"version": "0.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "luma-bounded-xml-ingress-experiment",
"version": "0.0.0",
"dependencies": {
"saxes": "6.0.0",
"stanza": "12.22.1",
"xmlchars": "2.2.0"
},
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
}
},
"node_modules/@types/node": {
"version": "22.20.5",
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
"license": "MIT",
"dependencies": {
"undici-types": "~6.21.0"
}
},
"node_modules/@types/punycode": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
"license": "MIT"
},
"node_modules/@types/ws": {
"version": "8.18.2",
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
"license": "MIT",
"dependencies": {
"@types/node": "*"
}
},
"node_modules/punycode": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
"license": "MIT",
"engines": {
"node": ">=6"
}
},
"node_modules/saxes": {
"version": "6.0.0",
"resolved": "https://registry.npmjs.org/saxes/-/saxes-6.0.0.tgz",
"integrity": "sha512-xAg7SOnEhrm5zI3puOOKyy1OMcMlIJZYNJY7xLBwSze0UjhPLnWfj2GF2EpT0jmzaJKIWKHLsaSSajf35bcYnA==",
"license": "ISC",
"dependencies": {
"xmlchars": "^2.2.0"
},
"engines": {
"node": ">=v12.22.7"
}
},
"node_modules/sdp": {
"version": "3.2.2",
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
"license": "MIT"
},
"node_modules/stanza": {
"version": "12.22.1",
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
"license": "MIT",
"dependencies": {
"@types/node": "^22.0.0",
"@types/punycode": "^2.1.0",
"@types/ws": "^8.18.1",
"punycode": "^2.1.1",
"sdp": "^3.0.2",
"ws": "^8.18.2"
}
},
"node_modules/undici-types": {
"version": "6.21.0",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
"license": "MIT"
},
"node_modules/ws": {
"version": "8.22.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
},
"peerDependencies": {
"bufferutil": "^4.0.1",
"utf-8-validate": ">=5.0.2"
},
"peerDependenciesMeta": {
"bufferutil": {
"optional": true
},
"utf-8-validate": {
"optional": true
}
}
},
"node_modules/xmlchars": {
"version": "2.2.0",
"resolved": "https://registry.npmjs.org/xmlchars/-/xmlchars-2.2.0.tgz",
"integrity": "sha512-JZnDKK8B0RCDw84FNdDAIpZK+JuJw+s7Lz8nksI7SIuU3UXJJslUthsi+uWBUYOwPFwW7W7PRLRfUKpxjtjFCw==",
"license": "MIT"
}
}
}
experiments/0002-xmpp-library/parser-validation/package.json
+10
View File
@@ -0,0 +1,10 @@
{
"name": "luma-bounded-xml-ingress-experiment",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {"node": "24.21.0", "npm": "11.19.0"},
"packageManager": "npm@11.19.0",
"scripts": {"test": "node --test test/*.test.mjs"},
"dependencies": {"saxes": "6.0.0", "stanza": "12.22.1", "xmlchars": "2.2.0"}
}
experiments/0002-xmpp-library/parser-validation/test/fixtures.mjs
+68
View File
@@ -0,0 +1,68 @@
export const opening = '<message xmlns="jabber:client"><body>';
export const closing = '</body></message>';
export const message = text => opening + text + closing;
export const valid = message('finite fixture');
export const deep = n => '<message xmlns="jabber:client">' + '<x>'.repeat(n - 1) +
'</x>'.repeat(n - 1) + '</message>';
export const elements = n => '<message xmlns="jabber:client">' + '<x/>'.repeat(n - 1) + '</message>';
export const attributes = n => '<message xmlns="jabber:client"' +
Array.from({length: n - 1}, (_, i) => ` a${i}="x"`).join('') + '/>';
export function boundary() {
// 16 attributes / 1024 name+value UTF-16 units including xmlns.
let attrs = ' xmlns="jabber:client"';
let chars = 'xmlns'.length + 'jabber:client'.length;
for (let i = 0; i < 15; i++) {
const name = `a${i}`;
const value = 'v'.repeat(i === 14 ? 1024 - chars - name.length : 60);
attrs += ` ${name}="${value}"`;
chars += name.length + value.length;
}
// Root + body + chain of 7 + 23 siblings = 32 elements; depth 8.
const before = `<message${attrs}><body>`;
const after = '</body>' + '<x>'.repeat(7) + '</x>'.repeat(7) + '<x/>'.repeat(23) + '</message>';
return {xml: before + 'z'.repeat(4096 - before.length - after.length) + after,
body: 'z'.repeat(4096 - before.length - after.length)};
}
export const invalid = [
['large stock body', message('b'.repeat(1048576)), 'bytes'],
['deep stock XML', deep(257), 'depth'],
['unfinished opening', opening, 'invalid-xml'],
['unfinished attribute', '<message xmlns="jabber:client" a="unfinished', 'invalid-xml'],
['unfinished tag', '<message xmlns="jabber:client"', 'invalid-xml'],
['unfinished entity', message('&amp'), 'invalid-xml'],
['empty', '', 'framing'],
['leading whitespace', ' ' + valid, 'framing'],
['text only', 'not xml', 'framing'],
['two roots', valid + valid, 'invalid-xml'],
['valid root then unfinished root', valid + '<message', 'invalid-xml'],
['valid root then junk', valid + 'junk', 'invalid-xml'],
['mismatched tags', '<message xmlns="jabber:client"><body></message>', 'invalid-xml'],
['depth over', deep(9), 'depth'],
['elements over', elements(33), 'elements'],
['attributes over', attributes(17), 'attributes'],
['attribute value over', `<message xmlns="jabber:client" a="${'x'.repeat(257)}"/>`, 'attribute-value'],
['attribute chars over', '<message xmlns="jabber:client" ' +
Array.from({length: 4}, (_, i) => `a${i}="${'x'.repeat(256)}"`).join(' ') + '/>', 'attribute-chars'],
['oversized name', `<message xmlns="jabber:client"><${'x'.repeat(129)}/></message>`, 'name'],
['oversized attribute name', `<message xmlns="jabber:client" ${'x'.repeat(129)}="x"/>`, 'name'],
['oversized unfinished token', '<' + 'x'.repeat(4096), 'bytes'],
['UTF-8 bytes over with bounded units', message('🦉'.repeat(1100)), 'bytes'],
['binary buffer', new Uint8Array([60, 120, 47, 62]), 'text-required'],
['binary ArrayBuffer', new ArrayBuffer(4), 'text-required'],
['binary Blob', new Blob([valid]), 'text-required'],
['boxed string', new String(valid), 'text-required'],
['comment', '<!--x-->' + valid, 'restricted-xml'],
['DTD internal entity', '<!DOCTYPE message [<!ENTITY x "payload">]>' + message('&x;'), 'restricted-xml'],
['external DTD', '<!DOCTYPE message SYSTEM "https://example.invalid/dtd">' + valid, 'restricted-xml'],
['processing instruction', '<?test x?>' + valid, 'restricted-xml'],
['XML declaration', '<?xml version="1.0"?>' + valid, 'restricted-xml'],
['duplicate attribute', '<message xmlns="jabber:client" id="a" id="b"/>', 'invalid-xml'],
['duplicate expanded attribute', '<message xmlns="jabber:client" xmlns:a="urn:x" xmlns:b="urn:x" a:id="a" b:id="b"/>', 'invalid-xml'],
['unbound namespace', '<p:message/>', 'invalid-xml'],
['illegal namespace binding', '<message xmlns="jabber:client" xmlns:xml="urn:wrong"/>', 'invalid-xml'],
['unknown entity', message('&unknown;'), 'invalid-xml'],
['illegal control', message('\u0000'), 'invalid-xml'],
['unpaired surrogate', message('\ud800'), 'invalid-xml'],
['invalid char reference', message('&#0;'), 'invalid-xml'],
['unknown root', '<unknown xmlns="urn:fixture"/>', 'unknown-root']
];
experiments/0002-xmpp-library/parser-validation/test/integration.test.mjs
+151
View File
@@ -0,0 +1,151 @@
import assert from 'node:assert/strict';
import {test} from 'node:test';
import clientModule from 'stanza/Client.js';
import {installBoundedTransport, validateMessage, LIMITS} from '../bounded-ingress.mjs';
import {opening, closing, message, valid, deep, elements, attributes, boundary, invalid} from './fixtures.mjs';
const Client = clientModule.default;
const tick = () => new Promise(resolve => setImmediate(resolve));
async function harness() {
const sockets = [];
class FixtureSocket {
readyState = 1; protocol = 'xmpp'; sent = []; closes = 0;
constructor(url, protocol) { this.url = url; this.requestedProtocol = protocol; sockets.push(this); }
send(data) { this.sent.push(data); }
close() { this.closes++; this.readyState = 3; }
}
const client = new Client({autoReconnect: false, server: 'example.invalid'});
installBoundedTransport(client, FixtureSocket);
client.updateConfig({transports: {'bounded-websocket': 'wss://example.invalid/xmpp'},
transportPreferenceOrder: ['bounded-websocket']});
const received = [], errors = [], raw = [], stanzas = [], starts = [];
client.on('stream:data', (stanza, kind) => received.push({stanza, kind}));
client.on('stanza', stanza => stanzas.push(stanza));
client.on('stream:start', stanza => starts.push(stanza));
client.on('ingress:rejected', code => errors.push(code));
client.on('raw', (...args) => raw.push(args));
// Tracing calls the real registry.import; proves rejection before import.
let imports = 0;
const original = client.stanzas.import.bind(client.stanzas);
client.stanzas.import = (...args) => { imports++; return original(...args); };
await client.connect();
const socket = sockets.at(-1);
socket.onopen();
return {client, sockets, socket, received, errors, raw, stanzas, starts,
imports: () => imports, finish: async () => {client.transport?.disconnect(false); await tick();}};
}
for (const [name, xml, code] of invalid) {
test(`terminal rejection: ${name}`, async () => {
const h = await harness();
const late = h.socket.onmessage;
late({data: xml});
assert.deepEqual(h.errors, [code]);
assert.equal(h.socket.closes, 1);
assert.equal(h.socket.onmessage, null);
assert.equal(h.received.length, 0);
assert.equal(h.starts.length, 0);
if (code !== 'unknown-root') assert.equal(h.imports(), 0);
// Old captured handlers and subsequent messages cannot revive an attempt.
late({data: closing}); late({data: valid});
await tick();
assert.equal(h.stanzas.length, 0);
assert.equal(h.received.length, 0);
assert.deepEqual(h.errors, [code]);
assert.equal(h.client.transport, undefined);
assert.equal(h.raw.length, 0);
await h.finish();
});
}
for (const [name, xml, body] of [
['all aggregate limits equal', boundary().xml, boundary().body],
['depth equal', deep(LIMITS.depth)],
['element count equal', elements(LIMITS.elements)],
['attribute count equal', attributes(LIMITS.attributes)],
['attribute value equal', `<message xmlns="jabber:client" a="${'v'.repeat(256)}"/>`],
['name equal', `<message xmlns="jabber:client"><${'x'.repeat(128)}/></message>`],
['UTF-8 byte equality', message('🦉'.repeat(1000) + 'a'.repeat(4096 - message('').length - 4000)), '🦉'.repeat(1000) + 'a'.repeat(4096 - message('').length - 4000)],
['escaped text and CDATA', message('&lt;&amp;<![CDATA[<fixture>]]>'), '<&<fixture>'],
['prefixed namespace', '<c:message xmlns:c="jabber:client"><c:body>namespace</c:body></c:message>', 'namespace']
]) {
test(`actual parser/import accepts ${name}`, async () => {
const h = await harness();
h.socket.onmessage({data: xml});
await tick();
assert.deepEqual(h.errors, []);
assert.equal(h.received.length, 1);
assert.equal(h.received[0].kind, 'message');
if (body !== undefined) assert.equal(h.received[0].stanza.body, body);
assert.equal(h.stanzas.length, 1);
assert.ok(h.imports() > 0);
await h.finish();
});
}
test('bytes one over and UTF-8 one over reject before import', async () => {
for (const xml of [boundary().xml + ' ', message('🦉'.repeat(1000) + 'a'.repeat(4097 - message('').length - 4000))]) {
const h = await harness(); h.socket.onmessage({data: xml});
assert.deepEqual(h.errors, ['bytes']); assert.equal(h.imports(), 0);
await h.finish();
}
});
test('stock 18-message partial document never accumulates or revives; fresh connect works', async () => {
const h = await harness(); const old = h.socket.onmessage;
old({data: opening});
for (let i = 0; i < 16; i++) old({data: 'a'.repeat(4096)});
old({data: closing});
await tick();
assert.equal(h.received.length, 0); assert.equal(h.imports(), 0);
assert.deepEqual(h.errors, ['invalid-xml']);
await h.client.connect(); const fresh = h.sockets.at(-1); fresh.onopen();
old({data: valid}); assert.equal(h.received.length, 0);
fresh.onmessage({data: valid}); await tick();
assert.equal(h.received.length, 1); assert.equal(h.stanzas.length, 1);
assert.equal(h.received[0].stanza.body, 'finite fixture');
await h.finish();
});
test('successive complete documents have no shared namespace/parser state', async () => {
const h = await harness();
h.socket.onmessage({data: valid}); h.socket.onmessage({data: valid}); await tick();
assert.equal(h.stanzas.length, 2);
h.socket.onmessage({data: '<c:message/>'}); await tick();
assert.deepEqual(h.errors, ['invalid-xml']); assert.equal(h.stanzas.length, 2);
await h.finish();
});
test('open, restart, message, outgoing export and close use actual registry', async () => {
const h = await harness();
h.socket.onmessage({data: '<open xmlns="urn:ietf:params:xml:ns:xmpp-framing" from="example.invalid" version="1.0"/>'});
assert.equal(h.client.transport.hasStream, true); assert.equal(h.starts.length, 1);
h.client.transport.restart(); assert.equal(h.client.transport.hasStream, false);
await h.client.transport.send('message', {body: 'outgoing fixture'});
assert.ok(h.socket.sent.at(-1).includes('outgoing fixture'));
h.socket.onmessage({data: '<close xmlns="urn:ietf:params:xml:ns:xmpp-framing"/>'});
await tick(); assert.equal(h.socket.closes, 1); assert.equal(h.client.transport, undefined);
assert.equal(h.errors.length, 0);
await h.finish();
});
test('failed subprotocol, socket error, clean disconnect and stale callbacks are terminal', async () => {
for (const mode of ['subprotocol', 'error', 'clean']) {
const h = await harness(); const old = h.socket.onmessage;
if (mode === 'subprotocol') {h.socket.protocol = 'wrong'; h.socket.onopen();}
if (mode === 'error') h.socket.onerror(new Error('fixture'));
if (mode === 'clean') {
h.socket.onmessage({data: '<open xmlns="urn:ietf:params:xml:ns:xmpp-framing"/>'});
h.client.transport.disconnect(); assert.ok(h.socket.sent.at(-1).includes('close'));
}
old({data: valid}); await tick();
assert.equal(h.received.length, 0); assert.equal(h.socket.closes, 1);
await h.finish();
}
});
test('SAX framing validation retains no attempt object', () => {
assert.throws(() => validateMessage(opening));
assert.throws(() => validateMessage(closing));
assert.doesNotThrow(() => validateMessage(valid));
});
experiments/0002-xmpp-library/sasl-validation/.npmrc
+3
View File
@@ -0,0 +1,3 @@
engine-strict=true
strict-ssl=true
registry=https://registry.npmjs.org/
experiments/0002-xmpp-library/sasl-validation/.nvmrc
+1
View File
@@ -0,0 +1 @@
24.21.0
experiments/0002-xmpp-library/sasl-validation/LICENSE_INVENTORY.md
+14
View File
@@ -0,0 +1,14 @@
# Locked license inventory
Exact installed graph for the isolated Node experiment; no release/browser clearance.
| Package | Version | License |
| --- | --- | --- |
| @types/node | 22.20.5 | MIT |
| @types/punycode | 2.1.4 | MIT |
| @types/ws | 8.18.2 | MIT |
| punycode | 2.3.1 | MIT |
| sdp | 3.2.2 | MIT |
| stanza | 12.22.1 | MIT |
| undici-types | 6.21.0 | MIT |
| ws | 8.22.0 | MIT |
experiments/0002-xmpp-library/sasl-validation/README.md
+76
View File
@@ -0,0 +1,76 @@
# SCRAM server-final validation experiment
S00-017 fixture-only remediation of S00-003. No network connection or production
adapter. Public RFC example credentials are used only in memory. Requires the
accepted Node 24.21.0 / npm 11.19.0 runtime; installs enforce exact engines and TLS.
From the project root, use the isolated runtime already verified by S00-002:
```sh
export PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH
node --version
npm --version
npm ci --prefix experiments/0002-xmpp-library/sasl-validation --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-sasl-review-cache --fetch-retries=0 --fetch-timeout=15000
npm test --prefix experiments/0002-xmpp-library/sasl-validation
```
On another host, obtain the official exact Node runtime with verified HTTPS and
checksum; do not change system configuration or disable certificates. Use a fresh
cache directory for an independent clean-install check. The original parent
experiment manifest remains incomplete and is not used by these commands.
The 44 tests use Stanza's actual Client, XML parse/registry, named SASL feature
handler, feature negotiation dispatcher and SCRAM implementation. Outgoing sends,
restart and disconnect are captured fixture effects, not server evidence. Tests
first reproduce stock 12.22.1 accepting missing/forged premature success, then
verify rejection with the replacement. RFC 5802 §5 / RFC 7677 §3 client-first,
client-proof and verified server-final are checked byte-for-byte for SHA-1/256.
No real credentials or key material are printed. A passing stock reproduction
means the defect was observed, not safe authentication.
`validated-sasl.mjs` installs through the public plugin and feature APIs:
```js
// Illustrative integration for a fresh Client, BEFORE any connect/features.
client.use(validatedSasl);
```
The plugin calls `registerFeature('sasl', 100, handler)`. Stanza's feature registry
uses one handler per name, so this replaces the stock callback. Registration also
adds another order entry; the real dispatcher exits on restart/disconnect, and
our integrated tests verify only one negotiation/completion, including after
reset. Do not install after authentication has started or alongside another SASL
replacement. The stock handler must never have an active event listener.
State is bounded to initial credentials/send, server-first, proof send,
server-final and closed. Success is allowed only after completed proof send,
strict final syntax, `processSuccess` and `finalize` reporting both authenticated
and mutuallyAuthenticated. Invalid input disconnects once, removes listeners
and never requests authenticated restart. Reset closes the old attempt before
awaited work resumes. Crypto remains entirely in the installed library, backed
by Node crypto in this run; no hash, HMAC, KDF or proof implementation is authored.
No credential cache/update is persisted by the replacement.
This is a deliberately limited non-PLUS SHA-256/SHA-1 experiment. It rejects
other mechanisms, supplied TLS binding bytes, extensions, extra challenges and
server-final delivered separately as a challenge. It accepts only server-final
additional-data on success. It checks nonce extension and bounds decoded data
at 4096 bytes and iterations at 100000; these are experiment limits, not shared
contracts/product policy. Racing success before a send promise resolves is
rejected conservatively. A final timeout/lifecycle policy belongs to the original
integration; this experiment does not claim one.
Exact dependency graph and preserved licenses: LICENSE_INVENTORY.md and
THIRD_PARTY_NOTICES.md. All eight locked packages are MIT; lock entries retain
HTTPS registry URLs and SHA512 integrity. Node/npm notices stay with their runtime.
Security review must inspect the state transitions and actual library calls,
repeat clean install/tests, check the diff, licenses and executor evidence, then
approve/reject through the task workflow. No browser build/execution, live WSS,
independent server, parser resource-limit certification, TLS channel binding,
constant-time verification audit, advisory/provenance audit, production SASL
policy or release readiness is claimed. Stanza's verifier uses ordinary string
equality; these tests prove rejection correctness, not a timing guarantee.
Browser Stanza uses its bundled synchronous hash/HMAC code and browser RNG/WS;
that backend is not exercised here. S00-003 retains its library selection,
browser/WSS/parser/extension experiment and stronger-mechanism policy work.
experiments/0002-xmpp-library/sasl-validation/THIRD_PARTY_NOTICES.md
+208
View File
@@ -0,0 +1,208 @@
# Third-party notices
Installed package license texts, preserved for this experiment. Node/npm distribution notices remain with the isolated runtime.
## @types/node 22.20.5
```text
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
```
## @types/punycode 2.1.4
```text
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
```
## @types/ws 8.18.2
```text
MIT License
Copyright (c) Microsoft Corporation.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE
```
## punycode 2.3.1
```text
Copyright Mathias Bynens <https://mathiasbynens.be/>
Permission is hereby granted, free of charge, to any person obtaining
a copy of this software and associated documentation files (the
"Software"), to deal in the Software without restriction, including
without limitation the rights to use, copy, modify, merge, publish,
distribute, sublicense, and/or sell copies of the Software, and to
permit persons to whom the Software is furnished to do so, subject to
the following conditions:
The above copyright notice and this permission notice shall be
included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
```
## sdp 3.2.2
```text
Copyright (c) 2017 Philipp Hancke
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
```
## stanza 12.22.1
```text
The MIT License (MIT)
Copyright © 2013-2019 Lance Stout
Copyright © 2013-2019 &yet <https://andyet.com>
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
```
## undici-types 6.21.0
```text
MIT License
Copyright (c) Matteo Collina and Undici contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
```
## ws 8.22.0
```text
Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
Copyright (c) 2013 Arnout Kazemier and contributors
Copyright (c) 2016 Luigi Pinca and contributors
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
the Software, and to permit persons to whom the Software is furnished to do so,
subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
```
experiments/0002-xmpp-library/sasl-validation/package-lock.json
Generated
+99
View File
@@ -0,0 +1,99 @@
{
"name": "luma-scram-server-final-experiment",
"version": "0.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "luma-scram-server-final-experiment",
"version": "0.0.0",
"dependencies": {
"stanza": "12.22.1"
},
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
}
},
"node_modules/@types/node": {
"version": "22.20.5",
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
"license": "MIT",
"dependencies": {
"undici-types": "~6.21.0"
}
},
"node_modules/@types/punycode": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
"license": "MIT"
},
"node_modules/@types/ws": {
"version": "8.18.2",
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
"license": "MIT",
"dependencies": {
"@types/node": "*"
}
},
"node_modules/punycode": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
"license": "MIT",
"engines": {
"node": ">=6"
}
},
"node_modules/sdp": {
"version": "3.2.2",
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
"license": "MIT"
},
"node_modules/stanza": {
"version": "12.22.1",
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
"license": "MIT",
"dependencies": {
"@types/node": "^22.0.0",
"@types/punycode": "^2.1.0",
"@types/ws": "^8.18.1",
"punycode": "^2.1.1",
"sdp": "^3.0.2",
"ws": "^8.18.2"
}
},
"node_modules/undici-types": {
"version": "6.21.0",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
"license": "MIT"
},
"node_modules/ws": {
"version": "8.22.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
},
"peerDependencies": {
"bufferutil": "^4.0.1",
"utf-8-validate": ">=5.0.2"
},
"peerDependenciesMeta": {
"bufferutil": {
"optional": true
},
"utf-8-validate": {
"optional": true
}
}
}
}
}
experiments/0002-xmpp-library/sasl-validation/package.json
+10
View File
@@ -0,0 +1,10 @@
{
"name": "luma-scram-server-final-experiment",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {"node": "24.21.0", "npm": "11.19.0"},
"packageManager": "npm@11.19.0",
"scripts": {"test": "node --test test/*.test.mjs"},
"dependencies": {"stanza": "12.22.1"}
}
experiments/0002-xmpp-library/sasl-validation/test/fixtures.mjs
+19
View File
@@ -0,0 +1,19 @@
// Public RFC examples only. Not accounts, secrets, or network endpoints.
export const vectors = [
{
source: 'https://www.rfc-editor.org/rfc/rfc5802.html#section-5',
mechanism: 'SCRAM-SHA-1', username: 'user', password: 'pencil',
nonce: 'fyko+d2lbbFgONRv9qkxdawL',
first: 'r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,s=QSXCR+Q6sek8bf92,i=4096',
proof: 'c=biws,r=fyko+d2lbbFgONRv9qkxdawL3rfcNHYJY1ZVvWVs7j,p=v0X8v3Bz2T0CJGbJQyF0X+HI4Ts=',
final: 'v=rmF9pqV8S7suAoZWja4dJRkFsKQ='
},
{
source: 'https://www.rfc-editor.org/rfc/rfc7677.html#section-3',
mechanism: 'SCRAM-SHA-256', username: 'user', password: 'pencil',
nonce: 'rOprNGfwEbeRWgbNEkqO',
first: 'r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096',
proof: 'c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=dHzbZapWIk4jUhN+Ute9ytag9zjfMHgsqmmiz7AndVQ=',
final: 'v=6rriTRBi23WpRR/wtup+mMhUZUn/dB5nLTJRsjl95G4='
}
];
experiments/0002-xmpp-library/sasl-validation/test/integration.test.mjs
+277
View File
@@ -0,0 +1,277 @@
import assert from 'node:assert/strict';
import test from 'node:test';
import {createRequire} from 'node:module';
import validatedSasl from '../validated-sasl.mjs';
import {vectors} from './fixtures.mjs';
const require = createRequire(import.meta.url);
const Client = require('stanza/Client').default;
const {parse} = require('stanza/jxt');
const tick = () => new Promise(resolve => setImmediate(resolve));
const deferred = () => {
let resolve;
const promise = new Promise(r => {resolve = r;});
return {promise, resolve};
};
function harness(vector = vectors[1], fixed = true, mechanisms = [vector.mechanism]) {
const client = new Client({jid: 'user@example.invalid', autoReconnect: false,
credentials: {username: vector.username, password: vector.password, clientNonce: vector.nonce}});
const result = {sent: [], success: 0, failed: 0, restart: 0, disconnect: 0, verification: []};
// Capture fixture effects; use the real Client, XML registry, feature dispatcher,
// mechanism factory and SCRAM crypto. Never connect to a real provider.
client.send = async (kind, stanza) => {result.sent.push({kind, stanza});};
client.transport = {authenticated: false, restart: () => {result.restart++;}};
client.disconnect = async () => {result.disconnect++;};
client.on('auth:success', () => {result.success++;});
client.on('auth:failed', () => {result.failed++;});
if (fixed) {
client.use(validatedSasl);
const original = client.sasl.createMechanism.bind(client.sasl);
client.sasl.createMechanism = names => {
const mech = original(names);
if (mech) for (const method of ['processSuccess', 'finalize']) {
const fn = mech[method].bind(mech);
mech[method] = (...args) => {result.verification.push(method); return fn(...args);};
}
return mech;
};
}
const receive = async (type, value) => {
const body = value === undefined ? '' : Buffer.from(value).toString('base64');
const xml = parse(`<${type} xmlns="urn:ietf:params:xml:ns:xmpp-sasl">${body}</${type}>`);
const stanza = client.stanzas.import(xml);
assert.equal(stanza.type, type);
client.emit('sasl', stanza);
await tick();
};
const start = async () => {
client.emit('features', {sasl: {mechanisms}});
await tick();
};
return {client, result, receive, start};
}
function rejected(h) {
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.result.failed, 1);
assert.equal(h.result.disconnect, 1);
assert.equal(h.client.features.negotiated.sasl, false);
assert.equal(h.client.transport.authenticated, false);
assert.equal(h.client.listenerCount('sasl'), 0);
}
for (const vector of vectors) {
test(`${vector.mechanism}: RFC proof and verified final through feature dispatcher`, async () => {
const h = harness(vector);
await h.start();
assert.equal(h.result.sent[0].stanza.value.toString(), `n,,n=user,r=${vector.nonce}`);
await h.receive('challenge', vector.first);
assert.equal(h.result.sent[1].stanza.value.toString(), vector.proof);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.transport.authenticated, false);
await h.receive('success', vector.final);
assert.deepEqual(h.result.verification, ['processSuccess', 'finalize']);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
assert.equal(h.result.disconnect, 0);
assert.equal(h.client.features.negotiated.sasl, true);
assert.equal(h.client.transport.authenticated, true);
await h.receive('success', vector.final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
});
for (const [label, final] of [
['missing', undefined],
['forged', vector.final.replace(/v=./, 'v=A')],
['error', 'e=invalid-proof'],
['conflicting error', `${vector.final},e=invalid-proof`],
['duplicate verifier', `${vector.final},${vector.final}`],
['bad base64', 'v=***'],
['oversized', 'v=' + 'A'.repeat(4096)]
]) {
test(`${vector.mechanism}: reject ${label} server-final after proof`, async () => {
const h = harness(vector);
await h.start();
await h.receive('challenge', vector.first);
await h.receive('success', final);
rejected(h);
if (label === 'forged') assert.deepEqual(h.result.verification, ['processSuccess', 'finalize']);
await h.receive('success', vector.final);
rejected(h);
});
}
test(`${vector.mechanism}: reject valid-looking final before proof`, async () => {
const h = harness(vector);
await h.start();
await h.receive('success', vector.final);
rejected(h);
assert.deepEqual(h.result.verification, []);
});
}
for (const [label, final] of [['missing', undefined], ['forged', 'v=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=']]) {
test(`stock 12.22.1 reproduces ${label} premature acceptance`, async () => {
const h = harness(vectors[1], false);
await h.start();
await h.receive('success', final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
assert.equal(h.client.transport.authenticated, true);
});
test(`replacement rejects original ${label} premature defect`, async () => {
const h = harness();
await h.start();
await h.receive('success', final);
rejected(h);
});
}
for (const [label, first] of [
['wrong nonce', vectors[1].first.replace('r=rOpr', 'r=wrong')],
['unextended nonce', `r=${vectors[1].nonce},s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096`],
['iteration overflow', vectors[1].first.replace('i=4096', 'i=100001')],
['invalid iterations', vectors[1].first.replace('i=4096', 'i=NaN')],
['duplicate attribute', vectors[1].first + ',i=4096'],
['mandatory extension', 'm=required,' + vectors[1].first]
]) {
test(`reject ${label} before library proof work`, async () => {
const h = harness();
await h.start();
await h.receive('challenge', first);
rejected(h);
assert.equal(h.result.sent.length, 1);
});
}
test('reject success while proof send is pending; no late revival', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
await h.receive('success', vectors[1].final);
rejected(h);
pending.resolve();
await tick();
await h.receive('success', vectors[1].final);
rejected(h);
});
test('duplicate challenge while sending proof fails closed', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
await h.receive('challenge', vectors[1].first);
rejected(h);
pending.resolve();
await tick();
rejected(h);
});
test('reset while awaiting credentials prevents late auth and listener leak', async () => {
const h = harness();
const pending = deferred();
h.client.getCredentials = () => pending.promise;
await h.start();
h.client.emit('--reset-stream-features');
pending.resolve({username: 'user', password: 'pencil', clientNonce: vectors[1].nonce});
await tick();
await h.receive('success', vectors[1].final);
assert.equal(h.result.sent.length, 0);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
});
test('reset after proof, new negotiation succeeds without old handlers', async () => {
const h = harness();
await h.start();
await h.receive('challenge', vectors[1].first);
h.client.emit('--reset-stream-features');
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
await h.start();
assert.equal(h.client.listenerCount('sasl'), 1);
await h.receive('challenge', vectors[1].first);
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
});
test('fixture policy filters PLUS and plaintext; strongest available non-PLUS selected', async () => {
const h = harness(vectors[1], true, ['PLAIN', 'SCRAM-SHA-1', 'SCRAM-SHA-256-PLUS', 'SCRAM-SHA-256']);
await h.start();
assert.equal(h.result.sent[0].stanza.mechanism, 'SCRAM-SHA-256');
});
for (const names of [['PLAIN'], ['SCRAM-SHA-256-PLUS'], []]) {
test(`no allowed mechanism (${names.join(',')}) disconnects`, async () => {
const h = harness(vectors[1], true, names);
await h.start();
rejected(h);
assert.equal(h.result.sent.length, 0);
});
}
for (const type of ['failure', 'abort']) {
test(`${type} is terminal; valid final cannot revive it`, async () => {
const h = harness();
await h.start();
await h.receive(type);
await h.receive('success', vectors[1].final);
rejected(h);
});
}
test('success during pending initial credentials fails closed', async () => {
const h = harness();
const pending = deferred();
h.client.getCredentials = () => pending.promise;
await h.start();
await h.receive('success', vectors[1].final);
rejected(h);
pending.resolve({username: 'user', password: 'pencil', clientNonce: vectors[1].nonce});
await tick();
assert.equal(h.result.sent.length, 0);
rejected(h);
});
test('reset during proof send cancels continuation', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
h.client.emit('--reset-stream-features');
pending.resolve();
await tick();
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
});
for (const stage of ['credentials', 'initial send', 'proof send']) {
test(`${stage} rejection disconnects without success`, async () => {
const h = harness();
const reject = async () => {throw new Error('synthetic fixture failure');};
if (stage === 'credentials') h.client.getCredentials = reject;
if (stage === 'initial send') h.client.send = reject;
await h.start();
if (stage === 'proof send') {
h.client.send = reject;
await h.receive('challenge', vectors[1].first);
}
rejected(h);
});
}
test('repeat challenge after completed proof is rejected', async () => {
const h = harness();
await h.start();
await h.receive('challenge', vectors[1].first);
await h.receive('challenge', vectors[1].first);
rejected(h);
});
experiments/0002-xmpp-library/sasl-validation/validated-sasl.mjs
+108
View File
@@ -0,0 +1,108 @@
// Fixture-bound feature replacement. Cryptographic operations stay in Stanza SCRAM.
// No production transport, credential persistence, or channel binding is provided.
const SUPPORTED = new Set(['SCRAM-SHA-256', 'SCRAM-SHA-1']);
const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
function text(value) {
// SASL's parsed additional-data is a Buffer, not raw XML/base64 text.
if (!value || typeof value.toString !== 'function' || value.length > 4096) {
throw new Error('Invalid SASL data');
}
const result = value.toString('utf8');
if (!/^[\x21-\x7e]*$/.test(result)) throw new Error('Invalid SASL data');
return result;
}
function firstMessage(value, nonce) {
// Deliberately narrow, no extensions. Bound work before calling library crypto.
const match = /^r=([\x21-\x2b\x2d-\x7e]+),s=([A-Za-z0-9+/=]+),i=([1-9][0-9]*)$/.exec(text(value));
if (!match || !BASE64.test(match[2]) || !match[1].startsWith(nonce) ||
match[1].length <= nonce.length || Number(match[3]) > 100000) {
throw new Error('Invalid SCRAM server-first');
}
}
function finalMessage(value, name) {
const final = text(value);
const length = name === 'SCRAM-SHA-256' ? 44 : 28;
if (!final.startsWith('v=') || final.length !== length + 2 || !BASE64.test(final.slice(2))) {
throw new Error('Invalid SCRAM server-final');
}
}
export default function validatedSasl(client) {
let active;
// Public plugin + named feature registration replaces the stock handler before use.
client.registerFeature('sasl', 100, async (features, done) => {
if (active) active();
const names = features.sasl.mechanisms.filter(name => SUPPORTED.has(name));
const mech = client.sasl.createMechanism(names);
let phase = 'starting';
let credentials;
let nonce;
const cleanup = () => {
client.off('sasl', handler);
client.off('--reset-stream-features', reset);
if (active === reset) active = undefined;
};
const reset = () => {
phase = 'closed';
cleanup();
client.features.negotiated.sasl = false;
};
const fail = () => {
if (phase === 'closed') return;
phase = 'closed';
cleanup();
client.features.negotiated.sasl = false;
if (client.transport) client.transport.authenticated = false;
client.emit('auth:failed');
done('disconnect', 'SCRAM validation failed'); // Never log peer data/credentials.
};
const handler = async sasl => {
if (phase === 'closed') return;
try {
if (sasl.type === 'challenge' && phase === 'server-first') {
phase = 'sending-proof'; // Reject duplicate challenges and racing success.
firstMessage(sasl.value, nonce);
mech.processChallenge(sasl.value);
const response = mech.createResponse(credentials);
await client.send('sasl', {type: 'response', value: response});
if (phase !== 'closed') phase = 'server-final';
return;
}
if (sasl.type !== 'success' || phase !== 'server-final') return fail();
finalMessage(sasl.value, mech.name);
mech.processSuccess(sasl.value);
const result = mech.finalize();
if (!result.authenticated || !result.mutuallyAuthenticated) return fail();
phase = 'closed';
cleanup();
client.features.negotiated.sasl = true;
if (client.transport) client.transport.authenticated = true;
client.emit('auth:success', client.config.credentials);
done('restart');
} catch {
fail();
}
};
active = reset;
client.features.negotiated.sasl = false;
client.on('sasl', handler);
client.once('--reset-stream-features', reset);
try {
if (!mech || !SUPPORTED.has(mech.name)) return fail();
credentials = await client.getCredentials();
if (phase === 'closed') return;
// Restrict this experiment to non-PLUS; never invent TLS binding bytes.
if (credentials.tlsUnique) return fail();
const response = mech.createResponse(credentials);
nonce = /,r=([^,]+)$/.exec(response.toString('utf8'))?.[1];
if (!nonce) return fail();
await client.send('sasl', {type: 'auth', mechanism: mech.name, value: response});
if (phase !== 'closed') phase = 'server-first';
} catch {
fail();
}
});
}
experiments/0002-xmpp-library/sha512-validation/.npmrc
+3
View File
@@ -0,0 +1,3 @@
engine-strict=true
strict-ssl=true
registry=https://registry.npmjs.org/
experiments/0002-xmpp-library/sha512-validation/LICENSE_INVENTORY.md
+55
View File
@@ -0,0 +1,55 @@
# Locked dependency license inventory
All optional build-host entries are included; installed graph checked separately.
| Package | Version | License |
| --- | --- | --- |
| @oxc-project/types | 0.154.0 | MIT |
| @rolldown/binding-android-arm-eabi | 1.2.14 | MIT |
| @rolldown/binding-android-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-x64 | 1.2.14 | MIT |
| @rolldown/binding-freebsd-x64 | 1.2.14 | MIT |
| @rolldown/binding-linux-arm-gnueabihf | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-musl | 1.2.14 | MIT |
| @rolldown/binding-linux-ppc64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-s390x-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-musl | 1.2.14 | MIT |
| @rolldown/binding-openharmony-arm64 | 1.2.14 | MIT |
| @rolldown/binding-win32-arm64-msvc | 1.2.14 | MIT |
| @rolldown/binding-win32-x64-msvc | 1.2.14 | MIT |
| @rolldown/pluginutils | 1.0.1 | MIT |
| @types/node | 22.20.5 | MIT |
| @types/punycode | 2.1.4 | MIT |
| @types/ws | 8.18.2 | MIT |
| detect-libc | 2.1.2 | Apache-2.0 |
| events | 3.3.0 | MIT |
| fdir | 6.5.0 | MIT |
| fsevents | 2.3.3 | MIT |
| lightningcss | 1.33.0 | MPL-2.0 |
| lightningcss-android-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-freebsd-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm-gnueabihf | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-win32-arm64-msvc | 1.33.0 | MPL-2.0 |
| lightningcss-win32-x64-msvc | 1.33.0 | MPL-2.0 |
| nanoid | 3.3.20 | MIT |
| picocolors | 1.1.1 | ISC |
| picomatch | 4.0.7 | MIT |
| postcss | 8.5.30 | MIT |
| punycode | 2.3.1 | MIT |
| rolldown | 1.2.14 | MIT |
| sdp | 3.2.2 | MIT |
| source-map-js | 1.2.2 | BSD-3-Clause |
| stanza | 12.22.1 | MIT |
| tinyglobby | 0.2.17 | MIT |
| undici-types | 6.21.0 | MIT |
| vite | 8.3.4 | MIT |
| ws | 8.22.0 | MIT |
experiments/0002-xmpp-library/sha512-validation/ORACLE_NOTICES.md
+47
View File
@@ -0,0 +1,47 @@
# Independent oracle licenses
Test-only Python dependencies; not browser/app/runtime dependencies.
## scramp 1.4.6
MIT No Attribution
Copyright The Contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## asn1crypto 1.5.1
Copyright (c) 2015-2022 Will Bond <will@wbond.net>
Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
experiments/0002-xmpp-library/sha512-validation/README.md
+103
View File
@@ -0,0 +1,103 @@
# Isolated browser SCRAM-SHA-512 validation
S00-019 fixture experiment, proposed for independent security review. No live
account/transport or parent library selection. Node executes the **browser-built
backend**, not Stanza's Node crypto. This is browser bundle/backend evidence,
not an actual Chrome/Firefox/Safari execution or WSS interoperability result.
## Reproduce
Use accepted Node 24.21.0 / npm 11.19.0. Existing reviewed macOS ARM64 runtime:
```sh
export PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH
npm ci --prefix experiments/0002-xmpp-library/sha512-validation --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-sha512-review-cache --fetch-retries=0 --fetch-timeout=15000
npm test --prefix experiments/0002-xmpp-library/sha512-validation
python3 experiments/0002-xmpp-library/sha512-validation/check-dependencies.py
```
Use a new empty cache for independent clean-install evidence. The dependency
check also reads the original installed candidate at the parent node_modules
for byte comparison; it does not modify it. If unavailable, reproduce its pinned
install under the parent task's authority or compare Stanza against its locked
tarball separately; do not change the parent from this task.
`npm test` builds before running 87 checks. Vite's default browser resolution
selects stanza/platform/browser. events 3.3.0 is the explicit browser EventEmitter
polyfill. Build fails if module IDs show Node backend/builtins/browser externals
or no browser HMAC. Output `dist/modules.json` lists resolved modules;
`dist/browser.mjs` is a self-contained ESM bundle. Backend tests inspect graph,
no runtime imports/require, and exported platform name `browser`. All integrated
exchanges import this artifact, never Node source. Node crypto is an independent
primitive oracle in tests only; the integration suite has no Node crypto import.
The native RNG path uses host getRandomValues, not a fabricated success value.
## Independent full-exchange oracle
The checked-in `test/scramp-vectors.json` is fixed output from **Scramp 1.4.6**
client and server (Python test-only MIT-0 dependency, asn1crypto 1.5.1 MIT).
Both client proof and server-final are independently verified. Inputs combine
public RFC 7677 nonce/salt/4096-iteration data with SHA-512 and synthetic passwords
pencil, 131 A characters and péncil. These SHA-512 transcripts are independently
derived vectors, not a claim that RFC 7677 specifies SHA-512 examples.
```sh
python3 -m venv /private/tmp/luma-sha512-review-oracle
/private/tmp/luma-sha512-review-oracle/bin/python -m pip install --require-hashes --only-binary=:all: --no-cache-dir -r experiments/0002-xmpp-library/sha512-validation/oracle-requirements.txt
/private/tmp/luma-sha512-review-oracle/bin/python experiments/0002-xmpp-library/sha512-validation/oracle.py
```
Python >=3.8; each wheel version/hash is exact. Default oracle mode compares
existing fixed fixtures; it does not rewrite them. `--write` is an explicit
fixture-generation operation. Scramp is excluded from the app/browser graph.
1.4.6 supports the available Python 3.9 host and the documented APIs; no current
release or supply-chain/advisory clearance is inferred. Notices are preserved.
## Public mechanism path
`Sha512Mechanism` composes Stanza's exported `SCRAM` using its public string
constructor with `SCRAM-SHA512`, selecting the existing documented-by-shipped-code
`sha512` alias. Its separate Mechanism.name is always **SCRAM-SHA-512**. Internal
alias never goes on the wire. Public Factory.disable/register installs that
constructor. No Stanza private field is read/changed, no subclass/private-method
hook or vendor/bundler crypto patch. Actual cryptographic primitives, PBKDF-style
SCRAM composition, SASLprep and verifier stay in unmodified Stanza library code.
This is version-specific public API composition, not an upstream endorsement of
a future stable alias contract; pins and full vectors are mandatory safeguards.
The isolated feature handler is copied from reviewed S00-017, narrowed to SHA-512
and 88-character base64 verifier, and registers the new mechanism. Install via
Client.use on a fresh Client before any negotiation; never install after stock
SASL begins. Mechanism priorities filter to SHA-512 even alongside PLUS/256/1/PLAIN
offers; unsupported-only offers fail. Complete product fallback policy stays
with S00-003. No real channel binding exists; tlsUnique input fails rather than
creating PLUS or a fabricated binding. Initial GS2 is n,, and c=biws.
Guard requires completed proof send before success, strict bounded first/final
syntax, then real processSuccess/finalize with both authenticated flags. Missing,
forged, malformed, premature/duplicate/racing final and replay fail without auth
or restart. Async reset/send failures discard continuation. No derived cache is
persisted/emitted and no raw credentials/peer data is logged by authored code.
Captured send/transport/disconnect effects are explicit fixtures; actual Client,
registry/XML parser, feature dispatcher, mechanism and crypto run.
## Limits
Only server-final in success additional-data, no SCRAM extensions/separate final
challenge. Limits 4096 decoded bytes and 100000 iterations are fixture policy.
Synchronous library PBKDF work can block the UI; no worker/performance acceptance.
No constant-time claim: Stanza compares verifier strings. No timeout is added;
server silence stays unauthenticated until external reset/cancellation. No
arbitrary Unicode/SASLprep conformance certification beyond the fixed case.
Native browser engine/RNG execution, WSS/TLS, independent live server/client,
parent bounded-ingress integration, complete mechanism policy and release
readiness remain outside this experiment. No TLS/certificate/CORS bypass or
plaintext downgrade. Browser syntax floors match accepted Vite targets
Chrome/Edge 111, Firefox 114, Safari 16.4; API requirements include crypto RNG,
fetch and WebSocket. These are build floors, not a certified product matrix.
Licenses: full locked graph in LICENSE_INVENTORY.md, installed notices including
Stanza browser crypto ancestry in THIRD_PARTY_NOTICES.md; oracle notices separate.
Vite/build native components are not browser runtime crypto. events maintenance
has few contributors per upstream; Stanza crypto is reviewed here with vectors,
not newly audited. Dependency/advisory/provenance review remains release work.
experiments/0002-xmpp-library/sha512-validation/THIRD_PARTY_NOTICES.md
+4155
View File
File diff suppressed because it is too large. Load diff
experiments/0002-xmpp-library/sha512-validation/browser-entry.mjs
+10
View File
@@ -0,0 +1,10 @@
import client from 'stanza/Client.js';
import jxt from 'stanza/jxt/index.js';
import platform from 'stanza/platform';
import sasl from 'stanza/lib/sasl/index.js';
export {default as validatedSasl} from './validated-sasl.mjs';
export {Sha512Mechanism} from './sha512-mechanism.mjs';
export const Client = client.default;
export const parse = jxt.parse;
export const {Buffer, createHash, createHmac, name: backend, randomBytes} = platform;
export const StockScram = sasl.SCRAM;
experiments/0002-xmpp-library/sha512-validation/check-dependencies.py
+54
View File
@@ -0,0 +1,54 @@
"""Verify exact installed pins/notices, immutable vendor files and browser graph."""
import hashlib
import json
from pathlib import Path
root = Path(__file__).resolve().parent
lock = json.loads((root / 'package-lock.json').read_text())
manifest = json.loads((root / 'package.json').read_text())
inventory = (root / 'LICENSE_INVENTORY.md').read_text()
notices = (root / 'THIRD_PARTY_NOTICES.md').read_text()
installed = 0
for section in ['dependencies', 'devDependencies']:
for name, version in manifest[section].items():
assert lock['packages']['node_modules/' + name]['version'] == version
for path, entry in lock['packages'].items():
if not path:
continue
name = path.split('node_modules/')[-1]
assert entry['resolved'].startswith('https://registry.npmjs.org/')
assert entry['integrity'].startswith('sha512-')
assert f"| {name} | {entry['version']} | {entry['license']} |" in inventory
package = root / path
if not package.exists():
assert entry.get('optional'), name
continue
meta = json.loads((package / 'package.json').read_text())
assert meta['version'] == entry['version'], name
assert meta['license'] == entry['license'], name
licenses = [f for f in package.iterdir() if f.is_file() and
('license' in f.name.lower() or f.name.lower().startswith(('copying', 'notice')))]
if name == '@rolldown/binding-darwin-arm64':
assert not licenses
licenses = [root / 'node_modules/rolldown/LICENSE',
root / 'node_modules/rolldown/THIRD-PARTY-LICENSE']
assert licenses, name
for file in licenses:
assert file.read_text().rstrip() in notices, file
installed += 1
# Parent is read-only evidence of unmodified pinned candidate, not a dependency.
original = root.parent / 'node_modules/stanza'
current = root / 'node_modules/stanza'
files = [f for f in current.rglob('*') if f.is_file()]
assert {f.relative_to(current) for f in files} == {
f.relative_to(original) for f in original.rglob('*') if f.is_file()}
for file in files:
assert file.read_bytes() == (original / file.relative_to(current)).read_bytes(), file
modules = json.loads((root / 'dist/modules.json').read_text())
assert any(x.endswith('/stanza/platform/browser/crypto/Hmac.js') for x in modules)
assert not any('/platform/node/' in x or x.startswith('node:') or 'browser-external' in x for x in modules)
print(f"{len(lock['packages']) - 1} locked entries; {installed} installed licenses/pins; "
f"{len(files)} unchanged Stanza files; browser backend confirmed")
for name in ['package-lock.json', 'sha512-mechanism.mjs', 'validated-sasl.mjs',
'test/scramp-vectors.json', 'dist/browser.mjs', 'dist/modules.json']:
print(name, hashlib.sha256((root / name).read_bytes()).hexdigest())
experiments/0002-xmpp-library/sha512-validation/oracle-requirements.txt
+2
View File
@@ -0,0 +1,2 @@
scramp==1.4.6 --hash=sha256:a0cf9d2b4624b69bac5432dd69fecfc55a542384fe73c3a23ed9b138cda484e1
asn1crypto==1.5.1 --hash=sha256:db4e40728b728508912cbb3d44f19ce188f218e9eba635821bb4b68564f8fd67
experiments/0002-xmpp-library/sha512-validation/oracle.py
+39
View File
@@ -0,0 +1,39 @@
"""Independent existing SCRAM client/server; synthetic public fixture data only."""
import base64
import json
import sys
from importlib.metadata import version
from pathlib import Path
from scramp import ScramClient, ScramMechanism
assert version("scramp") == "1.4.6"
assert version("asn1crypto") == "1.5.1"
path = Path(__file__).parent / "test" / "scramp-vectors.json"
nonce = "rOprNGfwEbeRWgbNEkqO"
server_nonce = "%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0"
salt = base64.b64decode("W22ZaJ0SNY7soEsUEjb6gQ==")
results = []
for password in ["pencil", "A" * 131, "p\u00e9ncil"]:
mechanism = ScramMechanism("SCRAM-SHA-512")
auth = mechanism.make_auth_info(password, iteration_count=4096, salt=salt)
def auth_fn(username):
assert username == "user"
return auth
server = mechanism.make_server(auth_fn, s_nonce=server_nonce)
client = ScramClient(["SCRAM-SHA-512"], "user", password, c_nonce=nonce)
initial = client.get_client_first()
server.set_client_first(initial)
first = server.get_server_first()
client.set_server_first(first)
proof = client.get_client_final()
server.set_client_final(proof) # Independent server verifies proof.
final = server.get_server_final()
client.set_server_final(final) # Independent client verifies server.
results.append(dict(mechanism="SCRAM-SHA-512", username="user", password=password,
nonce=nonce, initial=initial, first=first, proof=proof, final=final))
if sys.argv[1:] == ["--write"]:
path.write_text(json.dumps(results, indent=2) + "\n")
else:
assert not sys.argv[1:]
assert json.loads(path.read_text()) == results
print("scramp 1.4.6: three fixed SHA-512 client/server exchanges verified")
experiments/0002-xmpp-library/sha512-validation/package-lock.json
Generated
+925
View File
@@ -0,0 +1,925 @@
{
"name": "luma-browser-scram-sha512-experiment",
"version": "0.0.0",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "luma-browser-scram-sha512-experiment",
"version": "0.0.0",
"dependencies": {
"events": "3.3.0",
"stanza": "12.22.1"
},
"devDependencies": {
"vite": "8.3.4"
},
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
}
},
"node_modules/@oxc-project/types": {
"version": "0.154.0",
"resolved": "https://registry.npmjs.org/@oxc-project/types/-/types-0.154.0.tgz",
"integrity": "sha512-KYOUGQFlLWR+s4QMV2Q9ko38TZm7EdO87Qm7rvZLqk/webse/cDjtyxKhg/47l0byCbs/k46LT8qc4PKjAikzA==",
"dev": true,
"license": "MIT",
"funding": {
"url": "https://github.com/sponsors/oxc-project"
}
},
"node_modules/@rolldown/binding-android-arm-eabi": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm-eabi/-/binding-android-arm-eabi-1.2.14.tgz",
"integrity": "sha512-aWR+XKH9+rW7m5fWq/5360J3mHycrx/o6xZM2DQFdJnTMdyP7/WzxPjhtLbVWdKo2y612/4U1bWqb3HQhiF7vg==",
"cpu": [
"arm"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"android"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-android-arm64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-android-arm64/-/binding-android-arm64-1.2.14.tgz",
"integrity": "sha512-QiVxHofl6A8lQU7WAtOUY4QMVZXohxwz7WJJoeh8NBEUyKfIkMRKhYyq8az/1RypNiIXzNTtiS6KwHz0erxYRQ==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"android"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-darwin-arm64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-arm64/-/binding-darwin-arm64-1.2.14.tgz",
"integrity": "sha512-lTQOzHuBIooh3jIr5XINQkjPGEuGy+Dsy0meXDr6Sjty0b99kYgGh4uBC/8mJX1T0kC8d6S0aPP1Y+bHkh6aBw==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-darwin-x64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-darwin-x64/-/binding-darwin-x64-1.2.14.tgz",
"integrity": "sha512-hyMKEGatjmBYCs/Q4sbIcL/GqpFEqsX3wc+HYVQ/85A4rxc1o7rPm4DUI4GV4k/h0ITddwFSGpqQunI14GXjTA==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-freebsd-x64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-freebsd-x64/-/binding-freebsd-x64-1.2.14.tgz",
"integrity": "sha512-u371GbXoVXrEgP20PwzoGNOdAOqAMhzo19JzzY+V4YmmnC+DTOoqdbMu+O+54emM59Mik/UdrtWgcuEDKWRPKA==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"freebsd"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-arm-gnueabihf": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm-gnueabihf/-/binding-linux-arm-gnueabihf-1.2.14.tgz",
"integrity": "sha512-BqwKsdZQf6EqVWr8fv2MrDYzAvOZ7+NYFSJESRGs87fkseEhs0TU9TXgRJTkZoRRkxTizyEg1LKUXfU3/78uqg==",
"cpu": [
"arm"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-arm64-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-gnu/-/binding-linux-arm64-gnu-1.2.14.tgz",
"integrity": "sha512-SD9kY8M009x/7s57Z1dgUVlP5+uYBgKQK0Tkr1WIWngrtUJmRCW1RJFMY7QDla2khXhmg2i5Io7MUjcmZNZ/KQ==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-arm64-musl": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-arm64-musl/-/binding-linux-arm64-musl-1.2.14.tgz",
"integrity": "sha512-BJ2CL19M6uuWesMgnqJzgxoI+N+eV7b0A9O9vLV42y+gitC41fNa8KElau1tHVzuLWX5GzEuxMPhAO0tQXQMkg==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-ppc64-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-ppc64-gnu/-/binding-linux-ppc64-gnu-1.2.14.tgz",
"integrity": "sha512-4+Kl8daPV8NDHaD7mfCcc1pRM+Qg7ab8DyMm5FG5WoZgv4h2i3KFN1CybYBNbQqmuYm7ftJLvmMI1eHYJ22S/Q==",
"cpu": [
"ppc64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-s390x-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-s390x-gnu/-/binding-linux-s390x-gnu-1.2.14.tgz",
"integrity": "sha512-V/h8ePq1fKDrmtFMz6xcCN3DKvuvMRrwwD1q0PkBeeo4DpK64biaKvqWGVxqCeYKqeRk7gE7/iKPxLCn08O97A==",
"cpu": [
"s390x"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-x64-gnu": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-gnu/-/binding-linux-x64-gnu-1.2.14.tgz",
"integrity": "sha512-WxalXzgrLVpKC93xfpaJ3gCXUWzeCr+FRCbDVD2mUAy4L6Vo3lNVz0epUEUpxPWJkLNYUwM4OSIikv36OJ9mLg==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-linux-x64-musl": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-linux-x64-musl/-/binding-linux-x64-musl-1.2.14.tgz",
"integrity": "sha512-3G3tnAmTpdk9jO3GQtyHXqeFD2SlecfTws/Y3M2mmj9nMBwwuLT4kur8sZKeu7ENUHSpVO3cIsm5A52LEWWwlg==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MIT",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-openharmony-arm64": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-openharmony-arm64/-/binding-openharmony-arm64-1.2.14.tgz",
"integrity": "sha512-qyr5XiNGxm2ytx17vvtcJ9nXn6v1gENETi503bJx3OGwZ1tSonj7BosxbMa/xeAfSl5iS9X6KjEWYXLu6v1L7Q==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"openharmony"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-win32-arm64-msvc": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-arm64-msvc/-/binding-win32-arm64-msvc-1.2.14.tgz",
"integrity": "sha512-oA4o5o0S2yB199YyYXDzKUv1Z56Rc+mgOjwm7Z/vJ9Z8igiDPYvoOuDyo6g7AK/ZaF09nPhDKVnGBcYHO11GXA==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/binding-win32-x64-msvc": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/@rolldown/binding-win32-x64-msvc/-/binding-win32-x64-msvc-1.2.14.tgz",
"integrity": "sha512-9mE94bf2GZUaR/fUSXCMpBoWkctu421Mi0ORpm4zqfbkjKep7RxzPFa5etcGs5h+2KApoWBOA/hAJa/7saGgEQ==",
"cpu": [
"x64"
],
"dev": true,
"license": "MIT",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": "^20.19.0 || >=22.12.0"
}
},
"node_modules/@rolldown/pluginutils": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/@rolldown/pluginutils/-/pluginutils-1.0.1.tgz",
"integrity": "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw==",
"dev": true,
"license": "MIT"
},
"node_modules/@types/node": {
"version": "22.20.5",
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
"license": "MIT",
"dependencies": {
"undici-types": "~6.21.0"
}
},
"node_modules/@types/punycode": {
"version": "2.1.4",
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
"license": "MIT"
},
"node_modules/@types/ws": {
"version": "8.18.2",
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
"license": "MIT",
"dependencies": {
"@types/node": "*"
}
},
"node_modules/detect-libc": {
"version": "2.1.2",
"resolved": "https://registry.npmjs.org/detect-libc/-/detect-libc-2.1.2.tgz",
"integrity": "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ==",
"dev": true,
"license": "Apache-2.0",
"engines": {
"node": ">=8"
}
},
"node_modules/events": {
"version": "3.3.0",
"resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
"integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
"license": "MIT",
"engines": {
"node": ">=0.8.x"
}
},
"node_modules/fdir": {
"version": "6.5.0",
"resolved": "https://registry.npmjs.org/fdir/-/fdir-6.5.0.tgz",
"integrity": "sha512-tIbYtZbucOs0BRGqPJkshJUYdL+SDH7dVM8gjy+ERp3WAUjLEFJE+02kanyHtwjWOnwrKYBiwAmM0p4kLJAnXg==",
"dev": true,
"license": "MIT",
"engines": {
"node": ">=12.0.0"
},
"peerDependencies": {
"picomatch": "^3 || ^4"
},
"peerDependenciesMeta": {
"picomatch": {
"optional": true
}
}
},
"node_modules/fsevents": {
"version": "2.3.3",
"resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.3.tgz",
"integrity": "sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==",
"dev": true,
"hasInstallScript": true,
"license": "MIT",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": "^8.16.0 || ^10.6.0 || >=11.0.0"
}
},
"node_modules/lightningcss": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss/-/lightningcss-1.33.0.tgz",
"integrity": "sha512-WkUDrojuJs0xkgGf2udWxa3yGBRxPtxUkB79i6aCZLRgc7PM8fZe9TosfPDcvEpQZbuFASnHYmRLBLUbmLOIIA==",
"dev": true,
"license": "MPL-2.0",
"dependencies": {
"detect-libc": "^2.0.3"
},
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
},
"optionalDependencies": {
"lightningcss-android-arm64": "1.33.0",
"lightningcss-darwin-arm64": "1.33.0",
"lightningcss-darwin-x64": "1.33.0",
"lightningcss-freebsd-x64": "1.33.0",
"lightningcss-linux-arm-gnueabihf": "1.33.0",
"lightningcss-linux-arm64-gnu": "1.33.0",
"lightningcss-linux-arm64-musl": "1.33.0",
"lightningcss-linux-x64-gnu": "1.33.0",
"lightningcss-linux-x64-musl": "1.33.0",
"lightningcss-win32-arm64-msvc": "1.33.0",
"lightningcss-win32-x64-msvc": "1.33.0"
}
},
"node_modules/lightningcss-android-arm64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.33.0.tgz",
"integrity": "sha512-gEpRTalKdosp4Bb8qWtc2iOgE5SeIHlpS1up9bFq2wAyYhl1UdTObYiHe98zEM9SQvSoqQZ1IQD0JNpg3Ml5pg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"android"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-darwin-arm64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.33.0.tgz",
"integrity": "sha512-Sciaz8eenNTKn9b3t7+xr0ipTp9YxKQY4npwQ3mrRuL0BAVHBLyZxofhaKBAVtzmtRZ/zTyo0/to4B1uWG/Djg==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-darwin-x64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-darwin-x64/-/lightningcss-darwin-x64-1.33.0.tgz",
"integrity": "sha512-Z5UPAxzrjlWNNyGy6i65cJzzvgJ5D3T6wMvs+gWpY9d7qRhANrxqAp6LhxIgZhWEw18RfJTGcRxjuLIBr+m8XQ==",
"cpu": [
"x64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"darwin"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-freebsd-x64": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-freebsd-x64/-/lightningcss-freebsd-x64-1.33.0.tgz",
"integrity": "sha512-QQM/Ti/hQajJwCY+RiWuCZ9sdtI/XQk7nDK5vC8kkdwixezOlDgvDx7+RT+QjK6FcFT4MpsuoBnHIo/O3StRRg==",
"cpu": [
"x64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"freebsd"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-arm-gnueabihf": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-arm-gnueabihf/-/lightningcss-linux-arm-gnueabihf-1.33.0.tgz",
"integrity": "sha512-N7FVBe6iS24MlM6R/4RBTxGhQheZGs7tiQ9U32UtF75NzP5Q7xWPRqLBCKxlRQRk3rY1jCIPLzx7WzOhuUIRLQ==",
"cpu": [
"arm"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-arm64-gnu": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-gnu/-/lightningcss-linux-arm64-gnu-1.33.0.tgz",
"integrity": "sha512-j2v/itmy4HlNxlc6voKXYgBqNi0Ng2LShg4z7GufpEgs05P+2suBVyi9I6YHq5uoVFx9ETin3eCEhLVyXGQnKg==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-arm64-musl": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-arm64-musl/-/lightningcss-linux-arm64-musl-1.33.0.tgz",
"integrity": "sha512-yiO5ROMuYQgXbC60yjZU5CYSFZGKXL0HFATXt9mHJn1+zW55oCtMI9NfcVhYLMFDL7gV7oBPon/EmMMGg2OvtQ==",
"cpu": [
"arm64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-x64-gnu": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-gnu/-/lightningcss-linux-x64-gnu-1.33.0.tgz",
"integrity": "sha512-ar+Ju7LmcN0Jo4FpL4hpFybwNG9/3A/Br5KW2n2jyODg3MEZXaDYADdemoNS+BDNfMgKvylJLj4S5tyRActuAg==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"glibc"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-linux-x64-musl": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-linux-x64-musl/-/lightningcss-linux-x64-musl-1.33.0.tgz",
"integrity": "sha512-RYiYbkokw0trfKqqzfF55lginwEPrD3OJDfTuJzFs1MK6iFnDenaz1fqLLtX4ITG3OktJQXOeTaw1awrBAlZPw==",
"cpu": [
"x64"
],
"dev": true,
"libc": [
"musl"
],
"license": "MPL-2.0",
"optional": true,
"os": [
"linux"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-win32-arm64-msvc": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-win32-arm64-msvc/-/lightningcss-win32-arm64-msvc-1.33.0.tgz",
"integrity": "sha512-1K+MPfLSFVpphzpdbfkhlWk6wBrTObBzS2T6db10PNOZgR9GoVsAWzwNyuhUYYbTp23j+4RrncfujZ4uAzXvwA==",
"cpu": [
"arm64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/lightningcss-win32-x64-msvc": {
"version": "1.33.0",
"resolved": "https://registry.npmjs.org/lightningcss-win32-x64-msvc/-/lightningcss-win32-x64-msvc-1.33.0.tgz",
"integrity": "sha512-OlEICDx/Xl0FqSp4bry8zFnCvGpig3Gl4gCquvYwHuqJKEC1+n9NgDniFvqHGmMv1ZkqDJrDqKKSykTDX+ehuA==",
"cpu": [
"x64"
],
"dev": true,
"license": "MPL-2.0",
"optional": true,
"os": [
"win32"
],
"engines": {
"node": ">= 12.0.0"
},
"funding": {
"type": "opencollective",
"url": "https://opencollective.com/parcel"
}
},
"node_modules/nanoid": {
"version": "3.3.20",
"resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.20.tgz",
"integrity": "sha512-uKdg2G3GNCKQn9byYOpxbGqrT2fGO5KRt5J/8b3pok8rT6qxGWF6hxMyJiEYtAf+FVyYuD9hRaDqX5uPFYJ4ZQ==",
"dev": true,
"funding": [
{
"type": "github",
"url": "https://github.com/sponsors/ai"
}
],
"license": "MIT",
"bin": {
"nanoid": "bin/nanoid.cjs"
},
"engines": {
"node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
}
},
"node_modules/picocolors": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
"integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==",
"dev": true,
"license": "ISC"
},
"node_modules/picomatch": {
"version": "4.0.7",
"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.7.tgz",
"integrity": "sha512-qcJu88Q2IWqJsDD529JKMdwGm/dvInW4HvQnRwiH9JtihJvzGOscDtHE3x1pBKeUOTysQ8kVmLnJ2kJu7yhcGA==",
"dev": true,
"license": "MIT",
"engines": {
"node": ">=12"
},
"funding": {
"url": "https://github.com/sponsors/jonschlinkert"
}
},
"node_modules/postcss": {
"version": "8.5.30",
"resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.30.tgz",
"integrity": "sha512-zkd+e9S1AQHhmaBKye9zlFHWjOwVgqXl1q3ECYy8561K7qxR2cREf/STLskulBFd78k6AOFeA+ff1TtEzk9bAA==",
"dev": true,
"funding": [
{
"type": "opencollective",
"url": "https://opencollective.com/postcss/"
},
{
"type": "tidelift",
"url": "https://tidelift.com/funding/github/npm/postcss"
},
{
"type": "github",
"url": "https://github.com/sponsors/ai"
}
],
"license": "MIT",
"dependencies": {
"nanoid": "^3.3.20",
"picocolors": "^1.1.1",
"source-map-js": "^1.2.2"
},
"engines": {
"node": "^10 || ^12 || >=14"
}
},
"node_modules/punycode": {
"version": "2.3.1",
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
"license": "MIT",
"engines": {
"node": ">=6"
}
},
"node_modules/rolldown": {
"version": "1.2.14",
"resolved": "https://registry.npmjs.org/rolldown/-/rolldown-1.2.14.tgz",
"integrity": "sha512-eTBTTqMR6uHKLgcUqpJP8ntzDI6V4LYA8negAMBEI7gkgVvOdrx6VsvS2Ym+83KhOPdLCHWJu0w7UQFJZhHKNw==",
"dev": true,
"license": "MIT",
"dependencies": {
"@oxc-project/types": "=0.154.0",
"@rolldown/pluginutils": "^1.0.0"
},
"bin": {
"rolldown": "bin/cli.mjs"
},
"engines": {
"node": "^20.19.0 || >=22.12.0"
},
"optionalDependencies": {
"@rolldown/binding-android-arm-eabi": "1.2.14",
"@rolldown/binding-android-arm64": "1.2.14",
"@rolldown/binding-darwin-arm64": "1.2.14",
"@rolldown/binding-darwin-x64": "1.2.14",
"@rolldown/binding-freebsd-x64": "1.2.14",
"@rolldown/binding-linux-arm-gnueabihf": "1.2.14",
"@rolldown/binding-linux-arm64-gnu": "1.2.14",
"@rolldown/binding-linux-arm64-musl": "1.2.14",
"@rolldown/binding-linux-ppc64-gnu": "1.2.14",
"@rolldown/binding-linux-s390x-gnu": "1.2.14",
"@rolldown/binding-linux-x64-gnu": "1.2.14",
"@rolldown/binding-linux-x64-musl": "1.2.14",
"@rolldown/binding-openharmony-arm64": "1.2.14",
"@rolldown/binding-win32-arm64-msvc": "1.2.14",
"@rolldown/binding-win32-x64-msvc": "1.2.14"
}
},
"node_modules/sdp": {
"version": "3.2.2",
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
"license": "MIT"
},
"node_modules/source-map-js": {
"version": "1.2.2",
"resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
"integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
"dev": true,
"license": "BSD-3-Clause",
"engines": {
"node": ">=0.10.0"
}
},
"node_modules/stanza": {
"version": "12.22.1",
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
"license": "MIT",
"dependencies": {
"@types/node": "^22.0.0",
"@types/punycode": "^2.1.0",
"@types/ws": "^8.18.1",
"punycode": "^2.1.1",
"sdp": "^3.0.2",
"ws": "^8.18.2"
}
},
"node_modules/tinyglobby": {
"version": "0.2.17",
"resolved": "https://registry.npmjs.org/tinyglobby/-/tinyglobby-0.2.17.tgz",
"integrity": "sha512-wXR/dYpcqKmfWpEdZjiKJOwCNFndD0DMnrW/cYjVGttEkBfVgcLFHoNrlj47mjOVic9yyNu65alsgF4NQyTa2g==",
"dev": true,
"license": "MIT",
"dependencies": {
"fdir": "^6.5.0",
"picomatch": "^4.0.4"
},
"engines": {
"node": ">=12.0.0"
},
"funding": {
"url": "https://github.com/sponsors/SuperchupuDev"
}
},
"node_modules/undici-types": {
"version": "6.21.0",
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
"license": "MIT"
},
"node_modules/vite": {
"version": "8.3.4",
"resolved": "https://registry.npmjs.org/vite/-/vite-8.3.4.tgz",
"integrity": "sha512-IftLE8phJhdNRIGNEV4JCCvfNScoZQVfcXaN8TQropWGJtOHcu+iAB9pHcuGvmEb/kddw0LBe/jS8ztdC6xdiQ==",
"dev": true,
"license": "MIT",
"dependencies": {
"lightningcss": "^1.33.0",
"picomatch": "^4.0.7",
"postcss": "^8.5.29",
"rolldown": "~1.2.12",
"tinyglobby": "^0.2.17"
},
"bin": {
"vite": "bin/vite.js"
},
"engines": {
"node": "^20.19.0 || >=22.12.0"
},
"funding": {
"url": "https://github.com/vitejs/vite?sponsor=1"
},
"optionalDependencies": {
"fsevents": "~2.3.3"
},
"peerDependencies": {
"@types/node": "^20.19.0 || >=22.12.0",
"@vitejs/devtools": "^0.7.1",
"esbuild": "^0.27.0 || ^0.28.0",
"jiti": ">=1.21.0",
"less": "^4.0.0",
"sass": "^1.70.0",
"sass-embedded": "^1.70.0",
"stylus": ">=0.54.8",
"sugarss": "^5.0.0",
"terser": "^5.16.0",
"tsx": "^4.8.1",
"yaml": "^2.4.2"
},
"peerDependenciesMeta": {
"@types/node": {
"optional": true
},
"@vitejs/devtools": {
"optional": true
},
"esbuild": {
"optional": true
},
"jiti": {
"optional": true
},
"less": {
"optional": true
},
"sass": {
"optional": true
},
"sass-embedded": {
"optional": true
},
"stylus": {
"optional": true
},
"sugarss": {
"optional": true
},
"terser": {
"optional": true
},
"tsx": {
"optional": true
},
"yaml": {
"optional": true
}
}
},
"node_modules/ws": {
"version": "8.22.0",
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
"license": "MIT",
"engines": {
"node": ">=10.0.0"
},
"peerDependencies": {
"bufferutil": "^4.0.1",
"utf-8-validate": ">=5.0.2"
},
"peerDependenciesMeta": {
"bufferutil": {
"optional": true
},
"utf-8-validate": {
"optional": true
}
}
}
}
}
experiments/0002-xmpp-library/sha512-validation/package.json
+22
View File
@@ -0,0 +1,22 @@
{
"name": "luma-browser-scram-sha512-experiment",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
},
"packageManager": "npm@11.19.0",
"scripts": {
"build": "vite build",
"test": "npm run build && node --test test/*.test.mjs"
},
"dependencies": {
"stanza": "12.22.1",
"events": "3.3.0"
},
"devDependencies": {
"vite": "8.3.4"
}
}
experiments/0002-xmpp-library/sha512-validation/sha512-mechanism.mjs
+28
View File
@@ -0,0 +1,28 @@
import sasl from 'stanza/lib/sasl/index.js';
// Public constructor selects the existing browser backend's supported hash alias.
// The delegate name never goes on the wire. No private field is read or changed.
export class Sha512Mechanism {
name = 'SCRAM-SHA-512';
providesMutualAuthentication = true;
#delegate;
constructor(name) {
if (name !== this.name) throw new Error('Unsupported mechanism');
this.#delegate = new sasl.SCRAM('SCRAM-SHA512');
}
getExpectedCredentials() { return this.#delegate.getExpectedCredentials(); }
// Keep derived credentials attempt-local; no cache leaves this boundary.
getCacheableCredentials() { return null; }
createResponse(credentials) {
if (credentials.tlsUnique) throw new Error('Channel binding unavailable');
return this.#delegate.createResponse(credentials);
}
processChallenge(value) { this.#delegate.processChallenge(value); }
processSuccess(value) { this.#delegate.processSuccess(value); }
finalize() { return this.#delegate.finalize(); }
}
export function registerSha512(client) {
client.sasl.disable('SCRAM-SHA-512');
client.sasl.register('SCRAM-SHA-512', Sha512Mechanism, 1000);
}
experiments/0002-xmpp-library/sha512-validation/test/backend.test.mjs
+83
View File
@@ -0,0 +1,83 @@
import assert from 'node:assert/strict';
import test from 'node:test';
import {readFileSync} from 'node:fs';
import {createHash as oracleHash, createHmac as oracleHmac} from 'node:crypto';
import {Buffer as BrowserBuffer, createHash, createHmac, backend, StockScram, Sha512Mechanism, randomBytes} from '../dist/browser.mjs';
const hmacVectors = JSON.parse(readFileSync(new URL('./hmac-vectors.json', import.meta.url)));
const scramVectors = JSON.parse(readFileSync(new URL('./scramp-vectors.json', import.meta.url)));
test('bundle resolves browser backend and contains no external runtime imports', () => {
assert.equal(backend, 'browser');
const modules = JSON.parse(readFileSync(new URL('../dist/modules.json', import.meta.url)));
assert.ok(modules.some(id => id.endsWith('/platform/browser/crypto/Hmac.js')));
assert.ok(modules.some(id => id.endsWith('/platform/browser/crypto/SHA-512.js')));
assert.ok(!modules.some(id => /platform\/node\/|^node:|browser-external/.test(id)));
const bundle = readFileSync(new URL('../dist/browser.mjs', import.meta.url), 'utf8');
assert.ok(!/^import\s|\brequire\(/m.test(bundle));
});
for (const vector of hmacVectors) {
for (const algorithm of ['sha512', 'SHA512']) {
test(`RFC 4231 case ${vector.case}, browser ${algorithm}`, () => {
const key = BrowserBuffer.from(vector.key, 'hex');
const data = BrowserBuffer.from(vector.data, 'hex');
const actual = createHmac(algorithm, key).update(data).digest('hex');
assert.equal(actual.slice(0, vector.digest.length), vector.digest);
});
}
}
test('reproduce browser hyphenated HMAC mismatch, keep Node independent control', () => {
const vector = hmacVectors[0];
const key = BrowserBuffer.from(vector.key, 'hex');
const data = BrowserBuffer.from(vector.data, 'hex');
const broken = createHmac('sha-512', key).update(data).digest('hex');
assert.notEqual(broken, vector.digest);
assert.equal(broken, '9656975ee5de55e75f2976ecce9a04501060b9dc22a6eda2eaef638966280182477fe09f080b2bf564649cad42af8607a2bd8d02979df3a980f15e2326a0a22a');
assert.equal(oracleHmac('sha512', Buffer.from(vector.key, 'hex')).update(Buffer.from(vector.data, 'hex')).digest('hex'), vector.digest);
});
const abc = 'ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a2192' +
'992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f';
for (const algorithm of ['sha512', 'sha-512', 'SHA512', 'SHA-512']) {
test(`fixed SHA512 abc digest, browser ${algorithm}`, () => {
assert.equal(createHash(algorithm).update('abc').digest('hex'), abc);
});
}
for (const length of [0, 1, 63, 64, 65, 127, 128, 129, 131, 256]) {
test(`browser HMAC alias key length ${length} agrees with Node crypto`, () => {
const key = Buffer.alloc(length, 0xab);
const data = Buffer.alloc(257, 0xcd);
assert.equal(createHmac('sha512', BrowserBuffer.from(key)).update(BrowserBuffer.from(data)).digest('hex'),
oracleHmac('sha512', key).update(data).digest('hex'));
assert.equal(createHash('sha512').update(BrowserBuffer.from(data)).digest('hex'),
oracleHash('sha512').update(data).digest('hex'));
});
}
test('stock browser SHA512 proof mismatch; public alias delegate matches independent vector', () => {
const vector = scramVectors[0];
const credentials = {username: vector.username, password: vector.password, clientNonce: vector.nonce};
const stock = new StockScram('SCRAM-SHA-512');
stock.createResponse(credentials);
stock.processChallenge(BrowserBuffer.from(vector.first));
assert.notEqual(stock.createResponse(credentials).toString(), vector.proof);
const selected = new Sha512Mechanism('SCRAM-SHA-512');
assert.equal(selected.name, vector.mechanism);
assert.equal(selected.createResponse(credentials).toString(), vector.initial);
selected.processChallenge(BrowserBuffer.from(vector.first));
assert.equal(selected.createResponse(credentials).toString(), vector.proof);
selected.processSuccess(BrowserBuffer.from(vector.final));
assert.deepEqual(selected.finalize(), {authenticated: true, mutuallyAuthenticated: true});
assert.equal(selected.getCacheableCredentials(), null);
});
test('native browser RNG path works without fixed nonce, no invented channel binding', () => {
assert.equal(randomBytes(32).length, 32);
const selected = new Sha512Mechanism('SCRAM-SHA-512');
const initial = selected.createResponse({username: 'user', password: 'pencil'}).toString();
assert.match(initial, /^n,,n=user,r=[0-9a-f]{64}$/);
assert.throws(() => new Sha512Mechanism('SCRAM-SHA-512-PLUS'));
assert.throws(() => new Sha512Mechanism('SCRAM-SHA-512').createResponse({tlsUnique: BrowserBuffer.alloc(32)}));
});
experiments/0002-xmpp-library/sha512-validation/test/hmac-vectors.json
+44
View File
@@ -0,0 +1,44 @@
[
{
"case": 1,
"key": "0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b",
"data": "4869205468657265",
"digest": "87aa7cdea5ef619d4ff0b4241a1d6cb02379f4e2ce4ec2787ad0b30545e17cdedaa833b7d6b8a702038b274eaea3f4e4be9d914eeb61f1702e696c203a126854"
},
{
"case": 2,
"key": "4a656665",
"data": "7768617420646f2079612077616e7420666f72206e6f7468696e673f",
"digest": "164b7a7bfcf819e2e395fbe73b56e0a387bd64222e831fd610270cd7ea2505549758bf75c05a994a6d034f65f8f0e6fdcaeab1a34d4a6b4b636e070a38bce737"
},
{
"case": 3,
"key": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"data": "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd",
"digest": "fa73b0089d56a284efb0f0756c890be9b1b5dbdd8ee81a3655f83e33b2279d39bf3e848279a722c806b485a47e67c807b946a337bee8942674278859e13292fb"
},
{
"case": 4,
"key": "0102030405060708090a0b0c0d0e0f10111213141516171819",
"data": "cdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcdcd",
"digest": "b0ba465637458c6990e5a8c5f61d4af7e576d97ff94b872de76f8050361ee3dba91ca5c11aa25eb4d679275cc5788063a5f19741120c4f2de2adebeb10a298dd"
},
{
"case": 5,
"key": "0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c0c",
"data": "546573742057697468205472756e636174696f6e",
"digest": "415fad6271580a531d4179bc891d87a6"
},
{
"case": 6,
"key": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"data": "54657374205573696e67204c6172676572205468616e20426c6f636b2d53697a65204b6579202d2048617368204b6579204669727374",
"digest": "80b24263c7c1a3ebb71493c1dd7be8b49b46d1f41b4aeec1121b013783f8f3526b56d037e05f2598bd0fd2215d6a1e5295e64f73f63f0aec8b915a985d786598"
},
{
"case": 7,
"key": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"data": "5468697320697320612074657374207573696e672061206c6172676572207468616e20626c6f636b2d73697a65206b657920616e642061206c6172676572207468616e20626c6f636b2d73697a6520646174612e20546865206b6579206e6565647320746f20626520686173686564206265666f7265206265696e6720757365642062792074686520484d414320616c676f726974686d2e",
"digest": "e37b6a775dc87dbaa4dfa9f96e5e3ffddebd71f8867289865df5a32d20cdc944b6022cac3c4982b10d5eeb55c3e4de15134676fb6de0446065c97440fa8c6a58"
}
]
experiments/0002-xmpp-library/sha512-validation/test/integration.test.mjs
+302
View File
@@ -0,0 +1,302 @@
import assert from 'node:assert/strict';
import test from 'node:test';
import {readFileSync} from 'node:fs';
import {Client, parse, validatedSasl, StockScram} from '../dist/browser.mjs';
const vectors = JSON.parse(readFileSync(new URL('./scramp-vectors.json', import.meta.url)));
const tick = () => new Promise(resolve => setImmediate(resolve));
const deferred = () => {
let resolve;
const promise = new Promise(r => {resolve = r;});
return {promise, resolve};
};
function harness(vector = vectors[1], fixed = true, mechanisms = [vector.mechanism]) {
const client = new Client({jid: 'user@example.invalid', autoReconnect: false,
credentials: {username: vector.username, password: vector.password, clientNonce: vector.nonce}});
const result = {sent: [], success: 0, failed: 0, restart: 0, disconnect: 0, verification: []};
// Capture fixture effects; use the real Client, XML registry, feature dispatcher,
// mechanism factory and SCRAM crypto. Never connect to a real provider.
client.send = async (kind, stanza) => {result.sent.push({kind, stanza});};
client.transport = {authenticated: false, restart: () => {result.restart++;}};
client.disconnect = async () => {result.disconnect++;};
client.on('auth:success', () => {result.success++;});
client.on('auth:failed', () => {result.failed++;});
if (!fixed) client.sasl.register('SCRAM-SHA-512', StockScram, 1000);
if (fixed) {
client.use(validatedSasl);
const original = client.sasl.createMechanism.bind(client.sasl);
client.sasl.createMechanism = names => {
const mech = original(names);
if (mech) for (const method of ['processSuccess', 'finalize']) {
const fn = mech[method].bind(mech);
mech[method] = (...args) => {result.verification.push(method); return fn(...args);};
}
return mech;
};
}
const receive = async (type, value) => {
const body = value === undefined ? '' : Buffer.from(value).toString('base64');
const xml = parse(`<${type} xmlns="urn:ietf:params:xml:ns:xmpp-sasl">${body}</${type}>`);
const stanza = client.stanzas.import(xml);
assert.equal(stanza.type, type);
client.emit('sasl', stanza);
await tick();
};
const start = async () => {
client.emit('features', {sasl: {mechanisms}});
await tick();
};
return {client, result, receive, start};
}
function rejected(h) {
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.result.failed, 1);
assert.equal(h.result.disconnect, 1);
assert.equal(h.client.features.negotiated.sasl, false);
assert.equal(h.client.transport.authenticated, false);
assert.equal(h.client.listenerCount('sasl'), 0);
}
for (const vector of vectors) {
test(`${vector.mechanism}: independent Scramp proof and verified final through feature dispatcher`, async () => {
const h = harness(vector);
await h.start();
assert.equal(h.result.sent[0].stanza.mechanism, vector.mechanism);
assert.equal(h.result.sent[0].stanza.value.toString(), `n,,n=user,r=${vector.nonce}`);
await h.receive('challenge', vector.first);
assert.equal(h.result.sent[1].stanza.value.toString(), vector.proof);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.transport.authenticated, false);
await h.receive('success', vector.final);
assert.deepEqual(h.result.verification, ['processSuccess', 'finalize']);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
assert.equal(h.result.disconnect, 0);
assert.equal(h.client.features.negotiated.sasl, true);
assert.equal(h.client.transport.authenticated, true);
await h.receive('success', vector.final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
});
for (const [label, final] of [
['missing', undefined],
['forged', 'v=' + (vector.final[2] === 'A' ? 'B' : 'A') + vector.final.slice(3)],
['error', 'e=invalid-proof'],
['conflicting error', `${vector.final},e=invalid-proof`],
['duplicate verifier', `${vector.final},${vector.final}`],
['bad base64', 'v=***'],
['oversized', 'v=' + 'A'.repeat(4096)]
]) {
test(`${vector.mechanism}: reject ${label} server-final after proof`, async () => {
const h = harness(vector);
await h.start();
await h.receive('challenge', vector.first);
await h.receive('success', final);
rejected(h);
if (label === 'forged') assert.deepEqual(h.result.verification, ['processSuccess', 'finalize']);
await h.receive('success', vector.final);
rejected(h);
});
}
test(`${vector.mechanism}: reject valid-looking final before proof`, async () => {
const h = harness(vector);
await h.start();
await h.receive('success', vector.final);
rejected(h);
assert.deepEqual(h.result.verification, []);
});
}
for (const [label, final] of [['missing', undefined], ['forged', 'v=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=']]) {
test(`stock 12.22.1 reproduces ${label} premature acceptance`, async () => {
const h = harness(vectors[1], false);
await h.start();
await h.receive('success', final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
assert.equal(h.client.transport.authenticated, true);
});
test(`replacement rejects original ${label} premature defect`, async () => {
const h = harness();
await h.start();
await h.receive('success', final);
rejected(h);
});
}
for (const [label, first] of [
['wrong nonce', vectors[1].first.replace('r=rOpr', 'r=wrong')],
['unextended nonce', `r=${vectors[1].nonce},s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096`],
['iteration overflow', vectors[1].first.replace('i=4096', 'i=100001')],
['invalid iterations', vectors[1].first.replace('i=4096', 'i=NaN')],
['duplicate attribute', vectors[1].first + ',i=4096'],
['mandatory extension', 'm=required,' + vectors[1].first]
]) {
test(`reject ${label} before library proof work`, async () => {
const h = harness();
await h.start();
await h.receive('challenge', first);
rejected(h);
assert.equal(h.result.sent.length, 1);
});
}
test('reject success while proof send is pending; no late revival', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
await h.receive('success', vectors[1].final);
rejected(h);
pending.resolve();
await tick();
await h.receive('success', vectors[1].final);
rejected(h);
});
test('duplicate challenge while sending proof fails closed', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
await h.receive('challenge', vectors[1].first);
rejected(h);
pending.resolve();
await tick();
rejected(h);
});
test('reset while awaiting credentials prevents late auth and listener leak', async () => {
const h = harness();
const pending = deferred();
h.client.getCredentials = () => pending.promise;
await h.start();
h.client.emit('--reset-stream-features');
pending.resolve({username: 'user', password: 'pencil', clientNonce: vectors[1].nonce});
await tick();
await h.receive('success', vectors[1].final);
assert.equal(h.result.sent.length, 0);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
});
test('reset after proof, new negotiation succeeds without old handlers', async () => {
const h = harness();
await h.start();
await h.receive('challenge', vectors[1].first);
h.client.emit('--reset-stream-features');
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
await h.start();
assert.equal(h.client.listenerCount('sasl'), 1);
await h.receive('challenge', vectors[1].first);
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 1);
assert.equal(h.result.restart, 1);
});
test('fixture policy filters PLUS and plaintext; strongest available non-PLUS selected', async () => {
const h = harness(vectors[1], true, ['PLAIN', 'SCRAM-SHA-1', 'SCRAM-SHA-512-PLUS', 'SCRAM-SHA-256', 'SCRAM-SHA-512']);
await h.start();
assert.equal(h.result.sent[0].stanza.mechanism, 'SCRAM-SHA-512');
});
for (const names of [['PLAIN'], ['SCRAM-SHA-512-PLUS'], []]) {
test(`no allowed mechanism (${names.join(',')}) disconnects`, async () => {
const h = harness(vectors[1], true, names);
await h.start();
rejected(h);
assert.equal(h.result.sent.length, 0);
});
}
for (const type of ['failure', 'abort']) {
test(`${type} is terminal; valid final cannot revive it`, async () => {
const h = harness();
await h.start();
await h.receive(type);
await h.receive('success', vectors[1].final);
rejected(h);
});
}
test('success during pending initial credentials fails closed', async () => {
const h = harness();
const pending = deferred();
h.client.getCredentials = () => pending.promise;
await h.start();
await h.receive('success', vectors[1].final);
rejected(h);
pending.resolve({username: 'user', password: 'pencil', clientNonce: vectors[1].nonce});
await tick();
assert.equal(h.result.sent.length, 0);
rejected(h);
});
test('reset during proof send cancels continuation', async () => {
const h = harness();
await h.start();
const pending = deferred();
h.client.send = () => pending.promise;
await h.receive('challenge', vectors[1].first);
h.client.emit('--reset-stream-features');
pending.resolve();
await tick();
await h.receive('success', vectors[1].final);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.listenerCount('sasl'), 0);
});
for (const stage of ['credentials', 'initial send', 'proof send']) {
test(`${stage} rejection disconnects without success`, async () => {
const h = harness();
const reject = async () => {throw new Error('synthetic fixture failure');};
if (stage === 'credentials') h.client.getCredentials = reject;
if (stage === 'initial send') h.client.send = reject;
await h.start();
if (stage === 'proof send') {
h.client.send = reject;
await h.receive('challenge', vectors[1].first);
}
rejected(h);
});
}
test('repeat challenge after completed proof is rejected', async () => {
const h = harness();
await h.start();
await h.receive('challenge', vectors[1].first);
await h.receive('challenge', vectors[1].first);
rejected(h);
});
test('synthetic binding input fails without auth or plaintext fallback', async () => {
const h = harness();
h.client.config.credentials.tlsUnique = Buffer.alloc(32);
await h.start();
rejected(h);
assert.equal(h.result.sent.length, 0);
});
test('server silence after proof never authenticates; reset discards attempt', async () => {
const h = harness();
let cacheEvents = 0;
h.client.on('credentials:update', () => {cacheEvents++;});
await h.start();
await h.receive('challenge', vectors[0].first);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
assert.equal(h.client.transport.authenticated, false);
assert.equal(cacheEvents, 0);
assert.equal(h.client.config.credentials.saltedPassword, undefined);
h.client.emit('--reset-stream-features');
await h.receive('success', vectors[0].final);
assert.equal(h.result.success, 0);
assert.equal(h.result.restart, 0);
});
experiments/0002-xmpp-library/sha512-validation/test/scramp-vectors.json
+32
View File
@@ -0,0 +1,32 @@
[
{
"mechanism": "SCRAM-SHA-512",
"username": "user",
"password": "pencil",
"nonce": "rOprNGfwEbeRWgbNEkqO",
"initial": "n,,n=user,r=rOprNGfwEbeRWgbNEkqO",
"first": "r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096",
"proof": "c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=gMGXRcevScNtxZ6/8lQYpGtnsNAc3mGcmNomv+xnoOMw+3R2xNJdMNnzMlTN8PPC6wdp6dybEmDYXYTxwnYPJQ==",
"final": "v=ZQnYEgWQMFmmsM8aQMF0nDDCy/AgCzkwk8CmMZYcMg0vSVlKDanekLtifDSeVGT4+5ZxXnJq199RVG2rR7N7Zw=="
},
{
"mechanism": "SCRAM-SHA-512",
"username": "user",
"password": "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
"nonce": "rOprNGfwEbeRWgbNEkqO",
"initial": "n,,n=user,r=rOprNGfwEbeRWgbNEkqO",
"first": "r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096",
"proof": "c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=FQ+Ds6nMR5kU+jnkwyhJGBK8lA2hTFKTqEBVSUCvSgmexvd4GGT4uAqD3iACaCkLYP0Bc6JHwnHMWkpGNOX2rg==",
"final": "v=dXX1mz64UYbnX15NloHSoWfqoMVVvFg23i8KXwHigIVa+U6w+eJBBwhNg47qeIqkRLhhVnRnvcVvQMXpqav+4A=="
},
{
"mechanism": "SCRAM-SHA-512",
"username": "user",
"password": "p\u00e9ncil",
"nonce": "rOprNGfwEbeRWgbNEkqO",
"initial": "n,,n=user,r=rOprNGfwEbeRWgbNEkqO",
"first": "r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,s=W22ZaJ0SNY7soEsUEjb6gQ==,i=4096",
"proof": "c=biws,r=rOprNGfwEbeRWgbNEkqO%hvYDpWUa2RaTCAfuxFIlj)hNlF$k0,p=Jwk58tl/01ikMIUvnr0MXiTPWZJOiqtTyIAKx2A7IL85TXsL9S/fvBEIYvd/a0QIAQrNp47BSvResR5QB63TSg==",
"final": "v=QwFhP0JOInTkJ/uTsZ2DRt00V0dQtkZKotpq815cU8X2SpF/5qbOd8sd6TCj8NjX/GPke8Xj4yg6whLHu7KNlw=="
}
]
experiments/0002-xmpp-library/sha512-validation/validated-sasl.mjs
+111
View File
@@ -0,0 +1,111 @@
// Isolated S00-019 copy of the reviewed S00-017 ordering guard.
import {registerSha512} from './sha512-mechanism.mjs';
// No production transport, credential persistence, or channel binding is provided.
const SUPPORTED = new Set(['SCRAM-SHA-512']);
const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
function text(value) {
// SASL's parsed additional-data is a Buffer, not raw XML/base64 text.
if (!value || typeof value.toString !== 'function' || value.length > 4096) {
throw new Error('Invalid SASL data');
}
const result = value.toString('utf8');
if (!/^[\x21-\x7e]*$/.test(result)) throw new Error('Invalid SASL data');
return result;
}
function firstMessage(value, nonce) {
// Deliberately narrow, no extensions. Bound work before calling library crypto.
const match = /^r=([\x21-\x2b\x2d-\x7e]+),s=([A-Za-z0-9+/=]+),i=([1-9][0-9]*)$/.exec(text(value));
if (!match || !BASE64.test(match[2]) || !match[1].startsWith(nonce) ||
match[1].length <= nonce.length || Number(match[3]) > 100000) {
throw new Error('Invalid SCRAM server-first');
}
}
function finalMessage(value, name) {
const final = text(value);
if (name !== 'SCRAM-SHA-512') throw new Error('Unsupported mechanism');
const length = 88;
if (!final.startsWith('v=') || final.length !== length + 2 || !BASE64.test(final.slice(2))) {
throw new Error('Invalid SCRAM server-final');
}
}
export default function validatedSasl(client) {
registerSha512(client);
let active;
// Public plugin + named feature registration replaces the stock handler before use.
client.registerFeature('sasl', 100, async (features, done) => {
if (active) active();
const names = features.sasl.mechanisms.filter(name => SUPPORTED.has(name));
const mech = client.sasl.createMechanism(names);
let phase = 'starting';
let credentials;
let nonce;
const cleanup = () => {
client.off('sasl', handler);
client.off('--reset-stream-features', reset);
if (active === reset) active = undefined;
};
const reset = () => {
phase = 'closed';
cleanup();
client.features.negotiated.sasl = false;
};
const fail = () => {
if (phase === 'closed') return;
phase = 'closed';
cleanup();
client.features.negotiated.sasl = false;
if (client.transport) client.transport.authenticated = false;
client.emit('auth:failed');
done('disconnect', 'SCRAM validation failed'); // Never log peer data/credentials.
};
const handler = async sasl => {
if (phase === 'closed') return;
try {
if (sasl.type === 'challenge' && phase === 'server-first') {
phase = 'sending-proof'; // Reject duplicate challenges and racing success.
firstMessage(sasl.value, nonce);
mech.processChallenge(sasl.value);
const response = mech.createResponse(credentials);
await client.send('sasl', {type: 'response', value: response});
if (phase !== 'closed') phase = 'server-final';
return;
}
if (sasl.type !== 'success' || phase !== 'server-final') return fail();
finalMessage(sasl.value, mech.name);
mech.processSuccess(sasl.value);
const result = mech.finalize();
if (!result.authenticated || !result.mutuallyAuthenticated) return fail();
phase = 'closed';
cleanup();
client.features.negotiated.sasl = true;
if (client.transport) client.transport.authenticated = true;
client.emit('auth:success', client.config.credentials);
done('restart');
} catch {
fail();
}
};
active = reset;
client.features.negotiated.sasl = false;
client.on('sasl', handler);
client.once('--reset-stream-features', reset);
try {
if (!mech || !SUPPORTED.has(mech.name)) return fail();
credentials = await client.getCredentials();
if (phase === 'closed') return;
// Restrict this experiment to non-PLUS; never invent TLS binding bytes.
if (credentials.tlsUnique) return fail();
const response = mech.createResponse(credentials);
nonce = /,r=([^,]+)$/.exec(response.toString('utf8'))?.[1];
if (!nonce) return fail();
await client.send('sasl', {type: 'auth', mechanism: mech.name, value: response});
if (phase !== 'closed') phase = 'server-first';
} catch {
fail();
}
});
}
experiments/0002-xmpp-library/sha512-validation/vite.config.mjs
+23
View File
@@ -0,0 +1,23 @@
import {defineConfig} from 'vite';
import {fileURLToPath} from 'node:url';
export default defineConfig({
resolve: {alias: {events: fileURLToPath(new URL('./node_modules/events/events.js', import.meta.url))}},
build: {
target: ['chrome111', 'edge111', 'firefox114', 'safari16.4'],
minify: false,
lib: {entry: 'browser-entry.mjs', formats: ['es'], fileName: () => 'browser.mjs'},
rollupOptions: {plugins: [{
name: 'backend-evidence',
generateBundle() {
const modules = [...this.getModuleIds()].map(id => id.replace(process.cwd(), '.')).sort();
if (!modules.some(id => id.endsWith('/stanza/platform/browser/crypto/Hmac.js'))) {
throw new Error('Browser HMAC missing');
}
if (modules.some(id => /stanza\/platform\/node\/|^node:|browser-external/.test(id))) {
throw new Error('Unexpected Node runtime backend');
}
this.emitFile({type: 'asset', fileName: 'modules.json', source: JSON.stringify(modules, null, 2) + '\n'});
}
}]}
}
});
planning/ROADMAP.md
+1 -1
View File
@@ -6,7 +6,7 @@
Зафиксировать Web scope, browser targets и проверенные кандидаты, не устанавливая непроверенный framework по догадке.
Задач: 10; entry: нет; exit: S00-010.
Задач: 19; entry: нет; exit: S00-010.
## [S01: Предметные контракты](stages/S01.md)
planning/TASK_MATRIX.md
+13 -4
View File
@@ -1,18 +1,27 @@
# Матрица задач
Generated; state revision **0**. Canonical status: state/tasks.json.
Generated; state revision **51**. Canonical status: state/tasks.json.
| ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
| --- | --- | --- | --- | --- | --- | --- | --- |
| [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | todo | | | Утвердить Web-профиль |
| [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | todo | | S00-001 | Выбрать framework и build runtime |
| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | todo | | S00-001, S00-002 | Проверить XMPP WSS/auth библиотеку |
| [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | done | auto-orchestrator-48aab142ecde | | Утвердить Web-профиль |
| [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | done | auto-orchestrator-68a05c587e33 | S00-001, S00-011, S00-012 | Выбрать framework и build runtime |
| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | todo | | S00-001, S00-002, S00-017, S00-018, S00-019 | Проверить XMPP WSS/auth библиотеку |
| [S00-004](tasks/S00-004.md) | S00 | crypto | security | todo | | S00-001, S00-002 | Проверить browser OMEMO backend |
| [S00-005](tasks/S00-005.md) | S00 | storage | qa | todo | | S00-002 | Выбрать IndexedDB wrapper и migration policy |
| [S00-006](tasks/S00-006.md) | S00 | orchestrator | security | todo | | S00-002 | Зафиксировать browser/reference matrix |
| [S00-007](tasks/S00-007.md) | S00 | security | orchestrator | todo | | S00-004, S00-005 | Утвердить password и crypto unlock модель |
| [S00-008](tasks/S00-008.md) | S00 | ci-cd | qa | todo | | S00-003, S00-004 | Описать WSS/upload/TURN/push topology |
| [S00-009](tasks/S00-009.md) | S00 | orchestrator | security | todo | | S00-003, S00-004, S00-005, S00-006, S00-007, S00-008 | Согласовать результаты spikes |
| [S00-011](tasks/S00-011.md) | S00 | ci-cd | security | done | auto-ci-cd-d105e8027730 | S00-001 | Restore verified npm registry access for the stack spike |
| [S00-012](tasks/S00-012.md) | S00 | ci-cd | qa | done | auto-ci-cd-f101e40d9902 | S00-001, S00-011, S00-013, S00-014, S00-015 | Fix runner prompt delivery after partial stdin timeout |
| [S00-013](tasks/S00-013.md) | S00 | ci-cd | qa | done | auto-ci-cd-5f68f03dd33b | S00-001, S00-011 | Bound oversized S21-006 runner context without truncating requirements |
| [S00-014](tasks/S00-014.md) | S00 | ci-cd | qa | done | auto-ci-cd-14343249da62 | S00-001, S00-011, S00-013 | Fix repeated runner cleanup after a submitted parent is reaped |
| [S00-015](tasks/S00-015.md) | S00 | ci-cd | qa | done | auto-ci-cd-84e209103f24 | S00-001, S00-011, S00-013, S00-014, S00-016 | Устранить прерывание: Fix runner prompt delivery after partial stdin timeout |
| [S00-016](tasks/S00-016.md) | S00 | ci-cd | qa | done | auto-ci-cd-351a0cbbabef | S00-001, S00-011, S00-013, S00-014 | Restore reviewer model availability after provider capacity failure |
| [S00-017](tasks/S00-017.md) | S00 | protocol | security | done | auto-protocol-599343cd9e3f | S00-001, S00-002 | Establish fail-closed SCRAM server-final validation |
| [S00-018](tasks/S00-018.md) | S00 | protocol | security | done | auto-protocol-89fe6563092c | S00-001, S00-002, S00-017 | Validate bounded standalone XML ingress for the XMPP candidate |
| [S00-019](tasks/S00-019.md) | S00 | crypto | security | done | auto-crypto-c68801170fa4 | S00-001, S00-002, S00-017, S00-018 | Validate browser-compatible SCRAM-SHA-512 through a public mechanism API |
| [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo | | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
| [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo | | S00-010 | Описать identity/model contracts |
| [S01-002](tasks/S01-002.md) | S01 | orchestrator | security | todo | | S00-010, S01-001 | Описать async account context |
planning/TRACEABILITY.md
+4 -4
View File
@@ -14,7 +14,7 @@ Allocated означает наличие плана/приёмки, а не р
| ACC-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-003, S21-001 |
| ACC-002 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-001, S21-001 |
| ACC-003 | out_of_scope | Native host/port TCP configuration; Web uses ACC-004 WSS. | |
| ACC-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S05-001, S06-003, S21-001 |
| ACC-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S00-018, S00-019, S05-001, S06-003, S21-001 |
| ACC-005 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-001, S06-011, S21-001 |
| ACC-006 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-003, S06-004, S21-001 |
| ACC-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-002, S06-009, S20-008, S21-001 |
@@ -27,8 +27,8 @@ Allocated означает наличие плана/приёмки, а не р
| ACC-014 | web | Web requirement; cross-platform clauses apply only in Web context. | S01-002, S02-010, S06-006, S06-010, S21-001 |
| NET-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S02-008, S05-001, S05-002, S05-009, S21-001 |
| NET-002 | out_of_scope | Native transport discovery; Web WSS addressed by ACC-004/NET-001. | |
| NET-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S05-003, S21-001 |
| NET-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S05-003, S05-009, S21-001 |
| NET-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S00-018, S00-019, S05-003, S21-001 |
| NET-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S00-018, S00-019, S05-003, S05-009, S21-001 |
| NET-005 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-004, S21-001 |
| NET-006 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-002, S05-010, S06-004, S20-002, S21-001 |
| NET-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-007, S21-001 |
@@ -204,7 +204,7 @@ Allocated означает наличие плана/приёмки, а не р
| NFR-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S02-012, S09-012, S21-007 |
| NFR-005 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-006, S02-012, S09-012, S20-006, S21-011 |
| NFR-006 | web | Web requirement; cross-platform clauses apply only in Web context. | S02-012, S09-012 |
| NFR-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-002, S02-001, S02-002, S09-012, S21-008, S21-009 |
| NFR-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-002, S00-011, S00-012, S00-013, S00-014, S02-001, S02-002, S09-012, S21-008, S21-009 |
| NFR-008 | web | Web requirement; cross-platform clauses apply only in Web context. | S02-004, S02-005, S02-006, S09-012, S21-009 |
| NFR-009 | web | Web requirement; cross-platform clauses apply only in Web context. | S02-012, S09-012, S19-006, S20-003, S21-010 |
| UI-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S03-002, S20-001, S21-006 |
planning/stages/S00.md
+11 -2
View File
@@ -6,8 +6,8 @@
## Задачи
- [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; todo.
- [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; todo.
- [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; done.
- [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; done.
- [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; todo.
- [S00-004](../tasks/S00-004.md): Проверить browser OMEMO backend — crypto; todo.
- [S00-005](../tasks/S00-005.md): Выбрать IndexedDB wrapper и migration policy — storage; todo.
@@ -15,6 +15,15 @@
- [S00-007](../tasks/S00-007.md): Утвердить password и crypto unlock модель — security; todo.
- [S00-008](../tasks/S00-008.md): Описать WSS/upload/TURN/push topology — ci-cd; todo.
- [S00-009](../tasks/S00-009.md): Согласовать результаты spikes — orchestrator; todo.
- [S00-011](../tasks/S00-011.md): Restore verified npm registry access for the stack spike — ci-cd; done.
- [S00-012](../tasks/S00-012.md): Fix runner prompt delivery after partial stdin timeout — ci-cd; done.
- [S00-013](../tasks/S00-013.md): Bound oversized S21-006 runner context without truncating requirements — ci-cd; done.
- [S00-014](../tasks/S00-014.md): Fix repeated runner cleanup after a submitted parent is reaped — ci-cd; done.
- [S00-015](../tasks/S00-015.md): Устранить прерывание: Fix runner prompt delivery after partial stdin timeout — ci-cd; done.
- [S00-016](../tasks/S00-016.md): Restore reviewer model availability after provider capacity failure — ci-cd; done.
- [S00-017](../tasks/S00-017.md): Establish fail-closed SCRAM server-final validation — protocol; done.
- [S00-018](../tasks/S00-018.md): Validate bounded standalone XML ingress for the XMPP candidate — protocol; done.
- [S00-019](../tasks/S00-019.md): Validate browser-compatible SCRAM-SHA-512 through a public mechanism API — crypto; done.
- [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
## Граница этапа
planning/task_matrix.csv
+12 -3
View File
@@ -1,13 +1,22 @@
id,stage,operator,reviewer,status,owner,depends_on,title
S00-001,S00,orchestrator,security,todo,,,Утвердить Web-профиль
S00-002,S00,orchestrator,security,todo,,S00-001,Выбрать framework и build runtime
S00-003,S00,protocol,qa,todo,,"S00-001, S00-002",Проверить XMPP WSS/auth библиотеку
S00-001,S00,orchestrator,security,done,auto-orchestrator-48aab142ecde,,Утвердить Web-профиль
S00-002,S00,orchestrator,security,done,auto-orchestrator-68a05c587e33,"S00-001, S00-011, S00-012",Выбрать framework и build runtime
S00-003,S00,protocol,qa,todo,,"S00-001, S00-002, S00-017, S00-018, S00-019",Проверить XMPP WSS/auth библиотеку
S00-004,S00,crypto,security,todo,,"S00-001, S00-002",Проверить browser OMEMO backend
S00-005,S00,storage,qa,todo,,S00-002,Выбрать IndexedDB wrapper и migration policy
S00-006,S00,orchestrator,security,todo,,S00-002,Зафиксировать browser/reference matrix
S00-007,S00,security,orchestrator,todo,,"S00-004, S00-005",Утвердить password и crypto unlock модель
S00-008,S00,ci-cd,qa,todo,,"S00-003, S00-004",Описать WSS/upload/TURN/push topology
S00-009,S00,orchestrator,security,todo,,"S00-003, S00-004, S00-005, S00-006, S00-007, S00-008",Согласовать результаты spikes
S00-011,S00,ci-cd,security,done,auto-ci-cd-d105e8027730,S00-001,Restore verified npm registry access for the stack spike
S00-012,S00,ci-cd,qa,done,auto-ci-cd-f101e40d9902,"S00-001, S00-011, S00-013, S00-014, S00-015",Fix runner prompt delivery after partial stdin timeout
S00-013,S00,ci-cd,qa,done,auto-ci-cd-5f68f03dd33b,"S00-001, S00-011",Bound oversized S21-006 runner context without truncating requirements
S00-014,S00,ci-cd,qa,done,auto-ci-cd-14343249da62,"S00-001, S00-011, S00-013",Fix repeated runner cleanup after a submitted parent is reaped
S00-015,S00,ci-cd,qa,done,auto-ci-cd-84e209103f24,"S00-001, S00-011, S00-013, S00-014, S00-016",Устранить прерывание: Fix runner prompt delivery after partial stdin timeout
S00-016,S00,ci-cd,qa,done,auto-ci-cd-351a0cbbabef,"S00-001, S00-011, S00-013, S00-014",Restore reviewer model availability after provider capacity failure
S00-017,S00,protocol,security,done,auto-protocol-599343cd9e3f,"S00-001, S00-002",Establish fail-closed SCRAM server-final validation
S00-018,S00,protocol,security,done,auto-protocol-89fe6563092c,"S00-001, S00-002, S00-017",Validate bounded standalone XML ingress for the XMPP candidate
S00-019,S00,crypto,security,done,auto-crypto-c68801170fa4,"S00-001, S00-002, S00-017, S00-018",Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts
S01-002,S01,orchestrator,security,todo,,"S00-010, S01-001",Описать async account context
1 id stage operator reviewer status owner depends_on title
2 S00-001 S00 orchestrator security todo done auto-orchestrator-48aab142ecde Утвердить Web-профиль
3 S00-002 S00 orchestrator security todo done auto-orchestrator-68a05c587e33 S00-001 S00-001, S00-011, S00-012 Выбрать framework и build runtime
4 S00-003 S00 protocol qa todo S00-001, S00-002 S00-001, S00-002, S00-017, S00-018, S00-019 Проверить XMPP WSS/auth библиотеку
5 S00-004 S00 crypto security todo S00-001, S00-002 Проверить browser OMEMO backend
6 S00-005 S00 storage qa todo S00-002 Выбрать IndexedDB wrapper и migration policy
7 S00-006 S00 orchestrator security todo S00-002 Зафиксировать browser/reference matrix
8 S00-007 S00 security orchestrator todo S00-004, S00-005 Утвердить password и crypto unlock модель
9 S00-008 S00 ci-cd qa todo S00-003, S00-004 Описать WSS/upload/TURN/push topology
10 S00-009 S00 orchestrator security todo S00-003, S00-004, S00-005, S00-006, S00-007, S00-008 Согласовать результаты spikes
11 S00-011 S00 ci-cd security done auto-ci-cd-d105e8027730 S00-001 Restore verified npm registry access for the stack spike
12 S00-012 S00 ci-cd qa done auto-ci-cd-f101e40d9902 S00-001, S00-011, S00-013, S00-014, S00-015 Fix runner prompt delivery after partial stdin timeout
13 S00-013 S00 ci-cd qa done auto-ci-cd-5f68f03dd33b S00-001, S00-011 Bound oversized S21-006 runner context without truncating requirements
14 S00-014 S00 ci-cd qa done auto-ci-cd-14343249da62 S00-001, S00-011, S00-013 Fix repeated runner cleanup after a submitted parent is reaped
15 S00-015 S00 ci-cd qa done auto-ci-cd-84e209103f24 S00-001, S00-011, S00-013, S00-014, S00-016 Устранить прерывание: Fix runner prompt delivery after partial stdin timeout
16 S00-016 S00 ci-cd qa done auto-ci-cd-351a0cbbabef S00-001, S00-011, S00-013, S00-014 Restore reviewer model availability after provider capacity failure
17 S00-017 S00 protocol security done auto-protocol-599343cd9e3f S00-001, S00-002 Establish fail-closed SCRAM server-final validation
18 S00-018 S00 protocol security done auto-protocol-89fe6563092c S00-001, S00-002, S00-017 Validate bounded standalone XML ingress for the XMPP candidate
19 S00-019 S00 crypto security done auto-crypto-c68801170fa4 S00-001, S00-002, S00-017, S00-018 Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
20 S00-010 S00 qa orchestrator todo S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 Gate: Профиль и проверка стека
21 S01-001 S01 orchestrator security todo S00-010 Описать identity/model contracts
22 S01-002 S01 orchestrator security todo S00-010, S01-001 Описать async account context
planning/tasks.json
+500 -2
View File
@@ -215,7 +215,9 @@
"title": "Выбрать framework и build runtime",
"outcome": "ADR сравнивает два допустимых стека, фиксирует конкретные проверенные versions, lockfile и один минимальный rendering spike.",
"depends_on": [
"S00-001"
"S00-001",
"S00-011",
"S00-012"
],
"requirements": [
"NFR-007"
@@ -265,7 +267,10 @@
"outcome": "Spike подтверждает WSS stream, SCRAM, parser limits и нужные module extension points выбранной библиотеки.",
"depends_on": [
"S00-001",
"S00-002"
"S00-002",
"S00-017",
"S00-018",
"S00-019"
],
"requirements": [
"ACC-004",
@@ -617,6 +622,499 @@
],
"context_budget_chars": 48000
},
{
"id": "S00-011",
"stage": "S00",
"kind": "blocker",
"root_task": "S00-002",
"blocker_depth": 1,
"unblocks": [
"S00-002"
],
"role": "ci-cd",
"reviewer_role": "security",
"title": "Restore verified npm registry access for the stack spike",
"outcome": "A documented registry-capable execution path with successful npm metadata and integrity-checked package tarball retrieval, allowing a fresh S00-002 executor to run its own spike.",
"depends_on": [
"S00-001"
],
"requirements": [
"NFR-007"
],
"scope": [
"experiments/0001-stack/registry-access/**"
],
"inputs": [
"docs/WEB_PROFILE.md",
"docs/ARCHITECTURE.md",
"docs/CONTRACTS.md",
"docs/TESTING.md",
"roles/orchestrator.md",
"docs/decisions/README.md",
"state/blockers/S00-011.md"
],
"spec_sections": [],
"ui_sections": [],
"steps": [
"External owner: provide working DNS and HTTPS egress to registry.npmjs.org/package tarballs in the agent harness without disabling TLS or the project write sandbox; no secrets requested.",
"In a fresh resolver process verify public metadata and retrieve one exact-version package tarball in the scoped experiment directory, checking registry integrity metadata.",
"Record exact commands, exit codes and nonsecret runner environment instructions in the scoped registry-access report; do not select the stack or implement rendering.",
"Submit connectivity evidence for independent security review."
],
"acceptance": [
"npm metadata request succeeds with TLS validation enabled in the execution environment used for the next stack task.",
"One exact-version package tarball is retrieved and checked against registry integrity metadata.",
"No TLS/CORS bypass, secrets, shared module changes or premature stack selection; reproducible safe execution instructions recorded."
],
"checks": [
"Repeat the original npm view command and record exit 0 with actual package metadata.",
"Retrieve and integrity-check one exact-version tarball over HTTPS; record actual result and environment constraints."
],
"context_budget_chars": 48000
},
{
"id": "S00-012",
"stage": "S00",
"kind": "blocker",
"root_task": "S00-002",
"blocker_depth": 1,
"unblocks": [
"S00-002"
],
"role": "ci-cd",
"reviewer_role": "qa",
"title": "Fix runner prompt delivery after partial stdin timeout",
"outcome": "Reliable complete prompt delivery under startup delay and pipe backpressure, preserving runner lifecycle guarantees.",
"depends_on": [
"S00-001",
"S00-011",
"S00-013",
"S00-014",
"S00-015"
],
"requirements": [
"NFR-007"
],
"scope": [
"scripts/runner.py",
"tests/tooling/test_automation.py"
],
"inputs": [
"docs/WEB_PROFILE.md",
"docs/ARCHITECTURE.md",
"docs/CONTRACTS.md",
"docs/TESTING.md",
"roles/orchestrator.md",
"docs/decisions/README.md",
"state/blockers/S00-012.md"
],
"spec_sections": [],
"ui_sections": [],
"steps": [
"Read diagnostic evidence and reproduce delayed-reader partial-write timeout without launching a model.",
"Fix only runner stdin delivery; retain fresh sessions, prompt budget, terminal-transition monitoring, timeout and process-tree cleanup.",
"Add a deterministic delayed-reader large-prompt regression check and run focused runner tests plus make check.",
"Record evidence/handoff/commit message and submit for independent review."
],
"acceptance": [
"A delayed stdin reader receives the complete large UTF-8 prompt and EOF without hanging.",
"Timeout and terminal-transition process cleanup still work; no background source-writing descendants remain.",
"Existing runner/tooling checks pass; no task scope, spec snapshots or product implementation is changed."
],
"checks": [
"Delayed-reader large UTF-8 prompt regression.",
"Existing runner timeout, transition, scope and fresh-session tests.",
"make check"
],
"context_budget_chars": 48000
},
{
"id": "S00-013",
"stage": "S00",
"kind": "blocker",
"root_task": "S00-002",
"blocker_depth": 2,
"unblocks": [
"S00-012"
],
"role": "ci-cd",
"reviewer_role": "qa",
"title": "Bound oversized S21-006 runner context without truncating requirements",
"outcome": "All task prompts fit the existing configured budget with exact relevant requirements retained and no silent truncation.",
"depends_on": [
"S00-001",
"S00-011"
],
"requirements": [
"NFR-007"
],
"scope": [
"scripts/runner.py",
"tests/tooling/test_automation.py"
],
"inputs": [
"docs/WEB_PROFILE.md",
"docs/ARCHITECTURE.md",
"docs/CONTRACTS.md",
"docs/TESTING.md",
"roles/orchestrator.md",
"docs/decisions/README.md",
"state/blockers/S00-012.md",
"state/blockers/S00-013.md"
],
"spec_sections": [],
"ui_sections": [],
"steps": [
"Inspect S21-006 prompt inputs and identify unnecessary duplication or overly broad context loading.",
"Implement one bounded context-preparation correction while preserving assignment instructions and exact relevant requirements; retain stdin transport changes.",
"Add focused regression for the real oversized context and run existing prompt-budget checks and make check.",
"Record evidence/handoff/message and submit for independent review."
],
"acceptance": [
"S21-006 and all current task prompts fit the existing 80000-character limit.",
"Exact required context is retained; no spec snapshot edits, silent truncation or validation suppression.",
"stdin delivery, timeout and terminal-transition regression checks remain passing; make check passes."
],
"checks": [
"Existing FoundationRunnerTests all-current-prompts budget check.",
"Delayed UTF-8 stdin delivery and runner lifecycle tests.",
"make check"
],
"context_budget_chars": 48000
},
{
"id": "S00-014",
"stage": "S00",
"kind": "blocker",
"root_task": "S00-002",
"blocker_depth": 2,
"unblocks": [
"S00-012"
],
"role": "ci-cd",
"reviewer_role": "qa",
"title": "Fix repeated runner cleanup after a submitted parent is reaped",
"outcome": "Reliable repeated lifecycle cleanup after submit with a reaped parent and SIGTERM-ignoring descendant, preserving actual process-tree termination and valid workflow state.",
"depends_on": [
"S00-001",
"S00-011",
"S00-013"
],
"requirements": [
"NFR-007"
],
"scope": [
"scripts/runner.py",
"tests/tooling/test_automation.py"
],
"inputs": [
"docs/WEB_PROFILE.md",
"docs/ARCHITECTURE.md",
"docs/CONTRACTS.md",
"docs/TESTING.md",
"roles/orchestrator.md",
"docs/decisions/README.md",
"state/blockers/S00-012.md",
"state/blockers/S00-014.md"
],
"spec_sections": [],
"ui_sections": [],
"steps": [
"Read S00-012 evidence and preserved descendant regressions.",
"Reproduce repeated cleanup EPERM in the supplied execution harness without launching a model.",
"Correct only the repeated-cleanup lifecycle failure; retain fail-closed handling for inaccessible live descendants and terminal/deadline monitoring.",
"Run descendant, delayed stdin and existing lifecycle checks plus make check; record evidence and submit."
],
"acceptance": [
"Submit-transition descendant regression completes without invalid escalation or delayed source writes.",
"Timeout and terminal-transition paths terminate descendants, including SIGTERM-ignoring children.",
"Repeated cleanup does not hide a failure to terminate a live process; stdin delivery and prompt budgets remain intact."
],
"checks": [
"Both preserved descendant regressions.",
"Delayed-reader UTF-8/EOF, timeout, transition, scope and fresh-session runner checks.",
"make check"
],
"context_budget_chars": 48000
},
{
"id": "S00-015",
"stage": "S00",
"kind": "blocker",
"root_task": "S00-002",
"blocker_depth": 2,
"unblocks": [
"S00-012"
],
"role": "ci-cd",
"reviewer_role": "qa",
"title": "Устранить прерывание: Fix runner prompt delivery after partial stdin timeout",
"outcome": "Устранить одну указанную причину прерывания и доказать готовность исходной задачи к новому запуску; не выполнять соседние задачи.",
"depends_on": [
"S00-001",
"S00-011",
"S00-013",
"S00-014",
"S00-016"
],
"requirements": [],
"scope": [
"scripts/runner.py",
"tests/tooling/test_automation.py"
],
"inputs": [
"docs/WEB_PROFILE.md",
"docs/ARCHITECTURE.md",
"docs/CONTRACTS.md",
"docs/TESTING.md",
"roles/orchestrator.md",
"docs/decisions/README.md",
"state/blockers/S00-012.md",
"state/blockers/S00-015.md"
],
"spec_sections": [],
"ui_sections": [],
"steps": [
"Прочитать blocker report и handoff.",
"Воспроизвести конкретную причину.",
"Исправить только локальную причину в scope или уточнить внешний input.",
"Выполнить focused проверку и submit."
],
"acceptance": [
"Причина воспроизводимо устранена.",
"Исходная задача не завершена обходом требований."
],
"checks": [
"Повторить сценарий прерывания.",
"Проверить отсутствие изменений вне scope."
],
"context_budget_chars": 48000
},
{
"id": "S00-016",
"stage": "S00",
"kind": "blocker",
"root_task": "S00-002",
"blocker_depth": 3,
"unblocks": [
"S00-015"
],
"role": "ci-cd",
"reviewer_role": "qa",
"title": "Restore reviewer model availability after provider capacity failure",
"outcome": "A verified available tool-capable fresh reviewer execution path after explicit external provider/configuration readiness, without bypassing S00-012 independent review.",
"depends_on": [
"S00-001",
"S00-011",
"S00-013",
"S00-014"
],
"requirements": [],
"scope": [
"scripts/runner.py",
"tests/tooling/test_automation.py"
],
"inputs": [
"docs/WEB_PROFILE.md",
"docs/ARCHITECTURE.md",
"docs/CONTRACTS.md",
"docs/TESTING.md",
"roles/orchestrator.md",
"docs/decisions/README.md",
"state/blockers/S00-012.md",
"state/blockers/S00-015.md",
"state/blockers/S00-016.md"
],
"spec_sections": [],
"ui_sections": [],
"steps": [
"Obtain coordinator confirmation that the configured reviewer model is available or an available replacement is explicitly authorized and locally configured; do not put credentials in evidence.",
"After external release, verify the readiness condition using the coordinator-authorized harness in a fresh process; do not retry indefinitely.",
"Record actual readiness evidence and submit remediation for independent review; leave S00-012 acceptance to its subsequent fresh reviewer."
],
"acceptance": [
"Provider/configuration readiness is explicitly supplied by the coordinator.",
"A fresh tool-capable reviewer execution path succeeds without the recorded startup capacity/503 failure.",
"S00-012 is not accepted or bypassed by the remediation."
],
"checks": [
"Inspect failed reviewer run evidence for the exact external failure.",
"Record actual authorized fresh harness startup result after external readiness; do not claim unavailable checks passed."
],
"context_budget_chars": 48000
},
{
"id": "S00-017",
"stage": "S00",
"kind": "blocker",
"root_task": "S00-003",
"blocker_depth": 1,
"unblocks": [
"S00-003"
],
"role": "protocol",
"reviewer_role": "security",
"title": "Establish fail-closed SCRAM server-final validation",
"outcome": "One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.",
"depends_on": [
"S00-001",
"S00-002"
],
"requirements": [
"ACC-004",
"NET-003",
"NET-004"
],
"scope": [
"experiments/0002-xmpp-library/sasl-validation/**",
"docs/decisions/0002-xmpp-sasl-validation.md"
],
"inputs": [
"docs/WEB_PROFILE.md",
"docs/ARCHITECTURE.md",
"docs/CONTRACTS.md",
"docs/TESTING.md",
"roles/protocol.md",
"docs/decisions/README.md",
"state/blockers/S00-017.md"
],
"spec_sections": [],
"ui_sections": [],
"steps": [
"Read S00-003 blocker evidence and reproduce the missing/forged/premature success defect with exact candidate versions.",
"Evaluate supported SASL feature replacement or a maintained alternative; reuse vetted library crypto, never implement crypto primitives or modify ignored vendor source as the deliverable.",
"Build only a fixture-bound SASL validation experiment with exact dependency pins and document how S00-003 can integrate it through supported extension points; do not build production adapters/shared contracts.",
"Test valid RFC SCRAM transcript and missing/forged/premature server-final; record actual commands and limitations for independent security review."
],
"acceptance": [
"Missing, forged and premature SCRAM server-final cannot emit auth:success or request authenticated restart in the demonstrated integration.",
"A valid primary-spec SCRAM fixture is accepted only after server signature verification, with no handwritten crypto primitives, stub-success or plaintext fallback.",
"A supported integration path and pinned dependencies/licenses are documented; original library/WSS/parser/extension task remains separate."
],
"checks": [
"Reproduce original missing/forged/premature success rejection through the integrated SASL handler, not only a standalone mechanism.",
"Execute valid RFC SCRAM transcript and negative server-final cases with actual vetted implementation; do not log real credentials."
],
"context_budget_chars": 48000
},
{
"id": "S00-018",
"stage": "S00",
"kind": "blocker",
"root_task": "S00-003",
"blocker_depth": 1,
"unblocks": [
"S00-003"
],
"role": "protocol",
"reviewer_role": "security",
"title": "Validate bounded standalone XML ingress for the XMPP candidate",
"outcome": "One isolated runnable and independently reviewed ingress experiment enforces explicit finite XML resource limits and standalone text XML per WebSocket message before unsafe accumulation/import, through a supported library integration path.",
"depends_on": [
"S00-001",
"S00-002",
"S00-017"
],
"requirements": [
"ACC-004",
"NET-003",
"NET-004"
],
"scope": [
"experiments/0002-xmpp-library/parser-validation/**",
"docs/decisions/0002-xmpp-parser-validation.md"
],
"inputs": [
"docs/WEB_PROFILE.md",
"docs/ARCHITECTURE.md",
"docs/CONTRACTS.md",
"docs/TESTING.md",
"roles/protocol.md",
"docs/decisions/README.md",
"state/blockers/S00-018.md"
],
"spec_sections": [],
"ui_sections": [],
"steps": [
"Read original blocker evidence, bounded probe, shipped parser/transport APIs and RFC 7395 framing; reproduce the stock failure with finite synthetic input.",
"Choose and document a supported ingress integration using vetted existing XML parsing; keep limits experiment-local, do not implement a handwritten security XML parser or patch ignored vendor sources.",
"Enforce byte/depth/element/attribute budgets and complete single-document text-message framing before unbounded tree/import work; reject invalid input terminally and clear attempt state.",
"Add valid boundary and adversarial fixtures including incomplete messages, multiple roots, oversized tokens/attributes, deep XML, malformed XML and binary messages; verify rejection causes no stanza delivery or retained cross-message state.",
"Record exact dependencies/licenses/browser API constraints if adding packages, runnable commands/results and limitations, then submit for independent security review."
],
"acceptance": [
"Explicit finite byte/depth/element/attribute budgets are enforced before uncontrolled accumulation/import; boundary-valid stanza still parses with actual library behavior.",
"Each WebSocket message is one complete standalone text XML document; incomplete/multiple-root/binary input is rejected and cannot be revived by a later message.",
"Original large/deep/cross-message failure categories are rejected under documented local limits without post-import-only checks, vendor patch or TLS/CORS bypass.",
"One supported integration path and cleanup/reset behavior are demonstrated by runnable actual ingress tests; no production shared contract, auth policy or product limit change."
],
"checks": [
"Positive boundary-valid framed stanza using the actual candidate registry/parser and ingress integration.",
"Original bounded probe categories exceed local budgets or fail framing and produce terminal rejection without stanza emission.",
"Malformed/unfinished/multiple-root/binary/oversized-token/attribute/depth/element cases; no cross-message retained state or late revival.",
"Fresh attempt/reset accepts valid input; dependency pin/license/API and scope inspection."
],
"context_budget_chars": 48000
},
{
"id": "S00-019",
"stage": "S00",
"kind": "blocker",
"root_task": "S00-003",
"blocker_depth": 1,
"unblocks": [
"S00-003"
],
"role": "crypto",
"reviewer_role": "security",
"title": "Validate browser-compatible SCRAM-SHA-512 through a public mechanism API",
"outcome": "One isolated runnable independently reviewed browser-compatible SCRAM-SHA-512 integration uses vetted existing crypto through a supported public mechanism API and validates proof/server-final without vendor/private-field patching or custom primitives.",
"depends_on": [
"S00-001",
"S00-002",
"S00-017",
"S00-018"
],
"requirements": [
"ACC-004",
"NET-003",
"NET-004"
],
"scope": [
"experiments/0002-xmpp-library/sha512-validation/**",
"docs/decisions/0002-xmpp-sha512-validation.md"
],
"inputs": [
"docs/WEB_PROFILE.md",
"docs/ARCHITECTURE.md",
"docs/CONTRACTS.md",
"docs/TESTING.md",
"roles/protocol.md",
"docs/decisions/README.md",
"state/blockers/S00-019.md"
],
"spec_sections": [],
"ui_sections": [],
"steps": [
"Read original blocker, accepted stack/SASL ADR and pinned browser implementation/public APIs.",
"Reproduce the HMAC alias defect and evaluate an existing vetted mechanism/backend or candidate with primary docs, exact pins, license and browser/API checks.",
"Implement only isolated SCRAM-SHA-512 integration via supported public APIs using existing cryptographic code; retain fail-closed mutual authentication and real absence of channel binding.",
"Run fixed known vectors and full exchange positive/negative checks against the browser-resolved backend; preserve evidence, limitations and handoff for independent security review."
],
"acceptance": [
"RFC SHA-512 known vectors match using actual browser-compatible crypto backend, including algorithm spelling and varied key lengths.",
"Full SCRAM-SHA-512 client proof and verified server-final agree with an independent existing implementation/fixed externally derived vector; missing/forged/premature final fails without authentication/restart.",
"Integration uses public mechanism APIs, correct SCRAM-SHA-512 wire name, no private-field/vendor patch, invented binding, custom primitives or plaintext downgrade.",
"Runnable pinned fixture experiment and browser bundle/backend evidence permit independent review; no parent WSS/library selection/shared contract work."
],
"checks": [
"Reproduce original browser sha-512 HMAC mismatch.",
"Fixed SHA-512/HMAC known vectors including long keys using selected browser backend.",
"Full SCRAM-SHA-512 verified exchange and forged/missing/out-of-order server-final rejection.",
"Exact dependency/license/API/browser checks and repeatable clean install/bundle plus focused suite."
],
"context_budget_chars": 48000
},
{
"id": "S00-010",
"stage": "S00",
planning/tasks/S00-002.md
+1 -1
View File
@@ -5,7 +5,7 @@
- Этап: S00
- Оператор: orchestrator
- Reviewer: security
- Зависимости: S00-001
- Зависимости: S00-001, S00-011, S00-012
- Требования: NFR-007
## Один результат
planning/tasks/S00-003.md
+1 -1
View File
@@ -5,7 +5,7 @@
- Этап: S00
- Оператор: protocol
- Reviewer: qa
- Зависимости: S00-001, S00-002
- Зависимости: S00-001, S00-002, S00-017, S00-018, S00-019
- Требования: ACC-004, NET-003, NET-004
## Один результат
planning/tasks/S00-011.md
+57
View File
@@ -0,0 +1,57 @@
# S00-011: Restore verified npm registry access for the stack spike
- Remediation для: S00-002; root: S00-002; depth: 1
> Generated from planning/tasks.json; status is in state/tasks.json.
- Этап: S00
- Оператор: ci-cd
- Reviewer: security
- Зависимости: S00-001
- Требования: NFR-007
## Один результат
A documented registry-capable execution path with successful npm metadata and integrity-checked package tarball retrieval, allowing a fresh S00-002 executor to run its own spike.
## Разрешённые пути
- `experiments/0001-stack/registry-access/**`
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
## Прочитать
- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/orchestrator.md
- docs/decisions/README.md
- state/blockers/S00-011.md
## Шаги
1. External owner: provide working DNS and HTTPS egress to registry.npmjs.org/package tarballs in the agent harness without disabling TLS or the project write sandbox; no secrets requested.
2. In a fresh resolver process verify public metadata and retrieve one exact-version package tarball in the scoped experiment directory, checking registry integrity metadata.
3. Record exact commands, exit codes and nonsecret runner environment instructions in the scoped registry-access report; do not select the stack or implement rendering.
4. Submit connectivity evidence for independent security review.
## Приёмка
1. npm metadata request succeeds with TLS validation enabled in the execution environment used for the next stack task.
2. One exact-version package tarball is retrieved and checked against registry integrity metadata.
3. No TLS/CORS bypass, secrets, shared module changes or premature stack selection; reproducible safe execution instructions recorded.
## Focused checks
1. Repeat the original npm view command and record exit 0 with actual package metadata.
2. Retrieve and integrity-check one exact-version tarball over HTTPS; record actual result and environment constraints.
## Блокер и завершение запуска
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
## Передача
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
planning/tasks/S00-012.md
+59
View File
@@ -0,0 +1,59 @@
# S00-012: Fix runner prompt delivery after partial stdin timeout
- Remediation для: S00-002; root: S00-002; depth: 1
> Generated from planning/tasks.json; status is in state/tasks.json.
- Этап: S00
- Оператор: ci-cd
- Reviewer: qa
- Зависимости: S00-001, S00-011, S00-013, S00-014, S00-015
- Требования: NFR-007
## Один результат
Reliable complete prompt delivery under startup delay and pipe backpressure, preserving runner lifecycle guarantees.
## Разрешённые пути
- `scripts/runner.py`
- `tests/tooling/test_automation.py`
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
## Прочитать
- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/orchestrator.md
- docs/decisions/README.md
- state/blockers/S00-012.md
## Шаги
1. Read diagnostic evidence and reproduce delayed-reader partial-write timeout without launching a model.
2. Fix only runner stdin delivery; retain fresh sessions, prompt budget, terminal-transition monitoring, timeout and process-tree cleanup.
3. Add a deterministic delayed-reader large-prompt regression check and run focused runner tests plus make check.
4. Record evidence/handoff/commit message and submit for independent review.
## Приёмка
1. A delayed stdin reader receives the complete large UTF-8 prompt and EOF without hanging.
2. Timeout and terminal-transition process cleanup still work; no background source-writing descendants remain.
3. Existing runner/tooling checks pass; no task scope, spec snapshots or product implementation is changed.
## Focused checks
1. Delayed-reader large UTF-8 prompt regression.
2. Existing runner timeout, transition, scope and fresh-session tests.
3. make check
## Блокер и завершение запуска
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
## Передача
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
planning/tasks/S00-013.md
+60
View File
@@ -0,0 +1,60 @@
# S00-013: Bound oversized S21-006 runner context without truncating requirements
- Remediation для: S00-012; root: S00-002; depth: 2
> Generated from planning/tasks.json; status is in state/tasks.json.
- Этап: S00
- Оператор: ci-cd
- Reviewer: qa
- Зависимости: S00-001, S00-011
- Требования: NFR-007
## Один результат
All task prompts fit the existing configured budget with exact relevant requirements retained and no silent truncation.
## Разрешённые пути
- `scripts/runner.py`
- `tests/tooling/test_automation.py`
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
## Прочитать
- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/orchestrator.md
- docs/decisions/README.md
- state/blockers/S00-012.md
- state/blockers/S00-013.md
## Шаги
1. Inspect S21-006 prompt inputs and identify unnecessary duplication or overly broad context loading.
2. Implement one bounded context-preparation correction while preserving assignment instructions and exact relevant requirements; retain stdin transport changes.
3. Add focused regression for the real oversized context and run existing prompt-budget checks and make check.
4. Record evidence/handoff/message and submit for independent review.
## Приёмка
1. S21-006 and all current task prompts fit the existing 80000-character limit.
2. Exact required context is retained; no spec snapshot edits, silent truncation or validation suppression.
3. stdin delivery, timeout and terminal-transition regression checks remain passing; make check passes.
## Focused checks
1. Existing FoundationRunnerTests all-current-prompts budget check.
2. Delayed UTF-8 stdin delivery and runner lifecycle tests.
3. make check
## Блокер и завершение запуска
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
## Передача
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
planning/tasks/S00-014.md
+60
View File
@@ -0,0 +1,60 @@
# S00-014: Fix repeated runner cleanup after a submitted parent is reaped
- Remediation для: S00-012; root: S00-002; depth: 2
> Generated from planning/tasks.json; status is in state/tasks.json.
- Этап: S00
- Оператор: ci-cd
- Reviewer: qa
- Зависимости: S00-001, S00-011, S00-013
- Требования: NFR-007
## Один результат
Reliable repeated lifecycle cleanup after submit with a reaped parent and SIGTERM-ignoring descendant, preserving actual process-tree termination and valid workflow state.
## Разрешённые пути
- `scripts/runner.py`
- `tests/tooling/test_automation.py`
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
## Прочитать
- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/orchestrator.md
- docs/decisions/README.md
- state/blockers/S00-012.md
- state/blockers/S00-014.md
## Шаги
1. Read S00-012 evidence and preserved descendant regressions.
2. Reproduce repeated cleanup EPERM in the supplied execution harness without launching a model.
3. Correct only the repeated-cleanup lifecycle failure; retain fail-closed handling for inaccessible live descendants and terminal/deadline monitoring.
4. Run descendant, delayed stdin and existing lifecycle checks plus make check; record evidence and submit.
## Приёмка
1. Submit-transition descendant regression completes without invalid escalation or delayed source writes.
2. Timeout and terminal-transition paths terminate descendants, including SIGTERM-ignoring children.
3. Repeated cleanup does not hide a failure to terminate a live process; stdin delivery and prompt budgets remain intact.
## Focused checks
1. Both preserved descendant regressions.
2. Delayed-reader UTF-8/EOF, timeout, transition, scope and fresh-session runner checks.
3. make check
## Блокер и завершение запуска
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
## Передача
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
planning/tasks/S00-015.md
+58
View File
@@ -0,0 +1,58 @@
# S00-015: Устранить прерывание: Fix runner prompt delivery after partial stdin timeout
- Remediation для: S00-012; root: S00-002; depth: 2
> Generated from planning/tasks.json; status is in state/tasks.json.
- Этап: S00
- Оператор: ci-cd
- Reviewer: qa
- Зависимости: S00-001, S00-011, S00-013, S00-014, S00-016
- Требования: инженерная подготовка
## Один результат
Устранить одну указанную причину прерывания и доказать готовность исходной задачи к новому запуску; не выполнять соседние задачи.
## Разрешённые пути
- `scripts/runner.py`
- `tests/tooling/test_automation.py`
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
## Прочитать
- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/orchestrator.md
- docs/decisions/README.md
- state/blockers/S00-012.md
- state/blockers/S00-015.md
## Шаги
1. Прочитать blocker report и handoff.
2. Воспроизвести конкретную причину.
3. Исправить только локальную причину в scope или уточнить внешний input.
4. Выполнить focused проверку и submit.
## Приёмка
1. Причина воспроизводимо устранена.
2. Исходная задача не завершена обходом требований.
## Focused checks
1. Повторить сценарий прерывания.
2. Проверить отсутствие изменений вне scope.
## Блокер и завершение запуска
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
## Передача
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
planning/tasks/S00-016.md
+59
View File
@@ -0,0 +1,59 @@
# S00-016: Restore reviewer model availability after provider capacity failure
- Remediation для: S00-015; root: S00-002; depth: 3
> Generated from planning/tasks.json; status is in state/tasks.json.
- Этап: S00
- Оператор: ci-cd
- Reviewer: qa
- Зависимости: S00-001, S00-011, S00-013, S00-014
- Требования: инженерная подготовка
## Один результат
A verified available tool-capable fresh reviewer execution path after explicit external provider/configuration readiness, without bypassing S00-012 independent review.
## Разрешённые пути
- `scripts/runner.py`
- `tests/tooling/test_automation.py`
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
## Прочитать
- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/orchestrator.md
- docs/decisions/README.md
- state/blockers/S00-012.md
- state/blockers/S00-015.md
- state/blockers/S00-016.md
## Шаги
1. Obtain coordinator confirmation that the configured reviewer model is available or an available replacement is explicitly authorized and locally configured; do not put credentials in evidence.
2. After external release, verify the readiness condition using the coordinator-authorized harness in a fresh process; do not retry indefinitely.
3. Record actual readiness evidence and submit remediation for independent review; leave S00-012 acceptance to its subsequent fresh reviewer.
## Приёмка
1. Provider/configuration readiness is explicitly supplied by the coordinator.
2. A fresh tool-capable reviewer execution path succeeds without the recorded startup capacity/503 failure.
3. S00-012 is not accepted or bypassed by the remediation.
## Focused checks
1. Inspect failed reviewer run evidence for the exact external failure.
2. Record actual authorized fresh harness startup result after external readiness; do not claim unavailable checks passed.
## Блокер и завершение запуска
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
## Передача
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
planning/tasks/S00-017.md
+58
View File
@@ -0,0 +1,58 @@
# S00-017: Establish fail-closed SCRAM server-final validation
- Remediation для: S00-003; root: S00-003; depth: 1
> Generated from planning/tasks.json; status is in state/tasks.json.
- Этап: S00
- Оператор: protocol
- Reviewer: security
- Зависимости: S00-001, S00-002
- Требования: ACC-004, NET-003, NET-004
## Один результат
One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.
## Разрешённые пути
- `experiments/0002-xmpp-library/sasl-validation/**`
- `docs/decisions/0002-xmpp-sasl-validation.md`
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
## Прочитать
- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/protocol.md
- docs/decisions/README.md
- state/blockers/S00-017.md
## Шаги
1. Read S00-003 blocker evidence and reproduce the missing/forged/premature success defect with exact candidate versions.
2. Evaluate supported SASL feature replacement or a maintained alternative; reuse vetted library crypto, never implement crypto primitives or modify ignored vendor source as the deliverable.
3. Build only a fixture-bound SASL validation experiment with exact dependency pins and document how S00-003 can integrate it through supported extension points; do not build production adapters/shared contracts.
4. Test valid RFC SCRAM transcript and missing/forged/premature server-final; record actual commands and limitations for independent security review.
## Приёмка
1. Missing, forged and premature SCRAM server-final cannot emit auth:success or request authenticated restart in the demonstrated integration.
2. A valid primary-spec SCRAM fixture is accepted only after server signature verification, with no handwritten crypto primitives, stub-success or plaintext fallback.
3. A supported integration path and pinned dependencies/licenses are documented; original library/WSS/parser/extension task remains separate.
## Focused checks
1. Reproduce original missing/forged/premature success rejection through the integrated SASL handler, not only a standalone mechanism.
2. Execute valid RFC SCRAM transcript and negative server-final cases with actual vetted implementation; do not log real credentials.
## Блокер и завершение запуска
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
## Передача
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
planning/tasks/S00-018.md
+62
View File
@@ -0,0 +1,62 @@
# S00-018: Validate bounded standalone XML ingress for the XMPP candidate
- Remediation для: S00-003; root: S00-003; depth: 1
> Generated from planning/tasks.json; status is in state/tasks.json.
- Этап: S00
- Оператор: protocol
- Reviewer: security
- Зависимости: S00-001, S00-002, S00-017
- Требования: ACC-004, NET-003, NET-004
## Один результат
One isolated runnable and independently reviewed ingress experiment enforces explicit finite XML resource limits and standalone text XML per WebSocket message before unsafe accumulation/import, through a supported library integration path.
## Разрешённые пути
- `experiments/0002-xmpp-library/parser-validation/**`
- `docs/decisions/0002-xmpp-parser-validation.md`
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
## Прочитать
- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/protocol.md
- docs/decisions/README.md
- state/blockers/S00-018.md
## Шаги
1. Read original blocker evidence, bounded probe, shipped parser/transport APIs and RFC 7395 framing; reproduce the stock failure with finite synthetic input.
2. Choose and document a supported ingress integration using vetted existing XML parsing; keep limits experiment-local, do not implement a handwritten security XML parser or patch ignored vendor sources.
3. Enforce byte/depth/element/attribute budgets and complete single-document text-message framing before unbounded tree/import work; reject invalid input terminally and clear attempt state.
4. Add valid boundary and adversarial fixtures including incomplete messages, multiple roots, oversized tokens/attributes, deep XML, malformed XML and binary messages; verify rejection causes no stanza delivery or retained cross-message state.
5. Record exact dependencies/licenses/browser API constraints if adding packages, runnable commands/results and limitations, then submit for independent security review.
## Приёмка
1. Explicit finite byte/depth/element/attribute budgets are enforced before uncontrolled accumulation/import; boundary-valid stanza still parses with actual library behavior.
2. Each WebSocket message is one complete standalone text XML document; incomplete/multiple-root/binary input is rejected and cannot be revived by a later message.
3. Original large/deep/cross-message failure categories are rejected under documented local limits without post-import-only checks, vendor patch or TLS/CORS bypass.
4. One supported integration path and cleanup/reset behavior are demonstrated by runnable actual ingress tests; no production shared contract, auth policy or product limit change.
## Focused checks
1. Positive boundary-valid framed stanza using the actual candidate registry/parser and ingress integration.
2. Original bounded probe categories exceed local budgets or fail framing and produce terminal rejection without stanza emission.
3. Malformed/unfinished/multiple-root/binary/oversized-token/attribute/depth/element cases; no cross-message retained state or late revival.
4. Fresh attempt/reset accepts valid input; dependency pin/license/API and scope inspection.
## Блокер и завершение запуска
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
## Передача
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
planning/tasks/S00-019.md
+61
View File
@@ -0,0 +1,61 @@
# S00-019: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
- Remediation для: S00-003; root: S00-003; depth: 1
> Generated from planning/tasks.json; status is in state/tasks.json.
- Этап: S00
- Оператор: crypto
- Reviewer: security
- Зависимости: S00-001, S00-002, S00-017, S00-018
- Требования: ACC-004, NET-003, NET-004
## Один результат
One isolated runnable independently reviewed browser-compatible SCRAM-SHA-512 integration uses vetted existing crypto through a supported public mechanism API and validates proof/server-final without vendor/private-field patching or custom primitives.
## Разрешённые пути
- `experiments/0002-xmpp-library/sha512-validation/**`
- `docs/decisions/0002-xmpp-sha512-validation.md`
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
## Прочитать
- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/protocol.md
- docs/decisions/README.md
- state/blockers/S00-019.md
## Шаги
1. Read original blocker, accepted stack/SASL ADR and pinned browser implementation/public APIs.
2. Reproduce the HMAC alias defect and evaluate an existing vetted mechanism/backend or candidate with primary docs, exact pins, license and browser/API checks.
3. Implement only isolated SCRAM-SHA-512 integration via supported public APIs using existing cryptographic code; retain fail-closed mutual authentication and real absence of channel binding.
4. Run fixed known vectors and full exchange positive/negative checks against the browser-resolved backend; preserve evidence, limitations and handoff for independent security review.
## Приёмка
1. RFC SHA-512 known vectors match using actual browser-compatible crypto backend, including algorithm spelling and varied key lengths.
2. Full SCRAM-SHA-512 client proof and verified server-final agree with an independent existing implementation/fixed externally derived vector; missing/forged/premature final fails without authentication/restart.
3. Integration uses public mechanism APIs, correct SCRAM-SHA-512 wire name, no private-field/vendor patch, invented binding, custom primitives or plaintext downgrade.
4. Runnable pinned fixture experiment and browser bundle/backend evidence permit independent review; no parent WSS/library selection/shared contract work.
## Focused checks
1. Reproduce original browser sha-512 HMAC mismatch.
2. Fixed SHA-512/HMAC known vectors including long keys using selected browser backend.
3. Full SCRAM-SHA-512 verified exchange and forged/missing/out-of-order server-final rejection.
4. Exact dependency/license/API/browser checks and repeatable clean install/bundle plus focused suite.
## Блокер и завершение запуска
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
## Передача
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
scripts/runner.py
+30 -12
View File
@@ -121,17 +121,27 @@ The coordinator commits each transition before launching another agent.
'''
paths = ['AGENTS.md', 'README.md', 'master_prompt.md', 'roles/common.md', f'roles/{item["role"]}.md',
'docs/WEB_PROFILE.md', 'docs/ARCHITECTURE.md', 'docs/CONTRACTS.md', 'docs/WORKFLOW.md', 'docs/AUTOMATION.md']
# Only bounded, concrete referenced upstream artifacts, never the entire repository.
# Task-specific inputs are explicit required reads, rather than whole
# documents duplicated beside the exact requirements in the packet.
# Keep startup instructions inline for every fresh session.
required_reads = []
for raw in task['inputs']:
candidate = raw.split(' (')[0]
if candidate not in paths and (self.root / candidate).is_file():
paths.append(candidate)
if not (self.root / candidate).resolve().is_relative_to(self.root):
raise ValueError('Prompt input escapes project root')
if candidate not in paths:
required_reads.append(raw)
row = tracker.state()['tasks'][item['id']]
if row.get('handoff'):
paths.append(row['handoff'])
if item['action'] == 'review' and row.get('evidence'):
paths.append(row['evidence'])
chunks = [assigned]
if required_reads:
chunks.append('\n# Required task input reads (not inlined)\n\n'
'Before implementation or review, read these task inputs from the project. '
'Their contents are not included in this prompt; a missing required artifact is a blocker.\n\n'
+ '\n'.join('- ' + raw for raw in required_reads))
for rel in dict.fromkeys(paths):
path = (self.root / rel).resolve()
if not path.is_relative_to(self.root):
@@ -206,21 +216,21 @@ The coordinator commits each transition before launching another agent.
failure = None
stopped_after_transition = False
returncode = None
with (session / 'output.log').open('wb') as output:
# Give the child a complete UTF-8 stream ending at EOF. Feeding a pipe
# through short communicate() retries can strand a partially sent prompt
# when the child is slow to start reading. The prompt is already persisted.
with prompt_path.open('rb') as prompt_input, (session / 'output.log').open('wb') as output:
try:
process = subprocess.Popen(argv, cwd=self.root, env=env, stdin=subprocess.PIPE,
process = subprocess.Popen(argv, cwd=self.root, env=env, stdin=prompt_input,
stdout=output, stderr=subprocess.STDOUT, start_new_session=(os.name == 'posix'))
deadline = time.monotonic() + self.timeout
first_communicate = True
stopped_after_transition = False
try:
while True:
try:
process.communicate(prompt.encode('utf-8') if first_communicate else None,
timeout=min(.2, max(.01, deadline - time.monotonic())))
process.wait(timeout=min(.2, max(.01, deadline - time.monotonic())))
break
except subprocess.TimeoutExpired:
first_communicate = False
try:
live = self.tracker.state()
current = live['tasks'][item['id']]
@@ -231,17 +241,17 @@ The coordinator commits each transition before launching another agent.
blocker_exit = executor_exit = reviewer_exit = False
if blocker_exit or executor_exit or reviewer_exit:
stop_process_tree(process)
process.communicate()
process.wait()
stopped_after_transition = True
break
if time.monotonic() >= deadline:
stop_process_tree(process)
process.communicate()
process.wait()
failure = 'Agent timed out; process terminated before escalation'
break
except BaseException:
stop_process_tree(process)
process.communicate()
process.wait()
raise
finally:
# Even an exited harness must not leave source-writing descendants alive.
@@ -325,6 +335,10 @@ The coordinator commits each transition before launching another agent.
def stop_process_tree(process):
# Transition/deadline handling and finally share this Popen instance. Once
# cleanup succeeds, do not signal its reaped (possibly reused) group again.
if getattr(process, '_luma_tree_stopped', False) is True:
return
if os.name == 'posix':
try:
os.killpg(process.pid, signal.SIGTERM)
@@ -350,6 +364,10 @@ def stop_process_tree(process):
except ProcessLookupError:
pass
# Set only after all termination steps succeed. Permission errors must
# propagate, including when the parent exited but a descendant is live.
process._luma_tree_stopped = True
def task_scope(tracker, task_id):
return tracker.task(task_id)['scope']
state/blockers/S00-011.md
+22
View File
@@ -0,0 +1,22 @@
# Blocker S00-011
- Original task: S00-002
- Root task: S00-002
- Reporter: auto-orchestrator-3a4f07103316
- Role: orchestrator
- Original owner: auto-orchestrator-3a4f07103316
- Waits for user/external condition: True
## Cause
S00-002 cannot verify versions/licenses or run its required clean install/build: local npm lookup fails with getaddrinfo ENOTFOUND registry.npmjs.org. Restricted network and never-approval execution policy cannot be changed by this agent. External owner must supply registry-capable execution while preserving TLS validation and project-only writes.
## One remediation outcome
A documented registry-capable execution path with successful npm metadata and integrity-checked package tarball retrieval, allowing a fresh S00-002 executor to run its own spike.
## Evidence / reproduction
npm view react version license engines --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000 => exit 1, ENOTFOUND registry.npmjs.org. Evidence: state/evidence/S00-002-auto-orchestrator-3a4f07103316.md
The reporting agent must stop now. A new agent implements only S00-011.
state/blockers/S00-012.md
+22
View File
@@ -0,0 +1,22 @@
# Blocker S00-012
- Original task: S00-002
- Root task: S00-002
- Reporter: manual-security-stdin-20261015a
- Role: security
- Original owner: auto-orchestrator-68a05c587e33
- Waits for user/external condition: False
## Cause
Reviewer startup hangs waiting for stdin EOF: runner retries communicate(None) after a .2s partial-write timeout. Reproduced with delayed stdin reader and 80000-byte payload on Python 3.9.6; no S00-002 acceptance review was performed.
## One remediation outcome
Reliable complete prompt delivery under startup delay and pipe backpressure, preserving runner lifecycle guarantees.
## Evidence / reproduction
state/evidence/S00-002-manual-security-stdin-20261015a.md
The reporting agent must stop now. A new agent implements only S00-012.
state/blockers/S00-013.md
+22
View File
@@ -0,0 +1,22 @@
# Blocker S00-013
- Original task: S00-012
- Root task: S00-002
- Reporter: manual-ci-cd-stdin-20261015b
- Role: ci-cd
- Original owner: manual-ci-cd-stdin-20261015b
- Waits for user/external condition: False
## Cause
Required automation suite fails in existing all-prompts budget test: S21-006 exceeds even a diagnostic 90000-character prompt limit. This blocks verification of the stdin remediation; production limit remains 80000.
## One remediation outcome
All task prompts fit the existing configured budget with exact relevant requirements retained and no silent truncation.
## Evidence / reproduction
python3 -m unittest discover -s tests/tooling -p test_automation.py -v: 22 pass, one prompt-budget error. Read-only Runner(max_prompt_chars=90000).prompt for S21-006 also errors. Evidence: state/evidence/S00-012-manual-ci-cd-stdin-20261015b.md
The reporting agent must stop now. A new agent implements only S00-013.
state/blockers/S00-014.md
+22
View File
@@ -0,0 +1,22 @@
# Blocker S00-014
- Original task: S00-012
- Root task: S00-002
- Reporter: auto-ci-cd-28868645424b
- Role: ci-cd
- Original owner: auto-ci-cd-28868645424b
- Waits for user/external condition: False
## Cause
Submit-transition descendant regression fails: repeated stop_process_tree after parent reap raises EPERM at os.killpg; launch OSError handling then attempts invalid escalation from review state.
## One remediation outcome
Reliable repeated lifecycle cleanup after submit with a reaped parent and SIGTERM-ignoring descendant, preserving actual process-tree termination and valid workflow state.
## Evidence / reproduction
python3 -m unittest discover -s tests/tooling -p test_automation.py -v; test_submit_transition_stops_source_writing_descendant errors. In-memory trace: first cleanup returns parent -15; repeated cleanup raises PermissionError at runner.py:340. Evidence: state/evidence/S00-012-auto-ci-cd-28868645424b.md
The reporting agent must stop now. A new agent implements only S00-014.
state/blockers/S00-015.md
+22
View File
@@ -0,0 +1,22 @@
# Blocker S00-015
- Original task: S00-012
- Root task: S00-002
- Reporter: auto-qa-98b05bd56c25
- Role: qa
- Original owner: auto-ci-cd-f101e40d9902
- Waits for user/external condition: False
## Cause
Agent exited with code 1
## One remediation outcome
Устранить одну указанную причину прерывания и доказать готовность исходной задачи к новому запуску; не выполнять соседние задачи.
## Evidence / reproduction
See original handoff and task evidence.
The reporting agent must stop now. A new agent implements only S00-015.
state/blockers/S00-016.md
+22
View File
@@ -0,0 +1,22 @@
# Blocker S00-016
- Original task: S00-015
- Root task: S00-002
- Reporter: auto-ci-cd-5475930af078
- Role: ci-cd
- Original owner: auto-ci-cd-5475930af078
- Waits for user/external condition: True
## Cause
S00-012 fresh reviewer exited before review because its execution provider returned HTTP 503 and Selected model is at capacity. Provider availability or operator-authorized local harness model configuration is external to S00-015 source scope.
## One remediation outcome
A verified available tool-capable fresh reviewer execution path after explicit external provider/configuration readiness, without bypassing S00-012 independent review.
## Evidence / reproduction
Coordinator run auto-qa-98b05bd56c25: run.json returncode=1 and output.log contains reconnects, HTTP 503 and repeated capacity errors. Diagnosis: state/evidence/S00-015-auto-ci-cd-5475930af078.md. No fresh capacity retry performed.
The reporting agent must stop now. A new agent implements only S00-016.
state/blockers/S00-017.md
+22
View File
@@ -0,0 +1,22 @@
# Blocker S00-017
- Original task: S00-003
- Root task: S00-003
- Reporter: auto-protocol-826aa6bc12ef
- Role: protocol
- Original owner: auto-protocol-826aa6bc12ef
- Waits for user/external condition: False
## Cause
StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.
## One remediation outcome
One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.
## Evidence / reproduction
Run the pinned-node parsed-event reproduction in state/evidence/S00-003-auto-protocol-826aa6bc12ef.md; both invalid server-final cases emit auth:success and request restart (wrapper exit 0 confirms defect). Exact installed source: stanza/plugins/sasl.js success branch.
The reporting agent must stop now. A new agent implements only S00-017.
state/blockers/S00-018.md
+22
View File
@@ -0,0 +1,22 @@
# Blocker S00-018
- Original task: S00-003
- Root task: S00-003
- Reporter: auto-protocol-902594b44429
- Role: protocol
- Original owner: auto-protocol-902594b44429
- Waits for user/external condition: False
## Cause
S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages.
## One remediation outcome
One isolated runnable and independently reviewed ingress experiment enforces explicit finite XML resource limits and standalone text XML per WebSocket message before unsafe accumulation/import, through a supported library integration path.
## Evidence / reproduction
Run the pinned Node command in state/evidence/S00-003-auto-protocol-902594b44429.md: parser-probe/reproduce.mjs exits 0 after observing acceptance of a 1 MiB body, depth 256, and unfinished XML retained across 18 writes. Inspect stanza/transports/websocket.js and jxt/StreamParser.d.ts for absent per-message completeness/resource-limit enforcement.
The reporting agent must stop now. A new agent implements only S00-018.
state/blockers/S00-019.md
+22
View File
@@ -0,0 +1,22 @@
# Blocker S00-019
- Original task: S00-003
- Root task: S00-003
- Reporter: auto-protocol-dcdf92cd067e
- Role: protocol
- Original owner: auto-protocol-dcdf92cd067e
- Waits for user/external condition: False
## Cause
Stanza 12.22.1 browser HMAC sha-512 fails RFC 4231 Test Case 1: wrong 64-byte block selection. SCRAM-SHA-512 derives that hyphenated algorithm; private algorithm mutation/vendor patches are unsupported. Parent cannot attest browser strongest-mechanism compatibility from Node-only success.
## One remediation outcome
One isolated runnable independently reviewed browser-compatible SCRAM-SHA-512 integration uses vetted existing crypto through a supported public mechanism API and validates proof/server-final without vendor/private-field patching or custom primitives.
## Evidence / reproduction
Run the inline diagnostic in state/evidence/S00-003-auto-protocol-dcdf92cd067e.md using accepted Node runtime; sha-512 mismatches fixed RFC/Node digest while sha512 alias and SHA-256/SHA-1 controls match. Source Hmac.js uses alg === sha512 for 128-byte blocks.
The reporting agent must stop now. A new agent implements only S00-019.
state/commit_messages/auto-ci-cd-14343249da62.txt
+4
View File
@@ -0,0 +1,4 @@
Make successful runner process-tree cleanup idempotent
Changes: Record completed termination on the Popen instance after all cleanup steps succeed; avoid repeated signals to the reaped group. Add deterministic repeated-EPERM and failed-descendant-kill retry regressions without suppressing permission errors.
Validation: Four focused cleanup tests passed; make check passed 72 tests and plan/snapshot validation. git diff --check passed. Natural prior EPERM did not recur; injected EPERM reproduced the pre-fix failure. No application or parent-task acceptance is claimed.
state/commit_messages/auto-ci-cd-351a0cbbabef.txt
+4
View File
@@ -0,0 +1,4 @@
Record recovered fresh reviewer execution path
Changes: Document coordinator-authorized external readiness and successful post-release tool use through the shared reviewer/executor harness; add S00-016 evidence and handoff. No source or harness configuration changes.
Validation: Read-only readiness assertions passed with exit 0; tasks.py validate passed for 281 tasks at revision 29; git diff --check passed. Parent tasks remain blocked and unaccepted. Future provider capacity and S00-012 acceptance require separate fresh review.
state/commit_messages/auto-ci-cd-5f68f03dd33b.txt
+4
View File
@@ -0,0 +1,4 @@
Bound runner prompts with explicit required task input reads
Changes: Keep startup instructions and exact context packets inline while listing supplementary task inputs as mandatory project reads. Preserve root containment, missing-artifact guidance and budget failures. Add S21-006 exact UI context regression and cover claim/review budgets for all tasks; leave stdin delivery unchanged.
Validation: make check passed all 68 tests, including delayed UTF-8 stdin/EOF, timeout and terminal-transition checks. All 556 current prompts fit 80000 characters; largest 77693. git diff --check passed. Foundation checks do not establish application readiness.
state/commit_messages/auto-ci-cd-84e209103f24.txt
+4
View File
@@ -0,0 +1,4 @@
Verify recovered execution path for interrupted review
Changes: Record S00-015 readiness after independently reviewed S00-016 provider recovery; replace blocked handoff with concrete QA next steps. No runner or test source changes; parent acceptance remains separate.
Validation: Four focused automation tests passed in 4.560s; tasks.py validate passed for 281 tasks at revision 32. Read-only assertions verified the original capacity failure, committed successful resolver/QA transitions, fresh shared-model sessions and unaccepted parents. Git diff whitespace and scope checks passed. Future provider capacity and parent implementation acceptance are not guaranteed.
state/commit_messages/auto-ci-cd-d105e8027730.txt
+4
View File
@@ -0,0 +1,4 @@
Verify public npm access and exact-version tarball integrity
Changes: Add a scoped fresh-cache registry probe, safe reproduction instructions and artifact ignore rule; record actual TLS-enabled metadata/download results and review handoff without selecting a stack or changing the harness.
Validation: Original npm view command and verify.py returned exit 0; react@19.3.1 tarball (26394 bytes) matched registry SHA-512. make check passed validation and 66 tooling tests. git diff --check passed. App install/build and different-harness connectivity remain unverified.
state/commit_messages/auto-ci-cd-f101e40d9902.txt
+4
View File
@@ -0,0 +1,4 @@
Verify runner prompt delivery and lifecycle regressions
Changes: Record verification evidence and replace the blocked S00-012 handoff with independent QA review instructions. Retain the existing stdin implementation and regressions from prior checkpoints; no new source changes.
Validation: Reproduced the legacy partial stdin timeout on Python 3.9.6 and reaped the child. All 28 automation tests passed, including exact 140024-byte UTF-8/EOF and timeout/submit descendant cleanup. make check passed all 72 tests; git diff --check passed. No live model, application readiness or Windows cleanup check is claimed.
state/commit_messages/auto-crypto-c68801170fa4.txt
+4
View File
@@ -0,0 +1,4 @@
Validate browser SCRAM-SHA-512 through public mechanism composition
Changes: Add an isolated pinned mechanism wrapper using Stanza's public constructor and factory APIs, preserve the SCRAM-SHA-512 wire name and fail-closed final guard, and document the proposed ADR, browser bundle evidence, independent Scramp vectors, notices and limits. Leave parent selection, dependency experiments, specs and shared contracts unchanged.
Validation: Fresh-cache npm ci and Vite browser build pass; 87 focused tests pass, including RFC HMAC vectors, original defect reproduction, independent full SHA-512 exchanges and rejected invalid finals/order/reset paths. Hashed Scramp oracle fixture comparison passes. Dependency check verifies 49 locked entries, 25 installed pins/licenses and 340 unmodified Stanza files. make check passes 72 tooling tests. Native browsers, WSS/live server interoperability and production readiness are untested; independent security review remains pending.
state/commit_messages/auto-orchestrator-48aab142ecde.txt
+4
View File
@@ -0,0 +1,4 @@
Define the Web scope passport and native exclusion boundaries
Changes: Add proposed scope ADR with reasons for all ten excluded IDs, retained Web obligations, lifecycle limits, external provider roles and deferred decisions. Add a document coverage/lifecycle checker with four negative mutations and executor evidence/handoff for security review.
Validation: python3 experiments/0000-scope/check.py passed for ten excluded IDs and seven lifecycle scenarios; all four negative mutations were rejected. make check passed validation and 66 tooling tests. Whitespace and allowed source paths checked. No live browser or provider integration was tested; ADR awaits independent review.
state/commit_messages/auto-orchestrator-68a05c587e33.txt
+4
View File
@@ -0,0 +1,4 @@
Propose a pinned React stack with a reproducible rendering spike
Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review.
Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed.
Loaded 100 of 167 files, more files were not shown because too many files have changed in this diff. Show more