wt
71675b1cc0
Changes: Preserve incomplete work and blocker metadata for S00-004. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: Agent timed out; process terminated before escalation Task: S00-004 Agent: auto-crypto-8bf3dcf711b9 Role: crypto Action: claim Status: blocked Task title: Проверить browser OMEMO backend
105 lines
4.0 KiB
Markdown
105 lines
4.0 KiB
Markdown
# S00-004 - Browser OMEMO backend spike - Evidence
|
|
|
|
- Agent: `auto-crypto-8bf3dcf711b9`
|
|
- Role: crypto
|
|
- Task: S00-004 "Проверить browser OMEMO backend"
|
|
- Date-of-run: 2026-10-15
|
|
|
|
## 1. Known-answer session/ratchet + persistence probe (PASS)
|
|
|
|
Command and result:
|
|
|
|
```
|
|
cd experiments/0003-crypto-library
|
|
node session-probe/smoke.mjs
|
|
```
|
|
|
|
Actual output (native libsignal trace + KAS lines):
|
|
|
|
```
|
|
[log:3] Building PreKeyWhisperMessage for: 796abedb-...-4214?.3 with preKeyId: 31337 (session created at 1792052846)
|
|
[log:3] decrypted PreKey message from <ACI:9d0652a3-...>.1 with current session state ...
|
|
KAS_OK known plaintext: known vector: OMEMO session smoke
|
|
KAS_OK established via sealed-sender PreKey session
|
|
KAS_OK bob stored session bytes: 631
|
|
SMOKE_PASS
|
|
exit code: 0
|
|
```
|
|
|
|
What is shown: using the canonical real library API
|
|
(`sealedSenderEncryptMessage`/`sealedSenderDecryptMessage`) an independent
|
|
A/B pair established a PreKey session; the exact known plaintext string
|
|
(`known vector: OMEMO session smoke`) round-tripped; the decrypted-stored
|
|
session record serialized to 631 non-empty bytes and reloaded byte-for-byte
|
|
via `SessionRecord.deserialize`.
|
|
|
|
Verified capability: session/ratchet establishment and session-record
|
|
persistence on a real, unmodified, audited Signal session library. **No
|
|
homegrown ratchet.**
|
|
|
|
## 2. Unsupported format/backend probe (BLOCKER, exit 2)
|
|
|
|
Command and result:
|
|
|
|
```
|
|
cd experiments/0003-crypto-library
|
|
node session-probe/wasm-unsupported.mjs
|
|
```
|
|
|
|
Actual output:
|
|
|
|
```
|
|
pkgPresent: true
|
|
wasmFiles: 0
|
|
prebuilds: darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64
|
|
UNSUPPORTED_BLOCKER: no .wasm asset ships in @signalapp/libsignal-client; the
|
|
distribution is a Node native addon (prebuilds/*/*.node). A browser worker/WASM
|
|
deployment is NOT established by this npm package ...
|
|
exit code: 2
|
|
```
|
|
|
|
What is shown: the only maintained, installable, audited session library in
|
|
this registry (`@signalapp/libsignal-client@0.105.0`, AGPL-3.0-only) ships as a
|
|
Node native addon and contains no WebAssembly asset. It therefore cannot execute
|
|
in a browser worker as required by the Web client-endpoint.
|
|
|
|
## 3. OMEMO2 wire-format candidate search (no maintained package)
|
|
|
|
Registry queries (via proxy, real responses):
|
|
|
|
| package | result |
|
|
| --- | --- |
|
|
| `omemo2-js` | 404 Not Found |
|
|
| `@oxjs/omemo` | 404 Not Found |
|
|
| `omemo-wasm` | 404 Not Found |
|
|
| `@signalapp/libsignal` | 404 Not Found |
|
|
| `@signalapp/libsignal-client@0.105.0` | exists (AGPL-3.0-only, native addon) |
|
|
| `signal-protocol@0.1.3` | exists (GPL-3.0, 2017-era, unmaintained; not a viable maintained OMEMO2 candidate) |
|
|
|
|
No maintained browser/WASM-capable OMEMO or OMEMO2 wire-format package is
|
|
available on the reachable registry. `@signalapp/libsignal-client` provides the
|
|
session/ratchet engine but does not provide the OMEMO/OMEMO2 XMPP wire mapping
|
|
(ENC-009/ENC-011 SCE payload/key/MAC stanzas).
|
|
|
|
## 4. Honest conclusion (blocker, not success)
|
|
|
|
Feasible and verified:
|
|
- Audited session/ratchet engine + secure session-record persistence (real API,
|
|
known-answer roundtrip, no homegrown ratchet).
|
|
|
|
NOT established and therefore a blocker (per focused-check rule "unsupported
|
|
format recorded blocker, not success"):
|
|
- Browser/worker/WASM deployment: distribution is a Node native addon, zero
|
|
`.wasm` assets; cannot run in the Web client endpoint.
|
|
- OMEMO/OMEMO2 wire-format layer: no maintained browser-capable OMEMO2 package
|
|
on the registry; raw `signalDecryptPreKey` re-initiation nuance observed during
|
|
development was not treated as the acceptance path.
|
|
|
|
Task acceptance-1 requires legacy/OMEMO2 AND worker/wasm AND persistence. Two of
|
|
the three are not established -> escalate a focused remediation that provides or
|
|
records a verified browser/WASM-capable OMEMO backend and the OMEMO2 wire layer.
|
|
|
|
## Reproduction for reviewer
|
|
- `node experiments/0003-crypto-library/session-probe/smoke.mjs` -> SMOKE_PASS (0)
|
|
- `node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs` -> exit 2
|
|
- `npm view omemo2-js version` -> 404 (proxy-connected registry) |