S00-022: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-022. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: All ten live npm metadata queries fail with EAI_AGAIN resolving the configured proxy, including the known libsignal-client control. Required release and artifact verification for S00-022 cannot proceed; failures are not E404 evidence.

Task: S00-022
Agent: auto-crypto-316a193d6c3e
Role: crypto
Action: claim
Status: blocked

Task title: Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint

planning/tasks.json

@@ -1242,7 +1242,8 @@
       "depends_on": [
         "S00-001",
         "S00-002",
-        "S00-021"
+        "S00-021",
+        "S00-027"
       ],
       "requirements": [
         "ENC-003",
@@ -1487,6 +1488,62 @@
       ],
       "context_budget_chars": 48000
     },
+    {
+      "id": "S00-027",
+      "stage": "S00",
+      "kind": "blocker",
+      "root_task": "S00-004",
+      "blocker_depth": 2,
+      "unblocks": [
+        "S00-022"
+      ],
+      "role": "ci-cd",
+      "reviewer_role": "security",
+      "title": "Restore approved npm registry connectivity for the OMEMO2 backend investigation",
+      "outcome": "One independently reviewed connectivity record proving that the fresh project agent can retrieve real libomemo.js and libsignal-client metadata and a pinned candidate artifact through approved HTTPS registry access.",
+      "depends_on": [
+        "S00-001",
+        "S00-002",
+        "S00-021"
+      ],
+      "requirements": [
+        "ENC-003",
+        "ENC-009",
+        "ENC-011"
+      ],
+      "scope": [
+        "docs/decisions/0003-registry-connectivity.md"
+      ],
+      "inputs": [
+        "docs/WEB_PROFILE.md",
+        "docs/ARCHITECTURE.md",
+        "docs/CONTRACTS.md",
+        "docs/TESTING.md",
+        "roles/crypto.md",
+        "docs/decisions/README.md",
+        "state/blockers/S00-022.md",
+        "state/blockers/S00-027.md"
+      ],
+      "spec_sections": [],
+      "ui_sections": [],
+      "steps": [
+        "Obtain environment-owner confirmation that approved proxy/DNS/registry access is restored for the agent sandbox; never record credentials.",
+        "Reproduce the two npm metadata queries using a temporary cache and normal certificate validation.",
+        "Verify a pinned candidate artifact can be downloaded and integrity checked in a temporary directory without executing package scripts.",
+        "Record exact commands, exit codes, versions and integrity result in the bounded connectivity document; submit for independent review."
+      ],
+      "acceptance": [
+        "Both known-control and candidate npm metadata queries return actual registry responses without EAI_AGAIN.",
+        "A pinned candidate artifact download and integrity check succeed over normal HTTPS.",
+        "No TLS/proxy-policy bypass, secrets, crypto implementation or backend acceptance; remediation only restores network access."
+      ],
+      "checks": [
+        "npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache",
+        "npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache",
+        "Pinned artifact retrieval and registry integrity verification without install scripts"
+      ],
+      "context_budget_chars": 48000
+    },
     {
       "id": "S00-010",
       "stage": "S00",