wt
e69372c6db
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: Stanza 12.22.1 browser HMAC sha-512 fails RFC 4231 Test Case 1: wrong 64-byte block selection. SCRAM-SHA-512 derives that hyphenated algorithm; private algorithm mutation/vendor patches are unsupported. Parent cannot attest browser strongest-mechanism compatibility from Node-only success. Task: S00-003 Agent: auto-protocol-dcdf92cd067e Role: protocol Action: claim Status: blocked Task title: Проверить XMPP WSS/auth библиотеку
33 lines
1.9 KiB
Markdown
33 lines
1.9 KiB
Markdown
# S00-003 blocked handoff
|
|
|
|
Executor: auto-protocol-dcdf92cd067e, protocol, 2026-10-15.
|
|
Outcome remains library selection with WSS/auth/parser/extension spike.
|
|
|
|
Accepted prerequisites: S00-001 scope, S00-002 stack, S00-017 fail-closed SASL
|
|
and S00-018 bounded parser ingress. Their ADRs/evidence were read; their suites
|
|
were not rerun or changed. Parent Stanza candidate remains unselected, parent
|
|
exploratory manifest/lock incomplete, selection ADR absent.
|
|
|
|
Blocker newly reproduced in pinned Stanza 12.22.1 browser crypto:
|
|
createHmac('sha-512', RFC 4231 section 4.2 key/data) returns a different digest
|
|
than the fixed primary-spec vector and Node native crypto. sha512 alias and
|
|
sha-256/sha-1 controls match. Browser Hmac tests only alg === 'sha512' for its
|
|
128-byte block size, while SCRAM-SHA-512 derives 'sha-512'; that SCRAM field
|
|
is private in declarations. Direct browser module execution in Node is a
|
|
backend diagnostic, not actual browser/WSS execution. Exact reproduction and
|
|
digests: state/evidence/S00-003-auto-protocol-dcdf92cd067e.md.
|
|
|
|
Source edits stopped; none were made. Do not patch ignored vendor code/private
|
|
fields, implement primitives, change wire name, claim successful SHA-512 from
|
|
Node-only crypto or silently downgrade to avoid the defect. One fresh crypto
|
|
resolver must produce an isolated browser-compatible SCRAM-SHA-512 integration
|
|
using vetted existing crypto and supported public mechanism extension APIs,
|
|
with known vectors, full proof/server-final and negative tests. Independent
|
|
security review must accept that outcome before coordinator resumes original.
|
|
|
|
No WSS handshake, browser build/runtime, complete mechanism policy, extension
|
|
roundtrip, selection or independent interoperability has been completed in this
|
|
session. No clean install/make check claimed. No shared/spec/accepted dependency
|
|
changes. Reporter exits immediately after escalate and cannot implement resolver,
|
|
unblock/reclaim or launch another process.
|