S00-003: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-003 cannot reproduce accepted Node 24.21.0/npm 11.19.0 or install locked Stanza: host tools are 24.1.0/11.3.0, parent node_modules is absent, and normal official HTTPS retrieval fails with unresolved configured proxy.

Task: S00-003
Agent: auto-protocol-59f4d359b339
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку

planning/ROADMAP.md

@@ -6,7 +6,7 @@
 
 Зафиксировать Web scope, browser targets и проверенные кандидаты, не устанавливая непроверенный framework по догадке.
 
-Задач: 19; entry: нет; exit: S00-010.
+Задач: 20; entry: нет; exit: S00-010.
 
 ## [S01: Предметные контракты](stages/S01.md)
 

planning/TASK_MATRIX.md

@@ -1,12 +1,12 @@
 # Матрица задач
 
-Generated; state revision **51**. Canonical status: state/tasks.json.
+Generated; state revision **53**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | done | auto-orchestrator-48aab142ecde |  | Утвердить Web-профиль |
 | [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | done | auto-orchestrator-68a05c587e33 | S00-001, S00-011, S00-012 | Выбрать framework и build runtime |
-| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | todo |  | S00-001, S00-002, S00-017, S00-018, S00-019 | Проверить XMPP WSS/auth библиотеку |
+| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | blocked | auto-protocol-59f4d359b339 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-020 | Проверить XMPP WSS/auth библиотеку |
 | [S00-004](tasks/S00-004.md) | S00 | crypto | security | todo |  | S00-001, S00-002 | Проверить browser OMEMO backend |
 | [S00-005](tasks/S00-005.md) | S00 | storage | qa | todo |  | S00-002 | Выбрать IndexedDB wrapper и migration policy |
 | [S00-006](tasks/S00-006.md) | S00 | orchestrator | security | todo |  | S00-002 | Зафиксировать browser/reference matrix |
@@ -22,6 +22,7 @@ Generated; state revision **51**. Canonical status: state/tasks.json.
 | [S00-017](tasks/S00-017.md) | S00 | protocol | security | done | auto-protocol-599343cd9e3f | S00-001, S00-002 | Establish fail-closed SCRAM server-final validation |
 | [S00-018](tasks/S00-018.md) | S00 | protocol | security | done | auto-protocol-89fe6563092c | S00-001, S00-002, S00-017 | Validate bounded standalone XML ingress for the XMPP candidate |
 | [S00-019](tasks/S00-019.md) | S00 | crypto | security | done | auto-crypto-c68801170fa4 | S00-001, S00-002, S00-017, S00-018 | Validate browser-compatible SCRAM-SHA-512 through a public mechanism API |
+| [S00-020](tasks/S00-020.md) | S00 | ci-cd | qa | blocked |  | S00-001, S00-002, S00-017, S00-018, S00-019 | Restore access to the pinned Linux XMPP experiment toolchain |
 | [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo |  | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
 | [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo |  | S00-010 | Описать identity/model contracts |
 | [S01-002](tasks/S01-002.md) | S01 | orchestrator | security | todo |  | S00-010, S01-001 | Описать async account context |

planning/TRACEABILITY.md

@@ -14,7 +14,7 @@ Allocated означает наличие плана/приёмки, а не р
 | ACC-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-003, S21-001 |
 | ACC-002 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-001, S21-001 |
 | ACC-003 | out_of_scope | Native host/port TCP configuration; Web uses ACC-004 WSS. |  |
-| ACC-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S00-018, S00-019, S05-001, S06-003, S21-001 |
+| ACC-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S00-018, S00-019, S00-020, S05-001, S06-003, S21-001 |
 | ACC-005 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-001, S06-011, S21-001 |
 | ACC-006 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-003, S06-004, S21-001 |
 | ACC-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S06-002, S06-009, S20-008, S21-001 |
@@ -27,8 +27,8 @@ Allocated означает наличие плана/приёмки, а не р
 | ACC-014 | web | Web requirement; cross-platform clauses apply only in Web context. | S01-002, S02-010, S06-006, S06-010, S21-001 |
 | NET-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S02-008, S05-001, S05-002, S05-009, S21-001 |
 | NET-002 | out_of_scope | Native transport discovery; Web WSS addressed by ACC-004/NET-001. |  |
-| NET-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S00-018, S00-019, S05-003, S21-001 |
-| NET-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S00-018, S00-019, S05-003, S05-009, S21-001 |
+| NET-003 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S00-018, S00-019, S00-020, S05-003, S21-001 |
+| NET-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-003, S00-017, S00-018, S00-019, S00-020, S05-003, S05-009, S21-001 |
 | NET-005 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-004, S21-001 |
 | NET-006 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-002, S05-010, S06-004, S20-002, S21-001 |
 | NET-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S05-007, S21-001 |

planning/stages/S00.md

@@ -8,7 +8,7 @@
 
 - [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; done.
 - [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; done.
-- [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; todo.
+- [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; blocked.
 - [S00-004](../tasks/S00-004.md): Проверить browser OMEMO backend — crypto; todo.
 - [S00-005](../tasks/S00-005.md): Выбрать IndexedDB wrapper и migration policy — storage; todo.
 - [S00-006](../tasks/S00-006.md): Зафиксировать browser/reference matrix — orchestrator; todo.
@@ -24,6 +24,7 @@
 - [S00-017](../tasks/S00-017.md): Establish fail-closed SCRAM server-final validation — protocol; done.
 - [S00-018](../tasks/S00-018.md): Validate bounded standalone XML ingress for the XMPP candidate — protocol; done.
 - [S00-019](../tasks/S00-019.md): Validate browser-compatible SCRAM-SHA-512 through a public mechanism API — crypto; done.
+- [S00-020](../tasks/S00-020.md): Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; blocked.
 - [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
 
 ## Граница этапа

planning/task_matrix.csv

@@ -1,7 +1,7 @@
 id,stage,operator,reviewer,status,owner,depends_on,title
 S00-001,S00,orchestrator,security,done,auto-orchestrator-48aab142ecde,,Утвердить Web-профиль
 S00-002,S00,orchestrator,security,done,auto-orchestrator-68a05c587e33,"S00-001, S00-011, S00-012",Выбрать framework и build runtime
-S00-003,S00,protocol,qa,todo,,"S00-001, S00-002, S00-017, S00-018, S00-019",Проверить XMPP WSS/auth библиотеку
+S00-003,S00,protocol,qa,blocked,auto-protocol-59f4d359b339,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-020",Проверить XMPP WSS/auth библиотеку
 S00-004,S00,crypto,security,todo,,"S00-001, S00-002",Проверить browser OMEMO backend
 S00-005,S00,storage,qa,todo,,S00-002,Выбрать IndexedDB wrapper и migration policy
 S00-006,S00,orchestrator,security,todo,,S00-002,Зафиксировать browser/reference matrix
@@ -17,6 +17,7 @@ S00-016,S00,ci-cd,qa,done,auto-ci-cd-351a0cbbabef,"S00-001, S00-011, S00-013, S0
 S00-017,S00,protocol,security,done,auto-protocol-599343cd9e3f,"S00-001, S00-002",Establish fail-closed SCRAM server-final validation
 S00-018,S00,protocol,security,done,auto-protocol-89fe6563092c,"S00-001, S00-002, S00-017",Validate bounded standalone XML ingress for the XMPP candidate
 S00-019,S00,crypto,security,done,auto-crypto-c68801170fa4,"S00-001, S00-002, S00-017, S00-018",Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
+S00-020,S00,ci-cd,qa,blocked,,"S00-001, S00-002, S00-017, S00-018, S00-019",Restore access to the pinned Linux XMPP experiment toolchain
 S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
 S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts
 S01-002,S01,orchestrator,security,todo,,"S00-010, S01-001",Описать async account context

planning/tasks.json

@@ -270,7 +270,8 @@
         "S00-002",
         "S00-017",
         "S00-018",
-        "S00-019"
+        "S00-019",
+        "S00-020"
       ],
       "requirements": [
         "ACC-004",
@@ -1115,6 +1116,63 @@
       ],
       "context_budget_chars": 48000
     },
+    {
+      "id": "S00-020",
+      "stage": "S00",
+      "kind": "blocker",
+      "root_task": "S00-003",
+      "blocker_depth": 1,
+      "unblocks": [
+        "S00-003"
+      ],
+      "role": "ci-cd",
+      "reviewer_role": "qa",
+      "title": "Restore access to the pinned Linux XMPP experiment toolchain",
+      "outcome": "One independently reviewed environment-access probe demonstrates authentic pinned Linux Node/npm and integrity-verified installation of the parent locked dependency graph without changing accepted stack or network security policy.",
+      "depends_on": [
+        "S00-001",
+        "S00-002",
+        "S00-017",
+        "S00-018",
+        "S00-019"
+      ],
+      "requirements": [
+        "ACC-004",
+        "NET-003",
+        "NET-004"
+      ],
+      "scope": [
+        "experiments/0002-xmpp-library/environment-access/**"
+      ],
+      "inputs": [
+        "docs/WEB_PROFILE.md",
+        "docs/ARCHITECTURE.md",
+        "docs/CONTRACTS.md",
+        "docs/TESTING.md",
+        "roles/protocol.md",
+        "docs/decisions/README.md",
+        "state/blockers/S00-020.md"
+      ],
+      "spec_sections": [],
+      "ui_sections": [],
+      "steps": [
+        "Read S00-003 blocker evidence and accepted stack pins.",
+        "Obtain external approved HTTPS connectivity or authentic locally supplied pinned Linux runtime and locked dependency artifacts.",
+        "Verify vendor checksum for runtime, exact node/npm versions, and lock integrity with a script confined to the remediation directory; install a copy of the parent manifest/lock only inside that directory.",
+        "Document reproducible approved artifact paths or connectivity and actual results; submit for independent review."
+      ],
+      "acceptance": [
+        "Node 24.21.0 and npm 11.19.0 execute on this Linux host with authenticated vendor checksum verification recorded.",
+        "Copied unchanged parent package-lock installs successfully with package integrity enforced and Stanza 12.22.1 available.",
+        "No stack/lock/spec changes, engine or TLS bypass, proxy policy bypass or secrets in evidence."
+      ],
+      "checks": [
+        "Exact runtime version and official checksum comparison.",
+        "Isolated npm ci of unchanged parent manifest/lock with lifecycle scripts disabled and TLS verification retained.",
+        "Independent review repeats access/runtime/lock checks."
+      ],
+      "context_budget_chars": 48000
+    },
     {
       "id": "S00-010",
       "stage": "S00",

planning/tasks/.S00-006.mdts7b6m14

@@ -0,0 +1,57 @@
+# S00-006: Зафиксировать browser/reference matrix
+
+> Generated from planning/tasks.json; status is in state/tasks.json.
+
+- Этап: S00
+- Оператор: orchestrator
+- Reviewer: security
+- Зависимости: S00-002
+- Требования: NFR-003, NFR-005
+
+## Один результат
+
+Паспорт содержит concrete browsers/devices и измеряемые startup/render/cache budgets с методикой проверки.
+
+## Разрешённые пути
+
+- `docs/decisions/0005-browser-matrix.md`
+- `experiments/0005-browser-matrix/**`
+
+Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
+
+## Прочитать
+
+- docs/WEB_PROFILE.md
+- docs/ARCHITECTURE.md
+- docs/CONTRACTS.md
+- docs/TESTING.md
+- roles/orchestrator.md
+- docs/decisions/README.md
+
+## Шаги
+
+1. Прочитать приведённые requirements, контракт через реестр и evidence прямых dependencies.
+2. До выбора стека: читать реальные первичные документы кандидатов, выполнить только разрешённый focused experiment, записать решение/ограничения. Не считать framework/backend уже принятым.
+3. Работать только над одним указанным outcome. Если для него нужен новый shared contract — создать отдельную remediation через escalate, заблокировать original и завершить запуск; не расширять текущий scope.
+4. Паспорт содержит concrete browsers/devices и измеряемые startup/render/cache budgets с методикой проверки.
+5. Добавить focused fixtures/checks из списка ниже, выполнить их и записать фактический результат.
+
+## Приёмка
+
+1. Паспорт содержит concrete browsers/devices и измеряемые startup/render/cache budgets с методикой проверки.
+2. Каждый target воспроизводим
+3. неподдержанный feature имеет fallback
+4. Нет изменений вне scope; реальный результат/evidence и handoff позволяют другому агенту продолжить.
+
+## Focused checks
+
+1. Каждый target воспроизводим
+2. неподдержанный feature имеет fallback
+
+## Блокер и завершение запуска
+
+Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
+
+## Передача
+
+Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.

planning/tasks/S00-003.md

@@ -5,7 +5,7 @@
 - Этап: S00
 - Оператор: protocol
 - Reviewer: qa
-- Зависимости: S00-001, S00-002, S00-017, S00-018, S00-019
+- Зависимости: S00-001, S00-002, S00-017, S00-018, S00-019, S00-020
 - Требования: ACC-004, NET-003, NET-004
 
 ## Один результат

planning/tasks/S00-020.md

@@ -0,0 +1,58 @@
+# S00-020: Restore access to the pinned Linux XMPP experiment toolchain
+
+- Remediation для: S00-003; root: S00-003; depth: 1
+
+> Generated from planning/tasks.json; status is in state/tasks.json.
+
+- Этап: S00
+- Оператор: ci-cd
+- Reviewer: qa
+- Зависимости: S00-001, S00-002, S00-017, S00-018, S00-019
+- Требования: ACC-004, NET-003, NET-004
+
+## Один результат
+
+One independently reviewed environment-access probe demonstrates authentic pinned Linux Node/npm and integrity-verified installation of the parent locked dependency graph without changing accepted stack or network security policy.
+
+## Разрешённые пути
+
+- `experiments/0002-xmpp-library/environment-access/**`
+
+Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
+
+## Прочитать
+
+- docs/WEB_PROFILE.md
+- docs/ARCHITECTURE.md
+- docs/CONTRACTS.md
+- docs/TESTING.md
+- roles/protocol.md
+- docs/decisions/README.md
+- state/blockers/S00-020.md
+
+## Шаги
+
+1. Read S00-003 blocker evidence and accepted stack pins.
+2. Obtain external approved HTTPS connectivity or authentic locally supplied pinned Linux runtime and locked dependency artifacts.
+3. Verify vendor checksum for runtime, exact node/npm versions, and lock integrity with a script confined to the remediation directory; install a copy of the parent manifest/lock only inside that directory.
+4. Document reproducible approved artifact paths or connectivity and actual results; submit for independent review.
+
+## Приёмка
+
+1. Node 24.21.0 and npm 11.19.0 execute on this Linux host with authenticated vendor checksum verification recorded.
+2. Copied unchanged parent package-lock installs successfully with package integrity enforced and Stanza 12.22.1 available.
+3. No stack/lock/spec changes, engine or TLS bypass, proxy policy bypass or secrets in evidence.
+
+## Focused checks
+
+1. Exact runtime version and official checksum comparison.
+2. Isolated npm ci of unchanged parent manifest/lock with lifecycle scripts disabled and TLS verification retained.
+3. Independent review repeats access/runtime/lock checks.
+
+## Блокер и завершение запуска
+
+Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
+
+## Передача
+
+Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.