S00-026: Verify pinned Linux runtime and isolated locked dependency access
Changes: Add a bounded reproducible HTTPS/checksum/runtime probe under environment-access, vendor checksums, unchanged parent manifest/lock copies, strict npm settings, result and reproduction notes. Record evidence and QA handoff; submit S00-026 without completing parent tasks. Validation: Run verify.py twice successfully: vendor Linux archive SHA256 matched, Node 24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed eight integrity-locked packages with scripts disabled, parent bytes stayed unchanged and Stanza import passed. tasks.py validate, git diff --check and scoped file whitespace checks passed. No browser/WSS, detached signature or provenance audit performed. Task: S00-026 Agent: auto-ci-cd-4255c34da227 Role: ci-cd Action: claim Status: review Task title: Provide approved access to the pinned Linux experiment artifacts
This commit is contained in:
wt committed
1 parent
bac7706480
commit
2af4f143d8
14 files changed
+432
-8
No files matched your search
@@ -0,0 +1,4 @@
|
||||
engine-strict=true
|
||||
strict-ssl=true
|
||||
ignore-scripts=true
|
||||
registry=https://registry.npmjs.org/
|
||||
@@ -0,0 +1,45 @@
|
||||
# S00-026 Linux environment access probe
|
||||
|
||||
Normal configured HTTPS access, authorized by the assigned environment-access
|
||||
probe and this session's enabled network, succeeded on 2026-10-15. The previous
|
||||
configured-proxy DNS failure did not reproduce. No proxy/environment/system
|
||||
configuration was changed and no alternate network route was selected. No
|
||||
separate environment-owner connectivity statement was supplied; the evidence is
|
||||
actual access through the existing configured path, not an assertion about an
|
||||
administrator's network changes.
|
||||
|
||||
Run from the project root on Linux x86_64 with Python supporting tarfile's
|
||||
`data` extraction filter (Python 3.12+ recommended), curl and xz support:
|
||||
|
||||
```sh
|
||||
python3 experiments/0002-xmpp-library/environment-access/verify.py
|
||||
```
|
||||
|
||||
The probe retrieves the official Node 24.21.0 Linux x64 archive and vendor
|
||||
SHASUMS256.txt through verified HTTPS. It checks SHA256 before safe extraction
|
||||
into a fresh `/tmp/luma-S00-026-*` directory, executes exact Node 24.21.0 and
|
||||
npm 11.19.0, and installs byte-identical parent manifest/lock copies here using
|
||||
`npm ci --ignore-scripts --strict-ssl=true --engine-strict=true` with a fresh
|
||||
isolated cache. All eight locked dependencies retain HTTPS registry URLs and
|
||||
SHA512 integrity. It checks every installed version, unchanged manifest/lock
|
||||
bytes and a real Stanza createClient import. Any command/check failure exits
|
||||
unsuccessfully; `result.json` records the last successful run only.
|
||||
|
||||
`SHASUMS256.txt` preserves retrieved vendor checksum material; `result.json`
|
||||
records the verified archive hash, input hashes and temporary paths. Reviewer
|
||||
should repeat the probe with fresh retrieval, rather than trust these reports.
|
||||
The runtime/archive/cache remain temporary, node_modules is Git-ignored, and no
|
||||
system installation is performed. These paths are available to later local
|
||||
sessions until temporary storage is removed; rerun the probe if absent.
|
||||
|
||||
No TLS/proxy/engine bypass, dependency additions, stack/lock/spec modification,
|
||||
credentials, real messages, npm lifecycle scripts or Git mutations. The copied
|
||||
parent graph was already inspected in prior experiment tasks; this probe adds
|
||||
no dependency or library-selection decision. Node/npm retain their distribution
|
||||
license files; dependency notices remain in the existing experiment inventories.
|
||||
|
||||
Checksum verification trusts the vendor HTTPS origin; no detached signature,
|
||||
package provenance/advisory audit, browser/WSS authentication, application build
|
||||
or interoperability claim is made. This outcome is submitted for independent
|
||||
QA review only. S00-020, S00-024 and S00-003 remain unfinished; this executor
|
||||
does not continue their work or change their statuses directly.
|
||||
@@ -0,0 +1,34 @@
|
||||
aec7b2464afb99f078c19cb06d201d543bd3b311cba071282bce1b17c97e58bb node-v24.21.0-aix-ppc64.tar.gz
|
||||
22ca85110f26015696a3fa9216bc372ae65203d170622eaf7d211e2dd5bb49e3 node-v24.21.0-arm64.msi
|
||||
bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057 node-v24.21.0-darwin-arm64.tar.gz
|
||||
6239d4cf92d864487ec8cd3615038f7b67e7f58b77b21cd2f09ea9fbd68065fe node-v24.21.0-darwin-arm64.tar.xz
|
||||
1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097 node-v24.21.0-darwin-x64.tar.gz
|
||||
0ae5a24c24bb7d015cd816c5036b3f90f2945aa872fcf54e58da054753b3a299 node-v24.21.0-darwin-x64.tar.xz
|
||||
57c6bee2e30bbbee5bd51d6cc343eb992e174b56a2a1d0eab7a7510771c20ea2 node-v24.21.0-headers.tar.gz
|
||||
7497abc2fac1d332fae580046b6b39d0de283dfaf267207a32b59753739c1517 node-v24.21.0-headers.tar.xz
|
||||
724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5 node-v24.21.0-linux-arm64.tar.gz
|
||||
6ad1325edbdb5649c379b75a237147a666c95d4f9ae8d340fef2d1575d289ad2 node-v24.21.0-linux-arm64.tar.xz
|
||||
51c5d53066ee92920b61783b03b06ecb99f3661160f7b15ca77e8474115a67bc node-v24.21.0-linux-ppc64le.tar.gz
|
||||
1936fd64623a2f98d1fb31b456686d10c30e92639899cfefdefa8835d22adccd node-v24.21.0-linux-ppc64le.tar.xz
|
||||
5f2fa37422e0c75de35c1686fe51d78324f2c2a8fe2cc239a41d9c000a29d938 node-v24.21.0-linux-s390x.tar.gz
|
||||
2ef7e2ecbf7a6c2f3d08d106f6b2f279419c6dac89fe91b8cad193af7890082c node-v24.21.0-linux-s390x.tar.xz
|
||||
3d63405fc65a0d2d2976c1f0bc2fd27bb0bd07212469e705aac3f03ae5ab4c9c node-v24.21.0-linux-x64-musl.tar.gz
|
||||
34ab095af8efe9018f21489d3dc19871fb5edd4f130a71469b69c05fd4e32a5e node-v24.21.0-linux-x64-musl.tar.xz
|
||||
6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff node-v24.21.0-linux-x64.tar.gz
|
||||
fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6 node-v24.21.0-linux-x64.tar.xz
|
||||
848cc8d138b712b5ae0f38de08fde62feb404226a63dde07d0ea5ccddbbd9dd7 node-v24.21.0-win-arm64.7z
|
||||
8779b1bde1d39f8d420e3b57aa657b39891af434d3de44a919044cec06785921 node-v24.21.0-win-arm64.zip
|
||||
4e5f86609712acf841f3a5e2d9d4854b4c149f6ead024fc38381b6d7b272c636 node-v24.21.0-win-x64.7z
|
||||
158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541 node-v24.21.0-win-x64.zip
|
||||
bb0eaee134f9357f22aea915ee793343e627aefc1e66488164bac6915bce2cac node-v24.21.0-x64.msi
|
||||
9831a74b04c270a429bd5a240e37712c4fe229b02b032e18ff2e0702c17c20fd node-v24.21.0.pkg
|
||||
622424efb5dc0c26c93fbb619ff10737ee289c605b837c88778e186925d82777 node-v24.21.0.tar.gz
|
||||
a6f54defb6fd7c84f41dba13d61e78e9b4e0961712cf61f29715c05f5ced94fc node-v24.21.0.tar.xz
|
||||
dff59da18b6ffe1bf1ca99e1d2af4906080c481740619f5b5098c0fca28bd9b7 win-arm64/node.exe
|
||||
2c0c3215d59c09d7c136da4949696dae121a299e9bdfc64cd9130a58610af63d win-arm64/node.lib
|
||||
32ce76dd79deddcf6e08f612da714fc3a28fa39c0e4fe12283e019a90eb76483 win-arm64/node_pdb.7z
|
||||
d565f0a7a8eda1662886475471e454dbe2c2a53c9d1a8562fc986bd11c24fd72 win-arm64/node_pdb.zip
|
||||
ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32 win-x64/node.exe
|
||||
a0a84aa03917b578d286010b7521837e9ff1136ffb2e4a406c14316c33fd06f7 win-x64/node.lib
|
||||
0df783d02aee58bbe9dcfc157ccc5cc37987d24c4f35889587b39500b12030a9 win-x64/node_pdb.7z
|
||||
122f2af58bfb25816f12e49179217c3ff5bf96c1e083f3ccb0969a5b4794ff85 win-x64/node_pdb.zip
|
||||
@@ -0,0 +1,99 @@
|
||||
{
|
||||
"name": "luma-xmpp-library-spike",
|
||||
"version": "0.0.0",
|
||||
"lockfileVersion": 3,
|
||||
"requires": true,
|
||||
"packages": {
|
||||
"": {
|
||||
"name": "luma-xmpp-library-spike",
|
||||
"version": "0.0.0",
|
||||
"dependencies": {
|
||||
"stanza": "12.22.1"
|
||||
},
|
||||
"engines": {
|
||||
"node": "24.21.0",
|
||||
"npm": "11.19.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@types/node": {
|
||||
"version": "22.20.5",
|
||||
"resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
|
||||
"integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"undici-types": "~6.21.0"
|
||||
}
|
||||
},
|
||||
"node_modules/@types/punycode": {
|
||||
"version": "2.1.4",
|
||||
"resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
|
||||
"integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/@types/ws": {
|
||||
"version": "8.18.2",
|
||||
"resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
|
||||
"integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@types/node": "*"
|
||||
}
|
||||
},
|
||||
"node_modules/punycode": {
|
||||
"version": "2.3.1",
|
||||
"resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
|
||||
"integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=6"
|
||||
}
|
||||
},
|
||||
"node_modules/sdp": {
|
||||
"version": "3.2.2",
|
||||
"resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
|
||||
"integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/stanza": {
|
||||
"version": "12.22.1",
|
||||
"resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
|
||||
"integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
|
||||
"license": "MIT",
|
||||
"dependencies": {
|
||||
"@types/node": "^22.0.0",
|
||||
"@types/punycode": "^2.1.0",
|
||||
"@types/ws": "^8.18.1",
|
||||
"punycode": "^2.1.1",
|
||||
"sdp": "^3.0.2",
|
||||
"ws": "^8.18.2"
|
||||
}
|
||||
},
|
||||
"node_modules/undici-types": {
|
||||
"version": "6.21.0",
|
||||
"resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
|
||||
"integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
|
||||
"license": "MIT"
|
||||
},
|
||||
"node_modules/ws": {
|
||||
"version": "8.22.0",
|
||||
"resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
|
||||
"integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
|
||||
"license": "MIT",
|
||||
"engines": {
|
||||
"node": ">=10.0.0"
|
||||
},
|
||||
"peerDependencies": {
|
||||
"bufferutil": "^4.0.1",
|
||||
"utf-8-validate": ">=5.0.2"
|
||||
},
|
||||
"peerDependenciesMeta": {
|
||||
"bufferutil": {
|
||||
"optional": true
|
||||
},
|
||||
"utf-8-validate": {
|
||||
"optional": true
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,10 @@
|
||||
{
|
||||
"name": "luma-xmpp-library-spike",
|
||||
"version": "0.0.0",
|
||||
"private": true,
|
||||
"type": "module",
|
||||
"engines": {"node": "24.21.0", "npm": "11.19.0"},
|
||||
"packageManager": "npm@11.19.0",
|
||||
"scripts": {"test": "node --test test/*.test.mjs"},
|
||||
"dependencies": {"stanza": "12.22.1"}
|
||||
}
|
||||
@@ -0,0 +1,20 @@
|
||||
{
|
||||
"platform": "Linux x86_64",
|
||||
"origin": "https://nodejs.org/dist/v24.21.0/",
|
||||
"archive": "node-v24.21.0-linux-x64.tar.xz",
|
||||
"archive_sha256": "fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6",
|
||||
"versions": {
|
||||
"node": "v24.21.0",
|
||||
"npm": "11.19.0"
|
||||
},
|
||||
"runtime_bin": "/tmp/luma-S00-026-gyx_1csp/node-v24.21.0-linux-x64/bin",
|
||||
"cache": "/tmp/luma-S00-026-gyx_1csp/npm-cache",
|
||||
"parent_sha256": {
|
||||
"package.json": "e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766",
|
||||
"package-lock.json": "9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05"
|
||||
},
|
||||
"locked_packages": 8,
|
||||
"stanza": "12.22.1",
|
||||
"import_check": "Stanza createClient import passed",
|
||||
"checksum_method": "Vendor HTTPS SHASUMS256.txt; no detached signature check"
|
||||
}
|
||||
@@ -0,0 +1,82 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Repeat the bounded Linux x64 environment probe; never install system tools."""
|
||||
import hashlib
|
||||
import json
|
||||
import os
|
||||
from pathlib import Path
|
||||
import platform
|
||||
import shutil
|
||||
import subprocess
|
||||
import tarfile
|
||||
import tempfile
|
||||
|
||||
HERE = Path(__file__).resolve().parent
|
||||
PARENT = HERE.parent
|
||||
ARCHIVE = 'node-v24.21.0-linux-x64.tar.xz'
|
||||
ORIGIN = 'https://nodejs.org/dist/v24.21.0/'
|
||||
|
||||
|
||||
def run(argv, **kwargs):
|
||||
return subprocess.check_output(argv, text=True, **kwargs).strip()
|
||||
|
||||
|
||||
def digest(path):
|
||||
return hashlib.sha256(path.read_bytes()).hexdigest()
|
||||
|
||||
|
||||
def main():
|
||||
if (platform.system(), platform.machine()) != ('Linux', 'x86_64'):
|
||||
raise SystemExit('This probe requires Linux x86_64; no alternate runtime is selected.')
|
||||
work = Path(tempfile.mkdtemp(prefix='luma-S00-026-'))
|
||||
for name in ('SHASUMS256.txt', ARCHIVE):
|
||||
subprocess.run(['curl', '--fail', '--silent', '--show-error',
|
||||
'--proto', '=https', '--connect-timeout', '10',
|
||||
'--max-time', '60', ORIGIN + name, '-o', str(work / name)], check=True)
|
||||
shutil.copyfile(work / 'SHASUMS256.txt', HERE / 'SHASUMS256.txt')
|
||||
entries = dict(line.split()[::-1] for line in (work / 'SHASUMS256.txt').read_text().splitlines())
|
||||
archive_hash = digest(work / ARCHIVE)
|
||||
if entries.get(ARCHIVE) != archive_hash:
|
||||
raise SystemExit('Vendor archive checksum mismatch; extraction refused.')
|
||||
# Python data filter prevents traversal and unsafe special-file extraction.
|
||||
with tarfile.open(work / ARCHIVE) as archive:
|
||||
archive.extractall(work, filter='data')
|
||||
runtime = work / 'node-v24.21.0-linux-x64' / 'bin'
|
||||
env = dict(os.environ, PATH=str(runtime) + os.pathsep + os.environ.get('PATH', ''))
|
||||
versions = {tool: run([str(runtime / tool), '--version'], env=env) for tool in ('node', 'npm')}
|
||||
if versions != {'node': 'v24.21.0', 'npm': '11.19.0'}:
|
||||
raise SystemExit('Pinned runtime versions do not match.')
|
||||
for name in ('package.json', 'package-lock.json'):
|
||||
shutil.copyfile(PARENT / name, HERE / name)
|
||||
lock = json.loads((HERE / 'package-lock.json').read_text())
|
||||
for name, package in lock['packages'].items():
|
||||
if name and (not package['resolved'].startswith('https://registry.npmjs.org/')
|
||||
or not package['integrity'].startswith('sha512-')):
|
||||
raise SystemExit('Locked dependency lacks required HTTPS/SHA512 integrity.')
|
||||
subprocess.run([str(runtime / 'npm'), 'ci', '--ignore-scripts', '--no-audit', '--no-fund',
|
||||
'--strict-ssl=true', '--engine-strict=true',
|
||||
'--registry=https://registry.npmjs.org/', '--fetch-retries=0',
|
||||
'--fetch-timeout=15000', '--cache', str(work / 'npm-cache')],
|
||||
cwd=HERE, env=env, check=True)
|
||||
hashes = {}
|
||||
for name in ('package.json', 'package-lock.json'):
|
||||
if (PARENT / name).read_bytes() != (HERE / name).read_bytes():
|
||||
raise SystemExit('Copied parent manifest/lock changed.')
|
||||
hashes[name] = digest(HERE / name)
|
||||
for name, package in lock['packages'].items():
|
||||
if name:
|
||||
installed = json.loads((HERE / name / 'package.json').read_text())
|
||||
if installed['version'] != package['version']:
|
||||
raise SystemExit('Installed version differs from parent lock: ' + name)
|
||||
stanza = run([str(runtime / 'node'), '--input-type=module', '-e',
|
||||
"import {createClient} from 'stanza'; if(typeof createClient !== 'function') process.exit(1); console.log('Stanza createClient import passed')"], cwd=HERE, env=env)
|
||||
report = {'platform': 'Linux x86_64', 'origin': ORIGIN, 'archive': ARCHIVE,
|
||||
'archive_sha256': archive_hash, 'versions': versions, 'runtime_bin': str(runtime),
|
||||
'cache': str(work / 'npm-cache'), 'parent_sha256': hashes,
|
||||
'locked_packages': len(lock['packages']) - 1, 'stanza': '12.22.1',
|
||||
'import_check': stanza, 'checksum_method': 'Vendor HTTPS SHASUMS256.txt; no detached signature check'}
|
||||
(HERE / 'result.json').write_text(json.dumps(report, indent=2) + '\n')
|
||||
print(json.dumps(report, indent=2))
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
@@ -1,6 +1,6 @@
|
||||
# Матрица задач
|
||||
|
||||
Generated; state revision **77**. Canonical status: state/tasks.json.
|
||||
Generated; state revision **79**. Canonical status: state/tasks.json.
|
||||
|
||||
| ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
|
||||
| --- | --- | --- | --- | --- | --- | --- | --- |
|
||||
@@ -28,7 +28,7 @@ Generated; state revision **77**. Canonical status: state/tasks.json.
|
||||
| [S00-023](tasks/S00-023.md) | S00 | storage | qa | blocked | auto-storage-87486895c792 | S00-002, S00-025 | Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |
|
||||
| [S00-024](tasks/S00-024.md) | S00 | ci-cd | qa | blocked | auto-ci-cd-988167c541cf | S00-001, S00-002, S00-017, S00-018, S00-019, S00-026 | Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain |
|
||||
| [S00-025](tasks/S00-025.md) | S00 | storage | qa | blocked | auto-storage-ae5930b6fbdf | S00-002, S00-028 | Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |
|
||||
| [S00-026](tasks/S00-026.md) | S00 | ci-cd | qa | todo | | S00-001, S00-002, S00-017, S00-018, S00-019 | Provide approved access to the pinned Linux experiment artifacts |
|
||||
| [S00-026](tasks/S00-026.md) | S00 | ci-cd | qa | review | auto-ci-cd-4255c34da227 | S00-001, S00-002, S00-017, S00-018, S00-019 | Provide approved access to the pinned Linux experiment artifacts |
|
||||
| [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | todo | | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation |
|
||||
| [S00-028](tasks/S00-028.md) | S00 | ci-cd | qa | todo | | S00-002 | Repair conflicting Codex harness sandbox arguments |
|
||||
| [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo | | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
|
||||
|
||||
@@ -30,7 +30,7 @@
|
||||
- [S00-023](../tasks/S00-023.md): Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.
|
||||
- [S00-024](../tasks/S00-024.md): Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; blocked.
|
||||
- [S00-025](../tasks/S00-025.md): Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.
|
||||
- [S00-026](../tasks/S00-026.md): Provide approved access to the pinned Linux experiment artifacts — ci-cd; todo.
|
||||
- [S00-026](../tasks/S00-026.md): Provide approved access to the pinned Linux experiment artifacts — ci-cd; review.
|
||||
- [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; todo.
|
||||
- [S00-028](../tasks/S00-028.md): Repair conflicting Codex harness sandbox arguments — ci-cd; todo.
|
||||
- [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
|
||||
|
||||
@@ -23,7 +23,7 @@ S00-022,S00,crypto,security,blocked,auto-crypto-316a193d6c3e,"S00-001, S00-002,
|
||||
S00-023,S00,storage,qa,blocked,auto-storage-87486895c792,"S00-002, S00-025",Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
|
||||
S00-024,S00,ci-cd,qa,blocked,auto-ci-cd-988167c541cf,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-026",Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain
|
||||
S00-025,S00,storage,qa,blocked,auto-storage-ae5930b6fbdf,"S00-002, S00-028",Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
|
||||
S00-026,S00,ci-cd,qa,todo,,"S00-001, S00-002, S00-017, S00-018, S00-019",Provide approved access to the pinned Linux experiment artifacts
|
||||
S00-026,S00,ci-cd,qa,review,auto-ci-cd-4255c34da227,"S00-001, S00-002, S00-017, S00-018, S00-019",Provide approved access to the pinned Linux experiment artifacts
|
||||
S00-027,S00,ci-cd,security,todo,,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation
|
||||
S00-028,S00,ci-cd,qa,todo,,S00-002,Repair conflicting Codex harness sandbox arguments
|
||||
S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
|
||||
|
||||
|
@@ -0,0 +1,4 @@
|
||||
Verify pinned Linux runtime and isolated locked dependency access
|
||||
|
||||
Changes: Add a bounded reproducible HTTPS/checksum/runtime probe under environment-access, vendor checksums, unchanged parent manifest/lock copies, strict npm settings, result and reproduction notes. Record evidence and QA handoff; submit S00-026 without completing parent tasks.
|
||||
Validation: Run verify.py twice successfully: vendor Linux archive SHA256 matched, Node 24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed eight integrity-locked packages with scripts disabled, parent bytes stayed unchanged and Stanza import passed. tasks.py validate, git diff --check and scoped file whitespace checks passed. No browser/WSS, detached signature or provenance audit performed.
|
||||
@@ -0,0 +1,78 @@
|
||||
# S00-026 executor evidence
|
||||
|
||||
Agent: auto-ci-cd-4255c34da227 (ci-cd), 2026-10-15.
|
||||
Outcome: normal configured official HTTPS access works; isolated pinned Linux
|
||||
runtime and unchanged parent locked graph verified, awaiting independent QA.
|
||||
|
||||
Read master/startup/common/ci-cd, architecture/contracts/profile/workflow/
|
||||
automation/Git instructions, assigned resume/show/packet and card; required
|
||||
TESTING/protocol/decisions README and blockers S00-020/024/026; previous S00-024
|
||||
handoff/evidence, direct dependency executor evidence, accepted scope/stack/
|
||||
SASL/parser/SHA512 ADRs. No prior S00-026 handoff existed. Guessed
|
||||
0001-web-stack.md was absent (cat exit 1); actual 0001-stack.md was located/read.
|
||||
No required artifact is missing. No exact product requirement is assigned here.
|
||||
|
||||
Input: parent package.json/package-lock.json, Node 24.21.0/npm 11.19.0 pins,
|
||||
existing configured HTTPS path. Output: only environment-access/** with one
|
||||
reproducible verification script, copied manifest/lock, strict npm settings,
|
||||
vendor checksums, result and README. Workflow metadata is the allowed exception.
|
||||
|
||||
## Commands and actual results
|
||||
|
||||
- python3 scripts/tasks.py resume --agent auto-ci-cd-4255c34da227: exit 0;
|
||||
assigned S00-026 in_progress; no duplicate claim.
|
||||
- python3 scripts/tasks.py show S00-026 and packet S00-026 --agent
|
||||
auto-ci-cd-4255c34da227: exit 0 each; scope/dependencies confirmed.
|
||||
- Initial git status --short: exit 0; only coordinator state/tasks.json claim.
|
||||
- node --version and npm --version: exit 0 each, v24.1.0 / 11.3.0 (host tools,
|
||||
not used to install dependencies). uname -sm: Linux x86_64.
|
||||
- Python existence probe: exit 0; allowed environment-access, parent installed
|
||||
Stanza, and previous macOS runtime path absent.
|
||||
- curl --fail --silent --show-error --connect-timeout 10 --max-time 20
|
||||
https://nodejs.org/dist/v24.21.0/SHASUMS256.txt
|
||||
-o /tmp/luma-S00-026-SHASUMS256.txt: exit 0. Previous proxy DNS failure did
|
||||
not reproduce. No proxy/TLS configuration changed or alternate route selected.
|
||||
- python3 experiments/0002-xmpp-library/environment-access/verify.py: exit 0
|
||||
initially, then exit 0 again after preserving checksums and adding .npmrc.
|
||||
Both runs downloaded official archive/checksums using curl with HTTPS-only
|
||||
protocol, default certificate verification, bounded timeouts. Both archive
|
||||
SHA256 values match vendor Linux x64 entry:
|
||||
fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6.
|
||||
Extraction used Python tarfile data safety filter. Exact downloaded tools
|
||||
returned v24.21.0/11.19.0. Python host is 3.14.7.
|
||||
- Inside each probe, npm ci --ignore-scripts --no-audit --no-fund
|
||||
--strict-ssl=true --engine-strict=true --registry=https://registry.npmjs.org/
|
||||
--fetch-retries=0 --fetch-timeout=15000 --cache <fresh temporary cache>:
|
||||
exit 0; eight packages installed on both runs. Final run took 908ms.
|
||||
All eight lock entries have HTTPS/SHA512 integrity, installed versions match
|
||||
lock; actual Stanza createClient ESM import passed. Manifest/lock remain byte
|
||||
equal to parent after install. Node/npm notice suggests upgrade; no upgrade run.
|
||||
- python3 scripts/tasks.py validate: exit 0; 293 tasks, 22 stages,
|
||||
221 requirements, 211 allocated Web requirements, revision 78.
|
||||
- git diff --check and git status --short --untracked-files=all: exit 0 each;
|
||||
no tracked whitespace errors, only scoped seven source/material files and
|
||||
coordinator task state before this evidence. Inline Python checked all seven
|
||||
scoped files including untracked files for final newline/trailing whitespace:
|
||||
exit 0. No app/tooling suite was needed/run for this isolated access outcome.
|
||||
|
||||
Final runtime: /tmp/luma-S00-026-gyx_1csp/node-v24.21.0-linux-x64/bin.
|
||||
Final cache: /tmp/luma-S00-026-gyx_1csp/npm-cache.
|
||||
Parent package SHA256: e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766.
|
||||
Parent lock SHA256: 9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05.
|
||||
|
||||
## Limits / review input
|
||||
|
||||
Access authorization is the assigned probe and enabled session network over the
|
||||
existing configured path. No separate environment-owner statement about network
|
||||
restoration was supplied; no administrative cause is inferred. Real official
|
||||
HTTPS retrieval and fresh-cache locked installation prove present availability.
|
||||
Same-origin vendor HTTPS checksums, no detached-signature verification or
|
||||
package provenance/advisory clearance. No credentials, real conversations,
|
||||
TLS/proxy/engine bypass, dependency additions, lock/stack/spec/shared-contract
|
||||
change, system install, browser/WSS/interoperability or readiness claim. No Git
|
||||
mutations or other task/agent launch. Temporary runtime/cache can expire.
|
||||
|
||||
QA should independently rerun verify.py, compare source parent copies, inspect
|
||||
scope/security flags/results and limits. This executor submits S00-026 only;
|
||||
S00-020, S00-024 and S00-003 remain unfinished. Coordinator commits transition
|
||||
before a fresh reviewer. No done status is set by this executor.
|
||||
@@ -0,0 +1,21 @@
|
||||
# S00-026 review handoff
|
||||
|
||||
Executor auto-ci-cd-4255c34da227 verified normal configured HTTPS access and
|
||||
isolated Linux x64 Node 24.21.0/npm 11.19.0 twice. Official archive checksum
|
||||
matched; unchanged copied parent lock installed eight packages with npm ci,
|
||||
strict TLS/engines and scripts disabled. Stanza 12.22.1 actual import passed.
|
||||
|
||||
QA next: run python3 experiments/0002-xmpp-library/environment-access/verify.py
|
||||
from project root on Linux x86_64/Python with tarfile data filter, inspect the
|
||||
seven scoped files and state/evidence/S00-026-auto-ci-cd-4255c34da227.md.
|
||||
Compare copied manifest/lock to parent; verify fresh official checksum retrieval,
|
||||
exact versions, installed graph and no policy bypass. result.json records final
|
||||
runtime/cache paths under /tmp/luma-S00-026-gyx_1csp; they may expire, so repeat
|
||||
probe for independent evidence. node_modules is isolated and ignored.
|
||||
|
||||
No separate owner statement about network restoration was supplied; actual
|
||||
approved configured HTTPS path works in this authorized network-enabled session.
|
||||
No network/system configuration changed, detached signatures/provenance audit,
|
||||
WSS/browser/product readiness verified, or original tasks completed. Separate
|
||||
review is required; executor stops on submit. Coordinator alone commits and
|
||||
launches the next fresh process.
|
||||
+31
-4
@@ -1,6 +1,6 @@
|
||||
{
|
||||
"schema_version": 1,
|
||||
"revision": 77,
|
||||
"revision": 79,
|
||||
"tasks": {
|
||||
"S00-001": {
|
||||
"status": "done",
|
||||
@@ -1365,10 +1365,14 @@
|
||||
"handoff": "state/handoffs/S00-025.md"
|
||||
},
|
||||
"S00-026": {
|
||||
"status": "todo",
|
||||
"owner": null,
|
||||
"status": "review",
|
||||
"owner": "auto-ci-cd-4255c34da227",
|
||||
"external_wait": false,
|
||||
"reason": "Approved external artifact preparation completed through configured HTTPS proxy with TLS verification, without changing system tools or project sources. Authentic local supply: /tmp/luma-approved-toolchain/SHASUMS256.txt, node-v24.21.0-linux-x64.tar.xz, npm-11.19.0.tgz; provenance and SHA256/SRI in /tmp/luma-approved-toolchain/verification.json. Exact Node v24.21.0/npm 11.19.0 execute. Unchanged copied parent lock installed with npm ci --ignore-scripts --engine-strict and Stanza 12.22.1, exit 0; /tmp/luma-approved-toolchain/dependency-verification.json and npm-ci.log. Cache /tmp/luma-approved-toolchain/npm-cache permits fresh offline npm ci without proxy access. Fresh executor must independently verify supplied archives/checksums and repeat installation inside its environment-access scope; no task acceptance claimed."
|
||||
"reason": null,
|
||||
"started_at": "2026-10-15T09:54:28+00:00",
|
||||
"updated_at": "2026-10-15T09:57:53+00:00",
|
||||
"evidence": "state/evidence/S00-026-auto-ci-cd-4255c34da227.md",
|
||||
"handoff": "state/handoffs/S00-026.md"
|
||||
},
|
||||
"S00-027": {
|
||||
"status": "todo",
|
||||
@@ -2341,6 +2345,29 @@
|
||||
"task": "S00-028",
|
||||
"agent": "coordinator-input-s00-028",
|
||||
"reason": "Coordinator supplies the active compatible argv from runner.local.json: codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -. Explicit --sandbox was removed before the S00-024/S00-022/S00-025 fresh agent launches. --approve-for-me retains workspace-write per installed CLI help; no danger-full-access or bypass option. Actual subsequent run state/runs/auto-storage-ae5930b6fbdf/run.json shows the fresh harness executed tools and reached its own escalate, unlike the original immediate CLI exit 2. Installed CLI bounded help check codex exec --approve-for-me --ephemeral --help exited 0. Outbound network config retains existing proxy and TLS, independently probed via codex -c sandbox_mode='\"workspace-write\"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0; state/runs/coordinator-network/output.log. Fresh S00-028 executor/QA must verify supported argv and filesystem scope; no storage task completion or launcher repair acceptance claimed."
|
||||
},
|
||||
{
|
||||
"revision": 78,
|
||||
"at": "2026-10-15T09:54:28+00:00",
|
||||
"action": "claim",
|
||||
"task": "S00-026",
|
||||
"agent": "auto-ci-cd-4255c34da227",
|
||||
"role": "ci-cd",
|
||||
"from": "todo",
|
||||
"to": "in_progress",
|
||||
"reason": null
|
||||
},
|
||||
{
|
||||
"revision": 79,
|
||||
"at": "2026-10-15T09:57:53+00:00",
|
||||
"action": "submit",
|
||||
"task": "S00-026",
|
||||
"agent": "auto-ci-cd-4255c34da227",
|
||||
"role": null,
|
||||
"from": "in_progress",
|
||||
"to": "review",
|
||||
"reason": null,
|
||||
"evidence": "state/evidence/S00-026-auto-ci-cd-4255c34da227.md"
|
||||
}
|
||||
],
|
||||
"retired_agents": [
|
||||
|
||||
Reference in new issue
Block a user