S00-026: Verify pinned Linux runtime and isolated locked dependency access

Changes: Add a bounded reproducible HTTPS/checksum/runtime probe under environment-access, vendor checksums, unchanged parent manifest/lock copies, strict npm settings, result and reproduction notes. Record evidence and QA handoff; submit S00-026 without completing parent tasks.
Validation: Run verify.py twice successfully: vendor Linux archive SHA256 matched, Node 24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed eight integrity-locked packages with scripts disabled, parent bytes stayed unchanged and Stanza import passed. tasks.py validate, git diff --check and scoped file whitespace checks passed. No browser/WSS, detached signature or provenance audit performed.

Task: S00-026
Agent: auto-ci-cd-4255c34da227
Role: ci-cd
Action: claim
Status: review

Task title: Provide approved access to the pinned Linux experiment artifacts

experiments/0002-xmpp-library/environment-access/verify.py

@@ -0,0 +1,82 @@
+#!/usr/bin/env python3
+"""Repeat the bounded Linux x64 environment probe; never install system tools."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import platform
+import shutil
+import subprocess
+import tarfile
+import tempfile
+
+HERE = Path(__file__).resolve().parent
+PARENT = HERE.parent
+ARCHIVE = 'node-v24.21.0-linux-x64.tar.xz'
+ORIGIN = 'https://nodejs.org/dist/v24.21.0/'
+
+
+def run(argv, **kwargs):
+    return subprocess.check_output(argv, text=True, **kwargs).strip()
+
+
+def digest(path):
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def main():
+    if (platform.system(), platform.machine()) != ('Linux', 'x86_64'):
+        raise SystemExit('This probe requires Linux x86_64; no alternate runtime is selected.')
+    work = Path(tempfile.mkdtemp(prefix='luma-S00-026-'))
+    for name in ('SHASUMS256.txt', ARCHIVE):
+        subprocess.run(['curl', '--fail', '--silent', '--show-error',
+                        '--proto', '=https', '--connect-timeout', '10',
+                        '--max-time', '60', ORIGIN + name, '-o', str(work / name)], check=True)
+    shutil.copyfile(work / 'SHASUMS256.txt', HERE / 'SHASUMS256.txt')
+    entries = dict(line.split()[::-1] for line in (work / 'SHASUMS256.txt').read_text().splitlines())
+    archive_hash = digest(work / ARCHIVE)
+    if entries.get(ARCHIVE) != archive_hash:
+        raise SystemExit('Vendor archive checksum mismatch; extraction refused.')
+    # Python data filter prevents traversal and unsafe special-file extraction.
+    with tarfile.open(work / ARCHIVE) as archive:
+        archive.extractall(work, filter='data')
+    runtime = work / 'node-v24.21.0-linux-x64' / 'bin'
+    env = dict(os.environ, PATH=str(runtime) + os.pathsep + os.environ.get('PATH', ''))
+    versions = {tool: run([str(runtime / tool), '--version'], env=env) for tool in ('node', 'npm')}
+    if versions != {'node': 'v24.21.0', 'npm': '11.19.0'}:
+        raise SystemExit('Pinned runtime versions do not match.')
+    for name in ('package.json', 'package-lock.json'):
+        shutil.copyfile(PARENT / name, HERE / name)
+    lock = json.loads((HERE / 'package-lock.json').read_text())
+    for name, package in lock['packages'].items():
+        if name and (not package['resolved'].startswith('https://registry.npmjs.org/')
+                     or not package['integrity'].startswith('sha512-')):
+            raise SystemExit('Locked dependency lacks required HTTPS/SHA512 integrity.')
+    subprocess.run([str(runtime / 'npm'), 'ci', '--ignore-scripts', '--no-audit', '--no-fund',
+                    '--strict-ssl=true', '--engine-strict=true',
+                    '--registry=https://registry.npmjs.org/', '--fetch-retries=0',
+                    '--fetch-timeout=15000', '--cache', str(work / 'npm-cache')],
+                   cwd=HERE, env=env, check=True)
+    hashes = {}
+    for name in ('package.json', 'package-lock.json'):
+        if (PARENT / name).read_bytes() != (HERE / name).read_bytes():
+            raise SystemExit('Copied parent manifest/lock changed.')
+        hashes[name] = digest(HERE / name)
+    for name, package in lock['packages'].items():
+        if name:
+            installed = json.loads((HERE / name / 'package.json').read_text())
+            if installed['version'] != package['version']:
+                raise SystemExit('Installed version differs from parent lock: ' + name)
+    stanza = run([str(runtime / 'node'), '--input-type=module', '-e',
+                  "import {createClient} from 'stanza'; if(typeof createClient !== 'function') process.exit(1); console.log('Stanza createClient import passed')"], cwd=HERE, env=env)
+    report = {'platform': 'Linux x86_64', 'origin': ORIGIN, 'archive': ARCHIVE,
+              'archive_sha256': archive_hash, 'versions': versions, 'runtime_bin': str(runtime),
+              'cache': str(work / 'npm-cache'), 'parent_sha256': hashes,
+              'locked_packages': len(lock['packages']) - 1, 'stanza': '12.22.1',
+              'import_check': stanza, 'checksum_method': 'Vendor HTTPS SHASUMS256.txt; no detached signature check'}
+    (HERE / 'result.json').write_text(json.dumps(report, indent=2) + '\n')
+    print(json.dumps(report, indent=2))
+
+
+if __name__ == '__main__':
+    main()