# S00-017: Establish fail-closed SCRAM server-final validation

- Remediation для: S00-003; root: S00-003; depth: 1

> Generated from planning/tasks.json; status is in state/tasks.json.

- Этап: S00
- Оператор: protocol
- Reviewer: security
- Зависимости: S00-001, S00-002
- Требования: ACC-004, NET-003, NET-004

## Один результат

One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.

## Разрешённые пути

- `experiments/0002-xmpp-library/sasl-validation/**`
- `docs/decisions/0002-xmpp-sasl-validation.md`

Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.

## Прочитать

- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/protocol.md
- docs/decisions/README.md
- state/blockers/S00-017.md

## Шаги

1. Read S00-003 blocker evidence and reproduce the missing/forged/premature success defect with exact candidate versions.
2. Evaluate supported SASL feature replacement or a maintained alternative; reuse vetted library crypto, never implement crypto primitives or modify ignored vendor source as the deliverable.
3. Build only a fixture-bound SASL validation experiment with exact dependency pins and document how S00-003 can integrate it through supported extension points; do not build production adapters/shared contracts.
4. Test valid RFC SCRAM transcript and missing/forged/premature server-final; record actual commands and limitations for independent security review.

## Приёмка

1. Missing, forged and premature SCRAM server-final cannot emit auth:success or request authenticated restart in the demonstrated integration.
2. A valid primary-spec SCRAM fixture is accepted only after server signature verification, with no handwritten crypto primitives, stub-success or plaintext fallback.
3. A supported integration path and pinned dependencies/licenses are documented; original library/WSS/parser/extension task remains separate.

## Focused checks

1. Reproduce original missing/forged/premature success rejection through the integrated SASL handler, not only a standalone mechanism.
2. Execute valid RFC SCRAM transcript and negative server-final cases with actual vetted implementation; do not log real credentials.

## Блокер и завершение запуска

Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.

## Передача

Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.