# Blocker S00-017

- Original task: S00-003
- Root task: S00-003
- Reporter: auto-protocol-826aa6bc12ef
- Role: protocol
- Original owner: auto-protocol-826aa6bc12ef
- Waits for user/external condition: False

## Cause

StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.

## One remediation outcome

One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.

## Evidence / reproduction

Run the pinned-node parsed-event reproduction in state/evidence/S00-003-auto-protocol-826aa6bc12ef.md; both invalid server-final cases emit auth:success and request restart (wrapper exit 0 confirms defect). Exact installed source: stanza/plugins/sasl.js success branch.

The reporting agent must stop now. A new agent implements only S00-017.