diff --git a/docs/decisions/0003-registry-connectivity.md b/docs/decisions/0003-registry-connectivity.md new file mode 100644 index 0000000..0714ebe --- /dev/null +++ b/docs/decisions/0003-registry-connectivity.md @@ -0,0 +1,57 @@ +# S00-027: Approved npm registry connectivity record + +- Status: proposed; awaiting independent security review. +- Executor: auto-ci-cd-40ae46e8efe7 (ci-cd), 2026-10-15. +- Input: S00-027 card, S00-022/S00-027 blockers, accepted ADR 0000/0001 and direct dependency evidence. +- Output: connectivity evidence only for resuming the separate OMEMO2 investigation. + +## Environment-owner confirmation + +Canonical `state/tasks.json` history revision 74 records coordinator-input-s00-027 releasing the external wait on 2026-10-15T09:45:53+00:00. The confirmation explicitly enables sandbox outbound network while retaining workspace-write restrictions, configured proxy and TLS. It reports successful prior probes and requires fresh executor and reviewer verification. This session reproduced access; it did not alter proxy, DNS, TLS, runner configuration or system tools. No credentials or private proxy values are recorded. + +## Actual commands and responses + +All commands ran from project root. A fresh directory was created with Python `tempfile.mkdtemp(prefix='luma-s00-027-')`: `/tmp/luma-s00-027-kdeu0fv9`. Its cache was empty before the first query. Existing coordinator metadata, archive and cache were not used. + +| Command | Exit | Actual response | +| --- | --- | --- | +| `node --version` | 0 | v24.1.0 | +| `npm --version` | 0 | 11.3.0 | +| `npm config get strict-ssl` | 0 | true | +| `npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache` | 0 | `"0.105.0"` | +| `npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache` | 0 | 3.0.0; GPL-3.0; integrity and URL below | +| `npm view libomemo.js@3.0.0 version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/pinned-cache --registry=https://registry.npmjs.org/ --strict-ssl=true` | 0 | Same fields, fresh second cache | + +No EAI_AGAIN or E404 occurred. npm emitted an update notice on the control query; no update was performed. Host runtime versions are explicitly recorded; these metadata/download-only probes do not build the application or replace ADR 0001 tool pins. + +Pinned public artifact: [libomemo.js 3.0.0 tarball](https://registry.npmjs.org/libomemo.js/-/libomemo.js-3.0.0.tgz). Primary metadata source: [versioned registry record](https://registry.npmjs.org/libomemo.js/3.0.0). + +Registry integrity and independently computed SHA512 SRI both equal: + +```text +sha512-B4he9DOS+1LQrut+b2xjOjuSkKMAkZGes7ckB5JgVk/EHVNyxLIHx6NvQ3eJVaT1XeNJaWZBonXw3Nl5YKEbig== +``` + +## Artifact retrieval and integrity verification + +An inline Python wrapper ran the pinned command above with `subprocess.run(..., capture_output=True, text=True)`, required exit 0, parsed its JSON into `meta`, and asserted `meta['version'] == '3.0.0'`. The following retrieval/check body then ran unchanged inside that wrapper (root is the temporary directory above): + +```python +url=meta['dist.tarball'];assert url=='https://registry.npmjs.org/libomemo.js/-/libomemo.js-3.0.0.tgz' +with urllib.request.urlopen(url,context=ssl.create_default_context(),timeout=15) as response: + assert response.status==200 and response.url==url + data=response.read() +sri='sha512-'+base64.b64encode(hashlib.sha512(data).digest()).decode() +assert sri==meta['dist.integrity'] +(root/'libomemo.js-3.0.0.tgz').write_bytes(data) +``` + +Imports were `subprocess,json,pathlib,urllib.request,ssl,hashlib,base64`. The wrapper also wrote public verification JSON under the temporary root. Actual wrapper exit: 0. HTTP status: 200; final URL unchanged; archive size: 1,061,939 bytes. SHA256: `be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8`. Archive saved only under `/tmp`; it was neither extracted nor installed nor executed. Python used its default validated SSL context and existing configured environment; no certificate/proxy-policy bypass was used. + +## Acceptance boundary and review handoff + +Both required live metadata queries and the pinned artifact/SRI verification succeeded in the fresh agent session. This proposes acceptance of network restoration only. Registry integrity matches bytes to registry metadata; it does not establish independent provenance, safety or crypto suitability. GPL-3.0 is reported metadata, not a distribution approval. + +No crypto/backend decision, browser/WASM/worker execution, SCE mapping, audited interoperability, persistence compatibility, application build or release readiness was tested or accepted. ENC-003/009/011 remain obligations of the original investigation. The existing crypto ADR and experiments, specs, contracts and plan definitions are unchanged. + +The assigned independent security reviewer should repeat both queries with a new empty cache, repeat pinned metadata/download/SHA512 comparison under normal TLS and the approved environment, inspect scope and evidence, then record the review through tasks.py. Only reviewed resolver completion may return S00-022 to the queue for a new agent. Coordinator owns Git commits. diff --git a/planning/TASK_MATRIX.md b/planning/TASK_MATRIX.md index 2d35fa2..ef12803 100644 --- a/planning/TASK_MATRIX.md +++ b/planning/TASK_MATRIX.md @@ -1,6 +1,6 @@ # Матрица задач -Generated; state revision **86**. Canonical status: state/tasks.json. +Generated; state revision **88**. Canonical status: state/tasks.json. | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача | | --- | --- | --- | --- | --- | --- | --- | --- | @@ -29,7 +29,7 @@ Generated; state revision **86**. Canonical status: state/tasks.json. | [S00-024](tasks/S00-024.md) | S00 | ci-cd | qa | done | auto-ci-cd-49907d48a6d1 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-026 | Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain | | [S00-025](tasks/S00-025.md) | S00 | storage | qa | blocked | auto-storage-ae5930b6fbdf | S00-002, S00-028 | Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy | | [S00-026](tasks/S00-026.md) | S00 | ci-cd | qa | done | auto-ci-cd-4255c34da227 | S00-001, S00-002, S00-017, S00-018, S00-019 | Provide approved access to the pinned Linux experiment artifacts | -| [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | todo | | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation | +| [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | review | auto-ci-cd-40ae46e8efe7 | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation | | [S00-028](tasks/S00-028.md) | S00 | ci-cd | qa | todo | | S00-002 | Repair conflicting Codex harness sandbox arguments | | [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo | | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека | | [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo | | S00-010 | Описать identity/model contracts | diff --git a/planning/stages/S00.md b/planning/stages/S00.md index abe46d7..ba0959c 100644 --- a/planning/stages/S00.md +++ b/planning/stages/S00.md @@ -31,7 +31,7 @@ - [S00-024](../tasks/S00-024.md): Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; done. - [S00-025](../tasks/S00-025.md): Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked. - [S00-026](../tasks/S00-026.md): Provide approved access to the pinned Linux experiment artifacts — ci-cd; done. -- [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; todo. +- [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; review. - [S00-028](../tasks/S00-028.md): Repair conflicting Codex harness sandbox arguments — ci-cd; todo. - [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo. diff --git a/planning/task_matrix.csv b/planning/task_matrix.csv index 3106ac7..a16fd65 100644 --- a/planning/task_matrix.csv +++ b/planning/task_matrix.csv @@ -24,7 +24,7 @@ S00-023,S00,storage,qa,blocked,auto-storage-87486895c792,"S00-002, S00-025",Ус S00-024,S00,ci-cd,qa,done,auto-ci-cd-49907d48a6d1,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-026",Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain S00-025,S00,storage,qa,blocked,auto-storage-ae5930b6fbdf,"S00-002, S00-028",Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy S00-026,S00,ci-cd,qa,done,auto-ci-cd-4255c34da227,"S00-001, S00-002, S00-017, S00-018, S00-019",Provide approved access to the pinned Linux experiment artifacts -S00-027,S00,ci-cd,security,todo,,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation +S00-027,S00,ci-cd,security,review,auto-ci-cd-40ae46e8efe7,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation S00-028,S00,ci-cd,qa,todo,,S00-002,Repair conflicting Codex harness sandbox arguments S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts diff --git a/state/commit_messages/auto-ci-cd-40ae46e8efe7.txt b/state/commit_messages/auto-ci-cd-40ae46e8efe7.txt new file mode 100644 index 0000000..4789471 --- /dev/null +++ b/state/commit_messages/auto-ci-cd-40ae46e8efe7.txt @@ -0,0 +1,4 @@ +Document verified HTTPS npm registry connectivity + +Changes: Add the bounded S00-027 connectivity record with owner confirmation, fresh registry responses, pinned libomemo.js artifact integrity and independent review handoff. +Validation: Both live metadata queries and pinned metadata query exited 0; HTTPS archive SHA512 matched registry SRI without executing scripts. make check exited 0 with 72 tests; whitespace and scope inspected. No crypto/backend acceptance or application build claimed. diff --git a/state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md b/state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md new file mode 100644 index 0000000..e21622b --- /dev/null +++ b/state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md @@ -0,0 +1,20 @@ +# S00-027 executor evidence + +Agent: auto-ci-cd-40ae46e8efe7; role: ci-cd; date: 2026-10-15. +Result: proposed connectivity record; independent security review pending. + +Read required startup/role/workflow documents, CLI resume/show/packet, current card, required TESTING/crypto/ADR index and both blocker reports, direct dependency executor/review evidence and handoffs, accepted scope/stack ADRs and exact ENC-003/009/011. No previous S00-027 handoff existed. Canonical history revision 74 supplies environment-owner confirmation for approved network access; no new permission or configuration change was needed. + +Input: approved network restoration confirmation and registry connectivity acceptance. Output: docs/decisions/0003-registry-connectivity.md only, plus workflow artifacts. The document contains exact query commands, runtime versions, pinned URL, SRI, artifact size, SHA256, actual retrieval body and review procedure. + +## Actual checks + +- `python3 scripts/tasks.py resume --agent auto-ci-cd-40ae46e8efe7`, `show S00-027`, `packet S00-027 --agent auto-ci-cd-40ae46e8efe7`: exit 0 each; assigned in_progress task, no repeat claim. +- `node --version`, `npm --version`, `npm config get strict-ssl`: exit 0 each; v24.1.0, 11.3.0, true. Connectivity-only host probes, no project build or accepted runtime change. +- Both card npm metadata queries ran with --fetch-retries=0 --fetch-timeout=15000 and newly created cache /tmp/luma-s00-027-kdeu0fv9/cache: exit 0 each. Control 0.105.0, candidate 3.0.0 GPL-3.0. No EAI_AGAIN/E404; control stderr only npm update notice, no update performed. +- Pinned libomemo.js@3.0.0 query with new pinned-cache, explicit public HTTPS registry and strict-ssl=true: exit 0. Same version/license/SRI/tarball. Exact commands in connectivity document. +- Inline Python subprocess/urllib/default SSL/hashlib/base64 wrapper: exit 0. Downloaded official tarball afresh; HTTP 200, unchanged final HTTPS URL, 1,061,939 bytes; SHA512 SRI matches registry metadata. SHA256 be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8. No scripts/install/extraction/execution. Public temporary verification.json and archive are under /tmp/luma-s00-027-kdeu0fv9; supplied coordinator archives/caches were not used. +- `make check > /tmp/luma-s00-027-check.log 2>&1`: exit 0; 72 tests in 18.806s, OK. Foundation integrity only. +- `git diff --check`, `git status --short --untracked-files=all`: exit 0 each; before reports only coordinator claim in state/tasks.json and the permitted new connectivity document. Authored new files inspected separately; final whitespace/scope check also performed before submit. + +All three bounded acceptance conditions are evidenced for executor review: real control/candidate registry responses, pinned download/SRI match, normal TLS and no bypass or backend implementation. No proxy/DNS/environment/system/Git config edits, dependency installation, immutable specs, plan definition, crypto ADR or shared contract changes. No secrets/private proxy details in artifacts. SRI is not independent provenance or crypto approval. Browser/WASM/worker, SCE, audits, engine/persistence compatibility, interoperability and application readiness remain outside this record. Separate reviewer must reproduce network checks; coordinator commits and launches the next process. diff --git a/state/handoffs/S00-027.md b/state/handoffs/S00-027.md new file mode 100644 index 0000000..6e433ce --- /dev/null +++ b/state/handoffs/S00-027.md @@ -0,0 +1,9 @@ +# S00-027 handoff + +Executor: auto-ci-cd-40ae46e8efe7 (ci-cd), 2026-10-15. Proposed connectivity record ready for independent security review; no blocker. + +Result: fresh-cache live npm metadata queries succeeded for @signalapp/libsignal-client (0.105.0) and libomemo.js (3.0.0 GPL-3.0). Pinned libomemo.js@3.0.0 metadata and archive retrieval succeeded; 1,061,939 bytes, registry SHA512 SRI matched. TLS validation and configured proxy retained; no package scripts, extraction or install. Environment-owner confirmation is canonical history revision 74. No network or system configuration changes. + +Output: docs/decisions/0003-registry-connectivity.md. Exact commands/results and limits: state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md. Temporary archive/verification: /tmp/luma-s00-027-kdeu0fv9. make check exit 0, 72 tests. Host Node 24.1.0/npm 11.3.0 were used only for connectivity metadata probes, not project build or replacement of accepted pins. + +Next: assigned fresh security reviewer repeats both queries with a new empty cache, pinned artifact download and SRI check under approved HTTPS/TLS; reviews scope, evidence and commit message. Record review via tasks.py. Coordinator commits; executor exits after submit. Only reviewed resolver completion returns S00-022 for a new executor. This record accepts no crypto/backend/library, license distribution, browser/WASM/worker/SCE, audited interoperability or persistence compatibility result. diff --git a/state/tasks.json b/state/tasks.json index a9d8a71..41bb38f 100644 --- a/state/tasks.json +++ b/state/tasks.json @@ -1,6 +1,6 @@ { "schema_version": 1, - "revision": 86, + "revision": 88, "tasks": { "S00-001": { "status": "done", @@ -1384,10 +1384,14 @@ "completed_at": "2026-10-15T10:00:12+00:00" }, "S00-027": { - "status": "todo", - "owner": null, + "status": "review", + "owner": "auto-ci-cd-40ae46e8efe7", "external_wait": false, - "reason": "Approved agent sandbox outbound network enabled with documented sandbox_workspace_write.network_access=true in runner.local.json, retaining workspace-write filesystem restrictions, configured proxy and TLS. Verified with installed CLI: codex -c sandbox_mode='\"workspace-write\"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0. Both npm metadata queries returned actual values (@signalapp/libsignal-client 0.105.0; libomemo.js 3.0.0 GPL-3.0). Official pinned candidate artifact downloaded, SHA512 SRI matched; no package scripts executed. Public verification and commands: state/runs/coordinator-network/verification.json and output.log. Supplied metadata/archive also in /tmp/luma-approved-registry/. Fresh S00-027 executor and independent security reviewer must reproduce checks under their session, no crypto/backend acceptance claimed." + "reason": null, + "started_at": "2026-10-15T10:09:30+00:00", + "updated_at": "2026-10-15T10:12:28+00:00", + "evidence": "state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md", + "handoff": "state/handoffs/S00-027.md" }, "S00-028": { "status": "todo", @@ -2486,6 +2490,29 @@ "to": "done", "reason": null, "evidence": "state/evidence/S00-020-review.md" + }, + { + "revision": 87, + "at": "2026-10-15T10:09:30+00:00", + "action": "claim", + "task": "S00-027", + "agent": "auto-ci-cd-40ae46e8efe7", + "role": "ci-cd", + "from": "todo", + "to": "in_progress", + "reason": null + }, + { + "revision": 88, + "at": "2026-10-15T10:12:28+00:00", + "action": "submit", + "task": "S00-027", + "agent": "auto-ci-cd-40ae46e8efe7", + "role": null, + "from": "in_progress", + "to": "review", + "reason": null, + "evidence": "state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md" } ], "retired_agents": [