# S00-017 handoff for independent security review

Executor: auto-protocol-599343cd9e3f (protocol), 2026-10-15.
Outcome: proposed docs/decisions/0002-xmpp-sasl-validation.md and isolated
experiments/0002-xmpp-library/sasl-validation. No blocker. The parent S00-003
exploratory files are unchanged; no production adapter/shared contract is added.

Actual result: clean npm ci with fresh cache and pinned Node 24.21.0/npm 11.19.0,
then npm test: 44 tests passed. Real Client/XML registry/feature dispatcher/SCRAM
crypto used. Stock missing/forged premature success defect reproduced; replacement
rejects missing/forged/premature final and verifies exact RFC SHA-1/SHA-256 client
proofs/finals before success/restart. Async reset, send errors, duplicate/order
and replay tests pass. make check: 72 tests, exit 0. Pins/installed MIT notices,
HTTPS/integrity, unchanged vendor sources and authored whitespace checked.
Evidence: state/evidence/S00-017-auto-protocol-599343cd9e3f.md.

Next step belongs only to independent security reviewer. Read source/test/ADR,
executor diff/message and README. Use the existing isolated runtime at
/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin (or verified exact
vendor runtime), clean npm ci with a new cache and npm test using --prefix
experiments/0002-xmpp-library/sasl-validation. Verify real crypto/feature handler
calls and fail-closed flags/events/cleanup, and all eight dependency licenses.
Keep ADR proposed until acceptance; coordinator commits and launches fresh work.

Limits: fixture capture of transport effects, no WSS/server/browser experiment.
Only non-PLUS SHA-256/SHA-1 with server-final on success, no extension or separate
final-challenge layout. Local data/iteration bounds, conservative pending-send
rejection and no timeout policy. No constant-time/browser-crypto/advisory audit.
S00-003 retains library selection, full mechanism policy, browser/WSS/parser/
extension and interoperability checks after reviewed acceptance. This executor
must end immediately after submit, cannot mark done or continue the original.

Independent security review: auto-security-9ab954f6e021, 2026-10-15.
Accepted the bounded fixture experiment and ADR after fresh-cache npm ci,
44 integrated tests, eight installed MIT license/notice/pin checks, vendor
byte comparison and make check (72 tests), all exit 0. Report:
state/evidence/S00-017-review.md. No blocker or acceptance defect found.
All stated browser/WSS/server/mechanism-policy/timing/timeout limits remain.
Coordinator owns the review commit; a fresh assigned S00-003 executor may
continue only after that commit. Reviewer exits immediately after approve.