wt
c73d9cef45
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: StanzaJS 12.22.1 SASL feature accepts missing/forged server-final without processSuccess/finalize, including success before challenge/proof. Safe SCRAM cannot be attested by S00-003 until this authentication boundary has a reviewed solution. Task: S00-003 Agent: auto-protocol-826aa6bc12ef Role: protocol Action: claim Status: blocked Task title: Проверить XMPP WSS/auth библиотеку
3.4 KiB
S00-017: Establish fail-closed SCRAM server-final validation
- Remediation для: S00-003; root: S00-003; depth: 1
Generated from planning/tasks.json; status is in state/tasks.json.
- Этап: S00
- Оператор: protocol
- Reviewer: security
- Зависимости: S00-001, S00-002
- Требования: ACC-004, NET-003, NET-004
Один результат
One isolated, runnable and independently reviewed SASL integration experiment rejects unverified SCRAM server-final before reporting authentication success, using vetted existing crypto and a supported library extension path.
Разрешённые пути
experiments/0002-xmpp-library/sasl-validation/**docs/decisions/0002-xmpp-sasl-validation.md
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
Прочитать
- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/protocol.md
- docs/decisions/README.md
- state/blockers/S00-017.md
Шаги
- Read S00-003 blocker evidence and reproduce the missing/forged/premature success defect with exact candidate versions.
- Evaluate supported SASL feature replacement or a maintained alternative; reuse vetted library crypto, never implement crypto primitives or modify ignored vendor source as the deliverable.
- Build only a fixture-bound SASL validation experiment with exact dependency pins and document how S00-003 can integrate it through supported extension points; do not build production adapters/shared contracts.
- Test valid RFC SCRAM transcript and missing/forged/premature server-final; record actual commands and limitations for independent security review.
Приёмка
- Missing, forged and premature SCRAM server-final cannot emit auth:success or request authenticated restart in the demonstrated integration.
- A valid primary-spec SCRAM fixture is accepted only after server signature verification, with no handwritten crypto primitives, stub-success or plaintext fallback.
- A supported integration path and pinned dependencies/licenses are documented; original library/WSS/parser/extension task remains separate.
Focused checks
- Reproduce original missing/forged/premature success rejection through the integrated SASL handler, not only a standalone mechanism.
- Execute valid RFC SCRAM transcript and negative server-final cases with actual vetted implementation; do not log real credentials.
Блокер и завершение запуска
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
Передача
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.