{
  "title": "Validate bounded standalone XML ingress for the XMPP candidate",
  "reason": "S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages.",
  "reproduction": "Run the pinned Node command in state/evidence/S00-003-auto-protocol-902594b44429.md: parser-probe/reproduce.mjs exits 0 after observing acceptance of a 1 MiB body, depth 256, and unfinished XML retained across 18 writes. Inspect stanza/transports/websocket.js and jxt/StreamParser.d.ts for absent per-message completeness/resource-limit enforcement.",
  "role": "protocol",
  "reviewer_role": "security",
  "scope": [
    "experiments/0002-xmpp-library/parser-validation/**",
    "docs/decisions/0002-xmpp-parser-validation.md"
  ],
  "outcome": "One isolated runnable and independently reviewed ingress experiment enforces explicit finite XML resource limits and standalone text XML per WebSocket message before unsafe accumulation/import, through a supported library integration path.",
  "steps": [
    "Read original blocker evidence, bounded probe, shipped parser/transport APIs and RFC 7395 framing; reproduce the stock failure with finite synthetic input.",
    "Choose and document a supported ingress integration using vetted existing XML parsing; keep limits experiment-local, do not implement a handwritten security XML parser or patch ignored vendor sources.",
    "Enforce byte/depth/element/attribute budgets and complete single-document text-message framing before unbounded tree/import work; reject invalid input terminally and clear attempt state.",
    "Add valid boundary and adversarial fixtures including incomplete messages, multiple roots, oversized tokens/attributes, deep XML, malformed XML and binary messages; verify rejection causes no stanza delivery or retained cross-message state.",
    "Record exact dependencies/licenses/browser API constraints if adding packages, runnable commands/results and limitations, then submit for independent security review."
  ],
  "acceptance": [
    "Explicit finite byte/depth/element/attribute budgets are enforced before uncontrolled accumulation/import; boundary-valid stanza still parses with actual library behavior.",
    "Each WebSocket message is one complete standalone text XML document; incomplete/multiple-root/binary input is rejected and cannot be revived by a later message.",
    "Original large/deep/cross-message failure categories are rejected under documented local limits without post-import-only checks, vendor patch or TLS/CORS bypass.",
    "One supported integration path and cleanup/reset behavior are demonstrated by runnable actual ingress tests; no production shared contract, auth policy or product limit change."
  ],
  "checks": [
    "Positive boundary-valid framed stanza using the actual candidate registry/parser and ingress integration.",
    "Original bounded probe categories exceed local budgets or fail framing and produce terminal rejection without stanza emission.",
    "Malformed/unfinished/multiple-root/binary/oversized-token/attribute/depth/element cases; no cross-message retained state or late revival.",
    "Fresh attempt/reset accepts valid input; dependency pin/license/API and scope inspection."
  ],
  "depends_on": [],
  "requires_user_input": false
}