wt
c73d9cef45
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution. Task: S00-003 Agent: auto-protocol-826aa6bc12ef Role: protocol Action: claim Status: blocked Task title: Проверить XMPP WSS/auth библиотеку
59 lines
3.4 KiB
Markdown
59 lines
3.4 KiB
Markdown
# S00-017: Establish fail-closed SCRAM server-final validation
|
||
|
||
- Remediation для: S00-003; root: S00-003; depth: 1
|
||
|
||
> Generated from planning/tasks.json; status is in state/tasks.json.
|
||
|
||
- Этап: S00
|
||
- Оператор: protocol
|
||
- Reviewer: security
|
||
- Зависимости: S00-001, S00-002
|
||
- Требования: ACC-004, NET-003, NET-004
|
||
|
||
## Один результат
|
||
|
||
One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.
|
||
|
||
## Разрешённые пути
|
||
|
||
- `experiments/0002-xmpp-library/sasl-validation/**`
|
||
- `docs/decisions/0002-xmpp-sasl-validation.md`
|
||
|
||
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
|
||
|
||
## Прочитать
|
||
|
||
- docs/WEB_PROFILE.md
|
||
- docs/ARCHITECTURE.md
|
||
- docs/CONTRACTS.md
|
||
- docs/TESTING.md
|
||
- roles/protocol.md
|
||
- docs/decisions/README.md
|
||
- state/blockers/S00-017.md
|
||
|
||
## Шаги
|
||
|
||
1. Read S00-003 blocker evidence and reproduce the missing/forged/premature success defect with exact candidate versions.
|
||
2. Evaluate supported SASL feature replacement or a maintained alternative; reuse vetted library crypto, never implement crypto primitives or modify ignored vendor source as the deliverable.
|
||
3. Build only a fixture-bound SASL validation experiment with exact dependency pins and document how S00-003 can integrate it through supported extension points; do not build production adapters/shared contracts.
|
||
4. Test valid RFC SCRAM transcript and missing/forged/premature server-final; record actual commands and limitations for independent security review.
|
||
|
||
## Приёмка
|
||
|
||
1. Missing, forged and premature SCRAM server-final cannot emit auth:success or request authenticated restart in the demonstrated integration.
|
||
2. A valid primary-spec SCRAM fixture is accepted only after server signature verification, with no handwritten crypto primitives, stub-success or plaintext fallback.
|
||
3. A supported integration path and pinned dependencies/licenses are documented; original library/WSS/parser/extension task remains separate.
|
||
|
||
## Focused checks
|
||
|
||
1. Reproduce original missing/forged/premature success rejection through the integrated SASL handler, not only a standalone mechanism.
|
||
2. Execute valid RFC SCRAM transcript and negative server-final cases with actual vetted implementation; do not log real credentials.
|
||
|
||
## Блокер и завершение запуска
|
||
|
||
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
|
||
|
||
## Передача
|
||
|
||
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
|