LumaWeb/state/evidence/S00-019-review.md

S00-019 independent security review

Reviewer: auto-security-f465a677e48f (security). Executor: auto-crypto-c68801170fa4 (crypto). Date: 2026-10-15. Decision: approve the isolated pinned SHA-512 experiment and bounded ADR.

Inputs and patch

Read master/startup/security/protocol/workflow/Git/testing documents, required blocker and ADR registry, assigned card/context/handoff and exact ACC-004, NET-003/004. Read accepted scope/stack/SASL/parser decisions and direct dependency evidence/reviews/handoffs, original S00-003 blocker evidence/handoff. No new S01 contract is needed for the isolated experiment. Initial working tree was clean. Read implementation commit 07c9967d02, path list, source/test/build/dependency files and executor message. Message matches actual implementation and its explicitly untested external paths. Source changes stay within card experiment and ADR; other commit paths are generated/workflow metadata. No immutable specs, parent candidate, accepted dependency sources, application modules or shared contract changes found.

Acceptance findings

1. The built artifact resolves Stanza browser Hmac/SHA-512, never its Node crypto backend. Fixed SHA abc aliases, all seven RFC HMAC cases and varied key lengths pass. Canonical HTTPS RFC 4231 text independently matches all seven fixture digests. Exact original hyphenated HMAC defect and wrong stock full proof reproduce. Node crypto is only the independent primitive test oracle.
2. Three fixed ordinary/131-byte/Unicode password transcripts match real browser-backend SCRAM proof/final. A newly installed hashed Scramp 1.4.6 environment independently verifies client proof and server signature and compares fixtures. Real Client/XML registry/feature dispatcher run; captured send/socket effects are explicit fixtures. Missing/forged/premature/error/duplicate/racing finals and reset/send-error/replay paths produce no success/restart. Real processSuccess and finalize are called before authentication. Independent signature mutations at bytes 0, 31 and 63 reject. Guard-specific controlled finalize outputs demonstrate that either missing/false authenticated or mutuallyAuthenticated flag rejects; these three guard checks deliberately alter return flags after real verification, not crypto interoperability evidence.
3. Exported SCRAM constructor accepts a string in shipped public declarations; inspected implementation derives sha512 from SCRAM-SHA512. Wrapper implements public Mechanism, exposes SCRAM-SHA-512, and delegates declared methods only. Factory.disable/register, fresh Client.use and registerFeature are public paths. No vendor/private-field/prototype/crypto import patch or custom primitive found. This exact-version alias composition is accepted, without promising upstream future compatibility. PLUS/tlsUnique/plaintext-only paths fail, n,,/c=biws record no binding, and no plaintext fallback or invented TLS data is used.
4. Strict engine/TLS pins, fresh-cache install with scripts disabled, browser bundle graph/artifact and locked notice checks reproduce. 49 lock entries/25 installed pins/licenses and all 340 vendor files verified; output/source/lock hashes match executor evidence. Stanza ancestry and build-owner notices preserved; Python MIT-0/MIT notices byte-match installed licenses. Build-only MPL code is unmodified. These checks establish repeatability/notices, not audit/provenance or advisory clearance. No real secrets/accounts, authored credential/peer logs, TLS/certificate/CORS bypass or production transport found.

No acceptance defect or review blocker found. Numerical bounds, extension-free success-only final, synchronous derivation, string verifier comparison, no timeout and limited SASLprep coverage remain declared experiment limitations. Bundle runs in Node with browser backend/native host APIs: no actual browser engine, real WSS, live independent server/client or parent bounded-parser integration was exercised. Full mechanism fallback policy, production selection, worker/performance, release security and complete ACC/NET obligations remain outside S00-019 acceptance.

Actual independent commands/results

Node/npm PATH for all commands: /private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH. node --version and npm --version: exit 0, v24.21.0 / 11.19.0. Reused accepted runtime; no new archive verification claimed.

• python3 scripts/tasks.py resume --agent auto-security-f465a677e48f; show S00-019; packet S00-019 --agent auto-security-f465a677e48f: exit 0 each, review status, distinct executor and done prerequisites confirmed; no claim.
• Read-only git log/show/status and source/API/notice reads: exit 0; initially clean tree; scoped implementation and meaningful executor message inspected.
• npm ci --prefix experiments/0002-xmpp-library/sha512-validation --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-sha512-review-f465a677e48f --fetch-retries=0 --fetch-timeout=15000: exit 0, new reviewer cache, 25 packages.
• npm test --prefix experiments/0002-xmpp-library/sha512-validation: 87 passed, zero failed/skipped/cancelled. Final repeat captured npm exit separately from tail: exit 0, 2951.236417ms. Initial log-tail command's shell exit alone was not used as proof of npm exit; successful suite output was inspected.
• python3 -m venv /private/tmp/luma-sha512-review-f465-oracle: exit 0; its Python pip install --require-hashes --only-binary=:all: --no-cache-dir -r experiments/0002-xmpp-library/sha512-validation/oracle-requirements.txt: exit 0.
• /private/tmp/luma-sha512-review-f465-oracle/bin/python experiments/0002-xmpp-library/sha512-validation/oracle.py: exit 0, three fixed independent SHA-512 client/server exchanges verified, no rewrite.
• python3 experiments/0002-xmpp-library/sha512-validation/check-dependencies.py: exit 0, 49 locked entries, 25 installed pins/licenses, 340 unchanged vendor files, browser graph confirmed. All six printed SHA256 values equal executor evidence, including browser.mjs 0b4fb1ef7684d7eab5cb1cd2c6078cdb84bff55f5cb3986e1e79a1d7418cf72a.
• node --test /private/tmp/luma-sha512-review-f465-extra.test.mjs: exit 0, 10 extra checks passed. In addition to signature/flag checks above, i=0, i=04096, s=A=== and trailing newline reject before proof send. Temporary harness reuses actual browser-built Client/registry/dispatcher and fixture helper; repository test/source files unchanged.
• Inline Python urllib HTTPS RFC digest assertions: all seven matched. Same exploratory script then exited 1 on guessed Scramp LICENSE path. rg located dist-info/licenses/LICENSE; corrected inline license check exited 0 for both installed oracle licenses. Missing guessed path was not a required artifact.
• make check with preserved command exit: exit 0, 72 tooling tests in 19.370s. Foundation integrity only, not messenger readiness.
• git diff --check and final scope/metadata checks: exit 0 before approval.

Primary references independently opened: RFC 4231 https://www.rfc-editor.org/rfc/rfc4231.html; Stanza public SASL source https://github.com/legastero/stanza/blob/master/src/lib/sasl/index.ts; Scramp versioned API https://pypi.org/project/scramp/1.4.6/; events upstream https://github.com/browserify/events. Shipped pinned declarations and source, rather than mutable upstream alone, establish exact API behavior.

Reviewer changes only ADR acceptance metadata/paragraph, this report, handoff and commit message plus CLI transition. Coordinator owns the review commit; reviewer exits after approve and does not continue parent work or launch another agent.