wt/LumaWeb
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

S00-002: Propose a pinned React stack with a reproducible rendering spike

Browse Source 
Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review.
Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed.

Task: S00-002
Agent: auto-orchestrator-68a05c587e33
Role: orchestrator
Action: claim
Status: review

Task title: Выбрать framework и build runtime
This commit is contained in:
wt committed 2026-10-15 01:18:53 +07:00
1 parent 06f353b214
commit 59b9ff62fe
21 files changed
+1729 -16
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

experiments/0001-stack/.gitignore
+2
View File
@@ -0,0 +1,2 @@
node_modules/
dist/
experiments/0001-stack/.npmrc
+4
View File
@@ -0,0 +1,4 @@
engine-strict=true
save-exact=true
registry=https://registry.npmjs.org/
strict-ssl=true
experiments/0001-stack/.nvmrc
+1
View File
@@ -0,0 +1 @@
24.21.0
experiments/0001-stack/LICENSE_INVENTORY.md
+73
View File
@@ -0,0 +1,73 @@
# Locked dependency license inventory
Registry/package metadata inspected on 2026-10-15. Exact versions and integrity are in package-lock.json. Optional platform packages are included here even when not installed on macOS ARM64.
| Package | Version | SPDX license |
| --- | --- | --- |
| @oxc-project/types | 0.154.0 | MIT |
| @rolldown/binding-android-arm-eabi | 1.2.14 | MIT |
| @rolldown/binding-android-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-arm64 | 1.2.14 | MIT |
| @rolldown/binding-darwin-x64 | 1.2.14 | MIT |
| @rolldown/binding-freebsd-x64 | 1.2.14 | MIT |
| @rolldown/binding-linux-arm-gnueabihf | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-arm64-musl | 1.2.14 | MIT |
| @rolldown/binding-linux-ppc64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-s390x-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-gnu | 1.2.14 | MIT |
| @rolldown/binding-linux-x64-musl | 1.2.14 | MIT |
| @rolldown/binding-openharmony-arm64 | 1.2.14 | MIT |
| @rolldown/binding-win32-arm64-msvc | 1.2.14 | MIT |
| @rolldown/binding-win32-x64-msvc | 1.2.14 | MIT |
| @rolldown/pluginutils | 1.0.1 | MIT |
| @types/react | 19.3.0 | MIT |
| @types/react-dom | 19.3.0 | MIT |
| @typescript/typescript-aix-ppc64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-darwin-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-darwin-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-freebsd-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-freebsd-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-arm | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-loong64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-mips64el | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-ppc64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-riscv64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-s390x | 7.0.2 | Apache-2.0 |
| @typescript/typescript-linux-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-netbsd-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-netbsd-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-openbsd-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-openbsd-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-sunos-x64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-win32-arm64 | 7.0.2 | Apache-2.0 |
| @typescript/typescript-win32-x64 | 7.0.2 | Apache-2.0 |
| csstype | 3.2.3 | MIT |
| detect-libc | 2.1.2 | Apache-2.0 |
| fdir | 6.5.0 | MIT |
| fsevents | 2.3.3 | MIT |
| lightningcss | 1.33.0 | MPL-2.0 |
| lightningcss-android-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-arm64 | 1.33.0 | MPL-2.0 |
| lightningcss-darwin-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-freebsd-x64 | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm-gnueabihf | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-arm64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-gnu | 1.33.0 | MPL-2.0 |
| lightningcss-linux-x64-musl | 1.33.0 | MPL-2.0 |
| lightningcss-win32-arm64-msvc | 1.33.0 | MPL-2.0 |
| lightningcss-win32-x64-msvc | 1.33.0 | MPL-2.0 |
| nanoid | 3.3.20 | MIT |
| picocolors | 1.1.1 | ISC |
| picomatch | 4.0.7 | MIT |
| postcss | 8.5.30 | MIT |
| react | 19.3.1 | MIT |
| react-dom | 19.3.1 | MIT |
| rolldown | 1.2.14 | MIT |
| scheduler | 0.28.0 | MIT |
| source-map-js | 1.2.2 | BSD-3-Clause |
| tinyglobby | 0.2.17 | MIT |
| typescript | 7.0.2 | Apache-2.0 |
| vite | 8.3.4 | MIT |
experiments/0001-stack/README.md
+45
View File
@@ -0,0 +1,45 @@
# S00-002 rendering spike
One local React/TypeScript/Vite experiment for ADR 0001. The registry-access/
subdirectory belongs to the reviewed S00-011 probe and is retained unchanged.
No account, network messaging, crypto, media, service worker or application
scaffold is implemented here.
## Reproduce
Use Node **24.21.0** with bundled npm **11.19.0**. `.nvmrc` is a pin for an
existing version manager; installing the spike never changes system runtimes.
Official binaries: https://nodejs.org/dist/v24.21.0/ — verify the selected archive
against SHASUMS256.txt with normal TLS trust. On this executor, the verified
macOS ARM64 runtime was unpacked at
`/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64`.
From this directory with the pinned runtime's bin directory first on PATH:
```sh
node --version
npm --version
npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-review-cache --fetch-retries=0 --fetch-timeout=15000
npm run build
npm run preview -- --port 4173 --strictPort
```
Use a new cache path for a network/clean-cache check. npm ci itself removes old
node_modules and fails on lock/manifest mismatch. Keep optional platform packages
enabled; TypeScript/Vite use platform binaries and build succeeds without
lifecycle scripts. TLS verification and exact engine checks remain enabled.
The private package is not published. npm install is only for explicitly reviewed
lockfile updates, not normal reproduction.
Open `http://127.0.0.1:4173` locally: expect “Luma rendering spike” and “Count: 0”.
Click Increment twice: expect Count: 2. This is the manual DOM/interaction check;
it was **not run** because this harness exposes no browsers. Build/typechecking
were run successfully. Stop the server with Ctrl-C. `npm run dev` is available
for source development; no React refresh plugin is installed.
Build output/node_modules are ignored. The browser bundle is static and requires
no Node server. Explicit compiler floors: Chrome/Edge 111, Firefox 114, Safari
16.4, with no API polyfills; the product browser matrix is a later decision.
Preserve THIRD_PARTY_NOTICES.md when distributing this bundle; full lock graph
licenses are in LICENSE_INVENTORY.md. CI, release notice automation, app tests
and cryptographic/protocol compatibility remain subsequent tasks.
experiments/0001-stack/THIRD_PARTY_NOTICES.md
+78
View File
@@ -0,0 +1,78 @@
# Third-party notices for the rendering bundle
The browser bundle contains React, React DOM and Scheduler. Build-tool licenses are listed in LICENSE_INVENTORY.md; installed packages retain their license files. No build tool is shipped as a browser runtime. Preserve these notices when distributing this spike.
## react 19.3.1
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## react-dom 19.3.1
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
## scheduler 0.28.0
MIT License
Copyright (c) Meta Platforms, Inc. and affiliates.
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
experiments/0001-stack/index.html
+5
View File
@@ -0,0 +1,5 @@
<!doctype html>
<html lang="en">
<head><meta charset="UTF-8"><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Luma stack spike</title></head>
<body><div id="root"></div><script type="module" src="/src/main.tsx"></script></body>
</html>
experiments/0001-stack/package-lock.json
Generated
+1268
View File
File diff suppressed because it is too large. Load diff
experiments/0001-stack/package.json
+26
View File
@@ -0,0 +1,26 @@
{
"name": "luma-stack-rendering-spike",
"version": "0.0.0",
"private": true,
"type": "module",
"engines": {
"node": "24.21.0",
"npm": "11.19.0"
},
"packageManager": "npm@11.19.0",
"scripts": {
"build": "node tools/check-runtime.mjs && tsc --noEmit && vite build",
"dev": "vite --host 127.0.0.1",
"preview": "vite preview --host 127.0.0.1"
},
"dependencies": {
"react": "19.3.1",
"react-dom": "19.3.1"
},
"devDependencies": {
"@types/react": "19.3.0",
"@types/react-dom": "19.3.0",
"typescript": "7.0.2",
"vite": "8.3.4"
}
}
experiments/0001-stack/src/main.tsx
+20
View File
@@ -0,0 +1,20 @@
import { useState } from 'react';
import { createRoot } from 'react-dom/client';
function RenderingSpike() {
const [count, setCount] = useState(0);
return (
<main>
<h1>Luma rendering spike</h1>
<p>Local UI experiment; no account or transport.</p>
<button type="button" onClick={() => setCount(value => value + 1)}>
Increment
</button>
<output aria-live="polite">Count: {count}</output>
</main>
);
}
const root = document.getElementById('root');
if (!root) throw new Error('Missing rendering root');
createRoot(root).render(<RenderingSpike />);
experiments/0001-stack/tools/check-runtime.mjs
+6
View File
@@ -0,0 +1,6 @@
if (process.versions.node !== '24.21.0') {
throw new Error(`Expected Node 24.21.0, got ${process.versions.node}`);
}
if (!process.env.npm_config_user_agent?.startsWith('npm/11.19.0 ')) {
throw new Error('Run build with npm 11.19.0');
}
experiments/0001-stack/tsconfig.json
+19
View File
@@ -0,0 +1,19 @@
{
"compilerOptions": {
"target": "ES2022",
"lib": [
"ES2022",
"DOM",
"DOM.Iterable"
],
"module": "ESNext",
"moduleResolution": "Bundler",
"jsx": "react-jsx",
"strict": true,
"noEmit": true,
"skipLibCheck": false
},
"include": [
"src"
]
}
experiments/0001-stack/vite.config.js
+1
View File
@@ -0,0 +1 @@
export default { build: { target: ['chrome111', 'edge111', 'firefox114', 'safari16.4'] } };