LumaWeb/state/evidence/S00-004-auto-crypto-fe1c81c17ded.md

S00-004 - Browser OMEMO backend spike - Evidence (this run)

• Agent: auto-crypto-fe1c81c17ded
• Role: crypto
• Task: S00-004 "Проверить browser OMEMO backend"
• Resumed after: S00-021 remediation (done) - S00-004 back in_progress
• Date-of-run: 2026-10-15

1. Reproduction of the two committed probes (from project root)

1a. Known-answer session/ratchet + persistence probe

Command:

node experiments/0003-crypto-library/session-probe/smoke.mjs

Actual result (exit code 0):

[log:3] Initializing libsignal version:0.105.0
...
KAS_OK known plaintext: known vector: OMEMO session smoke
KAS_OK established via sealed-sender PreKey session
KAS_OK bob stored session bytes: 631
SMOKE_PASS
smoke exit: 0

Verified: an audited session/ratchet engine (@signalapp/libsignal-client APIs) establishes a sealed-sender PreKey session, round-trips the known plaintext, stores a 631-byte session record and reloads it byte-for-byte. No homegrown ratchet.

1b. Unsupported browser/WASM backend probe

Command:

node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs

Actual result (exit code 2):

pkgPresent: true
wasmFiles: 0
prebuilds: darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64
UNSUPPORTED_BLOCKER: no .wasm asset ships in @signalapp/libsignal-client; the
distribution is a Node native addon (prebuilds/*/*.node). A browser worker/WASM
deployment is NOT established by this npm package and must be treated as a blocker
until a verified browser/WASM distribution is found.
wasm exit: 2

Verified: the shipped distribution is native-only (zero .wasm files; prebuilds are *.node) and cannot run in a browser worker/WASM endpoint.

2. Live public-registry availability check (this run, npmjs.org)

Queried directly (npm view <pkg> version); actual responses:

package	actual response
@signalapp/libsignal-client	0.105.0 (exists; Node native addon; AGPL-3.0-only)
@signalapp/libsignal	E404 - Not Found
@converse/omemo	E404 - Not Found
@xmpp/omemo	E404 - Not Found
omemo2	E404 - Not Found
omemo-js	E404 - Not Found
omemo-client	E404 - Not Found
omemo-top	E404 - Not Found
omemo-wasm	E404 - Not Found

Confirmed again: no maintained browser/worker/WASM-capable OMEMO/OMEMO2 package is available on the reachable registry. @signalapp/libsignal (Signal's WASM web distribution) is not published there. The registry is live (it returns the real version 0.105.0 for @signalapp/libsignal-client), so the E404 responses are genuine.

3. Scope

• Wrote state/issues/S00-004-auto-crypto-fe1c81c17ded.json (one atomac remediation) and this evidence; updated state/handoffs/S00-004.md.
• No source edits outside scope. docs/decisions/0003-crypto-library.md and experiments/0003-crypto-library/** unchanged (the ADR remains as recorded by S00-021 and correctly lists the browser/WASM + OMEMO2 layer as a blocker).

4. Focused checks

1. Known-answer/library smoke -> smoke.mjs exit 0 (SMOKE_PASS, 631-byte byte-for-byte session record). PASS.
2. Unsupported format recorded as blocker, not success -> wasm-unsupported.mjs exit 2 (UNSUPPORTED_BLOCKER, wasmFiles: 0). PASS.
3. No out-of-scope edits -> only workflow metadata + this issue in working tree; experiments/** unchanged.

5. Honest conclusion

The audited session/ratchet engine and persistence are established (verified via a known-answer probe). The browser/worker/WASM endpoint and the OMEMO/OMEMO2 wire layer are NOT available from any maintained package on the reachable registry, confirmed independently on the live public registry this run, and are recorded as a blocker (not success), consistent with ENC-009/ENC-011 and the crypto role rule "unsupported backend - blocker". S00-004 is therefore escalated: the residual blocker (absent verified browser/WASM-capable OMEMO2 backend) requires sourcing or an external decision (requires_user_input). S00-004 is not declared done by bypassing requirements.