LumaWeb/planning/tasks/S00-022.md

S00-022: Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint

• Remediation для: S00-004; root: S00-004; depth: 1

Generated from planning/tasks.json; status is in state/tasks.json.

• Этап: S00
• Оператор: crypto
• Reviewer: security
• Зависимости: S00-001, S00-002, S00-021, S00-027, S00-029
• Требования: ENC-003, ENC-009, ENC-011

Один результат

One independently reviewed, traceable primary-source outcome that establishes a verified browser/worker/WASM-capable OMEMO2 backend (a maintained library with a real web/WASM build and an OMEMO2/S ce-format mapping, or an approved external library/provider decision with license + support + browser constraints), preserving the verified audited session/ratchet engine and persistence from the existing spike, without a homegrown ratchet or ENC-009/ENC-011 bypass.

Разрешённые пути

• docs/decisions/0003-crypto-library.md

Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.

Прочитать

• docs/WEB_PROFILE.md
• docs/ARCHITECTURE.md
• docs/CONTRACTS.md
• docs/TESTING.md
• roles/crypto.md
• docs/decisions/README.md
• state/blockers/S00-022.md

Шаги

1. Read S00-004 blocker evidence, ADR 0003, and accepted ENC-003/ENC-009/ENC-011 with ADRs 0000-0002.
2. Confirm the residual browser/worker/WASM OMEMO2 backend is unavailable from any maintained package on the reachable registry (reproduce wasm-unsupported probe and npm view queries).
3. Source or confirm a maintained browser/worker/WASM-capable OMEMO2 encryption layer: verify its web/WASM build, license, primary-source docs, support, and an OMEMO2 wire mapping against ENC-011; or record the concrete external product/administrative decision (library, provider, or license acceptance) required to bring such a backend in.
4. Run a focused known-answer OMEMO2 roundtrip in the web-compatible target and record actual results (or record an unsupported format blocker, not success) and update docs/decisions/0003-crypto-library.md; submit evidence and handoff for independent security review.

Приёмка

1. A browser/worker/WASM-capable OMEMO2 backend is established with a real, verified web build and an OMEMO2 wire mapping from traceable primary sources, or an explicit external decision (with specific requested input) is recorded that unblocks sourcing it.
2. The OMEMO2 wire-format mapping does not bypass ENC-009/ENC-011 client-endpoint encryption.
3. No homegrown ratchet, no spec/plan/shared-contract change without plan, no secrets in evidence, and no out-of-scope edits; unsupported format recorded as blocker, not success.

Focused checks

1. Known-answer OMEMO2 roundtrip in the web/WASM target, or a traceable upstream/external decision covering ENC-009/ENC-011.
2. Web/WASM asset presence verified (non-zero real footprint), license and support checked.
3. Independent security review confirms no bypass and no unsupported format counted as success.

Блокер и завершение запуска

Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.

Передача

Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.