diff --git a/experiments/0002-xmpp-library/environment-access/.npmrc b/experiments/0002-xmpp-library/environment-access/.npmrc new file mode 100644 index 0000000..ee31122 --- /dev/null +++ b/experiments/0002-xmpp-library/environment-access/.npmrc @@ -0,0 +1,4 @@ +engine-strict=true +strict-ssl=true +ignore-scripts=true +registry=https://registry.npmjs.org/ diff --git a/experiments/0002-xmpp-library/environment-access/README.md b/experiments/0002-xmpp-library/environment-access/README.md new file mode 100644 index 0000000..a7bb375 --- /dev/null +++ b/experiments/0002-xmpp-library/environment-access/README.md @@ -0,0 +1,45 @@ +# S00-026 Linux environment access probe + +Normal configured HTTPS access, authorized by the assigned environment-access +probe and this session's enabled network, succeeded on 2026-10-15. The previous +configured-proxy DNS failure did not reproduce. No proxy/environment/system +configuration was changed and no alternate network route was selected. No +separate environment-owner connectivity statement was supplied; the evidence is +actual access through the existing configured path, not an assertion about an +administrator's network changes. + +Run from the project root on Linux x86_64 with Python supporting tarfile's +`data` extraction filter (Python 3.12+ recommended), curl and xz support: + +```sh +python3 experiments/0002-xmpp-library/environment-access/verify.py +``` + +The probe retrieves the official Node 24.21.0 Linux x64 archive and vendor +SHASUMS256.txt through verified HTTPS. It checks SHA256 before safe extraction +into a fresh `/tmp/luma-S00-026-*` directory, executes exact Node 24.21.0 and +npm 11.19.0, and installs byte-identical parent manifest/lock copies here using +`npm ci --ignore-scripts --strict-ssl=true --engine-strict=true` with a fresh +isolated cache. All eight locked dependencies retain HTTPS registry URLs and +SHA512 integrity. It checks every installed version, unchanged manifest/lock +bytes and a real Stanza createClient import. Any command/check failure exits +unsuccessfully; `result.json` records the last successful run only. + +`SHASUMS256.txt` preserves retrieved vendor checksum material; `result.json` +records the verified archive hash, input hashes and temporary paths. Reviewer +should repeat the probe with fresh retrieval, rather than trust these reports. +The runtime/archive/cache remain temporary, node_modules is Git-ignored, and no +system installation is performed. These paths are available to later local +sessions until temporary storage is removed; rerun the probe if absent. + +No TLS/proxy/engine bypass, dependency additions, stack/lock/spec modification, +credentials, real messages, npm lifecycle scripts or Git mutations. The copied +parent graph was already inspected in prior experiment tasks; this probe adds +no dependency or library-selection decision. Node/npm retain their distribution +license files; dependency notices remain in the existing experiment inventories. + +Checksum verification trusts the vendor HTTPS origin; no detached signature, +package provenance/advisory audit, browser/WSS authentication, application build +or interoperability claim is made. This outcome is submitted for independent +QA review only. S00-020, S00-024 and S00-003 remain unfinished; this executor +does not continue their work or change their statuses directly. diff --git a/experiments/0002-xmpp-library/environment-access/SHASUMS256.txt b/experiments/0002-xmpp-library/environment-access/SHASUMS256.txt new file mode 100644 index 0000000..fd7dae1 --- /dev/null +++ b/experiments/0002-xmpp-library/environment-access/SHASUMS256.txt @@ -0,0 +1,34 @@ +aec7b2464afb99f078c19cb06d201d543bd3b311cba071282bce1b17c97e58bb node-v24.21.0-aix-ppc64.tar.gz +22ca85110f26015696a3fa9216bc372ae65203d170622eaf7d211e2dd5bb49e3 node-v24.21.0-arm64.msi +bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057 node-v24.21.0-darwin-arm64.tar.gz +6239d4cf92d864487ec8cd3615038f7b67e7f58b77b21cd2f09ea9fbd68065fe node-v24.21.0-darwin-arm64.tar.xz +1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097 node-v24.21.0-darwin-x64.tar.gz +0ae5a24c24bb7d015cd816c5036b3f90f2945aa872fcf54e58da054753b3a299 node-v24.21.0-darwin-x64.tar.xz +57c6bee2e30bbbee5bd51d6cc343eb992e174b56a2a1d0eab7a7510771c20ea2 node-v24.21.0-headers.tar.gz +7497abc2fac1d332fae580046b6b39d0de283dfaf267207a32b59753739c1517 node-v24.21.0-headers.tar.xz +724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5 node-v24.21.0-linux-arm64.tar.gz +6ad1325edbdb5649c379b75a237147a666c95d4f9ae8d340fef2d1575d289ad2 node-v24.21.0-linux-arm64.tar.xz +51c5d53066ee92920b61783b03b06ecb99f3661160f7b15ca77e8474115a67bc node-v24.21.0-linux-ppc64le.tar.gz +1936fd64623a2f98d1fb31b456686d10c30e92639899cfefdefa8835d22adccd node-v24.21.0-linux-ppc64le.tar.xz +5f2fa37422e0c75de35c1686fe51d78324f2c2a8fe2cc239a41d9c000a29d938 node-v24.21.0-linux-s390x.tar.gz +2ef7e2ecbf7a6c2f3d08d106f6b2f279419c6dac89fe91b8cad193af7890082c node-v24.21.0-linux-s390x.tar.xz +3d63405fc65a0d2d2976c1f0bc2fd27bb0bd07212469e705aac3f03ae5ab4c9c node-v24.21.0-linux-x64-musl.tar.gz +34ab095af8efe9018f21489d3dc19871fb5edd4f130a71469b69c05fd4e32a5e node-v24.21.0-linux-x64-musl.tar.xz +6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff node-v24.21.0-linux-x64.tar.gz +fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6 node-v24.21.0-linux-x64.tar.xz +848cc8d138b712b5ae0f38de08fde62feb404226a63dde07d0ea5ccddbbd9dd7 node-v24.21.0-win-arm64.7z +8779b1bde1d39f8d420e3b57aa657b39891af434d3de44a919044cec06785921 node-v24.21.0-win-arm64.zip +4e5f86609712acf841f3a5e2d9d4854b4c149f6ead024fc38381b6d7b272c636 node-v24.21.0-win-x64.7z +158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541 node-v24.21.0-win-x64.zip +bb0eaee134f9357f22aea915ee793343e627aefc1e66488164bac6915bce2cac node-v24.21.0-x64.msi +9831a74b04c270a429bd5a240e37712c4fe229b02b032e18ff2e0702c17c20fd node-v24.21.0.pkg +622424efb5dc0c26c93fbb619ff10737ee289c605b837c88778e186925d82777 node-v24.21.0.tar.gz +a6f54defb6fd7c84f41dba13d61e78e9b4e0961712cf61f29715c05f5ced94fc node-v24.21.0.tar.xz +dff59da18b6ffe1bf1ca99e1d2af4906080c481740619f5b5098c0fca28bd9b7 win-arm64/node.exe +2c0c3215d59c09d7c136da4949696dae121a299e9bdfc64cd9130a58610af63d win-arm64/node.lib +32ce76dd79deddcf6e08f612da714fc3a28fa39c0e4fe12283e019a90eb76483 win-arm64/node_pdb.7z +d565f0a7a8eda1662886475471e454dbe2c2a53c9d1a8562fc986bd11c24fd72 win-arm64/node_pdb.zip +ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32 win-x64/node.exe +a0a84aa03917b578d286010b7521837e9ff1136ffb2e4a406c14316c33fd06f7 win-x64/node.lib +0df783d02aee58bbe9dcfc157ccc5cc37987d24c4f35889587b39500b12030a9 win-x64/node_pdb.7z +122f2af58bfb25816f12e49179217c3ff5bf96c1e083f3ccb0969a5b4794ff85 win-x64/node_pdb.zip diff --git a/experiments/0002-xmpp-library/environment-access/package-lock.json b/experiments/0002-xmpp-library/environment-access/package-lock.json new file mode 100644 index 0000000..5323599 --- /dev/null +++ b/experiments/0002-xmpp-library/environment-access/package-lock.json @@ -0,0 +1,99 @@ +{ + "name": "luma-xmpp-library-spike", + "version": "0.0.0", + "lockfileVersion": 3, + "requires": true, + "packages": { + "": { + "name": "luma-xmpp-library-spike", + "version": "0.0.0", + "dependencies": { + "stanza": "12.22.1" + }, + "engines": { + "node": "24.21.0", + "npm": "11.19.0" + } + }, + "node_modules/@types/node": { + "version": "22.20.5", + "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz", + "integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==", + "license": "MIT", + "dependencies": { + "undici-types": "~6.21.0" + } + }, + "node_modules/@types/punycode": { + "version": "2.1.4", + "resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz", + "integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==", + "license": "MIT" + }, + "node_modules/@types/ws": { + "version": "8.18.2", + "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz", + "integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==", + "license": "MIT", + "dependencies": { + "@types/node": "*" + } + }, + "node_modules/punycode": { + "version": "2.3.1", + "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz", + "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==", + "license": "MIT", + "engines": { + "node": ">=6" + } + }, + "node_modules/sdp": { + "version": "3.2.2", + "resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz", + "integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==", + "license": "MIT" + }, + "node_modules/stanza": { + "version": "12.22.1", + "resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz", + "integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==", + "license": "MIT", + "dependencies": { + "@types/node": "^22.0.0", + "@types/punycode": "^2.1.0", + "@types/ws": "^8.18.1", + "punycode": "^2.1.1", + "sdp": "^3.0.2", + "ws": "^8.18.2" + } + }, + "node_modules/undici-types": { + "version": "6.21.0", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz", + "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==", + "license": "MIT" + }, + "node_modules/ws": { + "version": "8.22.0", + "resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz", + "integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==", + "license": "MIT", + "engines": { + "node": ">=10.0.0" + }, + "peerDependencies": { + "bufferutil": "^4.0.1", + "utf-8-validate": ">=5.0.2" + }, + "peerDependenciesMeta": { + "bufferutil": { + "optional": true + }, + "utf-8-validate": { + "optional": true + } + } + } + } +} diff --git a/experiments/0002-xmpp-library/environment-access/package.json b/experiments/0002-xmpp-library/environment-access/package.json new file mode 100644 index 0000000..d06b4ae --- /dev/null +++ b/experiments/0002-xmpp-library/environment-access/package.json @@ -0,0 +1,10 @@ +{ + "name": "luma-xmpp-library-spike", + "version": "0.0.0", + "private": true, + "type": "module", + "engines": {"node": "24.21.0", "npm": "11.19.0"}, + "packageManager": "npm@11.19.0", + "scripts": {"test": "node --test test/*.test.mjs"}, + "dependencies": {"stanza": "12.22.1"} +} diff --git a/experiments/0002-xmpp-library/environment-access/result.json b/experiments/0002-xmpp-library/environment-access/result.json new file mode 100644 index 0000000..e4585aa --- /dev/null +++ b/experiments/0002-xmpp-library/environment-access/result.json @@ -0,0 +1,20 @@ +{ + "platform": "Linux x86_64", + "origin": "https://nodejs.org/dist/v24.21.0/", + "archive": "node-v24.21.0-linux-x64.tar.xz", + "archive_sha256": "fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6", + "versions": { + "node": "v24.21.0", + "npm": "11.19.0" + }, + "runtime_bin": "/tmp/luma-S00-026-gyx_1csp/node-v24.21.0-linux-x64/bin", + "cache": "/tmp/luma-S00-026-gyx_1csp/npm-cache", + "parent_sha256": { + "package.json": "e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766", + "package-lock.json": "9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05" + }, + "locked_packages": 8, + "stanza": "12.22.1", + "import_check": "Stanza createClient import passed", + "checksum_method": "Vendor HTTPS SHASUMS256.txt; no detached signature check" +} diff --git a/experiments/0002-xmpp-library/environment-access/verify.py b/experiments/0002-xmpp-library/environment-access/verify.py new file mode 100644 index 0000000..74ef8e1 --- /dev/null +++ b/experiments/0002-xmpp-library/environment-access/verify.py @@ -0,0 +1,82 @@ +#!/usr/bin/env python3 +"""Repeat the bounded Linux x64 environment probe; never install system tools.""" +import hashlib +import json +import os +from pathlib import Path +import platform +import shutil +import subprocess +import tarfile +import tempfile + +HERE = Path(__file__).resolve().parent +PARENT = HERE.parent +ARCHIVE = 'node-v24.21.0-linux-x64.tar.xz' +ORIGIN = 'https://nodejs.org/dist/v24.21.0/' + + +def run(argv, **kwargs): + return subprocess.check_output(argv, text=True, **kwargs).strip() + + +def digest(path): + return hashlib.sha256(path.read_bytes()).hexdigest() + + +def main(): + if (platform.system(), platform.machine()) != ('Linux', 'x86_64'): + raise SystemExit('This probe requires Linux x86_64; no alternate runtime is selected.') + work = Path(tempfile.mkdtemp(prefix='luma-S00-026-')) + for name in ('SHASUMS256.txt', ARCHIVE): + subprocess.run(['curl', '--fail', '--silent', '--show-error', + '--proto', '=https', '--connect-timeout', '10', + '--max-time', '60', ORIGIN + name, '-o', str(work / name)], check=True) + shutil.copyfile(work / 'SHASUMS256.txt', HERE / 'SHASUMS256.txt') + entries = dict(line.split()[::-1] for line in (work / 'SHASUMS256.txt').read_text().splitlines()) + archive_hash = digest(work / ARCHIVE) + if entries.get(ARCHIVE) != archive_hash: + raise SystemExit('Vendor archive checksum mismatch; extraction refused.') + # Python data filter prevents traversal and unsafe special-file extraction. + with tarfile.open(work / ARCHIVE) as archive: + archive.extractall(work, filter='data') + runtime = work / 'node-v24.21.0-linux-x64' / 'bin' + env = dict(os.environ, PATH=str(runtime) + os.pathsep + os.environ.get('PATH', '')) + versions = {tool: run([str(runtime / tool), '--version'], env=env) for tool in ('node', 'npm')} + if versions != {'node': 'v24.21.0', 'npm': '11.19.0'}: + raise SystemExit('Pinned runtime versions do not match.') + for name in ('package.json', 'package-lock.json'): + shutil.copyfile(PARENT / name, HERE / name) + lock = json.loads((HERE / 'package-lock.json').read_text()) + for name, package in lock['packages'].items(): + if name and (not package['resolved'].startswith('https://registry.npmjs.org/') + or not package['integrity'].startswith('sha512-')): + raise SystemExit('Locked dependency lacks required HTTPS/SHA512 integrity.') + subprocess.run([str(runtime / 'npm'), 'ci', '--ignore-scripts', '--no-audit', '--no-fund', + '--strict-ssl=true', '--engine-strict=true', + '--registry=https://registry.npmjs.org/', '--fetch-retries=0', + '--fetch-timeout=15000', '--cache', str(work / 'npm-cache')], + cwd=HERE, env=env, check=True) + hashes = {} + for name in ('package.json', 'package-lock.json'): + if (PARENT / name).read_bytes() != (HERE / name).read_bytes(): + raise SystemExit('Copied parent manifest/lock changed.') + hashes[name] = digest(HERE / name) + for name, package in lock['packages'].items(): + if name: + installed = json.loads((HERE / name / 'package.json').read_text()) + if installed['version'] != package['version']: + raise SystemExit('Installed version differs from parent lock: ' + name) + stanza = run([str(runtime / 'node'), '--input-type=module', '-e', + "import {createClient} from 'stanza'; if(typeof createClient !== 'function') process.exit(1); console.log('Stanza createClient import passed')"], cwd=HERE, env=env) + report = {'platform': 'Linux x86_64', 'origin': ORIGIN, 'archive': ARCHIVE, + 'archive_sha256': archive_hash, 'versions': versions, 'runtime_bin': str(runtime), + 'cache': str(work / 'npm-cache'), 'parent_sha256': hashes, + 'locked_packages': len(lock['packages']) - 1, 'stanza': '12.22.1', + 'import_check': stanza, 'checksum_method': 'Vendor HTTPS SHASUMS256.txt; no detached signature check'} + (HERE / 'result.json').write_text(json.dumps(report, indent=2) + '\n') + print(json.dumps(report, indent=2)) + + +if __name__ == '__main__': + main() diff --git a/planning/TASK_MATRIX.md b/planning/TASK_MATRIX.md index 7264413..c405660 100644 --- a/planning/TASK_MATRIX.md +++ b/planning/TASK_MATRIX.md @@ -1,6 +1,6 @@ # Матрица задач -Generated; state revision **77**. Canonical status: state/tasks.json. +Generated; state revision **79**. Canonical status: state/tasks.json. | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача | | --- | --- | --- | --- | --- | --- | --- | --- | @@ -28,7 +28,7 @@ Generated; state revision **77**. Canonical status: state/tasks.json. | [S00-023](tasks/S00-023.md) | S00 | storage | qa | blocked | auto-storage-87486895c792 | S00-002, S00-025 | Устранить прерывание: Выбрать IndexedDB wrapper и migration policy | | [S00-024](tasks/S00-024.md) | S00 | ci-cd | qa | blocked | auto-ci-cd-988167c541cf | S00-001, S00-002, S00-017, S00-018, S00-019, S00-026 | Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain | | [S00-025](tasks/S00-025.md) | S00 | storage | qa | blocked | auto-storage-ae5930b6fbdf | S00-002, S00-028 | Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy | -| [S00-026](tasks/S00-026.md) | S00 | ci-cd | qa | todo | | S00-001, S00-002, S00-017, S00-018, S00-019 | Provide approved access to the pinned Linux experiment artifacts | +| [S00-026](tasks/S00-026.md) | S00 | ci-cd | qa | review | auto-ci-cd-4255c34da227 | S00-001, S00-002, S00-017, S00-018, S00-019 | Provide approved access to the pinned Linux experiment artifacts | | [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | todo | | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation | | [S00-028](tasks/S00-028.md) | S00 | ci-cd | qa | todo | | S00-002 | Repair conflicting Codex harness sandbox arguments | | [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo | | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека | diff --git a/planning/stages/S00.md b/planning/stages/S00.md index b70a2a2..ffa9bd3 100644 --- a/planning/stages/S00.md +++ b/planning/stages/S00.md @@ -30,7 +30,7 @@ - [S00-023](../tasks/S00-023.md): Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked. - [S00-024](../tasks/S00-024.md): Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; blocked. - [S00-025](../tasks/S00-025.md): Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked. -- [S00-026](../tasks/S00-026.md): Provide approved access to the pinned Linux experiment artifacts — ci-cd; todo. +- [S00-026](../tasks/S00-026.md): Provide approved access to the pinned Linux experiment artifacts — ci-cd; review. - [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; todo. - [S00-028](../tasks/S00-028.md): Repair conflicting Codex harness sandbox arguments — ci-cd; todo. - [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo. diff --git a/planning/task_matrix.csv b/planning/task_matrix.csv index 96eea5a..de337d5 100644 --- a/planning/task_matrix.csv +++ b/planning/task_matrix.csv @@ -23,7 +23,7 @@ S00-022,S00,crypto,security,blocked,auto-crypto-316a193d6c3e,"S00-001, S00-002, S00-023,S00,storage,qa,blocked,auto-storage-87486895c792,"S00-002, S00-025",Устранить прерывание: Выбрать IndexedDB wrapper и migration policy S00-024,S00,ci-cd,qa,blocked,auto-ci-cd-988167c541cf,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-026",Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain S00-025,S00,storage,qa,blocked,auto-storage-ae5930b6fbdf,"S00-002, S00-028",Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy -S00-026,S00,ci-cd,qa,todo,,"S00-001, S00-002, S00-017, S00-018, S00-019",Provide approved access to the pinned Linux experiment artifacts +S00-026,S00,ci-cd,qa,review,auto-ci-cd-4255c34da227,"S00-001, S00-002, S00-017, S00-018, S00-019",Provide approved access to the pinned Linux experiment artifacts S00-027,S00,ci-cd,security,todo,,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation S00-028,S00,ci-cd,qa,todo,,S00-002,Repair conflicting Codex harness sandbox arguments S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека diff --git a/state/commit_messages/auto-ci-cd-4255c34da227.txt b/state/commit_messages/auto-ci-cd-4255c34da227.txt new file mode 100644 index 0000000..702f47b --- /dev/null +++ b/state/commit_messages/auto-ci-cd-4255c34da227.txt @@ -0,0 +1,4 @@ +Verify pinned Linux runtime and isolated locked dependency access + +Changes: Add a bounded reproducible HTTPS/checksum/runtime probe under environment-access, vendor checksums, unchanged parent manifest/lock copies, strict npm settings, result and reproduction notes. Record evidence and QA handoff; submit S00-026 without completing parent tasks. +Validation: Run verify.py twice successfully: vendor Linux archive SHA256 matched, Node 24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed eight integrity-locked packages with scripts disabled, parent bytes stayed unchanged and Stanza import passed. tasks.py validate, git diff --check and scoped file whitespace checks passed. No browser/WSS, detached signature or provenance audit performed. diff --git a/state/evidence/S00-026-auto-ci-cd-4255c34da227.md b/state/evidence/S00-026-auto-ci-cd-4255c34da227.md new file mode 100644 index 0000000..d4bd568 --- /dev/null +++ b/state/evidence/S00-026-auto-ci-cd-4255c34da227.md @@ -0,0 +1,78 @@ +# S00-026 executor evidence + +Agent: auto-ci-cd-4255c34da227 (ci-cd), 2026-10-15. +Outcome: normal configured official HTTPS access works; isolated pinned Linux +runtime and unchanged parent locked graph verified, awaiting independent QA. + +Read master/startup/common/ci-cd, architecture/contracts/profile/workflow/ +automation/Git instructions, assigned resume/show/packet and card; required +TESTING/protocol/decisions README and blockers S00-020/024/026; previous S00-024 +handoff/evidence, direct dependency executor evidence, accepted scope/stack/ +SASL/parser/SHA512 ADRs. No prior S00-026 handoff existed. Guessed +0001-web-stack.md was absent (cat exit 1); actual 0001-stack.md was located/read. +No required artifact is missing. No exact product requirement is assigned here. + +Input: parent package.json/package-lock.json, Node 24.21.0/npm 11.19.0 pins, +existing configured HTTPS path. Output: only environment-access/** with one +reproducible verification script, copied manifest/lock, strict npm settings, +vendor checksums, result and README. Workflow metadata is the allowed exception. + +## Commands and actual results + +- python3 scripts/tasks.py resume --agent auto-ci-cd-4255c34da227: exit 0; + assigned S00-026 in_progress; no duplicate claim. +- python3 scripts/tasks.py show S00-026 and packet S00-026 --agent + auto-ci-cd-4255c34da227: exit 0 each; scope/dependencies confirmed. +- Initial git status --short: exit 0; only coordinator state/tasks.json claim. +- node --version and npm --version: exit 0 each, v24.1.0 / 11.3.0 (host tools, + not used to install dependencies). uname -sm: Linux x86_64. +- Python existence probe: exit 0; allowed environment-access, parent installed + Stanza, and previous macOS runtime path absent. +- curl --fail --silent --show-error --connect-timeout 10 --max-time 20 + https://nodejs.org/dist/v24.21.0/SHASUMS256.txt + -o /tmp/luma-S00-026-SHASUMS256.txt: exit 0. Previous proxy DNS failure did + not reproduce. No proxy/TLS configuration changed or alternate route selected. +- python3 experiments/0002-xmpp-library/environment-access/verify.py: exit 0 + initially, then exit 0 again after preserving checksums and adding .npmrc. + Both runs downloaded official archive/checksums using curl with HTTPS-only + protocol, default certificate verification, bounded timeouts. Both archive + SHA256 values match vendor Linux x64 entry: + fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6. + Extraction used Python tarfile data safety filter. Exact downloaded tools + returned v24.21.0/11.19.0. Python host is 3.14.7. +- Inside each probe, npm ci --ignore-scripts --no-audit --no-fund + --strict-ssl=true --engine-strict=true --registry=https://registry.npmjs.org/ + --fetch-retries=0 --fetch-timeout=15000 --cache : + exit 0; eight packages installed on both runs. Final run took 908ms. + All eight lock entries have HTTPS/SHA512 integrity, installed versions match + lock; actual Stanza createClient ESM import passed. Manifest/lock remain byte + equal to parent after install. Node/npm notice suggests upgrade; no upgrade run. +- python3 scripts/tasks.py validate: exit 0; 293 tasks, 22 stages, + 221 requirements, 211 allocated Web requirements, revision 78. +- git diff --check and git status --short --untracked-files=all: exit 0 each; + no tracked whitespace errors, only scoped seven source/material files and + coordinator task state before this evidence. Inline Python checked all seven + scoped files including untracked files for final newline/trailing whitespace: + exit 0. No app/tooling suite was needed/run for this isolated access outcome. + +Final runtime: /tmp/luma-S00-026-gyx_1csp/node-v24.21.0-linux-x64/bin. +Final cache: /tmp/luma-S00-026-gyx_1csp/npm-cache. +Parent package SHA256: e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766. +Parent lock SHA256: 9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05. + +## Limits / review input + +Access authorization is the assigned probe and enabled session network over the +existing configured path. No separate environment-owner statement about network +restoration was supplied; no administrative cause is inferred. Real official +HTTPS retrieval and fresh-cache locked installation prove present availability. +Same-origin vendor HTTPS checksums, no detached-signature verification or +package provenance/advisory clearance. No credentials, real conversations, +TLS/proxy/engine bypass, dependency additions, lock/stack/spec/shared-contract +change, system install, browser/WSS/interoperability or readiness claim. No Git +mutations or other task/agent launch. Temporary runtime/cache can expire. + +QA should independently rerun verify.py, compare source parent copies, inspect +scope/security flags/results and limits. This executor submits S00-026 only; +S00-020, S00-024 and S00-003 remain unfinished. Coordinator commits transition +before a fresh reviewer. No done status is set by this executor. diff --git a/state/handoffs/S00-026.md b/state/handoffs/S00-026.md new file mode 100644 index 0000000..e40d31b --- /dev/null +++ b/state/handoffs/S00-026.md @@ -0,0 +1,21 @@ +# S00-026 review handoff + +Executor auto-ci-cd-4255c34da227 verified normal configured HTTPS access and +isolated Linux x64 Node 24.21.0/npm 11.19.0 twice. Official archive checksum +matched; unchanged copied parent lock installed eight packages with npm ci, +strict TLS/engines and scripts disabled. Stanza 12.22.1 actual import passed. + +QA next: run python3 experiments/0002-xmpp-library/environment-access/verify.py +from project root on Linux x86_64/Python with tarfile data filter, inspect the +seven scoped files and state/evidence/S00-026-auto-ci-cd-4255c34da227.md. +Compare copied manifest/lock to parent; verify fresh official checksum retrieval, +exact versions, installed graph and no policy bypass. result.json records final +runtime/cache paths under /tmp/luma-S00-026-gyx_1csp; they may expire, so repeat +probe for independent evidence. node_modules is isolated and ignored. + +No separate owner statement about network restoration was supplied; actual +approved configured HTTPS path works in this authorized network-enabled session. +No network/system configuration changed, detached signatures/provenance audit, +WSS/browser/product readiness verified, or original tasks completed. Separate +review is required; executor stops on submit. Coordinator alone commits and +launches the next fresh process. diff --git a/state/tasks.json b/state/tasks.json index 22b299e..be707a6 100644 --- a/state/tasks.json +++ b/state/tasks.json @@ -1,6 +1,6 @@ { "schema_version": 1, - "revision": 77, + "revision": 79, "tasks": { "S00-001": { "status": "done", @@ -1365,10 +1365,14 @@ "handoff": "state/handoffs/S00-025.md" }, "S00-026": { - "status": "todo", - "owner": null, + "status": "review", + "owner": "auto-ci-cd-4255c34da227", "external_wait": false, - "reason": "Approved external artifact preparation completed through configured HTTPS proxy with TLS verification, without changing system tools or project sources. Authentic local supply: /tmp/luma-approved-toolchain/SHASUMS256.txt, node-v24.21.0-linux-x64.tar.xz, npm-11.19.0.tgz; provenance and SHA256/SRI in /tmp/luma-approved-toolchain/verification.json. Exact Node v24.21.0/npm 11.19.0 execute. Unchanged copied parent lock installed with npm ci --ignore-scripts --engine-strict and Stanza 12.22.1, exit 0; /tmp/luma-approved-toolchain/dependency-verification.json and npm-ci.log. Cache /tmp/luma-approved-toolchain/npm-cache permits fresh offline npm ci without proxy access. Fresh executor must independently verify supplied archives/checksums and repeat installation inside its environment-access scope; no task acceptance claimed." + "reason": null, + "started_at": "2026-10-15T09:54:28+00:00", + "updated_at": "2026-10-15T09:57:53+00:00", + "evidence": "state/evidence/S00-026-auto-ci-cd-4255c34da227.md", + "handoff": "state/handoffs/S00-026.md" }, "S00-027": { "status": "todo", @@ -2341,6 +2345,29 @@ "task": "S00-028", "agent": "coordinator-input-s00-028", "reason": "Coordinator supplies the active compatible argv from runner.local.json: codex -c sandbox_workspace_write.network_access=true exec --approve-for-me --ephemeral -. Explicit --sandbox was removed before the S00-024/S00-022/S00-025 fresh agent launches. --approve-for-me retains workspace-write per installed CLI help; no danger-full-access or bypass option. Actual subsequent run state/runs/auto-storage-ae5930b6fbdf/run.json shows the fresh harness executed tools and reached its own escalate, unlike the original immediate CLI exit 2. Installed CLI bounded help check codex exec --approve-for-me --ephemeral --help exited 0. Outbound network config retains existing proxy and TLS, independently probed via codex -c sandbox_mode='\"workspace-write\"' -c sandbox_workspace_write.network_access=true sandbox -- python3 /tmp/luma-probe-registry.py, exit 0; state/runs/coordinator-network/output.log. Fresh S00-028 executor/QA must verify supported argv and filesystem scope; no storage task completion or launcher repair acceptance claimed." + }, + { + "revision": 78, + "at": "2026-10-15T09:54:28+00:00", + "action": "claim", + "task": "S00-026", + "agent": "auto-ci-cd-4255c34da227", + "role": "ci-cd", + "from": "todo", + "to": "in_progress", + "reason": null + }, + { + "revision": 79, + "at": "2026-10-15T09:57:53+00:00", + "action": "submit", + "task": "S00-026", + "agent": "auto-ci-cd-4255c34da227", + "role": null, + "from": "in_progress", + "to": "review", + "reason": null, + "evidence": "state/evidence/S00-026-auto-ci-cd-4255c34da227.md" } ], "retired_agents": [