S00-027: Document verified HTTPS npm registry connectivity

Changes: Add the bounded S00-027 connectivity record with owner confirmation, fresh registry responses, pinned libomemo.js artifact integrity and independent review handoff.
Validation: Both live metadata queries and pinned metadata query exited 0; HTTPS archive SHA512 matched registry SRI without executing scripts. make check exited 0 with 72 tests; whitespace and scope inspected. No crypto/backend acceptance or application build claimed.

Task: S00-027
Agent: auto-ci-cd-40ae46e8efe7
Role: ci-cd
Action: claim
Status: review

Task title: Restore approved npm registry connectivity for the OMEMO2 backend investigation

state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md

@@ -0,0 +1,20 @@
+# S00-027 executor evidence
+
+Agent: auto-ci-cd-40ae46e8efe7; role: ci-cd; date: 2026-10-15.
+Result: proposed connectivity record; independent security review pending.
+
+Read required startup/role/workflow documents, CLI resume/show/packet, current card, required TESTING/crypto/ADR index and both blocker reports, direct dependency executor/review evidence and handoffs, accepted scope/stack ADRs and exact ENC-003/009/011. No previous S00-027 handoff existed. Canonical history revision 74 supplies environment-owner confirmation for approved network access; no new permission or configuration change was needed.
+
+Input: approved network restoration confirmation and registry connectivity acceptance. Output: docs/decisions/0003-registry-connectivity.md only, plus workflow artifacts. The document contains exact query commands, runtime versions, pinned URL, SRI, artifact size, SHA256, actual retrieval body and review procedure.
+
+## Actual checks
+
+- `python3 scripts/tasks.py resume --agent auto-ci-cd-40ae46e8efe7`, `show S00-027`, `packet S00-027 --agent auto-ci-cd-40ae46e8efe7`: exit 0 each; assigned in_progress task, no repeat claim.
+- `node --version`, `npm --version`, `npm config get strict-ssl`: exit 0 each; v24.1.0, 11.3.0, true. Connectivity-only host probes, no project build or accepted runtime change.
+- Both card npm metadata queries ran with --fetch-retries=0 --fetch-timeout=15000 and newly created cache /tmp/luma-s00-027-kdeu0fv9/cache: exit 0 each. Control 0.105.0, candidate 3.0.0 GPL-3.0. No EAI_AGAIN/E404; control stderr only npm update notice, no update performed.
+- Pinned libomemo.js@3.0.0 query with new pinned-cache, explicit public HTTPS registry and strict-ssl=true: exit 0. Same version/license/SRI/tarball. Exact commands in connectivity document.
+- Inline Python subprocess/urllib/default SSL/hashlib/base64 wrapper: exit 0. Downloaded official tarball afresh; HTTP 200, unchanged final HTTPS URL, 1,061,939 bytes; SHA512 SRI matches registry metadata. SHA256 be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8. No scripts/install/extraction/execution. Public temporary verification.json and archive are under /tmp/luma-s00-027-kdeu0fv9; supplied coordinator archives/caches were not used.
+- `make check > /tmp/luma-s00-027-check.log 2>&1`: exit 0; 72 tests in 18.806s, OK. Foundation integrity only.
+- `git diff --check`, `git status --short --untracked-files=all`: exit 0 each; before reports only coordinator claim in state/tasks.json and the permitted new connectivity document. Authored new files inspected separately; final whitespace/scope check also performed before submit.
+
+All three bounded acceptance conditions are evidenced for executor review: real control/candidate registry responses, pinned download/SRI match, normal TLS and no bypass or backend implementation. No proxy/DNS/environment/system/Git config edits, dependency installation, immutable specs, plan definition, crypto ADR or shared contract changes. No secrets/private proxy details in artifacts. SRI is not independent provenance or crypto approval. Browser/WASM/worker, SCE, audits, engine/persistence compatibility, interoperability and application readiness remain outside this record. Separate reviewer must reproduce network checks; coordinator commits and launches the next process.