wt
e69372c6db
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: Stanza 12.22.1 browser HMAC sha-512 fails RFC 4231 Test Case 1: wrong 64-byte block selection. SCRAM-SHA-512 derives that hyphenated algorithm; private algorithm mutation/vendor patches are unsupported. Parent cannot attest browser strongest-mechanism compatibility from Node-only success. Task: S00-003 Agent: auto-protocol-dcdf92cd067e Role: protocol Action: claim Status: blocked Task title: Проверить XMPP WSS/auth библиотеку
62 lines
3.7 KiB
Markdown
62 lines
3.7 KiB
Markdown
# S00-019: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
|
||
|
||
- Remediation для: S00-003; root: S00-003; depth: 1
|
||
|
||
> Generated from planning/tasks.json; status is in state/tasks.json.
|
||
|
||
- Этап: S00
|
||
- Оператор: crypto
|
||
- Reviewer: security
|
||
- Зависимости: S00-001, S00-002, S00-017, S00-018
|
||
- Требования: ACC-004, NET-003, NET-004
|
||
|
||
## Один результат
|
||
|
||
One isolated runnable independently reviewed browser-compatible SCRAM-SHA-512 integration uses vetted existing crypto through a supported public mechanism API and validates proof/server-final without vendor/private-field patching or custom primitives.
|
||
|
||
## Разрешённые пути
|
||
|
||
- `experiments/0002-xmpp-library/sha512-validation/**`
|
||
- `docs/decisions/0002-xmpp-sha512-validation.md`
|
||
|
||
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
|
||
|
||
## Прочитать
|
||
|
||
- docs/WEB_PROFILE.md
|
||
- docs/ARCHITECTURE.md
|
||
- docs/CONTRACTS.md
|
||
- docs/TESTING.md
|
||
- roles/protocol.md
|
||
- docs/decisions/README.md
|
||
- state/blockers/S00-019.md
|
||
|
||
## Шаги
|
||
|
||
1. Read original blocker, accepted stack/SASL ADR and pinned browser implementation/public APIs.
|
||
2. Reproduce the HMAC alias defect and evaluate an existing vetted mechanism/backend or candidate with primary docs, exact pins, license and browser/API checks.
|
||
3. Implement only isolated SCRAM-SHA-512 integration via supported public APIs using existing cryptographic code; retain fail-closed mutual authentication and real absence of channel binding.
|
||
4. Run fixed known vectors and full exchange positive/negative checks against the browser-resolved backend; preserve evidence, limitations and handoff for independent security review.
|
||
|
||
## Приёмка
|
||
|
||
1. RFC SHA-512 known vectors match using actual browser-compatible crypto backend, including algorithm spelling and varied key lengths.
|
||
2. Full SCRAM-SHA-512 client proof and verified server-final agree with an independent existing implementation/fixed externally derived vector; missing/forged/premature final fails without authentication/restart.
|
||
3. Integration uses public mechanism APIs, correct SCRAM-SHA-512 wire name, no private-field/vendor patch, invented binding, custom primitives or plaintext downgrade.
|
||
4. Runnable pinned fixture experiment and browser bundle/backend evidence permit independent review; no parent WSS/library selection/shared contract work.
|
||
|
||
## Focused checks
|
||
|
||
1. Reproduce original browser sha-512 HMAC mismatch.
|
||
2. Fixed SHA-512/HMAC known vectors including long keys using selected browser backend.
|
||
3. Full SCRAM-SHA-512 verified exchange and forged/missing/out-of-order server-final rejection.
|
||
4. Exact dependency/license/API/browser checks and repeatable clean install/bundle plus focused suite.
|
||
|
||
## Блокер и завершение запуска
|
||
|
||
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
|
||
|
||
## Передача
|
||
|
||
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
|