LumaWeb/state/evidence/S00-004-auto-crypto-8bf3dcf711b9.md

S00-004 - Browser OMEMO backend spike - Evidence

• Agent: auto-crypto-8bf3dcf711b9
• Role: crypto
• Task: S00-004 "Проверить browser OMEMO backend"
• Date-of-run: 2026-10-15

1. Known-answer session/ratchet + persistence probe (PASS)

Command and result:

cd experiments/0003-crypto-library
node session-probe/smoke.mjs

Actual output (native libsignal trace + KAS lines):

[log:3] Building PreKeyWhisperMessage for: 796abedb-...-4214?.3 with preKeyId: 31337 (session created at 1792052846)
[log:3] decrypted PreKey message from <ACI:9d0652a3-...>.1 with current session state ...
KAS_OK known plaintext: known vector: OMEMO session smoke
KAS_OK established via sealed-sender PreKey session
KAS_OK bob stored session bytes: 631
SMOKE_PASS
exit code: 0

What is shown: using the canonical real library API (sealedSenderEncryptMessage/sealedSenderDecryptMessage) an independent A/B pair established a PreKey session; the exact known plaintext string (known vector: OMEMO session smoke) round-tripped; the decrypted-stored session record serialized to 631 non-empty bytes and reloaded byte-for-byte via SessionRecord.deserialize.

Verified capability: session/ratchet establishment and session-record persistence on a real, unmodified, audited Signal session library. No homegrown ratchet.

2. Unsupported format/backend probe (BLOCKER, exit 2)

Command and result:

cd experiments/0003-crypto-library
node session-probe/wasm-unsupported.mjs

Actual output:

pkgPresent: true
wasmFiles: 0
prebuilds: darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64
UNSUPPORTED_BLOCKER: no .wasm asset ships in @signalapp/libsignal-client; the
distribution is a Node native addon (prebuilds/*/*.node). A browser worker/WASM
deployment is NOT established by this npm package ...
exit code: 2

What is shown: the only maintained, installable, audited session library in this registry (@signalapp/libsignal-client@0.105.0, AGPL-3.0-only) ships as a Node native addon and contains no WebAssembly asset. It therefore cannot execute in a browser worker as required by the Web client-endpoint.

3. OMEMO2 wire-format candidate search (no maintained package)

Registry queries (via proxy, real responses):

package	result
omemo2-js	404 Not Found
@oxjs/omemo	404 Not Found
omemo-wasm	404 Not Found
@signalapp/libsignal	404 Not Found
@signalapp/libsignal-client@0.105.0	exists (AGPL-3.0-only, native addon)
signal-protocol@0.1.3	exists (GPL-3.0, 2017-era, unmaintained; not a viable maintained OMEMO2 candidate)

No maintained browser/WASM-capable OMEMO or OMEMO2 wire-format package is available on the reachable registry. @signalapp/libsignal-client provides the session/ratchet engine but does not provide the OMEMO/OMEMO2 XMPP wire mapping (ENC-009/ENC-011 SCE payload/key/MAC stanzas).

4. Honest conclusion (blocker, not success)

Feasible and verified:

• Audited session/ratchet engine + secure session-record persistence (real API, known-answer roundtrip, no homegrown ratchet).

NOT established and therefore a blocker (per focused-check rule "unsupported format recorded blocker, not success"):

• Browser/worker/WASM deployment: distribution is a Node native addon, zero .wasm assets; cannot run in the Web client endpoint.
• OMEMO/OMEMO2 wire-format layer: no maintained browser-capable OMEMO2 package on the registry; raw signalDecryptPreKey re-initiation nuance observed during development was not treated as the acceptance path.

Task acceptance-1 requires legacy/OMEMO2 AND worker/wasm AND persistence. Two of the three are not established -> escalate a focused remediation that provides or records a verified browser/WASM-capable OMEMO backend and the OMEMO2 wire layer.

Reproduction for reviewer

• node experiments/0003-crypto-library/session-probe/smoke.mjs -> SMOKE_PASS (0)
• node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs -> exit 2
• npm view omemo2-js version -> 404 (proxy-connected registry)