S00-026: Verify pinned Linux runtime and isolated locked dependency access

Changes: Add a bounded reproducible HTTPS/checksum/runtime probe under environment-access, vendor checksums, unchanged parent manifest/lock copies, strict npm settings, result and reproduction notes. Record evidence and QA handoff; submit S00-026 without completing parent tasks. Validation: Run verify.py twice successfully: vendor Linux archive SHA256 matched, Node 24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed eight integrity-locked packages with scripts disabled, parent bytes stayed unchanged and Stanza import passed. tasks.py validate, git diff --check and scoped file whitespace checks passed. No browser/WSS, detached signature or provenance audit performed. Task: S00-026 Agent: auto-ci-cd-4255c34da227 Role: ci-cd Action: claim Status: review Task title: Provide approved access to the pinned Linux experiment artifacts
2026-10-15 16:57:59 +07:00
1 parent bac7706480
commit 2af4f143d8
@@ -0,0 +1,4 @@
+engine-strict=true
+strict-ssl=true
+ignore-scripts=true
+registry=https://registry.npmjs.org/
@@ -0,0 +1,45 @@
+# S00-026 Linux environment access probe
+
+Normal configured HTTPS access, authorized by the assigned environment-access
+probe and this session's enabled network, succeeded on 2026-10-15. The previous
+configured-proxy DNS failure did not reproduce. No proxy/environment/system
+configuration was changed and no alternate network route was selected. No
+separate environment-owner connectivity statement was supplied; the evidence is
+actual access through the existing configured path, not an assertion about an
+administrator's network changes.
+
+Run from the project root on Linux x86_64 with Python supporting tarfile's
+`data` extraction filter (Python 3.12+ recommended), curl and xz support:
+
+```sh
+python3 experiments/0002-xmpp-library/environment-access/verify.py
+```
+
+The probe retrieves the official Node 24.21.0 Linux x64 archive and vendor
+SHASUMS256.txt through verified HTTPS. It checks SHA256 before safe extraction
+into a fresh `/tmp/luma-S00-026-*` directory, executes exact Node 24.21.0 and
+npm 11.19.0, and installs byte-identical parent manifest/lock copies here using
+`npm ci --ignore-scripts --strict-ssl=true --engine-strict=true` with a fresh
+isolated cache. All eight locked dependencies retain HTTPS registry URLs and
+SHA512 integrity. It checks every installed version, unchanged manifest/lock
+bytes and a real Stanza createClient import. Any command/check failure exits
+unsuccessfully; `result.json` records the last successful run only.
+
+`SHASUMS256.txt` preserves retrieved vendor checksum material; `result.json`
+records the verified archive hash, input hashes and temporary paths. Reviewer
+should repeat the probe with fresh retrieval, rather than trust these reports.
+The runtime/archive/cache remain temporary, node_modules is Git-ignored, and no
+system installation is performed. These paths are available to later local
+sessions until temporary storage is removed; rerun the probe if absent.
+
+No TLS/proxy/engine bypass, dependency additions, stack/lock/spec modification,
+credentials, real messages, npm lifecycle scripts or Git mutations. The copied
+parent graph was already inspected in prior experiment tasks; this probe adds
+no dependency or library-selection decision. Node/npm retain their distribution
+license files; dependency notices remain in the existing experiment inventories.
+
+Checksum verification trusts the vendor HTTPS origin; no detached signature,
+package provenance/advisory audit, browser/WSS authentication, application build
+or interoperability claim is made. This outcome is submitted for independent
+QA review only. S00-020, S00-024 and S00-003 remain unfinished; this executor
+does not continue their work or change their statuses directly.
@@ -0,0 +1,34 @@
+aec7b2464afb99f078c19cb06d201d543bd3b311cba071282bce1b17c97e58bb  node-v24.21.0-aix-ppc64.tar.gz
+22ca85110f26015696a3fa9216bc372ae65203d170622eaf7d211e2dd5bb49e3  node-v24.21.0-arm64.msi
+bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057  node-v24.21.0-darwin-arm64.tar.gz
+6239d4cf92d864487ec8cd3615038f7b67e7f58b77b21cd2f09ea9fbd68065fe  node-v24.21.0-darwin-arm64.tar.xz
+1462cb3b3046b815cf8ea436d3da450ec1a9f11dac7e5a46b0ada5305d7e8097  node-v24.21.0-darwin-x64.tar.gz
+0ae5a24c24bb7d015cd816c5036b3f90f2945aa872fcf54e58da054753b3a299  node-v24.21.0-darwin-x64.tar.xz
+57c6bee2e30bbbee5bd51d6cc343eb992e174b56a2a1d0eab7a7510771c20ea2  node-v24.21.0-headers.tar.gz
+7497abc2fac1d332fae580046b6b39d0de283dfaf267207a32b59753739c1517  node-v24.21.0-headers.tar.xz
+724282c3b43aec998aa9527380465b45d229e021b58035f5f4f63095eabfe5d5  node-v24.21.0-linux-arm64.tar.gz
+6ad1325edbdb5649c379b75a237147a666c95d4f9ae8d340fef2d1575d289ad2  node-v24.21.0-linux-arm64.tar.xz
+51c5d53066ee92920b61783b03b06ecb99f3661160f7b15ca77e8474115a67bc  node-v24.21.0-linux-ppc64le.tar.gz
+1936fd64623a2f98d1fb31b456686d10c30e92639899cfefdefa8835d22adccd  node-v24.21.0-linux-ppc64le.tar.xz
+5f2fa37422e0c75de35c1686fe51d78324f2c2a8fe2cc239a41d9c000a29d938  node-v24.21.0-linux-s390x.tar.gz
+2ef7e2ecbf7a6c2f3d08d106f6b2f279419c6dac89fe91b8cad193af7890082c  node-v24.21.0-linux-s390x.tar.xz
+3d63405fc65a0d2d2976c1f0bc2fd27bb0bd07212469e705aac3f03ae5ab4c9c  node-v24.21.0-linux-x64-musl.tar.gz
+34ab095af8efe9018f21489d3dc19871fb5edd4f130a71469b69c05fd4e32a5e  node-v24.21.0-linux-x64-musl.tar.xz
+6e1db87ef58b8819e5d5402eff1536491b18edd8eb7bee5ef7897876e88dc5ff  node-v24.21.0-linux-x64.tar.gz
+fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6  node-v24.21.0-linux-x64.tar.xz
+848cc8d138b712b5ae0f38de08fde62feb404226a63dde07d0ea5ccddbbd9dd7  node-v24.21.0-win-arm64.7z
+8779b1bde1d39f8d420e3b57aa657b39891af434d3de44a919044cec06785921  node-v24.21.0-win-arm64.zip
+4e5f86609712acf841f3a5e2d9d4854b4c149f6ead024fc38381b6d7b272c636  node-v24.21.0-win-x64.7z
+158f7685b44de51f6c0df1d153526cbcd3e1bc739a8dfc607721cef75de9e541  node-v24.21.0-win-x64.zip
+bb0eaee134f9357f22aea915ee793343e627aefc1e66488164bac6915bce2cac  node-v24.21.0-x64.msi
+9831a74b04c270a429bd5a240e37712c4fe229b02b032e18ff2e0702c17c20fd  node-v24.21.0.pkg
+622424efb5dc0c26c93fbb619ff10737ee289c605b837c88778e186925d82777  node-v24.21.0.tar.gz
+a6f54defb6fd7c84f41dba13d61e78e9b4e0961712cf61f29715c05f5ced94fc  node-v24.21.0.tar.xz
+dff59da18b6ffe1bf1ca99e1d2af4906080c481740619f5b5098c0fca28bd9b7  win-arm64/node.exe
+2c0c3215d59c09d7c136da4949696dae121a299e9bdfc64cd9130a58610af63d  win-arm64/node.lib
+32ce76dd79deddcf6e08f612da714fc3a28fa39c0e4fe12283e019a90eb76483  win-arm64/node_pdb.7z
+d565f0a7a8eda1662886475471e454dbe2c2a53c9d1a8562fc986bd11c24fd72  win-arm64/node_pdb.zip
+ba4e6d110e8c1592a1ecd390f6b05f3da124b13871a5be62b341a07a853c6c32  win-x64/node.exe
+a0a84aa03917b578d286010b7521837e9ff1136ffb2e4a406c14316c33fd06f7  win-x64/node.lib
+0df783d02aee58bbe9dcfc157ccc5cc37987d24c4f35889587b39500b12030a9  win-x64/node_pdb.7z
+122f2af58bfb25816f12e49179217c3ff5bf96c1e083f3ccb0969a5b4794ff85  win-x64/node_pdb.zip
@@ -0,0 +1,99 @@
+{
+  "name": "luma-xmpp-library-spike",
+  "version": "0.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "luma-xmpp-library-spike",
+      "version": "0.0.0",
+      "dependencies": {
+        "stanza": "12.22.1"
+      },
+      "engines": {
+        "node": "24.21.0",
+        "npm": "11.19.0"
+      }
+    },
+    "node_modules/@types/node": {
+      "version": "22.20.5",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.5.tgz",
+      "integrity": "sha512-U2+DNr+wSjpsTS/wZGYHq7GcwfuSmKiKvoPvK22zwTlRhU91yOniN4qRR5KhIjvif7ysw/dz/hKmfDH0Ris4aA==",
+      "license": "MIT",
+      "dependencies": {
+        "undici-types": "~6.21.0"
+      }
+    },
+    "node_modules/@types/punycode": {
+      "version": "2.1.4",
+      "resolved": "https://registry.npmjs.org/@types/punycode/-/punycode-2.1.4.tgz",
+      "integrity": "sha512-trzh6NzBnq8yw5e35f8xe8VTYjqM3NE7bohBtvDVf/dtUer3zYTLK1Ka3DG3p7bdtoaOHZucma6FfVKlQ134pQ==",
+      "license": "MIT"
+    },
+    "node_modules/@types/ws": {
+      "version": "8.18.2",
+      "resolved": "https://registry.npmjs.org/@types/ws/-/ws-8.18.2.tgz",
+      "integrity": "sha512-67MQl+fpWKVTT1NYdnmo3U4sc/xPo/zQBncVnI74qmQa0z/b+1g6iYqNmGCPbxO+zz2aklb08a0oHfegiVd0/w==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
+    "node_modules/punycode": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+      "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/sdp": {
+      "version": "3.2.2",
+      "resolved": "https://registry.npmjs.org/sdp/-/sdp-3.2.2.tgz",
+      "integrity": "sha512-xZocWwfyp4hkbN4hLWxMjmv2Q8aNa9MhmOZ7L9aCZPT+dZsgRr6wZRrSYE3HTdyk/2pZKPSgqI7ns7Een1xMSA==",
+      "license": "MIT"
+    },
+    "node_modules/stanza": {
+      "version": "12.22.1",
+      "resolved": "https://registry.npmjs.org/stanza/-/stanza-12.22.1.tgz",
+      "integrity": "sha512-WwoSl3u5cCEAbed5ao+yt8ByH6AsBJcPDY0gax3JGQkBX/7wEZ2oxu9nMJ7O1tm8slDyH4FBYIpeluHrT+g/LA==",
+      "license": "MIT",
+      "dependencies": {
+        "@types/node": "^22.0.0",
+        "@types/punycode": "^2.1.0",
+        "@types/ws": "^8.18.1",
+        "punycode": "^2.1.1",
+        "sdp": "^3.0.2",
+        "ws": "^8.18.2"
+      }
+    },
+    "node_modules/undici-types": {
+      "version": "6.21.0",
+      "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+      "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
+      "license": "MIT"
+    },
+    "node_modules/ws": {
+      "version": "8.22.0",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-8.22.0.tgz",
+      "integrity": "sha512-Ydggc987+RO0AnWtZ/7Wq9FtNvcrL1b/RO0ud9mWjUPgDrsAAwQSF51sm2hm1XofbU/4jkpGEsLFsZZxU+1DOg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=10.0.0"
+      },
+      "peerDependencies": {
+        "bufferutil": "^4.0.1",
+        "utf-8-validate": ">=5.0.2"
+      },
+      "peerDependenciesMeta": {
+        "bufferutil": {
+          "optional": true
+        },
+        "utf-8-validate": {
+          "optional": true
+        }
+      }
+    }
+  }
+}
@@ -0,0 +1,10 @@
+{
+  "name": "luma-xmpp-library-spike",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "engines": {"node": "24.21.0", "npm": "11.19.0"},
+  "packageManager": "npm@11.19.0",
+  "scripts": {"test": "node --test test/*.test.mjs"},
+  "dependencies": {"stanza": "12.22.1"}
+}
@@ -0,0 +1,20 @@
+{
+  "platform": "Linux x86_64",
+  "origin": "https://nodejs.org/dist/v24.21.0/",
+  "archive": "node-v24.21.0-linux-x64.tar.xz",
+  "archive_sha256": "fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6",
+  "versions": {
+    "node": "v24.21.0",
+    "npm": "11.19.0"
+  },
+  "runtime_bin": "/tmp/luma-S00-026-gyx_1csp/node-v24.21.0-linux-x64/bin",
+  "cache": "/tmp/luma-S00-026-gyx_1csp/npm-cache",
+  "parent_sha256": {
+    "package.json": "e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766",
+    "package-lock.json": "9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05"
+  },
+  "locked_packages": 8,
+  "stanza": "12.22.1",
+  "import_check": "Stanza createClient import passed",
+  "checksum_method": "Vendor HTTPS SHASUMS256.txt; no detached signature check"
+}
@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""Repeat the bounded Linux x64 environment probe; never install system tools."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import platform
+import shutil
+import subprocess
+import tarfile
+import tempfile
+
+HERE = Path(__file__).resolve().parent
+PARENT = HERE.parent
+ARCHIVE = 'node-v24.21.0-linux-x64.tar.xz'
+ORIGIN = 'https://nodejs.org/dist/v24.21.0/'
+
+
+def run(argv, **kwargs):
+    return subprocess.check_output(argv, text=True, **kwargs).strip()
+
+
+def digest(path):
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def main():
+    if (platform.system(), platform.machine()) != ('Linux', 'x86_64'):
+        raise SystemExit('This probe requires Linux x86_64; no alternate runtime is selected.')
+    work = Path(tempfile.mkdtemp(prefix='luma-S00-026-'))
+    for name in ('SHASUMS256.txt', ARCHIVE):
+        subprocess.run(['curl', '--fail', '--silent', '--show-error',
+                        '--proto', '=https', '--connect-timeout', '10',
+                        '--max-time', '60', ORIGIN + name, '-o', str(work / name)], check=True)
+    shutil.copyfile(work / 'SHASUMS256.txt', HERE / 'SHASUMS256.txt')
+    entries = dict(line.split()[::-1] for line in (work / 'SHASUMS256.txt').read_text().splitlines())
+    archive_hash = digest(work / ARCHIVE)
+    if entries.get(ARCHIVE) != archive_hash:
+        raise SystemExit('Vendor archive checksum mismatch; extraction refused.')
+    # Python data filter prevents traversal and unsafe special-file extraction.
+    with tarfile.open(work / ARCHIVE) as archive:
+        archive.extractall(work, filter='data')
+    runtime = work / 'node-v24.21.0-linux-x64' / 'bin'
+    env = dict(os.environ, PATH=str(runtime) + os.pathsep + os.environ.get('PATH', ''))
+    versions = {tool: run([str(runtime / tool), '--version'], env=env) for tool in ('node', 'npm')}
+    if versions != {'node': 'v24.21.0', 'npm': '11.19.0'}:
+        raise SystemExit('Pinned runtime versions do not match.')
+    for name in ('package.json', 'package-lock.json'):
+        shutil.copyfile(PARENT / name, HERE / name)
+    lock = json.loads((HERE / 'package-lock.json').read_text())
+    for name, package in lock['packages'].items():
+        if name and (not package['resolved'].startswith('https://registry.npmjs.org/')
+                     or not package['integrity'].startswith('sha512-')):
+            raise SystemExit('Locked dependency lacks required HTTPS/SHA512 integrity.')
+    subprocess.run([str(runtime / 'npm'), 'ci', '--ignore-scripts', '--no-audit', '--no-fund',
+                    '--strict-ssl=true', '--engine-strict=true',
+                    '--registry=https://registry.npmjs.org/', '--fetch-retries=0',
+                    '--fetch-timeout=15000', '--cache', str(work / 'npm-cache')],
+                   cwd=HERE, env=env, check=True)
+    hashes = {}
+    for name in ('package.json', 'package-lock.json'):
+        if (PARENT / name).read_bytes() != (HERE / name).read_bytes():
+            raise SystemExit('Copied parent manifest/lock changed.')
+        hashes[name] = digest(HERE / name)
+    for name, package in lock['packages'].items():
+        if name:
+            installed = json.loads((HERE / name / 'package.json').read_text())
+            if installed['version'] != package['version']:
+                raise SystemExit('Installed version differs from parent lock: ' + name)
+    stanza = run([str(runtime / 'node'), '--input-type=module', '-e',
+                  "import {createClient} from 'stanza'; if(typeof createClient !== 'function') process.exit(1); console.log('Stanza createClient import passed')"], cwd=HERE, env=env)
+    report = {'platform': 'Linux x86_64', 'origin': ORIGIN, 'archive': ARCHIVE,
+              'archive_sha256': archive_hash, 'versions': versions, 'runtime_bin': str(runtime),
+              'cache': str(work / 'npm-cache'), 'parent_sha256': hashes,
+              'locked_packages': len(lock['packages']) - 1, 'stanza': '12.22.1',
+              'import_check': stanza, 'checksum_method': 'Vendor HTTPS SHASUMS256.txt; no detached signature check'}
+    (HERE / 'result.json').write_text(json.dumps(report, indent=2) + '\n')
+    print(json.dumps(report, indent=2))
+
+
+if __name__ == '__main__':
+    main()