wt
d91103ea1c
Changes: Accept ADR 0000 and record the independent reviewer, acceptance findings and handoff. Confirm native exclusion reasons, retained Web obligations, conditional push lifecycle and provider secret/metadata boundaries; transition S00-001 through the review CLI.
Validation: Reviewed executor commit d5ed7eaaed and its message against scope and evidence. python3 experiments/0000-scope/check.py passed ten IDs, seven states and four negative mutations. make check passed validation and all 66 tooling tests. No live browser/provider integration or crypto implementation was tested or accepted.
Task: S00-001
Agent: auto-security-bff4cfd4d38e
Role: security
Action: review
Status: done
Task title: Утвердить Web-профиль
36 lines
4.7 KiB
Markdown
36 lines
4.7 KiB
Markdown
# S00-001 — independent security review
|
|
|
|
Reviewer: auto-security-bff4cfd4d38e (security)
|
|
Executor: auto-orchestrator-48aab142ecde (orchestrator)
|
|
Date: 2026-10-15
|
|
Decision: approve the bounded Web-scope passport; ADR 0000 accepted.
|
|
|
|
Input: assigned review card/context packet, canonical applicability and exact requirements, executor patch d5ed7eaaed54d39ae928698df7085b2d6b86c69a, evidence and handoff. Output: this independent decision and accepted ADR metadata. No dependencies or previously accepted ADR/contracts apply; S01 schemas remain future work.
|
|
|
|
## Acceptance and security findings
|
|
|
|
- All ten excluded IDs match canonical applicability and have meaningful native-only reasons. Read their original clauses manually, including ACC-003, NET-002, DESK-001…003, AND-001…004 and STORE-002. NET-002's Web WSS clause remains explicitly mandatory; shared UI/accessibility/touch requirements remain applicable. No requirements snapshot or allocation was changed.
|
|
- GEN-005 is preserved: advertised, configured and verified states are distinct; unavailable providers/permissions disable the dependent function with an explanation. GEN-006's delivery/read/retraction/metadata limitations are explicit.
|
|
- WEB-002 is preserved in prose and the seven-state table. Closed-tab push is conditional and does not promise an XMPP session, continuous media or automatic fullscreen incoming UI. Hidden continuity is not guaranteed. Logout requires disable/revoke and rejects reactivation by late events; stale call notifications require current-state checking.
|
|
- Provider inventory separates hosting, XMPP/WSS, upload, STUN/TURN, XMPP gateway, browser push service and maps. Password memory-only and explicit endpoint selection prevent silently treating a third-party gateway as trusted. OMEMO plaintext/file keys are excluded from gateway data; subscriptions are sensitive, private credentials/VAPID/TURN secrets stay outside repo/logs. Routing, timing/size, IP and coordinates remain disclosed metadata risks. No real credentials, subscriptions, JIDs or conversations found in reviewed task artifacts. TLS/CORS bypass, decrypting proxy and plaintext fallback are prohibited.
|
|
- Executor commit/message accurately describes the actual scope ADR and dependency-free document checker. Full patch examined: other changes are only S00-001 workflow evidence, commit message, handoff and CLI-generated status/matrices. No app modules, shared contracts, planning definitions or immutable specs changed. Initial reviewer working tree was clean.
|
|
|
|
## Independent checks
|
|
|
|
| Command | Exit | Actual result |
|
|
| --- | --- | --- |
|
|
| `python3 scripts/tasks.py resume --agent auto-security-bff4cfd4d38e` | 0 | Empty owned-task list, expected for reviewer; did not claim. |
|
|
| `python3 scripts/tasks.py show S00-001` | 0 | Assigned security review, status review, no dependencies. |
|
|
| `python3 scripts/tasks.py packet S00-001 --agent auto-security-bff4cfd4d38e` | 0 | Exact requirements and handoff obtained. |
|
|
| `git log --all --grep='^S00-001:' --format=fuller -n 3` and `git show d5ed7eaaed54d39ae928698df7085b2d6b86c69a` (scoped sections) | 0 | Executor message and all nine changed files examined. |
|
|
| `python3 experiments/0000-scope/check.py` | 0 | 10 excluded IDs, 7 lifecycle states; all 4 negative mutations rejected. |
|
|
| `make check` | 0 | Validated 275 tasks, 22 stages, 221 requirements, 211 allocated Web requirements, revision 2; 66 tooling tests passed in 10.024s. |
|
|
|
|
The checker asserts document structure and forbidden lifecycle promises, not runtime behavior. Reason length alone cannot prove meaning; reasons and provider prose were reviewed manually. It must run without Python optimization.
|
|
|
|
## Primary sources and limits
|
|
|
|
Independently opened the ADR's sources with the web tool on 2026-10-15: [RFC 7395](https://www.rfc-editor.org/rfc/rfc7395.html) §6 for endpoint identity/TLS; [Push API](https://www.w3.org/TR/2026/WD-push-api-20261005/) §4 for visible metadata; [Service Workers](https://www.w3.org/TR/2026/CRD-service-workers-20260917/#service-worker-lifetime) §2.1.1 for event-bound lifetime/termination; [XEP-0357](https://xmpp.org/extensions/xep-0357.html) §2 for separate push actors; [XEP-0206](https://xmpp.org/extensions/xep-0206.html) for the BOSH alternative. The profile's continuous-session limitation is a conservative inference from worker lifetime, not a browser compatibility test.
|
|
|
|
No browser/provider integration, live XMPP, encrypted interoperability, storage unlock or deployed topology was tested or accepted. S00-002…010 still own these decisions and experiments. This review accepts a scope document and focused document experiment only. Reviewer changes are ADR acceptance metadata, this report, handoff and mandatory review commit message; status transition uses tasks.py. Git mutation/commit remains coordinator-owned.
|