S00-018: Bound standalone XML ingress before Stanza parsing and import

Changes: Add an isolated public transport integration with finite byte, depth, element and attribute budgets; validate complete text XML with pinned saxes before real JXT parsing/import. Add adversarial and boundary fixtures, terminal cleanup tests, dependency notices and a proposed parser ADR.
Validation: Fresh-cache npm ci and npm test passed all 55 tests with Node 24.21.0/npm 11.19.0. Reproduced three stock parser failures, checked ten exact dependency licenses/integrities and 340 unchanged Stanza files; make check passed 72 tooling tests. Scope and whitespace inspected. Browser runtime, live WSS and interoperability were not tested.

Task: S00-018
Agent: auto-protocol-89fe6563092c
Role: protocol
Action: claim
Status: review

Task title: Validate bounded standalone XML ingress for the XMPP candidate

state/handoffs/S00-018.md

@@ -0,0 +1,39 @@
+# S00-018 handoff for independent security review
+
+Executor: auto-protocol-89fe6563092c (protocol), 2026-10-15.
+Outcome: isolated bounded XML ingress experiment and proposed parser ADR.
+No blocker; implementation awaits independent security review.
+
+Actual result: new public Client.transports constructor selected by actual
+Client.connect, finite byte precheck, fresh saxes strict namespace-aware XML 1.0
+validation/close per message, then actual JXT.parse/registry.import. Explicit
+local byte/depth/element/attribute/name/value limits apply before tree/import.
+Malformed/incomplete/multiple-root/binary/budget violations close attempt,
+detach callbacks, clear stream/config; stale callbacks cannot revive it. A fresh
+connection works. No persistent parser, vendor patch or custom XML syntax parser.
+
+Pinned Node 24.21.0/npm 11.19.0 fresh-cache npm ci and 55 integrated tests passed;
+stock probe reproduced all three failures; license checks for all ten packages
+and byte comparison of all 340 Stanza files passed. make check: 72 tests passed.
+Commands/digests/failures/limits: state/evidence/S00-018-auto-protocol-89fe6563092c.md.
+
+Next belongs only to security reviewer: inspect proposed
+ docs/decisions/0002-xmpp-parser-validation.md, experiment source/tests/notices,
+executor diff/message and README. Run README commands with the reviewed isolated
+runtime at /private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin and a
+fresh reviewer cache. Verify budget/framing checks precede JXT allocations/import,
+actual Client registry selection, boundary success, zero delivery for bad input,
+terminal callback replay/cleanup and fresh attempts. check-dependencies.py also
+needs the original parent candidate installed for vendor comparison. Saxes
+published package omits LICENSE; preserved v6.0.0 upstream LICENSE and source are
+recorded. Keep ADR proposed until independent acceptance.
+
+Limits: fixture socket only, no browser build/runtime or real WSS/server/client
+interop; byte checks begin after browser allocates the message. No aggregate
+traffic/Client queue/rate bounds or production policy. Minimal transport lacks
+full stream-error/close negotiation/redirect/keepalive/language inheritance/
+sequencing, and exhaustive SAX/JXT equivalence is not certified. Auth/crypto and
+accepted SASL experiment unchanged. No specs/shared interfaces/app modules or
+original candidate files changed. S00-003 remains separate; only reviewed done
+and coordinator commit allow a fresh original executor to continue it. This
+executor exits after submit; no commit/next agent/original work is performed.