# S00-003 combined XMPP selection spike

One isolated experiment; no application adapter or production provider. See
`docs/decisions/0002-xmpp-library.md` for selection rationale and limits.

Use the authentic pinned Node 24.21.0 / npm 11.19.0 from S00-020. On this host its
reviewed temporary bin path was `/tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin`;
paths may expire. Recreate via the reviewed environment-access probe if needed.
Keep its verified runtime directory first in PATH. OpenSSL must be available.
No system install, trust-store change or secret is needed.

From project root, with the pinned runtime in PATH:

```sh
node --version
npm --version
npm ci --prefix experiments/0002-xmpp-library/selection-spike --ignore-scripts --no-audit --no-fund --engine-strict=true --strict-ssl=true --fetch-retries=0 --fetch-timeout=15000 --cache /tmp/luma-selection-independent-clean
npm test --prefix experiments/0002-xmpp-library/selection-spike
python3 experiments/0002-xmpp-library/selection-spike/check-dependencies.py
make check
```

Use a new empty cache for independent clean-install evidence. The checker compares
vendor bytes against the reviewed `environment-access/node_modules/stanza` graph;
that graph must exist (its verify.py recreates it without altering parent inputs).
No application code or accepted prerequisite source is changed by these commands.
`dist` and node_modules are ignored build artifacts. npm test explicitly invokes
Vite even though install lifecycle scripts are disabled. Lock updates need review.

Tests run the Vite browser artifact in Node. Reused S00-019 regression tests cover
known HMAC vectors, public alias, real feature dispatcher, forged/out-of-order
finals, reset, pending sends, synthetic binding rejection and no derived cache.
WSS tests use a fresh ephemeral localhost certificate/key under /tmp, explicitly
trusted only by the test socket; rejectUnauthorized stays true. A native socket
without that trust must reject it. No certificate/key is committed. The peer
checks fixed public RFC or accepted independent Scramp transcripts; it is a
scripted fixture, not an independent full XMPP implementation. Synthetic fixture
credentials are public/invented data only, never read from the environment.

Bounded ingress and SHA-512 composition are byte-identical reviewed copies.
Only the copied ordering guard extends allowed non-PLUS mechanisms to 512/256/1
and emits safe policy diagnostics. No fallback is enabled. Browser TLS data is
unavailable and never synthesized. Registry tests cover basic MAM/MUC/Jingle/
upload/legacy opaque OMEMO plus an invented extension namespace, not encrypted
interoperability or OMEMO2 wire compliance. They explicitly select the language
collection on export because echoing both library body projections duplicates text;
a separate stock-behavior regression preserves that finding.

No real browser/server/client interoperability, load bound, constant-time audit,
full XEP coverage or product readiness result is implied. All inherited limits
remain in the ADR. Changes are subject to independent QA review.