LumaWeb/state/evidence/S00-018-review.md

# S00-018 independent security review

Reviewer: auto-security-64dc2d9fa232 (security).
Executor: auto-protocol-89fe6563092c (protocol). Date: 2026-10-15.
Decision: approve the bounded standalone XML ingress experiment and its ADR.

Input: master/startup/role/workflow documents, assigned show/packet, required
TESTING/protocol role/ADR registry/blocker; exact ACC-004/NET-003/NET-004;
accepted scope, stack and SASL ADRs, direct dependency evidence/reviews/handoffs;
original parser blocker evidence/probe; executor source/tests/message/handoff.
Output: independent review evidence, accepted bounded ADR metadata and handoff.
No new shared contract or application implementation is introduced.

## Findings against acceptance

Implementation commit e2b4dbdb7628f5bf3c821fa89f69df8a6095926f and executor
commit message match the isolated transport integration, fixtures, exact pins,
notices and limitations. Scoped source and generated/state transition diff were
examined. Source paths stay within parser-validation and its ADR; other paths
are workflow metadata. Working tree was clean before review metadata. No specs,
shared interfaces, parent candidate, SASL implementation or plan definition edit.

Finite UTF-16 precheck precedes TextEncoder, bounding its temporary allocation;
4096-byte precheck precedes SAX construction/write. A fresh namespace-aware XML
1.0 document parser validates every message and close() enforces completion.
Depth 8, elements 32, total attributes 16 including xmlns, aggregate attribute
units 1024, names 128 and decoded values 256 are inclusive local budgets before
JXT.parse/registry.import. SAX may retain one token/attribute before callbacks,
but the byte ceiling already bounds it. No DTD fetching/custom entities or
handwritten XML syntax parser. DTD/comment/PI/declaration reject. Malformed,
incomplete, multiple-root and binary input cannot emit an earlier complete root.
The aggregate-limit fixture and Unicode boundary import the exact actual body.

Installed public Client.transports constructor declaration and Transport interface
agree with actual Client.connect selection. This bypasses the stock persistent
parser through a supported constructor registration, without a vendor patch or
post-import interception. Tests run actual Client/JXT/registry/queue; socket
injection captures external effects only and tracing invokes real methods.
Original large/deep/cross-message failure categories reject, with no stanza or
stream:start delivery. Disconnect marks terminal, detaches all four handlers,
clears socket/config/stream, and notifies Client reset. Failed restart and old
callbacks cannot revive the attempt; fresh Client.connect accepts valid input.
No raw XML/error text log/event, real credentials or conversations, crypto,
plaintext fallback, TLS/CORS bypass or invented channel binding found.

Dependency graph has ten exact installed versions/licenses and HTTPS/SHA512
lock entries. Preserved notices match shipped license texts; upstream saxes
v6.0.0 LICENSE independently retrieved over normal HTTPS matches byte-for-byte.
Strict TLS/engines and disabled lifecycle scripts retained. Stanza's 340 files
byte-match the parent candidate. Lock/license checks establish repeatability
and notices, not supply-chain provenance or vulnerability clearance.

No acceptance defect or missing review input found. This is a local ingress
experiment, not a production transport/library selection. Browser message
allocation occurs before JS checks; aggregate traffic, queue growth, CPU rate
and downstream work remain unbounded. Full stream sequencing/error negotiation,
redirect/keepalive/language inheritance and exhaustive SAX/JXT equivalence are
not certified. Browser bundling/runtime, real WSS/server/client interoperability,
load/exhaustion and advisory/provenance audit were not executed. ACC/NET product
obligations and the remaining S00-003 experiment are not accepted by this review.

## Actual independent commands and results

All Node/npm commands used
PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH.
Previously reviewed isolated runtime reused; no new archive verification claimed.

- python3 scripts/tasks.py resume --agent auto-security-64dc2d9fa232; show S00-018;
  packet S00-018 --agent auto-security-64dc2d9fa232: exit 0 each. Review status,
  distinct executor and done prerequisites confirmed; reviewer did not claim.
- Read-only git log --all --grep='^S00-018:' --oneline, git show e2b4dbd --stat,
  scoped source and state/generated diffs; git status --short: exit 0. Initially
  clean tree. Required artifact/source/test/dependency reads completed.
- npm ci --prefix experiments/0002-xmpp-library/parser-validation --ignore-scripts
  --no-audit --no-fund --cache /private/tmp/luma-parser-review-64dc2d9fa232
  --fetch-retries=0 --fetch-timeout=15000: exit 0, new reviewer cache, ten packages.
- npm test --prefix experiments/0002-xmpp-library/parser-validation: exit 0,
  55 passed, zero failed/skipped/cancelled, 335.373333 ms.
- python3 experiments/0002-xmpp-library/parser-validation/check-dependencies.py:
  exit 0, ten exact dependency/license/integrity checks and 340 unchanged files.
  Lock SHA256 35b177d57aaf81778eaf3d3321b3f77eb1e755a46abee784ef62b8959aedd63c;
  ingress e6399ff581f59d1f09b471234d6e4b8f2ed6b61804aa4eb0eef7dd3f8e3f2dbc;
  saxes license 0fac2374380621b22e6b50451057721a9c52935b02d16d106a9f04897f061d0e.
  All match executor evidence.
- node experiments/0002-xmpp-library/parser-probe/reproduce.mjs: exit 0,
  stock accepted 18-write/65536-byte reassembly, 1048576-byte body and 256 nested
  children. This reproduces defects, not safe behavior.
- Inline Node --input-type=module reviewer assertions: exit 0. Six additional
  adversarial documents: complete stream-open plus unfinished second root,
  17 total namespace attributes, surrogate char reference, literal forbidden
  CDATA close in text, 257 decoded character references in an attribute and
  unfinished CDATA. Traced real Parser.parse (the JXT exported implementation)
  invoked zero times on rejection and once per fresh boundary document.
  All four captured callbacks replayed after reconnect; fresh transport remained
  intact, no old delivery/error, exact boundary body imported. Tracing is process
  memory only; no vendor file edit or fabricated parser result.
- npm --version: exit 0, 11.19.0; initial Node tracing error reported v24.21.0.
- Inline Python urllib HTTPS retrieval/assertion of the versioned saxes LICENSE:
  exit 0; preserved bytes equal upstream.
- make check > /private/tmp/luma-S00-018-64dc2d9fa232-check.log 2>&1: exit 0;
  72 tooling tests in 17.775s. Foundation integrity only.
- git diff --check before review metadata: exit 0; final metadata whitespace
  and scope checked before approval.

Exploratory failed check: first inline Node tracing tried assigning jxt.parse;
exit 1, getter-only export TypeError before any assertions ran. Corrected tracing
wraps the writable underlying Parser module export and calls its real function;
subsequent assertions above passed. This initial attempt is not a passed check.
No required artifact or environment blocker resulted.

Primary sources independently opened on 2026-10-15:
[RFC 7395 sections 3.2/3.3.3](https://www.rfc-editor.org/rfc/rfc7395.html#section-3.3.3)
for text/standalone framing, first character and one element per frame;
[versioned saxes README](https://raw.githubusercontent.com/lddubeau/saxes/v6.0.0/README.md)
for public parser/options/entity and token-limit behavior; and
[versioned license](https://raw.githubusercontent.com/lddubeau/saxes/v6.0.0/LICENSE).
The RFC supplies framing requirements, not numerical budgets. Shipped pinned
API/source supplies the exact extension and allocation-order evidence.

Reviewer changes only ADR acceptance metadata/paragraph, report, handoff and
mandatory commit message, plus the CLI transition. Coordinator must commit
before any further session. This reviewer exits after approve and does not
continue S00-003 or launch another agent.