S00-003: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.

Task: S00-003
Agent: auto-protocol-826aa6bc12ef
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку

planning/tasks/S00-003.md

@@ -5,7 +5,7 @@
 - Этап: S00
 - Оператор: protocol
 - Reviewer: qa
-- Зависимости: S00-001, S00-002
+- Зависимости: S00-001, S00-002, S00-017
 - Требования: ACC-004, NET-003, NET-004
 
 ## Один результат

planning/tasks/S00-017.md

@@ -0,0 +1,58 @@
+# S00-017: Establish fail-closed SCRAM server-final validation
+
+- Remediation для: S00-003; root: S00-003; depth: 1
+
+> Generated from planning/tasks.json; status is in state/tasks.json.
+
+- Этап: S00
+- Оператор: protocol
+- Reviewer: security
+- Зависимости: S00-001, S00-002
+- Требования: ACC-004, NET-003, NET-004
+
+## Один результат
+
+One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.
+
+## Разрешённые пути
+
+- `experiments/0002-xmpp-library/sasl-validation/**`
+- `docs/decisions/0002-xmpp-sasl-validation.md`
+
+Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
+
+## Прочитать
+
+- docs/WEB_PROFILE.md
+- docs/ARCHITECTURE.md
+- docs/CONTRACTS.md
+- docs/TESTING.md
+- roles/protocol.md
+- docs/decisions/README.md
+- state/blockers/S00-017.md
+
+## Шаги
+
+1. Read S00-003 blocker evidence and reproduce the missing/forged/premature success defect with exact candidate versions.
+2. Evaluate supported SASL feature replacement or a maintained alternative; reuse vetted library crypto, never implement crypto primitives or modify ignored vendor source as the deliverable.
+3. Build only a fixture-bound SASL validation experiment with exact dependency pins and document how S00-003 can integrate it through supported extension points; do not build production adapters/shared contracts.
+4. Test valid RFC SCRAM transcript and missing/forged/premature server-final; record actual commands and limitations for independent security review.
+
+## Приёмка
+
+1. Missing, forged and premature SCRAM server-final cannot emit auth:success or request authenticated restart in the demonstrated integration.
+2. A valid primary-spec SCRAM fixture is accepted only after server signature verification, with no handwritten crypto primitives, stub-success or plaintext fallback.
+3. A supported integration path and pinned dependencies/licenses are documented; original library/WSS/parser/extension task remains separate.
+
+## Focused checks
+
+1. Reproduce original missing/forged/premature success rejection through the integrated SASL handler, not only a standalone mechanism.
+2. Execute valid RFC SCRAM transcript and negative server-final cases with actual vetted implementation; do not log real credentials.
+
+## Блокер и завершение запуска
+
+Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
+
+## Передача
+
+Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.