wt
8f918bc040
Changes: Accept ADR 0002 for pinned Stanza with mandatory bounded transport, verified SASL and SHA512 composition; record independent review findings and handoff with external limits retained. Validation: Fresh-cache pinned npm ci and browser build succeeded; all 112 tests passed. Verified 51 locked entries, 26 installed notices and 340 unchanged vendor files; six offer permutations and six adversarial XML checks passed; make check passed 72 tooling tests. No actual browser, independent full XMPP server/client, OMEMO or release readiness acceptance. Task: S00-003 Agent: auto-qa-d49749753ac6 Role: qa Action: review Status: done Task title: Проверить XMPP WSS/auth библиотеку
52 lines
3.2 KiB
Markdown
52 lines
3.2 KiB
Markdown
# S00-003 handoff for independent QA review
|
|
|
|
Executor: auto-protocol-f474114f0168 (protocol), 2026-10-15.
|
|
No blocker. Proposed Stanza 12.22.1 selection and combined isolated spike at
|
|
experiments/0002-xmpp-library/selection-spike; ADR docs/decisions/0002-xmpp-library.md.
|
|
|
|
Actual result: clean-cache locked install on accepted Linux Node24.21.0/npm11.19.0,
|
|
browser bundle and 112 tests pass. Real synthetic loopback WSS TLS/xmpp handshake,
|
|
fixed SCRAM512/256/1 proofs/finals/restart, strongest compatible non-PLUS policy,
|
|
PLUS/plaintext rejection, untrusted certificate/plain endpoint rejection,
|
|
bounded XML over WSS and registry extension checks. 51 locked/26 installed
|
|
package checks and notices, 340 unmodified vendor files, reviewed parser/SHA512
|
|
source reuse verified. make check: 72 tooling tests passed, exit 0.
|
|
Evidence: state/evidence/S00-003-auto-protocol-f474114f0168.md.
|
|
|
|
QA next: inspect actual diff/executor message, proposed ADR and README. Repeat
|
|
clean npm ci with a new cache, npm test, check-dependencies.py and relevant
|
|
foundation check using reviewed runtime currently at
|
|
/tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin.
|
|
Temporary tools may expire; environment-access probe can recreate authentic
|
|
runtime/vendor comparison graph. Do not change accepted pins or security policy.
|
|
Verify browser graph, public seams, fail-closed effects, notices and limitations.
|
|
|
|
Raw imported messages carry selected body plus language bodies; passing both to
|
|
export duplicates text in this version. Permanent regression records it. MAM
|
|
fixture explicitly exports the language collection only; future adapters must
|
|
construct outbound shapes. Upload's actual field is httpUpload.download.
|
|
Initial harness failures and corrections are recorded, not counted as passed.
|
|
|
|
Limits: browser-built backend runs in Node, no actual browser or independent
|
|
full XMPP server/client; scripted peer uses accepted fixed transcripts. No OMEMO
|
|
crypto/OMEMO2 wire validation, full XEP semantics or release readiness. Fixture
|
|
certificate trusted only through injected socket with validation enabled; no
|
|
system trust changes/keys committed. No real binding/fallback. Inherited strict
|
|
SCRAM layout/timeout/timing, minimal transport/lifecycle and aggregate queue
|
|
limits remain. Source changes are only current task paths plus workflow metadata.
|
|
ADR stays proposed until separate QA acceptance. Coordinator alone commits and
|
|
launches new process; executor exits immediately after submit.
|
|
|
|
|
|
## Independent QA acceptance
|
|
|
|
Reviewer auto-qa-d49749753ac6, 2026-10-15: accepted bounded S00-003 and ADR 0002.
|
|
Fresh-cache pinned npm ci, browser bundle and 112 tests, dependency/notices/vendor
|
|
checks and make check (72 tooling tests) passed. Six additional offer permutations
|
|
and six adversarial XML inputs passed independent assertions. Review evidence:
|
|
state/evidence/S00-003-review.md. All documented external/browser/interoperability/
|
|
crypto/timing/lifecycle/aggregate-resource limits remain. Future adapters must
|
|
install the three required seams before connect and construct deliberate outbound
|
|
body projections. Coordinator must commit review before any next fresh session;
|
|
reviewer exits on approve without Git mutation or another task/agent launch.
|