S00-003: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-003 cannot reproduce accepted Node 24.21.0/npm 11.19.0 or install locked Stanza: host tools are 24.1.0/11.3.0, parent node_modules is absent, and normal official HTTPS retrieval fails with unresolved configured proxy.

Task: S00-003
Agent: auto-protocol-59f4d359b339
Role: protocol
Action: claim
Status: blocked

Task title: Проверить XMPP WSS/auth библиотеку

state/blockers/S00-020.md

@@ -0,0 +1,22 @@
+# Blocker S00-020
+
+- Original task: S00-003
+- Root task: S00-003
+- Reporter: auto-protocol-59f4d359b339
+- Role: protocol
+- Original owner: auto-protocol-59f4d359b339
+- Waits for user/external condition: True
+
+## Cause
+
+S00-003 cannot reproduce accepted Node 24.21.0/npm 11.19.0 or install locked Stanza: host tools are 24.1.0/11.3.0, parent node_modules is absent, and normal official HTTPS retrieval fails with unresolved configured proxy.
+
+## One remediation outcome
+
+One independently reviewed environment-access probe demonstrates authentic pinned Linux Node/npm and integrity-verified installation of the parent locked dependency graph without changing accepted stack or network security policy.
+
+## Evidence / reproduction
+
+node --version => v24.1.0; npm --version => 11.3.0; parent node_modules/stanza absent; curl official v24.21.0 SHASUMS256.txt => exit 5 Could not resolve proxy. Details: state/evidence/S00-003-auto-protocol-59f4d359b339.md
+
+The reporting agent must stop now. A new agent implements only S00-020.

state/evidence/S00-003-auto-protocol-59f4d359b339.md

@@ -0,0 +1,40 @@
+# S00-003 environment blocker evidence
+
+Agent: auto-protocol-59f4d359b339 (protocol), 2026-10-15.
+Input: assigned S00-003, startup/workflow/role documents, required TESTING and
+ADR registry, task card/context, previous handoff, accepted scope/stack/SASL/
+parser/SHA512 ADRs and direct dependency evidence/reviews. Exact ACC-004,
+NET-003 and NET-004 read from specs/tz_clear.md. Dependency suites were not rerun.
+Output remains one library-selection/WSS/auth/parser/extensions spike. Acceptance
+requires an actual test WSS handshake and no fabricated channel binding.
+
+## Actual commands/results
+
+- python3 scripts/tasks.py resume --agent auto-protocol-59f4d359b339: exit 0;
+  S00-003 assigned in_progress. No repeat claim.
+- python3 scripts/tasks.py show S00-003: exit 0; scope/dependencies confirmed.
+- node --version: exit 0, v24.1.0.
+- npm --version: exit 0, 11.3.0.
+- command -v chromium chromium-browser google-chrome firefox openssl:
+  found /usr/bin/chromium, /usr/bin/firefox, /usr/bin/openssl. Browser presence
+  is not a successful execution or handshake.
+- ls experiments/0002-xmpp-library/node_modules/stanza: exit 2, path absent.
+  (Combined diagnostic shell ended 0 because the subsequent issue-template
+  read succeeded; this ls failure is not reported as passed.)
+- curl --fail --silent --show-error --connect-timeout 10 --max-time 20
+  https://nodejs.org/dist/v24.21.0/SHASUMS256.txt
+  -o /tmp/luma-S00-003-SHASUMS256.txt: exit 5,
+  `curl: (5) Could not resolve proxy: proxy.micran.ru`.
+- git status --short: exit 0; only coordinator state/tasks.json claim initially.
+
+Accepted ADR 0001 and parent manifest/lock require Node 24.21.0/npm 11.19.0.
+The prior evidence used a macOS ARM64 runtime under /private/tmp; this Linux
+session has different tools and no installed parent Stanza. Normal configured
+HTTPS runtime retrieval fails before reaching the vendor. No network bypass,
+TLS/engine override, alternate versions or source workaround attempted.
+
+No source changes, npm install, build, test suite, browser execution, WSS
+handshake, extension roundtrip, library selection or make check was performed.
+No success or product readiness claimed. Existing accepted remediations remain
+unchanged. One external environment remediation is requested; reporter stops
+immediately after escalate and cannot implement it or continue another task.

state/handoffs/S00-003.md

@@ -1,32 +1,27 @@
 # S00-003 blocked handoff
 
-Executor: auto-protocol-dcdf92cd067e, protocol, 2026-10-15.
+Executor: auto-protocol-59f4d359b339, protocol, 2026-10-15.
 Outcome remains library selection with WSS/auth/parser/extension spike.
 
-Accepted prerequisites: S00-001 scope, S00-002 stack, S00-017 fail-closed SASL
-and S00-018 bounded parser ingress. Their ADRs/evidence were read; their suites
-were not rerun or changed. Parent Stanza candidate remains unselected, parent
-exploratory manifest/lock incomplete, selection ADR absent.
+Accepted prerequisites S00-001/002/017/018/019 were read. The SHA-512 public
+mechanism composition is now independently accepted; the earlier crypto blocker
+is resolved. Their suites were not rerun in this environment. Parent candidate
+remains unselected and selection ADR absent.
 
-Blocker newly reproduced in pinned Stanza 12.22.1 browser crypto:
-createHmac('sha-512', RFC 4231 section 4.2 key/data) returns a different digest
-than the fixed primary-spec vector and Node native crypto. sha512 alias and
-sha-256/sha-1 controls match. Browser Hmac tests only alg === 'sha512' for its
-128-byte block size, while SCRAM-SHA-512 derives 'sha-512'; that SCRAM field
-is private in declarations. Direct browser module execution in Node is a
-backend diagnostic, not actual browser/WSS execution. Exact reproduction and
-digests: state/evidence/S00-003-auto-protocol-dcdf92cd067e.md.
+Current blocker: accepted Node 24.21.0/npm 11.19.0 and installed Stanza are not
+available in this Linux session (host tools 24.1.0/11.3.0; parent node_modules
+absent). Official checksum retrieval over configured HTTPS fails with curl exit
+5, unresolved proxy. See state/evidence/S00-003-auto-protocol-59f4d359b339.md for exact reproduction.
 
-Source edits stopped; none were made. Do not patch ignored vendor code/private
-fields, implement primitives, change wire name, claim successful SHA-512 from
-Node-only crypto or silently downgrade to avoid the defect. One fresh crypto
-resolver must produce an isolated browser-compatible SCRAM-SHA-512 integration
-using vetted existing crypto and supported public mechanism extension APIs,
-with known vectors, full proof/server-final and negative tests. Independent
-security review must accept that outcome before coordinator resumes original.
+Next input: external environment owner must restore approved HTTPS access to
+nodejs.org and registry.npmjs.org or provide authentic, checksum/integrity-
+verifiable pinned Linux toolchain and locked package artifacts through an
+approved local path. Do not change stack pins, bypass proxy policy/TLS, fabricate
+engine metadata or reuse a macOS binary. Fresh remediation executor must verify
+exact runtime and lock installation, with independent review before parent
+returns to a new executor. Supply no credentials in committed evidence.
 
-No WSS handshake, browser build/runtime, complete mechanism policy, extension
-roundtrip, selection or independent interoperability has been completed in this
-session. No clean install/make check claimed. No shared/spec/accepted dependency
-changes. Reporter exits immediately after escalate and cannot implement resolver,
-unblock/reclaim or launch another process.
+No source changes or installs/build/tests/browser/WSS execution occurred. Browser
+binaries are present but not exercised. No make check, complete SASL policy,
+extension roundtrip, independent interoperability or selection claimed.
+Reporter exits after escalation; no resolver work, unblock or new agent launch.

state/issues/S00-003-auto-protocol-59f4d359b339.json

@@ -0,0 +1,29 @@
+{
+  "title": "Restore access to the pinned Linux XMPP experiment toolchain",
+  "reason": "S00-003 cannot reproduce accepted Node 24.21.0/npm 11.19.0 or install locked Stanza: host tools are 24.1.0/11.3.0, parent node_modules is absent, and normal official HTTPS retrieval fails with unresolved configured proxy.",
+  "reproduction": "node --version => v24.1.0; npm --version => 11.3.0; parent node_modules/stanza absent; curl official v24.21.0 SHASUMS256.txt => exit 5 Could not resolve proxy. Details: state/evidence/S00-003-auto-protocol-59f4d359b339.md",
+  "role": "ci-cd",
+  "reviewer_role": "qa",
+  "scope": [
+    "experiments/0002-xmpp-library/environment-access/**"
+  ],
+  "outcome": "One independently reviewed environment-access probe demonstrates authentic pinned Linux Node/npm and integrity-verified installation of the parent locked dependency graph without changing accepted stack or network security policy.",
+  "steps": [
+    "Read S00-003 blocker evidence and accepted stack pins.",
+    "Obtain external approved HTTPS connectivity or authentic locally supplied pinned Linux runtime and locked dependency artifacts.",
+    "Verify vendor checksum for runtime, exact node/npm versions, and lock integrity with a script confined to the remediation directory; install a copy of the parent manifest/lock only inside that directory.",
+    "Document reproducible approved artifact paths or connectivity and actual results; submit for independent review."
+  ],
+  "acceptance": [
+    "Node 24.21.0 and npm 11.19.0 execute on this Linux host with authenticated vendor checksum verification recorded.",
+    "Copied unchanged parent package-lock installs successfully with package integrity enforced and Stanza 12.22.1 available.",
+    "No stack/lock/spec changes, engine or TLS bypass, proxy policy bypass or secrets in evidence."
+  ],
+  "checks": [
+    "Exact runtime version and official checksum comparison.",
+    "Isolated npm ci of unchanged parent manifest/lock with lifecycle scripts disabled and TLS verification retained.",
+    "Independent review repeats access/runtime/lock checks."
+  ],
+  "depends_on": [],
+  "requires_user_input": true
+}

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 51,
+  "revision": 53,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -32,14 +32,16 @@
       "completed_at": "2026-10-14T19:06:23+00:00"
     },
     "S00-003": {
-      "status": "todo",
-      "owner": null,
-      "started_at": "2026-10-14T19:35:56+00:00",
-      "reason": null,
-      "updated_at": "2026-10-14T19:52:28+00:00",
-      "blocked_by": [],
+      "status": "blocked",
+      "owner": "auto-protocol-59f4d359b339",
+      "started_at": "2026-10-15T04:12:38+00:00",
+      "reason": "S00-003 cannot reproduce accepted Node 24.21.0/npm 11.19.0 or install locked Stanza: host tools are 24.1.0/11.3.0, parent node_modules is absent, and normal official HTTPS retrieval fails with unresolved configured proxy.",
+      "updated_at": "2026-10-15T04:14:07+00:00",
+      "blocked_by": [
+        "S00-020"
+      ],
       "resume_status": "in_progress",
-      "blocker_report": "state/blockers/S00-019.md",
+      "blocker_report": "state/blockers/S00-020.md",
       "handoff": "state/handoffs/S00-003.md",
       "previous_owner": "auto-protocol-dcdf92cd067e",
       "resumed_after_blocker": true
@@ -1258,6 +1260,12 @@
       "reviewer": "auto-security-f465a677e48f",
       "review_evidence": "state/evidence/S00-019-review.md",
       "completed_at": "2026-10-14T19:52:28+00:00"
+    },
+    "S00-020": {
+      "status": "blocked",
+      "owner": null,
+      "external_wait": true,
+      "reason": "S00-003 cannot reproduce accepted Node 24.21.0/npm 11.19.0 or install locked Stanza: host tools are 24.1.0/11.3.0, parent node_modules is absent, and normal official HTTPS retrieval fails with unresolved configured proxy."
     }
   },
   "events": [
@@ -1927,6 +1935,29 @@
       "to": "done",
       "reason": null,
       "evidence": "state/evidence/S00-019-review.md"
+    },
+    {
+      "revision": 52,
+      "at": "2026-10-15T04:12:38+00:00",
+      "action": "claim",
+      "task": "S00-003",
+      "agent": "auto-protocol-59f4d359b339",
+      "role": "protocol",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 53,
+      "at": "2026-10-15T04:14:07+00:00",
+      "action": "escalate",
+      "task": "S00-003",
+      "resolution_task": "S00-020",
+      "agent": "auto-protocol-59f4d359b339",
+      "role": "protocol",
+      "from": "in_progress",
+      "to": "blocked",
+      "reason": "S00-003 cannot reproduce accepted Node 24.21.0/npm 11.19.0 or install locked Stanza: host tools are 24.1.0/11.3.0, parent node_modules is absent, and normal official HTTPS retrieval fails with unresolved configured proxy."
     }
   ],
   "retired_agents": [
@@ -1938,6 +1969,7 @@
     "auto-ci-cd-5475930af078",
     "auto-protocol-826aa6bc12ef",
     "auto-protocol-902594b44429",
-    "auto-protocol-dcdf92cd067e"
+    "auto-protocol-dcdf92cd067e",
+    "auto-protocol-59f4d359b339"
   ]
 }