S00-003: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages.

Task: S00-003
Agent: auto-protocol-902594b44429
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку

state/handoffs/S00-003.md

@@ -1,11 +1,14 @@
 # S00-003 blocked handoff
 
-Executor: auto-protocol-826aa6bc12ef, protocol. Original scope: library selection and WSS/auth/parser/extension spike.
+Executor: auto-protocol-902594b44429, protocol, 2026-10-15.
+Original outcome remains library selection with WSS/auth/parser/extension spike.
 
-Reached: inspected StanzaJS 12.22.1 and xmpp.js primary sources; created an exploratory pinned Stanza manifest/lock under experiments/0002-xmpp-library. Stanza's actual registered SASL handler was reproduced accepting empty and forged server-final before challenge/proof and requesting restart. See state/evidence/S00-003-auto-protocol-826aa6bc12ef.md for exact runnable reproduction/commands and limitations.
+Prior S00-017 SASL validation remediation is independently accepted. Read its ADR/plugin/44-test evidence; this session did not rerun those tests or change that experiment. Stanza is still an unselected candidate and the parent exploratory manifest/lock remain incomplete.
 
-Blocker: cannot attest safe SCRAM authentication with the candidate's unverified server-final success path. Its SCRAM implementation exposes finalize verification but its feature handler never calls it. Alternative xmpp.js upstream source likewise completes on success without verifier processing; this alternative was not installed/tested. A separately reviewed fail-closed SASL validation experiment is required; no handwritten cryptographic primitives or upstream source patch should be improvised in original selection.
+New bounded probe: experiments/0002-xmpp-library/parser-probe/reproduce.mjs. With the accepted Node 24.21.0 runtime, its actual parser/Client registry accepts a 1 MiB body and 256 nested children and retains/reassembles unfinished XML across 18 writes into a 64 KiB body without error. StreamParserOptions exposes no resource-limit configuration. The shipped WebSocket transport forwards successive messages to that persistent parser without enforcing standalone XML or limits. Evidence and exact command: state/evidence/S00-003-auto-protocol-902594b44429.md. This is a local diagnostic, not WSS/server/browser execution or an exhaustion benchmark.
 
-Source edits stopped. Manifest/lock are an unaccepted exploratory checkpoint, not a complete spike; npm test points at future tests. No ADR 0002 selection written. WSS, parser bounds, extension roundtrip, browser support and valid SCRAM are unverified. No make check result or release readiness claimed. Secrets/account fixtures are invented; no network auth was sent.
+Blocker: cannot attest the required bounded parser ingress using the candidate's stock input path. Needs one separately reviewed experiment enforcing finite input resource limits and complete standalone text XML per WebSocket message, using vetted parsing and a supported integration path. Do not patch ignored vendor source or rely on post-import events after allocations. Keep policy local to the experiment; no shared contract/product-limit decision is authorized here.
 
-Next input: new resolver agent implements only the atomic server-final validation outcome in the issue, with actual negative and valid-vector evidence; independent security reviewer validates it. After reviewed done, a fresh original executor resumes library selection and completes all original focused checks. Reporter must exit after escalate; coordinator owns commits/process launches.
+Source edits stopped after diagnosis. No selection ADR, actual WSS handshake, browser build/runtime, complete mechanism policy, module extension roundtrip or independent interoperability is completed. No make check/clean install claimed for this run; source/accepted dependencies/specs were not altered beyond the bounded probe.
+
+Next input: fresh resolver agent performs only the issue's parser ingress experiment and independent reviewer validates it. Only after reviewed done and coordinator commit may a new original executor resume remaining S00-003 acceptance. Current reporter must exit after escalation, cannot implement resolver, unblock, claim again or launch another agent.