S00-022: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-022. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: All ten live npm metadata queries fail with EAI_AGAIN resolving the configured proxy, including the known libsignal-client control. Required release and artifact verification for S00-022 cannot proceed; failures are not E404 evidence. Task: S00-022 Agent: auto-crypto-316a193d6c3e Role: crypto Action: claim Status: blocked Task title: Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
2026-10-15 16:41:17 +07:00
1 parent a338d3a1dd
commit 0d97f48929
@@ -6,7 +6,7 @@

 Зафиксировать Web scope, browser targets и проверенные кандидаты, не устанавливая непроверенный framework по догадке.

-Задач: 26; entry: нет; exit: S00-010.
+Задач: 27; entry: нет; exit: S00-010.

 ## [S01: Предметные контракты](stages/S01.md)

@@ -1,6 +1,6 @@
 # Матрица задач

-Generated; state revision **71**. Canonical status: state/tasks.json.
+Generated; state revision **73**. Canonical status: state/tasks.json.

 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -24,11 +24,12 @@ Generated; state revision **71**. Canonical status: state/tasks.json.
 | [S00-019](tasks/S00-019.md) | S00 | crypto | security | done | auto-crypto-c68801170fa4 | S00-001, S00-002, S00-017, S00-018 | Validate browser-compatible SCRAM-SHA-512 through a public mechanism API |
 | [S00-020](tasks/S00-020.md) | S00 | ci-cd | qa | blocked | auto-ci-cd-5a18c8aa1b42 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-024 | Restore access to the pinned Linux XMPP experiment toolchain |
 | [S00-021](tasks/S00-021.md) | S00 | crypto | security | done | auto-crypto-fcef9b6781bf | S00-001, S00-002 | Устранить прерывание: Проверить browser OMEMO backend |
-| [S00-022](tasks/S00-022.md) | S00 | crypto | security | todo |  | S00-001, S00-002, S00-021 | Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint |
+| [S00-022](tasks/S00-022.md) | S00 | crypto | security | blocked | auto-crypto-316a193d6c3e | S00-001, S00-002, S00-021, S00-027 | Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint |
 | [S00-023](tasks/S00-023.md) | S00 | storage | qa | blocked | auto-storage-87486895c792 | S00-002, S00-025 | Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |
 | [S00-024](tasks/S00-024.md) | S00 | ci-cd | qa | blocked | auto-ci-cd-988167c541cf | S00-001, S00-002, S00-017, S00-018, S00-019, S00-026 | Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain |
 | [S00-025](tasks/S00-025.md) | S00 | storage | qa | todo |  | S00-002 | Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |
 | [S00-026](tasks/S00-026.md) | S00 | ci-cd | qa | todo |  | S00-001, S00-002, S00-017, S00-018, S00-019 | Provide approved access to the pinned Linux experiment artifacts |
+| [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | blocked |  | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation |
 | [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo |  | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
 | [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo |  | S00-010 | Описать identity/model contracts |
 | [S01-002](tasks/S01-002.md) | S01 | orchestrator | security | todo |  | S00-010, S01-001 | Описать async account context |
@@ -97,15 +97,15 @@ Allocated означает наличие плана/приёмки, а не р
 | MUC-008 | web | Web requirement; cross-platform clauses apply only in Web context. | S13-009, S21-003 |
 | ENC-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-018, S20-008, S21-003 |
 | ENC-002 | web | Web requirement; cross-platform clauses apply only in Web context. | S01-005, S08-004, S12-007, S12-008, S12-018, S12-020, S21-003 |
-| ENC-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S12-005, S12-006, S12-007, S12-008, S12-009, S12-010, S12-011, S12-012, S12-014, S12-021, S21-003 |
+| ENC-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S00-027, S12-005, S12-006, S12-007, S12-008, S12-009, S12-010, S12-011, S12-012, S12-014, S12-021, S21-003 |
 | ENC-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-015, S12-021, S13-006, S21-003 |
 | ENC-005 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-016, S12-021, S21-003 |
 | ENC-006 | web | Web requirement; cross-platform clauses apply only in Web context. | S01-005, S12-002, S12-003, S12-020, S21-003 |
 | ENC-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-004, S12-019, S21-003 |
 | ENC-008 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-019, S21-003 |
-| ENC-009 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S12-001, S12-013, S12-017, S12-020, S21-003 |
+| ENC-009 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S00-027, S12-001, S12-013, S12-017, S12-020, S21-003 |
 | ENC-010 | web | Web requirement; cross-platform clauses apply only in Web context. | S12-020, S20-004, S21-003 |
-| ENC-011 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S12-010, S12-011, S12-012, S12-013, S12-014, S21-003 |
+| ENC-011 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-004, S00-022, S00-027, S12-010, S12-011, S12-012, S12-013, S12-014, S21-003 |
 | FILE-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S14-002, S21-004 |
 | FILE-002 | web | Web requirement; cross-platform clauses apply only in Web context. | S14-001, S14-011, S21-004 |
 | FILE-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S01-006, S14-001, S21-004 |
@@ -26,11 +26,12 @@
 - [S00-019](../tasks/S00-019.md): Validate browser-compatible SCRAM-SHA-512 through a public mechanism API — crypto; done.
 - [S00-020](../tasks/S00-020.md): Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; blocked.
 - [S00-021](../tasks/S00-021.md): Устранить прерывание: Проверить browser OMEMO backend — crypto; done.
- [S00-022](../tasks/S00-022.md): Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint — crypto; todo.
+- [S00-022](../tasks/S00-022.md): Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint — crypto; blocked.
 - [S00-023](../tasks/S00-023.md): Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.
 - [S00-024](../tasks/S00-024.md): Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; blocked.
 - [S00-025](../tasks/S00-025.md): Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; todo.
 - [S00-026](../tasks/S00-026.md): Provide approved access to the pinned Linux experiment artifacts — ci-cd; todo.
+- [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; blocked.
 - [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.

 ## Граница этапа
@@ -19,11 +19,12 @@ S00-018,S00,protocol,security,done,auto-protocol-89fe6563092c,"S00-001, S00-002,
 S00-019,S00,crypto,security,done,auto-crypto-c68801170fa4,"S00-001, S00-002, S00-017, S00-018",Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
 S00-020,S00,ci-cd,qa,blocked,auto-ci-cd-5a18c8aa1b42,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-024",Restore access to the pinned Linux XMPP experiment toolchain
 S00-021,S00,crypto,security,done,auto-crypto-fcef9b6781bf,"S00-001, S00-002",Устранить прерывание: Проверить browser OMEMO backend
-S00-022,S00,crypto,security,todo,,"S00-001, S00-002, S00-021",Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
+S00-022,S00,crypto,security,blocked,auto-crypto-316a193d6c3e,"S00-001, S00-002, S00-021, S00-027",Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
 S00-023,S00,storage,qa,blocked,auto-storage-87486895c792,"S00-002, S00-025",Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 S00-024,S00,ci-cd,qa,blocked,auto-ci-cd-988167c541cf,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-026",Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain
 S00-025,S00,storage,qa,todo,,S00-002,Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 S00-026,S00,ci-cd,qa,todo,,"S00-001, S00-002, S00-017, S00-018, S00-019",Provide approved access to the pinned Linux experiment artifacts
+S00-027,S00,ci-cd,security,blocked,,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation
 S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
 S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts
 S01-002,S01,orchestrator,security,todo,,"S00-010, S01-001",Описать async account context
@@ -1242,7 +1242,8 @@
      "depends_on": [
        "S00-001",
        "S00-002",
-        "S00-021"
+        "S00-021",
+        "S00-027"
      ],
      "requirements": [
        "ENC-003",
@@ -1487,6 +1488,62 @@
      ],
      "context_budget_chars": 48000
    },
+    {
+      "id": "S00-027",
+      "stage": "S00",
+      "kind": "blocker",
+      "root_task": "S00-004",
+      "blocker_depth": 2,
+      "unblocks": [
+        "S00-022"
+      ],
+      "role": "ci-cd",
+      "reviewer_role": "security",
+      "title": "Restore approved npm registry connectivity for the OMEMO2 backend investigation",
+      "outcome": "One independently reviewed connectivity record proving that the fresh project agent can retrieve real libomemo.js and libsignal-client metadata and a pinned candidate artifact through approved HTTPS registry access.",
+      "depends_on": [
+        "S00-001",
+        "S00-002",
+        "S00-021"
+      ],
+      "requirements": [
+        "ENC-003",
+        "ENC-009",
+        "ENC-011"
+      ],
+      "scope": [
+        "docs/decisions/0003-registry-connectivity.md"
+      ],
+      "inputs": [
+        "docs/WEB_PROFILE.md",
+        "docs/ARCHITECTURE.md",
+        "docs/CONTRACTS.md",
+        "docs/TESTING.md",
+        "roles/crypto.md",
+        "docs/decisions/README.md",
+        "state/blockers/S00-022.md",
+        "state/blockers/S00-027.md"
+      ],
+      "spec_sections": [],
+      "ui_sections": [],
+      "steps": [
+        "Obtain environment-owner confirmation that approved proxy/DNS/registry access is restored for the agent sandbox; never record credentials.",
+        "Reproduce the two npm metadata queries using a temporary cache and normal certificate validation.",
+        "Verify a pinned candidate artifact can be downloaded and integrity checked in a temporary directory without executing package scripts.",
+        "Record exact commands, exit codes, versions and integrity result in the bounded connectivity document; submit for independent review."
+      ],
+      "acceptance": [
+        "Both known-control and candidate npm metadata queries return actual registry responses without EAI_AGAIN.",
+        "A pinned candidate artifact download and integrity check succeed over normal HTTPS.",
+        "No TLS/proxy-policy bypass, secrets, crypto implementation or backend acceptance; remediation only restores network access."
+      ],
+      "checks": [
+        "npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache",
+        "npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache",
+        "Pinned artifact retrieval and registry integrity verification without install scripts"
+      ],
+      "context_budget_chars": 48000
+    },
    {
      "id": "S00-010",
      "stage": "S00",
@@ -0,0 +1,57 @@
+# S00-001: Утвердить Web-профиль
+
+> Generated from planning/tasks.json; status is in state/tasks.json.
+
+- Этап: S00
+- Оператор: orchestrator
+- Reviewer: security
+- Зависимости: нет
+- Требования: GEN-005, GEN-006, WEB-002
+
+## Один результат
+
+Паспорт scope разделяет Web и native-only требования и перечисляет внешние providers без secrets.
+
+## Разрешённые пути
+
+- `docs/decisions/0000-scope.md`
+- `experiments/0000-scope/**`
+
+Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
+
+## Прочитать
+
+- docs/WEB_PROFILE.md
+- docs/ARCHITECTURE.md
+- docs/CONTRACTS.md
+- docs/TESTING.md
+- roles/orchestrator.md
+- docs/decisions/README.md
+
+## Шаги
+
+1. Прочитать приведённые requirements, контракт через реестр и evidence прямых dependencies.
+2. До выбора стека: читать реальные первичные документы кандидатов, выполнить только разрешённый focused experiment, записать решение/ограничения. Не считать framework/backend уже принятым.
+3. Работать только над одним указанным outcome. Если для него нужен новый shared contract — создать отдельную remediation через escalate, заблокировать original и завершить запуск; не расширять текущий scope.
+4. Паспорт scope разделяет Web и native-only требования и перечисляет внешние providers без secrets.
+5. Добавить focused fixtures/checks из списка ниже, выполнить их и записать фактический результат.
+
+## Приёмка
+
+1. Паспорт scope разделяет Web и native-only требования и перечисляет внешние providers без secrets.
+2. Каждый excluded ID имеет причину
+3. Web Push не называется живым closed-tab socket
+4. Нет изменений вне scope; реальный результат/evidence и handoff позволяют другому агенту продолжить.
+
+## Focused checks
+
+1. Каждый excluded ID имеет причину
+2. Web Push не называется живым closed-tab socket
+
+## Блокер и завершение запуска
+
+Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
+
+## Передача
+
+Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
@@ -7,7 +7,7 @@
 - Этап: S00
 - Оператор: crypto
 - Reviewer: security
- Зависимости: S00-001, S00-002, S00-021
+- Зависимости: S00-001, S00-002, S00-021, S00-027
 - Требования: ENC-003, ENC-009, ENC-011

 ## Один результат
@@ -0,0 +1,59 @@
+# S00-027: Restore approved npm registry connectivity for the OMEMO2 backend investigation
+
+- Remediation для: S00-022; root: S00-004; depth: 2
+
+> Generated from planning/tasks.json; status is in state/tasks.json.
+
+- Этап: S00
+- Оператор: ci-cd
+- Reviewer: security
+- Зависимости: S00-001, S00-002, S00-021
+- Требования: ENC-003, ENC-009, ENC-011
+
+## Один результат
+
+One independently reviewed connectivity record proving that the fresh project agent can retrieve real libomemo.js and libsignal-client metadata and a pinned candidate artifact through approved HTTPS registry access.
+
+## Разрешённые пути
+
+- `docs/decisions/0003-registry-connectivity.md`
+
+Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
+
+## Прочитать
+
+- docs/WEB_PROFILE.md
+- docs/ARCHITECTURE.md
+- docs/CONTRACTS.md
+- docs/TESTING.md
+- roles/crypto.md
+- docs/decisions/README.md
+- state/blockers/S00-022.md
+- state/blockers/S00-027.md
+
+## Шаги
+
+1. Obtain environment-owner confirmation that approved proxy/DNS/registry access is restored for the agent sandbox; never record credentials.
+2. Reproduce the two npm metadata queries using a temporary cache and normal certificate validation.
+3. Verify a pinned candidate artifact can be downloaded and integrity checked in a temporary directory without executing package scripts.
+4. Record exact commands, exit codes, versions and integrity result in the bounded connectivity document; submit for independent review.
+
+## Приёмка
+
+1. Both known-control and candidate npm metadata queries return actual registry responses without EAI_AGAIN.
+2. A pinned candidate artifact download and integrity check succeed over normal HTTPS.
+3. No TLS/proxy-policy bypass, secrets, crypto implementation or backend acceptance; remediation only restores network access.
+
+## Focused checks
+
+1. npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache
+2. npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache
+3. Pinned artifact retrieval and registry integrity verification without install scripts
+
+## Блокер и завершение запуска
+
+Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
+
+## Передача
+
+Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
@@ -0,0 +1,22 @@
+# Blocker S00-027
+
+- Original task: S00-022
+- Root task: S00-004
+- Reporter: auto-crypto-316a193d6c3e
+- Role: crypto
+- Original owner: auto-crypto-316a193d6c3e
+- Waits for user/external condition: True
+
+## Cause
+
+All ten live npm metadata queries fail with EAI_AGAIN resolving the configured proxy, including the known libsignal-client control. Required release and artifact verification for S00-022 cannot proceed; failures are not E404 evidence.
+
+## One remediation outcome
+
+One independently reviewed connectivity record proving that the fresh project agent can retrieve real libomemo.js and libsignal-client metadata and a pinned candidate artifact through approved HTTPS registry access.
+
+## Evidence / reproduction
+
+npm view libomemo.js version license dist-tags --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-022-npm-cache -> exit 1 EAI_AGAIN; same failure for @signalapp/libsignal-client. See state/evidence/S00-022-auto-crypto-316a193d6c3e.md.
+
+The reporting agent must stop now. A new agent implements only S00-027.
@@ -0,0 +1,19 @@
+# S00-022 evidence — registry connectivity blocker
+
+Agent: auto-crypto-316a193d6c3e; role: crypto; date: 2026-10-15.
+
+Input: S00-022 card, ENC-003/009/011, ADRs 0000–0003, direct-dependency evidence and S00-004/S00-021 handoffs. Intended output: one traceable browser OMEMO2 backend decision. Acceptance requires verified web artifacts and compatible wire evidence or an approved external sourcing decision; neither is established this run.
+
+## Actual checks
+
+- `python3 scripts/tasks.py resume --agent auto-crypto-316a193d6c3e`: exit 0; assigned S00-022 in_progress. `python3 scripts/tasks.py show S00-022`: exit 0; scope only ADR 0003 plus workflow metadata.
+- `node experiments/0003-crypto-library/session-probe/wasm-unsupported.mjs`: exit 2, pkgPresent true, wasmFiles 0; six native prebuild platforms listed. This confirms only the installed package distribution boundary. Absence of standalone .wasm files is not a general test for absence of embedded WASM in other packages.
+- Ten independent subprocess calls, each `npm view <package> version license dist-tags --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-022-npm-cache`: each exit 1, JSON error code EAI_AGAIN, getaddrinfo failure for the configured proxy. Packages: @signalapp/libsignal-client, @signalapp/libsignal, @converse/omemo, @xmpp/omemo, omemo2, omemo-js, omemo-client, omemo-top, omemo-wasm, libomemo.js. No E404 or live version was reproduced. No credentials or private environment values captured in this report.
+
+## Primary-source discovery (web tool; not execution evidence)
+
+[Converse upstream README](https://github.com/conversejs/libomemo.js) describes a browser/worker candidate with embedded WASM and OMEMO2 ratchet support. It explicitly leaves SCE payload encryption to consumers and states there is no formal third-party audit. [Upstream package manifest](https://raw.githubusercontent.com/conversejs/libomemo.js/master/package.json) shows version 3.0.0 and GPL-3.0. These moving upstream pages are leads, not a pinned installed artifact, maintenance assurance, license acceptance or verified end-to-end result. The earlier universal claim that no maintained registry package exists is not established by queries of a few guessed names. Likewise the earlier ADR claim of a Signal browser WASM distribution lacks a specific supporting source and is not reaffirmed.
+
+## Limits and disposition
+
+Registry connectivity blocks required live metadata/artifact verification. No browser OMEMO2 known-answer roundtrip, nonzero candidate WASM footprint, session migration, persistence compatibility or SCE payload/key/MAC mapping was verified. Existing Node smoke was not rerun; previous audit/persistence claims are historical evidence, not newly certified. No candidate installed, no source/ADR/spec/contract edited, no encryption bypass. Stop and escalate one network remediation; the subsequent fresh S00-022 executor must investigate the candidate and remaining acceptance after connectivity is independently restored.
@@ -0,0 +1,17 @@
+# Handoff S00-022
+
+Agent: auto-crypto-316a193d6c3e; role: crypto. Disposition: blocker escalation; no backend accepted.
+
+## Reached result
+
+Installed libsignal-client unsupported probe reproduced exit 2 with pkgPresent true and zero .wasm files. Web search found conversejs/libomemo.js as a concrete browser/WASM OMEMO2 ratchet candidate previously omitted from registry queries. Its README explicitly excludes consumer SCE encryption and reports no formal third-party audit. Do not substitute this discovery for an audited, tested full backend or silently replace existing session/persistence semantics.
+
+## Exact obstacle and reproduction
+
+`npm view libomemo.js version license dist-tags --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-022-npm-cache` exits 1 with EAI_AGAIN resolving configured proxy. All nine other metadata queries fail the same way, including the known libsignal-client control. This is network failure, not E404. Evidence: state/evidence/S00-022-auto-crypto-316a193d6c3e.md.
+
+## One required next input
+
+Environment/network owner must restore normal authenticated-if-required HTTPS npm registry access through the approved proxy for the fresh agent, without disclosing credentials, disabling TLS, or bypassing policy. Resolver verifies only connectivity, then independent review. It must not implement OMEMO or accept a library.
+
+After reviewed resolver completion, a new S00-022 executor should query a pinned libomemo.js release and primary sources, check real embedded WASM/worker artifacts, license/support/audit constraints, approved SCE mapping, and existing engine/persistence compatibility. A full web-target known-answer roundtrip remains unperformed. ADR 0003 remains proposed and unchanged; its universal registry-absence and Signal-WASM claims need bounded correction once research can proceed. Do not call S00-022 or S00-004 done from this handoff.
@@ -0,0 +1,29 @@
+{
+  "title": "Restore approved npm registry connectivity for the OMEMO2 backend investigation",
+  "reason": "All ten live npm metadata queries fail with EAI_AGAIN resolving the configured proxy, including the known libsignal-client control. Required release and artifact verification for S00-022 cannot proceed; failures are not E404 evidence.",
+  "reproduction": "npm view libomemo.js version license dist-tags --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-022-npm-cache -> exit 1 EAI_AGAIN; same failure for @signalapp/libsignal-client. See state/evidence/S00-022-auto-crypto-316a193d6c3e.md.",
+  "role": "ci-cd",
+  "reviewer_role": "security",
+  "scope": [
+    "docs/decisions/0003-registry-connectivity.md"
+  ],
+  "outcome": "One independently reviewed connectivity record proving that the fresh project agent can retrieve real libomemo.js and libsignal-client metadata and a pinned candidate artifact through approved HTTPS registry access.",
+  "steps": [
+    "Obtain environment-owner confirmation that approved proxy/DNS/registry access is restored for the agent sandbox; never record credentials.",
+    "Reproduce the two npm metadata queries using a temporary cache and normal certificate validation.",
+    "Verify a pinned candidate artifact can be downloaded and integrity checked in a temporary directory without executing package scripts.",
+    "Record exact commands, exit codes, versions and integrity result in the bounded connectivity document; submit for independent review."
+  ],
+  "acceptance": [
+    "Both known-control and candidate npm metadata queries return actual registry responses without EAI_AGAIN.",
+    "A pinned candidate artifact download and integrity check succeed over normal HTTPS.",
+    "No TLS/proxy-policy bypass, secrets, crypto implementation or backend acceptance; remediation only restores network access."
+  ],
+  "checks": [
+    "npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache",
+    "npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache",
+    "Pinned artifact retrieval and registry integrity verification without install scripts"
+  ],
+  "depends_on": [],
+  "requires_user_input": true
+}
@@ -1,6 +1,6 @@
 {
  "schema_version": 1,
-  "revision": 71,
+  "revision": 73,
  "tasks": {
    "S00-001": {
      "status": "done",
@@ -1309,10 +1309,18 @@
      "completed_at": "2026-10-15T08:40:27+00:00"
    },
    "S00-022": {
-      "status": "todo",
-      "owner": null,
+      "status": "blocked",
+      "owner": "auto-crypto-316a193d6c3e",
      "external_wait": false,
-      "reason": "New primary-source candidate supplied: libomemo.js@3.0.0 https://github.com/conversejs/libomemo.js declares legacy OMEMO and OMEMO2 0.9.1 urn:xmpp:omemo:2, WASM and browser worker-client; Converse 14 source uses this dependency and encryptSCE/decryptSCE. Source links and limitations in state/runs/coordinator-research/omemo2-sources.md. Previous npm E404 queries did not include libomemo.js. Upstream explicitly lacks third-party security audit; GPL-3.0 compatibility, actual target tests, preservation of accepted verified engine/persistence and security review remain mandatory. New candidate is sourcing input only, not permission to replace an accepted engine, waive audit/requirements, or claim acceptance. Fresh task executor must evaluate this candidate under the existing card and escalate any unresolved bounded requirement."
+      "reason": "All ten live npm metadata queries fail with EAI_AGAIN resolving the configured proxy, including the known libsignal-client control. Required release and artifact verification for S00-022 cannot proceed; failures are not E404 evidence.",
+      "started_at": "2026-10-15T09:39:15+00:00",
+      "updated_at": "2026-10-15T09:41:11+00:00",
+      "blocked_by": [
+        "S00-027"
+      ],
+      "resume_status": "in_progress",
+      "blocker_report": "state/blockers/S00-027.md",
+      "handoff": "state/handoffs/S00-022.md"
    },
    "S00-023": {
      "status": "blocked",
@@ -1353,6 +1361,12 @@
      "owner": null,
      "external_wait": false,
      "reason": "Approved external artifact preparation completed through configured HTTPS proxy with TLS verification, without changing system tools or project sources. Authentic local supply: /tmp/luma-approved-toolchain/SHASUMS256.txt, node-v24.21.0-linux-x64.tar.xz, npm-11.19.0.tgz; provenance and SHA256/SRI in /tmp/luma-approved-toolchain/verification.json. Exact Node v24.21.0/npm 11.19.0 execute. Unchanged copied parent lock installed with npm ci --ignore-scripts --engine-strict and Stanza 12.22.1, exit 0; /tmp/luma-approved-toolchain/dependency-verification.json and npm-ci.log. Cache /tmp/luma-approved-toolchain/npm-cache permits fresh offline npm ci without proxy access. Fresh executor must independently verify supplied archives/checksums and repeat installation inside its environment-access scope; no task acceptance claimed."
+    },
+    "S00-027": {
+      "status": "blocked",
+      "owner": null,
+      "external_wait": true,
+      "reason": "All ten live npm metadata queries fail with EAI_AGAIN resolving the configured proxy, including the known libsignal-client control. Required release and artifact verification for S00-022 cannot proceed; failures are not E404 evidence."
    }
  },
  "events": [
@@ -2251,6 +2265,29 @@
      "task": "S00-022",
      "agent": "coordinator-input-s00-022",
      "reason": "New primary-source candidate supplied: libomemo.js@3.0.0 https://github.com/conversejs/libomemo.js declares legacy OMEMO and OMEMO2 0.9.1 urn:xmpp:omemo:2, WASM and browser worker-client; Converse 14 source uses this dependency and encryptSCE/decryptSCE. Source links and limitations in state/runs/coordinator-research/omemo2-sources.md. Previous npm E404 queries did not include libomemo.js. Upstream explicitly lacks third-party security audit; GPL-3.0 compatibility, actual target tests, preservation of accepted verified engine/persistence and security review remain mandatory. New candidate is sourcing input only, not permission to replace an accepted engine, waive audit/requirements, or claim acceptance. Fresh task executor must evaluate this candidate under the existing card and escalate any unresolved bounded requirement."
+    },
+    {
+      "revision": 72,
+      "at": "2026-10-15T09:39:15+00:00",
+      "action": "claim",
+      "task": "S00-022",
+      "agent": "auto-crypto-316a193d6c3e",
+      "role": "crypto",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 73,
+      "at": "2026-10-15T09:41:11+00:00",
+      "action": "escalate",
+      "task": "S00-022",
+      "resolution_task": "S00-027",
+      "agent": "auto-crypto-316a193d6c3e",
+      "role": "crypto",
+      "from": "in_progress",
+      "to": "blocked",
+      "reason": "All ten live npm metadata queries fail with EAI_AGAIN resolving the configured proxy, including the known libsignal-client control. Required release and artifact verification for S00-022 cannot proceed; failures are not E404 evidence."
    }
  ],
  "retired_agents": [
@@ -2269,6 +2306,7 @@
    "auto-storage-88c3286c6641",
    "auto-ci-cd-5a18c8aa1b42",
    "auto-storage-87486895c792",
-    "auto-ci-cd-988167c541cf"
+    "auto-ci-cd-988167c541cf",
+    "auto-crypto-316a193d6c3e"
  ]
 }