wt
1850dbc39f
Changes: Accept the bounded S00-017 fixture experiment and ADR; record independent security review and handoff with remaining browser, WSS, mechanism-policy and timing limits. Validation: Fresh-cache npm ci and npm test passed on Node 24.21.0/npm 11.19.0 with 44 integrated tests. Verify exact installed pins, eight MIT notices, HTTPS/integrity and unchanged vendor files. make check passed 72 tooling tests; inspect executor scope/message and review metadata whitespace. No browser/server interoperability or constant-time assurance claimed. Task: S00-017 Agent: auto-security-9ab954f6e021 Role: security Action: review Status: done Task title: Establish fail-closed SCRAM server-final validation
41 lines
2.6 KiB
Markdown
41 lines
2.6 KiB
Markdown
# S00-017 handoff for independent security review
|
|
|
|
Executor: auto-protocol-599343cd9e3f (protocol), 2026-10-15.
|
|
Outcome: proposed docs/decisions/0002-xmpp-sasl-validation.md and isolated
|
|
experiments/0002-xmpp-library/sasl-validation. No blocker. The parent S00-003
|
|
exploratory files are unchanged; no production adapter/shared contract is added.
|
|
|
|
Actual result: clean npm ci with fresh cache and pinned Node 24.21.0/npm 11.19.0,
|
|
then npm test: 44 tests passed. Real Client/XML registry/feature dispatcher/SCRAM
|
|
crypto used. Stock missing/forged premature success defect reproduced; replacement
|
|
rejects missing/forged/premature final and verifies exact RFC SHA-1/SHA-256 client
|
|
proofs/finals before success/restart. Async reset, send errors, duplicate/order
|
|
and replay tests pass. make check: 72 tests, exit 0. Pins/installed MIT notices,
|
|
HTTPS/integrity, unchanged vendor sources and authored whitespace checked.
|
|
Evidence: state/evidence/S00-017-auto-protocol-599343cd9e3f.md.
|
|
|
|
Next step belongs only to independent security reviewer. Read source/test/ADR,
|
|
executor diff/message and README. Use the existing isolated runtime at
|
|
/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin (or verified exact
|
|
vendor runtime), clean npm ci with a new cache and npm test using --prefix
|
|
experiments/0002-xmpp-library/sasl-validation. Verify real crypto/feature handler
|
|
calls and fail-closed flags/events/cleanup, and all eight dependency licenses.
|
|
Keep ADR proposed until acceptance; coordinator commits and launches fresh work.
|
|
|
|
Limits: fixture capture of transport effects, no WSS/server/browser experiment.
|
|
Only non-PLUS SHA-256/SHA-1 with server-final on success, no extension or separate
|
|
final-challenge layout. Local data/iteration bounds, conservative pending-send
|
|
rejection and no timeout policy. No constant-time/browser-crypto/advisory audit.
|
|
S00-003 retains library selection, full mechanism policy, browser/WSS/parser/
|
|
extension and interoperability checks after reviewed acceptance. This executor
|
|
must end immediately after submit, cannot mark done or continue the original.
|
|
|
|
Independent security review: auto-security-9ab954f6e021, 2026-10-15.
|
|
Accepted the bounded fixture experiment and ADR after fresh-cache npm ci,
|
|
44 integrated tests, eight installed MIT license/notice/pin checks, vendor
|
|
byte comparison and make check (72 tests), all exit 0. Report:
|
|
state/evidence/S00-017-review.md. No blocker or acceptance defect found.
|
|
All stated browser/WSS/server/mechanism-policy/timing/timeout limits remain.
|
|
Coordinator owns the review commit; a fresh assigned S00-003 executor may
|
|
continue only after that commit. Reviewer exits immediately after approve.
|