wt
f556fc0deb
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages. Task: S00-003 Agent: auto-protocol-902594b44429 Role: protocol Action: claim Status: blocked Task title: Проверить XMPP WSS/auth библиотеку
1.1 KiB
Blocker S00-018
- Original task: S00-003
- Root task: S00-003
- Reporter: auto-protocol-902594b44429
- Role: protocol
- Original owner: auto-protocol-902594b44429
- Waits for user/external condition: False
Cause
S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages.
One remediation outcome
One isolated runnable and independently reviewed ingress experiment enforces explicit finite XML resource limits and standalone text XML per WebSocket message before unsafe accumulation/import, through a supported library integration path.
Evidence / reproduction
Run the pinned Node command in state/evidence/S00-003-auto-protocol-902594b44429.md: parser-probe/reproduce.mjs exits 0 after observing acceptance of a 1 MiB body, depth 256, and unfinished XML retained across 18 writes. Inspect stanza/transports/websocket.js and jxt/StreamParser.d.ts for absent per-message completeness/resource-limit enforcement.
The reporting agent must stop now. A new agent implements only S00-018.