# Handoff S00-021 - Browser OMEMO backend remediation

Agent: `auto-crypto-fcef9b6781bf`
Role: crypto
Status: submitted for review
Original: S00-004; remediation: S00-021 (blocker cause: "Agent timed out; process
terminated before escalation").

## Result
Re-ran both committed probes unchanged (exit 0 SMOKE_PASS; exit 2
wasm-unsupported) and recorded the actual outputs. Documented the verified
capability (audited session/ratchet engine + session-record persistence via
`@signalapp/libsignal-client`, no homegrown ratchet) and the verified blocker
(browser/worker/WASM endpoint and the OMEMO2 wire layer are not available from
any maintained package on the reachable registry; Signal's WASM distribution
`@signalapp/libsignal` is E404 there). Wrote `docs/decisions/0003-crypto-library.md`
(proposed) with traceable primary sources and honest boundaries.

## Outputs produced (all inside accepted scope)
- `docs/decisions/0003-crypto-library.md` (proposed ADR).
- `state/evidence/S00-021-auto-crypto-fcef9b6781bf.md` (this run's evidence).
- No source changes elsewhere; `experiments/0003-crypto-library/**` unchanged.

## Evidence (actual, this run)
- `node experiments/0003-crypto-library/session-probe/smoke.mjs` -> exit 0,
  `SMOKE_PASS` (631-byte session record, byte-for-byte reload).
- `node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs` ->
  exit 2, `UNSUPPORTED_BLOCKER`, `wasmFiles: 0`.
- `npm view` on reachable proxy: `@signalapp/libsignal-client` = 0.105.0
  (AGPL-3.0-only); `@signalapp/libsignal`, `omemo-client`, `omemo-top`,
  `omemo-wasm`, `@converse/omemo` = E404.

## Honest status
S00-004 is NOT done; it remains blocked on the browser/worker/WASM OMEMO2
backend. This remediation documents that blocker truthfully so the next executor
has a reproducible state and a clear next step, instead of re-doing research and
timing out again. No requirement bypass; unsupported format recorded as blocker.

## Next input for S00-004 continuation
1. Confirm `node experiments/0003-crypto-library/session-probe/smoke.mjs` (0) and
   `.../wasm-unsupported.mjs` (2).
2. Obtain a verified browser/WASM-capable OMEMO2 backend (real `.wasm`/web build
   with an OMEMO2/S ce-format mapping) and run a known-answer roundtrip in the
   web target; or
3. Escalate with traceable upstream primary sources resolving ENC-009/ENC-011
   client-endpoint encryption for the browser transport.
4. Only then may acceptance-1 (legacy/OMEMO2 AND worker/wasm AND persistence) be
   re-evaluated; do not declare S00-004 done on the persistence+Ratchet part
   alone.