wt
c73d9cef45
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution. Task: S00-003 Agent: auto-protocol-826aa6bc12ef Role: protocol Action: claim Status: blocked Task title: Проверить XMPP WSS/auth библиотеку
23 lines
1.1 KiB
Markdown
23 lines
1.1 KiB
Markdown
# Blocker S00-017
|
|
|
|
- Original task: S00-003
|
|
- Root task: S00-003
|
|
- Reporter: auto-protocol-826aa6bc12ef
|
|
- Role: protocol
|
|
- Original owner: auto-protocol-826aa6bc12ef
|
|
- Waits for user/external condition: False
|
|
|
|
## Cause
|
|
|
|
StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution.
|
|
|
|
## One remediation outcome
|
|
|
|
One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.
|
|
|
|
## Evidence / reproduction
|
|
|
|
Run the pinned-node parsed-event reproduction in state/evidence/S00-003-auto-protocol-826aa6bc12ef.md; both invalid server-final cases emit auth:success and request restart (wrapper exit 0 confirms defect). Exact installed source: stanza/plugins/sasl.js success branch.
|
|
|
|
The reporting agent must stop now. A new agent implements only S00-017.
|