wt
8f918bc040
Changes: Accept ADR 0002 for pinned Stanza with mandatory bounded transport, verified SASL and SHA512 composition; record independent review findings and handoff with external limits retained. Validation: Fresh-cache pinned npm ci and browser build succeeded; all 112 tests passed. Verified 51 locked entries, 26 installed notices and 340 unchanged vendor files; six offer permutations and six adversarial XML checks passed; make check passed 72 tooling tests. No actual browser, independent full XMPP server/client, OMEMO or release readiness acceptance. Task: S00-003 Agent: auto-qa-d49749753ac6 Role: qa Action: review Status: done Task title: Проверить XMPP WSS/auth библиотеку
3.2 KiB
S00-003 handoff for independent QA review
Executor: auto-protocol-f474114f0168 (protocol), 2026-10-15. No blocker. Proposed Stanza 12.22.1 selection and combined isolated spike at experiments/0002-xmpp-library/selection-spike; ADR docs/decisions/0002-xmpp-library.md.
Actual result: clean-cache locked install on accepted Linux Node24.21.0/npm11.19.0, browser bundle and 112 tests pass. Real synthetic loopback WSS TLS/xmpp handshake, fixed SCRAM512/256/1 proofs/finals/restart, strongest compatible non-PLUS policy, PLUS/plaintext rejection, untrusted certificate/plain endpoint rejection, bounded XML over WSS and registry extension checks. 51 locked/26 installed package checks and notices, 340 unmodified vendor files, reviewed parser/SHA512 source reuse verified. make check: 72 tooling tests passed, exit 0. Evidence: state/evidence/S00-003-auto-protocol-f474114f0168.md.
QA next: inspect actual diff/executor message, proposed ADR and README. Repeat clean npm ci with a new cache, npm test, check-dependencies.py and relevant foundation check using reviewed runtime currently at /tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin. Temporary tools may expire; environment-access probe can recreate authentic runtime/vendor comparison graph. Do not change accepted pins or security policy. Verify browser graph, public seams, fail-closed effects, notices and limitations.
Raw imported messages carry selected body plus language bodies; passing both to export duplicates text in this version. Permanent regression records it. MAM fixture explicitly exports the language collection only; future adapters must construct outbound shapes. Upload's actual field is httpUpload.download. Initial harness failures and corrections are recorded, not counted as passed.
Limits: browser-built backend runs in Node, no actual browser or independent full XMPP server/client; scripted peer uses accepted fixed transcripts. No OMEMO crypto/OMEMO2 wire validation, full XEP semantics or release readiness. Fixture certificate trusted only through injected socket with validation enabled; no system trust changes/keys committed. No real binding/fallback. Inherited strict SCRAM layout/timeout/timing, minimal transport/lifecycle and aggregate queue limits remain. Source changes are only current task paths plus workflow metadata. ADR stays proposed until separate QA acceptance. Coordinator alone commits and launches new process; executor exits immediately after submit.
Independent QA acceptance
Reviewer auto-qa-d49749753ac6, 2026-10-15: accepted bounded S00-003 and ADR 0002. Fresh-cache pinned npm ci, browser bundle and 112 tests, dependency/notices/vendor checks and make check (72 tooling tests) passed. Six additional offer permutations and six adversarial XML inputs passed independent assertions. Review evidence: state/evidence/S00-003-review.md. All documented external/browser/interoperability/ crypto/timing/lifecycle/aggregate-resource limits remain. Future adapters must install the three required seams before connect and construct deliberate outbound body projections. Coordinator must commit review before any next fresh session; reviewer exits on approve without Git mutation or another task/agent launch.