wt
e69372c6db
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: Stanza 12.22.1 browser HMAC sha-512 fails RFC 4231 Test Case 1: wrong 64-byte block selection. SCRAM-SHA-512 derives that hyphenated algorithm; private algorithm mutation/vendor patches are unsupported. Parent cannot attest browser strongest-mechanism compatibility from Node-only success. Task: S00-003 Agent: auto-protocol-dcdf92cd067e Role: protocol Action: claim Status: blocked Task title: Проверить XMPP WSS/auth библиотеку
85 lines
4.8 KiB
Markdown
85 lines
4.8 KiB
Markdown
# S00-003 blocked executor evidence
|
|
|
|
Agent: auto-protocol-dcdf92cd067e, protocol. Date: 2026-10-15.
|
|
|
|
Input: master_prompt and assigned startup/role/workflow documents; CLI resume/show;
|
|
S00-003 card/context and previous handoff; required docs/TESTING.md and
|
|
docs/decisions/README.md; accepted scope/stack/SASL/parser ADRs and dependency
|
|
reports/handoffs; exact ACC-004/NET-003/NET-004. Assigned owner confirmed;
|
|
no repeat claim. Output remains the library selection spike, not completed.
|
|
|
|
## Reproduced blocker
|
|
|
|
Pinned Stanza 12.22.1 browser createHmac('sha-512', ...) does not match
|
|
RFC 4231 section 4.2 Test Case 1 or Node's independent native implementation.
|
|
Its browser Hmac constructor chooses 128-byte blocks only when alg === 'sha512';
|
|
otherwise it chooses 64. Browser createHmac lowercases but does not remove the
|
|
hyphen. SCRAM derives algorithm 'sha-512' from the correct wire mechanism
|
|
SCRAM-SHA-512. This makes merely registering SASL.SCRAM under that mechanism
|
|
insufficient for browser interoperability. Browser getHashes advertises sha-512.
|
|
The SCRAM algorithm field is private in shipped index.d.ts, so changing it is
|
|
not a public supported integration path. No vendor/private-field patch attempted.
|
|
|
|
Public key: 20 bytes 0x0b; data: Hi There (RFC test data only).
|
|
Expected SHA-512:
|
|
87aa7cdea5ef619d4ff0b4241a1d6cb02379f4e2ce4ec2787ad0b30545e17cdedaa833b7d6b8a702038b274eaea3f4e4be9d914eeb61f1702e696c203a126854
|
|
Browser sha-512 actual:
|
|
9656975ee5de55e75f2976ecce9a04501060b9dc22a6eda2eaef638966280182477fe09f080b2bf564649cad42af8607a2bd8d02979df3a980f15e2326a0a22a
|
|
Browser sha512 alias matches expected; sha-1 and sha-256 also match Node controls.
|
|
This is a direct browser-backend module diagnostic executed in Node, not an
|
|
actual browser execution, full SCRAM exchange or WSS handshake.
|
|
|
|
## Commands and observed results
|
|
|
|
- python3 scripts/tasks.py resume --agent auto-protocol-dcdf92cd067e: exit 0,
|
|
assigned S00-003 in_progress.
|
|
- python3 scripts/tasks.py show S00-003: exit 0, dependencies done/scope confirmed.
|
|
- Scoped cat/rg reads: actual SASL/browser Hmac/createHash/factory/features/Client
|
|
source and public declarations examined. Guessed platform/browser.js,
|
|
lib/sasl/scram.js and parent .npmrc paths absent (cat calls exit 1);
|
|
actual platform/browser/index.js and lib/sasl/index.js/.d.ts located/read.
|
|
These exploratory failures are not passed tests or missing required artifacts.
|
|
- git status --short: exit 0; only coordinator state/tasks.json claim change.
|
|
- The following exact diagnostic ran with exit 0 and printed matching controls
|
|
and the SHA-512 mismatch above (exit 0 means reproduction completed, not safety):
|
|
|
|
```sh
|
|
PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH node --input-type=module <<'JS'
|
|
import {createRequire} from 'node:module';
|
|
import {createHmac} from 'node:crypto';
|
|
const require = createRequire(new URL('./experiments/0002-xmpp-library/package.json', `file://${process.cwd()}/`));
|
|
const browser = require('stanza/platform/browser/index.js');
|
|
const key = browser.Buffer.alloc(20, 0x0b);
|
|
for (const name of ['sha-1','sha-256','sha-512','sha512']) {
|
|
const actual = browser.createHmac(name,key).update('Hi There').digest('hex');
|
|
const expected = createHmac(name.replace('-', ''), Buffer.alloc(20,0x0b)).update('Hi There').digest('hex');
|
|
console.log(JSON.stringify({name, matchesNode: actual === expected, actual, expected}));
|
|
}
|
|
JS
|
|
```
|
|
|
|
Primary sources opened on 2026-10-15: RFC 7395, RFC 5802, RFC 7677,
|
|
https://www.rfc-editor.org/rfc/rfc4231.html#section-4.2,
|
|
https://github.com/legastero/stanza and https://github.com/xmppjs/xmpp.js.
|
|
Pinned shipped files establish the defect; upstream documentation alone is not
|
|
acceptance evidence. RFC 4231 provides the independent fixed HMAC vector.
|
|
Reused previously accepted isolated runtime; no new installation/checksum claim.
|
|
|
|
## Boundaries and next input
|
|
|
|
No source edits, manifest/lock/dependency changes, new primitive, credential,
|
|
TLS/CORS bypass or private vendor patch. No make check, npm ci, dependency
|
|
suite rerun, browser build/runtime, WSS handshake or independent interoperability
|
|
is claimed in this session. Accepted S00-017/S00-018 experiments remain unchanged.
|
|
Their local acceptance does not cover SHA-512 browser crypto. Current parent
|
|
selection ADR is absent and candidate unselected. No plaintext/downgrade
|
|
workaround was implemented.
|
|
|
|
One fresh crypto resolver must demonstrate correct browser-compatible
|
|
SCRAM-SHA-512 through a supported mechanism API using vetted existing crypto,
|
|
including SHA-512 known vectors, full proof/server-final and failure behavior;
|
|
independent security review precedes original-task resumption. The resolver may
|
|
assess an existing alternative backend/candidate inside its isolated scope, not
|
|
implement parent selection/WSS or shared contracts. This reporter exits after
|
|
escalation and does not solve remediation or launch another agent.
|