{
  "title": "Establish fail-closed SCRAM server-final validation",
  "reason": "StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.",
  "reproduction": "Run the pinned-node parsed-event reproduction in state/evidence/S00-003-auto-protocol-826aa6bc12ef.md; both invalid server-final cases emit auth:success and request restart (wrapper exit 0 confirms defect). Exact installed source: stanza/plugins/sasl.js success branch.",
  "role": "protocol",
  "reviewer_role": "security",
  "scope": [
    "experiments/0002-xmpp-library/sasl-validation/**",
    "docs/decisions/0002-xmpp-sasl-validation.md"
  ],
  "outcome": "One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.",
  "steps": [
    "Read S00-003 blocker evidence and reproduce the missing/forged/premature success defect with exact candidate versions.",
    "Evaluate supported SASL feature replacement or a maintained alternative; reuse vetted library crypto, never implement crypto primitives or modify ignored vendor source as the deliverable.",
    "Build only a fixture-bound SASL validation experiment with exact dependency pins and document how S00-003 can integrate it through supported extension points; do not build production adapters/shared contracts.",
    "Test valid RFC SCRAM transcript and missing/forged/premature server-final; record actual commands and limitations for independent security review."
  ],
  "acceptance": [
    "Missing, forged and premature SCRAM server-final cannot emit auth:success or request authenticated restart in the demonstrated integration.",
    "A valid primary-spec SCRAM fixture is accepted only after server signature verification, with no handwritten crypto primitives, stub-success or plaintext fallback.",
    "A supported integration path and pinned dependencies/licenses are documented; original library/WSS/parser/extension task remains separate."
  ],
  "checks": [
    "Reproduce original missing/forged/premature success rejection through the integrated SASL handler, not only a standalone mechanism.",
    "Execute valid RFC SCRAM transcript and negative server-final cases with actual vetted implementation; do not log real credentials."
  ],
  "depends_on": [],
  "requires_user_input": false
}