LumaWeb/state/evidence/S00-021-auto-crypto-fcef9b6781bf.md

S00-021 - Eliminate interruption cause and prove S00-004 ready - Evidence

• Agent: auto-crypto-fcef9b6781bf
• Role: crypto
• Task: S00-021 "Устранить прерывание: Проверить browser OMEMO backend"
• Remediation of: S00-004
• Date-of-run: 2026-10-15

1. Reproduction of the two committed probes (run from project root)

Blocker cause recorded: "Agent timed out; process terminated before escalation". The probes from the S00-004 handoff were re-run unchanged to confirm the current, reproducible state.

1a. Known-answer session/ratchet + persistence probe

node experiments/0003-crypto-library/session-probe/smoke.mjs

Actual result (exit code 0):

[log:3] Building PreKeyWhisperMessage for: 796abedb-...-4214?.3 with preKeyId: 31337
[log:3] decrypted PreKey message from <ACI:9d0652a3-...>.1 with current session state ...
KAS_OK known plaintext: known vector: OMEMO session smoke
KAS_OK established via sealed-sender PreKey session
KAS_OK bob stored session bytes: 631
SMOKE_PASS
exit code: 0

Verified: an audited session/ratchet engine (real @signalapp/libsignal-client APIs) establishes a PreKey session, round-trips the known plaintext, stores a 631-byte session record and reloads it byte-for-byte. No homegrown ratchet.

1b. Unsupported browser/WASM backend probe

node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs

Actual result (exit code 2):

pkgPresent: true
wasmFiles: 0
prebuilds: darwin-arm64, darwin-x64, linux-arm64, linux-x64, win32-arm64, win32-x64
UNSUPPORTED_BLOCKER: no .wasm asset ships in @signalapp/libsignal-client; the
distribution is a Node native addon (prebuilds/*/*.node). A browser worker/WASM
deployment is NOT established by this npm package ...
exit code: 2

Verified: the shipped distribution is native-only (dist/Native.js loads via node-gyp-build, prebuilds/*/*.node, zero .wasm files) and cannot run in a browser worker/WASM endpoint.

2. Registry/primary-source availability check (reachable npm proxy, 2026-10-15)

Queried with npm view <pkg> version; actual responses:

package	actual response
@signalapp/libsignal-client	version 0.105.0, license AGPL-3.0-only (exists)
@signalapp/libsignal	E404 Not Found
omemo-client	E404 Not Found
omemo-top	E404 Not Found
omemo-wasm	E404 Not Found
@converse/omemo	E404 Not Found

No maintained browser/WASM-capable OMEMO or OMEMO2 package is available on the reachable registry. Signal's WASM web distribution (@signalapp/libsignal) is not published there. Access was established earlier (S00-020, S00-019) and the same proxy returns the real version for @signalapp/libsignal-client, so the E404 responses are genuine, not a network outage.

3. Deliverable in scope

• Wrote docs/decisions/0003-crypto-library.md (proposed) recording the verified audited session/ratchet + persistence capability and the verified blocker for the browser/worker/WASM endpoint and the OMEMO2 wire layer, with traceable primary sources (docs/decisions/0003-crypto-library.md).
• No source edits outside scope; no spec/plan/shared-contract change.

4. Focused checks

1. Reproduce interruption scenario -> both probes re-run: smoke exits 0 (SMOKE_PASS), wasm-unsupported exits 2 (blocker line). Reproducible.
2. No out-of-scope changes -> git working tree contains only workflow metadata (state/tasks.json) plus the in-scope ADR; experiments/** unchanged.

5. Honest conclusion

The audited session/ratchet engine and persistence are established (verified via known-answer probe). The browser/worker/WASM endpoint and the OMEMO2 wire layer are NOT available from any maintained package on the reachable registry and are recorded as a blocker (not success), consistent with ENC-009/ENC-011 and the crypto role rule "unsupported backend — blocker". S00-004 is thereby left with a documented, reproducible state and a clear next step rather than an interrupted/timeout dead-end; it is not declared done by bypassing requirements.