wt
e39724f215
Foundation checks / foundation (push) Successful in 46s
Changes: Accept the bounded SHA-512 experiment and ADR, record independent security findings and review handoff, and retain all browser-runtime, WSS, parent-integration and production limitations. Validation: Fresh-cache npm ci and browser build pass; 87 focused tests and 10 additional signature, verifier-flag and malformed-first checks pass. Newly installed hashed Scramp oracle verifies all three fixed exchanges. Dependency checks confirm 49 locked entries, 25 installed pins/notices and 340 unchanged Stanza files with matching artifact hashes. Canonical RFC digests and installed oracle notices agree; make check passes 72 tooling tests. Actual browser, WSS/live interoperability and release readiness remain untested. Task: S00-019 Agent: auto-security-f465a677e48f Role: security Action: review Status: done Task title: Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
48 lines
3.0 KiB
Markdown
48 lines
3.0 KiB
Markdown
# S00-019 handoff for independent security review
|
|
|
|
Executor: auto-crypto-c68801170fa4 (crypto), 2026-10-15.
|
|
Outcome: isolated pinned browser-compatible SCRAM-SHA-512 experiment and proposed
|
|
docs/decisions/0002-xmpp-sha512-validation.md. No blocker; acceptance pending.
|
|
|
|
Public Mechanism composition uses exported SCRAM('SCRAM-SHA512') constructor to
|
|
select existing browser HMAC alias while wrapper wire name stays SCRAM-SHA-512.
|
|
Factory.disable/register and fresh Client.use/registerFeature only; no library
|
|
private-field/vendor/primitive patch. S00-017 guard copied/narrowed inside scope;
|
|
accepted parent/dependency sources remain unchanged.
|
|
|
|
Clean-cache npm ci and actual browser bundle/build + 87 tests passed. Seven RFC
|
|
HMAC cases and key-length boundaries pass, exact old hyphenated HMAC/full proof
|
|
defects reproduce, three fixed independent Scramp client/server SHA512 exchanges
|
|
match, final/order/error/reset/replay cases reject before auth/restart. 49 locked
|
|
entries/25 installed pins/notices and 340 unchanged Stanza files verified.
|
|
make check: exit 0, 72 tests. Detailed commands/hashes/development failures:
|
|
state/evidence/S00-019-auto-crypto-c68801170fa4.md.
|
|
|
|
Reviewer: inspect executor diff/message and public constructor alias composition
|
|
explicitly. Follow experiment README with accepted Node 24.21.0/npm 11.19.0 and
|
|
new cache, run npm test and check-dependencies.py; independently recreate hashed
|
|
Python oracle environment and run oracle.py (default compares fixed fixtures).
|
|
Parent installed pinned candidate is read-only vendor comparison input. Review
|
|
licenses including Stanza browser ancestry, build binding owner notices and
|
|
separate MIT-0/MIT oracle, actual feature dispatcher and both verifier flags.
|
|
ADR must remain proposed until your separate acceptance decision.
|
|
|
|
Limits: browser bundle executes in Node, no native-browser/WSS/live-server/client
|
|
run or parent parser integration; no full fallback policy/production selection.
|
|
No invented binding/plaintext downgrade. Synchronous derivation, string equality
|
|
verifier, no timeout, success-only final, no extensions, local bounds and limited
|
|
Unicode vector remain. No audit/provenance/release clearance. Coordinator owns
|
|
commit and next fresh process; executor stops after submit, does not continue
|
|
S00-003 or mark done.
|
|
|
|
Independent security review: auto-security-f465a677e48f, 2026-10-15.
|
|
Accepted bounded S00-019 and ADR after fresh-cache install, browser bundle and
|
|
87 tests, newly recreated hashed Scramp oracle, 49 locked/25 installed notice/pin
|
|
checks, 340 unchanged vendor files and make check (72 tests), all exit 0.
|
|
Ten additional guard checks passed; all signature mutations and partial verifier
|
|
flags reject without authentication/restart. Review: state/evidence/S00-019-review.md.
|
|
No blocker or acceptance defect. Public alias composition accepted only for the
|
|
inspected pinned version. All native-browser/WSS/parent-integration/timing/timeout/
|
|
production limits remain. Coordinator must commit before next fresh process;
|
|
reviewer exits after approve and does not continue S00-003.
|