Changes: Add an isolated public transport integration with finite byte, depth, element and attribute budgets; validate complete text XML with pinned saxes before real JXT parsing/import. Add adversarial and boundary fixtures, terminal cleanup tests, dependency notices and a proposed parser ADR.
Validation: Fresh-cache npm ci and npm test passed all 55 tests with Node 24.21.0/npm 11.19.0. Reproduced three stock parser failures, checked ten exact dependency licenses/integrities and 340 unchanged Stanza files; make check passed 72 tooling tests. Scope and whitespace inspected. Browser runtime, live WSS and interoperability were not tested.
Task: S00-018
Agent: auto-protocol-89fe6563092c
Role: protocol
Action: claim
Status: review
Task title: Validate bounded standalone XML ingress for the XMPP candidate
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages.
Task: S00-003
Agent: auto-protocol-902594b44429
Role: protocol
Action: claim
Status: blocked
Task title: Проверить XMPP WSS/auth библиотеку
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.
Task: S00-003
Agent: auto-protocol-826aa6bc12ef
Role: protocol
Action: claim
Status: blocked
Task title: Проверить XMPP WSS/auth библиотеку
wt