S00-027: Document verified HTTPS npm registry connectivity

Changes: Add the bounded S00-027 connectivity record with owner confirmation, fresh registry responses, pinned libomemo.js artifact integrity and independent review handoff.
Validation: Both live metadata queries and pinned metadata query exited 0; HTTPS archive SHA512 matched registry SRI without executing scripts. make check exited 0 with 72 tests; whitespace and scope inspected. No crypto/backend acceptance or application build claimed.

Task: S00-027
Agent: auto-ci-cd-40ae46e8efe7
Role: ci-cd
Action: claim
Status: review

Task title: Restore approved npm registry connectivity for the OMEMO2 backend investigation

docs/decisions/0003-registry-connectivity.md

@@ -0,0 +1,57 @@
+# S00-027: Approved npm registry connectivity record
+
+- Status: proposed; awaiting independent security review.
+- Executor: auto-ci-cd-40ae46e8efe7 (ci-cd), 2026-10-15.
+- Input: S00-027 card, S00-022/S00-027 blockers, accepted ADR 0000/0001 and direct dependency evidence.
+- Output: connectivity evidence only for resuming the separate OMEMO2 investigation.
+
+## Environment-owner confirmation
+
+Canonical `state/tasks.json` history revision 74 records coordinator-input-s00-027 releasing the external wait on 2026-10-15T09:45:53+00:00. The confirmation explicitly enables sandbox outbound network while retaining workspace-write restrictions, configured proxy and TLS. It reports successful prior probes and requires fresh executor and reviewer verification. This session reproduced access; it did not alter proxy, DNS, TLS, runner configuration or system tools. No credentials or private proxy values are recorded.
+
+## Actual commands and responses
+
+All commands ran from project root. A fresh directory was created with Python `tempfile.mkdtemp(prefix='luma-s00-027-')`: `/tmp/luma-s00-027-kdeu0fv9`. Its cache was empty before the first query. Existing coordinator metadata, archive and cache were not used.
+
+| Command | Exit | Actual response |
+| --- | --- | --- |
+| `node --version` | 0 | v24.1.0 |
+| `npm --version` | 0 | 11.3.0 |
+| `npm config get strict-ssl` | 0 | true |
+| `npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache` | 0 | `"0.105.0"` |
+| `npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache` | 0 | 3.0.0; GPL-3.0; integrity and URL below |
+| `npm view libomemo.js@3.0.0 version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/pinned-cache --registry=https://registry.npmjs.org/ --strict-ssl=true` | 0 | Same fields, fresh second cache |
+
+No EAI_AGAIN or E404 occurred. npm emitted an update notice on the control query; no update was performed. Host runtime versions are explicitly recorded; these metadata/download-only probes do not build the application or replace ADR 0001 tool pins.
+
+Pinned public artifact: [libomemo.js 3.0.0 tarball](https://registry.npmjs.org/libomemo.js/-/libomemo.js-3.0.0.tgz). Primary metadata source: [versioned registry record](https://registry.npmjs.org/libomemo.js/3.0.0).
+
+Registry integrity and independently computed SHA512 SRI both equal:
+
+```text
+sha512-B4he9DOS+1LQrut+b2xjOjuSkKMAkZGes7ckB5JgVk/EHVNyxLIHx6NvQ3eJVaT1XeNJaWZBonXw3Nl5YKEbig==
+```
+
+## Artifact retrieval and integrity verification
+
+An inline Python wrapper ran the pinned command above with `subprocess.run(..., capture_output=True, text=True)`, required exit 0, parsed its JSON into `meta`, and asserted `meta['version'] == '3.0.0'`. The following retrieval/check body then ran unchanged inside that wrapper (root is the temporary directory above):
+
+```python
+url=meta['dist.tarball'];assert url=='https://registry.npmjs.org/libomemo.js/-/libomemo.js-3.0.0.tgz'
+with urllib.request.urlopen(url,context=ssl.create_default_context(),timeout=15) as response:
+ assert response.status==200 and response.url==url
+ data=response.read()
+sri='sha512-'+base64.b64encode(hashlib.sha512(data).digest()).decode()
+assert sri==meta['dist.integrity']
+(root/'libomemo.js-3.0.0.tgz').write_bytes(data)
+```
+
+Imports were `subprocess,json,pathlib,urllib.request,ssl,hashlib,base64`. The wrapper also wrote public verification JSON under the temporary root. Actual wrapper exit: 0. HTTP status: 200; final URL unchanged; archive size: 1,061,939 bytes. SHA256: `be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8`. Archive saved only under `/tmp`; it was neither extracted nor installed nor executed. Python used its default validated SSL context and existing configured environment; no certificate/proxy-policy bypass was used.
+
+## Acceptance boundary and review handoff
+
+Both required live metadata queries and the pinned artifact/SRI verification succeeded in the fresh agent session. This proposes acceptance of network restoration only. Registry integrity matches bytes to registry metadata; it does not establish independent provenance, safety or crypto suitability. GPL-3.0 is reported metadata, not a distribution approval.
+
+No crypto/backend decision, browser/WASM/worker execution, SCE mapping, audited interoperability, persistence compatibility, application build or release readiness was tested or accepted. ENC-003/009/011 remain obligations of the original investigation. The existing crypto ADR and experiments, specs, contracts and plan definitions are unchanged.
+
+The assigned independent security reviewer should repeat both queries with a new empty cache, repeat pinned metadata/download/SHA512 comparison under normal TLS and the approved environment, inspect scope and evidence, then record the review through tasks.py. Only reviewed resolver completion may return S00-022 to the queue for a new agent. Coordinator owns Git commits.

planning/TASK_MATRIX.md

@@ -1,6 +1,6 @@
 # Матрица задач
 
-Generated; state revision **86**. Canonical status: state/tasks.json.
+Generated; state revision **88**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -29,7 +29,7 @@ Generated; state revision **86**. Canonical status: state/tasks.json.
 | [S00-024](tasks/S00-024.md) | S00 | ci-cd | qa | done | auto-ci-cd-49907d48a6d1 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-026 | Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain |
 | [S00-025](tasks/S00-025.md) | S00 | storage | qa | blocked | auto-storage-ae5930b6fbdf | S00-002, S00-028 | Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |
 | [S00-026](tasks/S00-026.md) | S00 | ci-cd | qa | done | auto-ci-cd-4255c34da227 | S00-001, S00-002, S00-017, S00-018, S00-019 | Provide approved access to the pinned Linux experiment artifacts |
-| [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | todo |  | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation |
+| [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | review | auto-ci-cd-40ae46e8efe7 | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation |
 | [S00-028](tasks/S00-028.md) | S00 | ci-cd | qa | todo |  | S00-002 | Repair conflicting Codex harness sandbox arguments |
 | [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo |  | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
 | [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo |  | S00-010 | Описать identity/model contracts |

planning/stages/S00.md

@@ -31,7 +31,7 @@
 - [S00-024](../tasks/S00-024.md): Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; done.
 - [S00-025](../tasks/S00-025.md): Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.
 - [S00-026](../tasks/S00-026.md): Provide approved access to the pinned Linux experiment artifacts — ci-cd; done.
-- [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; todo.
+- [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; review.
 - [S00-028](../tasks/S00-028.md): Repair conflicting Codex harness sandbox arguments — ci-cd; todo.
 - [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
 

planning/task_matrix.csv

@@ -24,7 +24,7 @@ S00-023,S00,storage,qa,blocked,auto-storage-87486895c792,"S00-002, S00-025",Ус
 S00-024,S00,ci-cd,qa,done,auto-ci-cd-49907d48a6d1,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-026",Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain
 S00-025,S00,storage,qa,blocked,auto-storage-ae5930b6fbdf,"S00-002, S00-028",Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 S00-026,S00,ci-cd,qa,done,auto-ci-cd-4255c34da227,"S00-001, S00-002, S00-017, S00-018, S00-019",Provide approved access to the pinned Linux experiment artifacts
-S00-027,S00,ci-cd,security,todo,,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation
+S00-027,S00,ci-cd,security,review,auto-ci-cd-40ae46e8efe7,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation
 S00-028,S00,ci-cd,qa,todo,,S00-002,Repair conflicting Codex harness sandbox arguments
 S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
 S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts

state/commit_messages/auto-ci-cd-40ae46e8efe7.txt

@@ -0,0 +1,4 @@
+Document verified HTTPS npm registry connectivity
+
+Changes: Add the bounded S00-027 connectivity record with owner confirmation, fresh registry responses, pinned libomemo.js artifact integrity and independent review handoff.
+Validation: Both live metadata queries and pinned metadata query exited 0; HTTPS archive SHA512 matched registry SRI without executing scripts. make check exited 0 with 72 tests; whitespace and scope inspected. No crypto/backend acceptance or application build claimed.

state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md

@@ -0,0 +1,20 @@
+# S00-027 executor evidence
+
+Agent: auto-ci-cd-40ae46e8efe7; role: ci-cd; date: 2026-10-15.
+Result: proposed connectivity record; independent security review pending.
+
+Read required startup/role/workflow documents, CLI resume/show/packet, current card, required TESTING/crypto/ADR index and both blocker reports, direct dependency executor/review evidence and handoffs, accepted scope/stack ADRs and exact ENC-003/009/011. No previous S00-027 handoff existed. Canonical history revision 74 supplies environment-owner confirmation for approved network access; no new permission or configuration change was needed.
+
+Input: approved network restoration confirmation and registry connectivity acceptance. Output: docs/decisions/0003-registry-connectivity.md only, plus workflow artifacts. The document contains exact query commands, runtime versions, pinned URL, SRI, artifact size, SHA256, actual retrieval body and review procedure.
+
+## Actual checks
+
+- `python3 scripts/tasks.py resume --agent auto-ci-cd-40ae46e8efe7`, `show S00-027`, `packet S00-027 --agent auto-ci-cd-40ae46e8efe7`: exit 0 each; assigned in_progress task, no repeat claim.
+- `node --version`, `npm --version`, `npm config get strict-ssl`: exit 0 each; v24.1.0, 11.3.0, true. Connectivity-only host probes, no project build or accepted runtime change.
+- Both card npm metadata queries ran with --fetch-retries=0 --fetch-timeout=15000 and newly created cache /tmp/luma-s00-027-kdeu0fv9/cache: exit 0 each. Control 0.105.0, candidate 3.0.0 GPL-3.0. No EAI_AGAIN/E404; control stderr only npm update notice, no update performed.
+- Pinned libomemo.js@3.0.0 query with new pinned-cache, explicit public HTTPS registry and strict-ssl=true: exit 0. Same version/license/SRI/tarball. Exact commands in connectivity document.
+- Inline Python subprocess/urllib/default SSL/hashlib/base64 wrapper: exit 0. Downloaded official tarball afresh; HTTP 200, unchanged final HTTPS URL, 1,061,939 bytes; SHA512 SRI matches registry metadata. SHA256 be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8. No scripts/install/extraction/execution. Public temporary verification.json and archive are under /tmp/luma-s00-027-kdeu0fv9; supplied coordinator archives/caches were not used.
+- `make check > /tmp/luma-s00-027-check.log 2>&1`: exit 0; 72 tests in 18.806s, OK. Foundation integrity only.
+- `git diff --check`, `git status --short --untracked-files=all`: exit 0 each; before reports only coordinator claim in state/tasks.json and the permitted new connectivity document. Authored new files inspected separately; final whitespace/scope check also performed before submit.
+
+All three bounded acceptance conditions are evidenced for executor review: real control/candidate registry responses, pinned download/SRI match, normal TLS and no bypass or backend implementation. No proxy/DNS/environment/system/Git config edits, dependency installation, immutable specs, plan definition, crypto ADR or shared contract changes. No secrets/private proxy details in artifacts. SRI is not independent provenance or crypto approval. Browser/WASM/worker, SCE, audits, engine/persistence compatibility, interoperability and application readiness remain outside this record. Separate reviewer must reproduce network checks; coordinator commits and launches the next process.

state/handoffs/S00-027.md

@@ -0,0 +1,9 @@
+# S00-027 handoff
+
+Executor: auto-ci-cd-40ae46e8efe7 (ci-cd), 2026-10-15. Proposed connectivity record ready for independent security review; no blocker.
+
+Result: fresh-cache live npm metadata queries succeeded for @signalapp/libsignal-client (0.105.0) and libomemo.js (3.0.0 GPL-3.0). Pinned libomemo.js@3.0.0 metadata and archive retrieval succeeded; 1,061,939 bytes, registry SHA512 SRI matched. TLS validation and configured proxy retained; no package scripts, extraction or install. Environment-owner confirmation is canonical history revision 74. No network or system configuration changes.
+
+Output: docs/decisions/0003-registry-connectivity.md. Exact commands/results and limits: state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md. Temporary archive/verification: /tmp/luma-s00-027-kdeu0fv9. make check exit 0, 72 tests. Host Node 24.1.0/npm 11.3.0 were used only for connectivity metadata probes, not project build or replacement of accepted pins.
+
+Next: assigned fresh security reviewer repeats both queries with a new empty cache, pinned artifact download and SRI check under approved HTTPS/TLS; reviews scope, evidence and commit message. Record review via tasks.py. Coordinator commits; executor exits after submit. Only reviewed resolver completion returns S00-022 for a new executor. This record accepts no crypto/backend/library, license distribution, browser/WASM/worker/SCE, audited interoperability or persistence compatibility result.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 86,
+  "revision": 88,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -1384,10 +1384,14 @@
       "completed_at": "2026-10-15T10:00:12+00:00"
     },
     "S00-027": {
-      "status": "todo",
-      "owner": null,
+      "status": "review",
+      "owner": "auto-ci-cd-40ae46e8efe7",
       "external_wait": false,
-      "reason": "Approved agent sandbox outbound network enabled with documented sandbox_workspace_write.network_access=true in runner.local.json, retaining workspace-write filesystem restrictions, configured proxy and TLS. Verified with installed CLI: codex -c sandbox_mode='\"workspace-write\"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0. Both npm metadata queries returned actual values (@signalapp/libsignal-client 0.105.0; libomemo.js 3.0.0 GPL-3.0). Official pinned candidate artifact downloaded, SHA512 SRI matched; no package scripts executed. Public verification and commands: state/runs/coordinator-network/verification.json and output.log. Supplied metadata/archive also in /tmp/luma-approved-registry/. Fresh S00-027 executor and independent security reviewer must reproduce checks under their session, no crypto/backend acceptance claimed."
+      "reason": null,
+      "started_at": "2026-10-15T10:09:30+00:00",
+      "updated_at": "2026-10-15T10:12:28+00:00",
+      "evidence": "state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md",
+      "handoff": "state/handoffs/S00-027.md"
     },
     "S00-028": {
       "status": "todo",
@@ -2486,6 +2490,29 @@
       "to": "done",
       "reason": null,
       "evidence": "state/evidence/S00-020-review.md"
+    },
+    {
+      "revision": 87,
+      "at": "2026-10-15T10:09:30+00:00",
+      "action": "claim",
+      "task": "S00-027",
+      "agent": "auto-ci-cd-40ae46e8efe7",
+      "role": "ci-cd",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 88,
+      "at": "2026-10-15T10:12:28+00:00",
+      "action": "submit",
+      "task": "S00-027",
+      "agent": "auto-ci-cd-40ae46e8efe7",
+      "role": null,
+      "from": "in_progress",
+      "to": "review",
+      "reason": null,
+      "evidence": "state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md"
     }
   ],
   "retired_agents": [