S00-002: Propose a pinned React stack with a reproducible rendering spike

Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review.
Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed.

Task: S00-002
Agent: auto-orchestrator-68a05c587e33
Role: orchestrator
Action: claim
Status: review

Task title: Выбрать framework и build runtime

state/commit_messages/auto-orchestrator-68a05c587e33.txt

@@ -0,0 +1,4 @@
+Propose a pinned React stack with a reproducible rendering spike
+
+Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review.
+Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed.

state/evidence/S00-002-auto-orchestrator-68a05c587e33.md

@@ -0,0 +1,60 @@
+# S00-002 executor evidence
+
+Agent: auto-orchestrator-68a05c587e33 (orchestrator). Date: 2026-10-15.
+Result: proposed stack ADR and one rendering spike, awaiting independent security review.
+
+## Actual changes and scope
+
+- docs/decisions/0001-stack.md compares React/TypeScript/Vite and Vue/TypeScript/Vite, proposes exact selected pins, records sources, licenses, browser/runtime constraints and verification limits.
+- experiments/0001-stack: exact manifest/lockfile, runtime/engine/TLS pins, strict TSX counter, Vite target, build guard, reproduction instructions, locked license inventory and browser-runtime notices.
+- Existing reviewed registry-access/ probe unchanged. Application modules, shared contracts, immutable specifications, plan definitions and system/Git configuration unchanged. Initial git status showed only coordinator claim change in state/tasks.json.
+- No secrets, real accounts/conversations or production transports. No encryption/CORS/certificate workaround. Source scope is only the two card paths; evidence/handoff/commit message are workflow metadata.
+
+Read master prompt, role and workflow documents; assigned resume/show/packet; previous blocker handoff; exact NFR-007; accepted ADR 0000 and S00-001/S00-011 executor/review evidence and handoffs. S01 schemas are not yet accepted and this spike requires no new shared interface.
+
+## Commands and actual results
+
+All npm install/build commands below ran from experiments/0001-stack with:
+`PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH`.
+This uses the downloaded isolated LTS runtime, not the system Node 26.
+
+| Command/check | Exit | Actual result |
+| --- | --- | --- |
+| `python3 scripts/tasks.py resume --agent auto-orchestrator-68a05c587e33` | 0 | S00-002 assigned in_progress; no repeat claim. |
+| `python3 scripts/tasks.py show S00-002` and `packet S00-002 --agent auto-orchestrator-68a05c587e33` | 0 each | Correct scope/requirements and reviewed prerequisites read. |
+| Python subprocess batch of `npm view <package> version license engines peerDependencies --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000 --registry=https://registry.npmjs.org/ --strict-ssl=true` | 0, all children 0 | React/React DOM 19.3.1 MIT; Vue 3.5.44 MIT; Vite 8.3.4 MIT; TypeScript 7.0.2 Apache-2.0; both React types 19.3.0 MIT; available Node 24 releases and npm 12.2.0 inspected. Latest npm was not selected. |
+| `npm view npm@11.19.0 version license engines --json --cache /private/tmp/luma-stack-npm-cache --strict-ssl=true` | 0 | Bundled npm verified: 11.19.0, Artistic-2.0, node ^20.17.0 or >=22.9.0. |
+| Same metadata batch for `@vitejs/plugin-vue`, `vue-tsc` | 0, both children 0 | 6.0.10 / 3.3.13, MIT; plugin peer ranges permit candidate Vue/Vite. Candidate not installed/built. |
+| Python urllib download and hashlib SHA256 verification of official Node v24.21.0 darwin-arm64 archive / checked-path extraction under /private/tmp | 0 on final extraction | HTTPS download matched vendor SHASUMS256.txt; exact node/npm commands returned v24.21.0 / 11.19.0. See setup attempts below. |
+| `npm install --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000` | 0 | Initial manifest resolution/lockfile creation, 24 installed packages. |
+| `npm run build` | 0 | Runtime guard + strict tsc --noEmit + Vite 8.3.4; 14 modules, HTML 0.29 kB, JS 219.87 kB / gzip 68.75 kB. |
+| `npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-clean-cache-68a05c587e33 --fetch-retries=0 --fetch-timeout=15000` | 0 | Actual clean install with newly created empty cache, 24 packages; lifecycle scripts disabled. |
+| `npm run build` after npm ci | 0 | Same strict check/build and same output sizes. |
+| Python hashlib comparison of lockfile and both emitted files against first-build digests | 0 | Lock and both artifacts unchanged after clean install/rebuild. |
+| Python JSON inspection of lock graph | 0 | All 67 locked package entries have HTTPS public-registry URL, SHA512 integrity and license; includes optional uninstalled platforms. |
+| Python subprocess wrapper: `npm run preview -- --port 4173 --strictPort`, urllib HTML/JS fetch and digest assertion | 0 wrapper | Both HTTP 200; served JS byte-matches build artifact. Preview process group terminated in finally. No DOM/JavaScript execution claimed. |
+| `make check` | 0 | 276 tasks, 22 stages, 221 requirements, 211 Web requirements, revision 10; 66 tooling tests passed in 10.205s. Foundation integrity only. |
+| `git diff --check`, `git status --short --untracked-files=all` | 0 each | No tracked whitespace errors; only scoped source files plus claim/workflow metadata. Authored untracked contents separately inspected. |
+
+Setup attempts, not successful checks: the first Python extraction attempt failed (exit 1) because this host Python's tarfile does not support the `filter` keyword. The download/checksum had already succeeded. A second path guard rejected normal relative symlinks (exit 1) before extracting anything. Final extraction resolved each member/symlink/hardlink target, required containment in the task temporary root, and succeeded (exit 0). No system install or permission changes. An exploratory `rg --files ... .agents .codex` returned exit 2 for absent optional directories; no task context was missing.
+
+## Digests
+
+Official Node archive SHA256:
+`bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057`.
+Downloaded from https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-arm64.tar.gz
+and compared with the official same-origin SHASUMS256.txt. No detached signature verification claimed.
+
+- package-lock.json: `7b2dee5e231629c30501194fa40346ba9f0752cea32a4eb9d91e8f5d4b5ab47f`
+- dist/index.html: `67962911c9b0bcb45d6a13f9d0e5877cfa0164c09d2e2128407db84889026a73`
+- dist/assets/index-PZnFDfAT.js: `3cbf3f9adf300aeb52b465fe9e78530103fa5b23fb22e6beae768faa3a8b0f04`
+
+Artifacts/node_modules remain ignored. Local same-host hashes do not prove cross-platform reproducibility.
+
+## Sources and limitations
+
+Primary pages opened through web tool: React from-scratch/createRoot; Vue quick-start/FAQ/TypeScript overview; TypeScript JSX; Vite getting-started/production; Node release lifecycle; npm ci. Exact links and inspection date are in ADR. Version/license/engine/peer fields obtained through real npm registry queries; installed package LICENSE texts inspected for runtime notices. Optional platforms are inventory-only. Web tool could not fetch versioned GitHub license pages or Node checksum URL; actual HTTPS Node checksum retrieval and local package license inspection supplied those facts instead.
+
+Browser external check: `cua.createBrowserTab('iab', 'about:blank', {visible:false})` returned Browser is not available; `cua.listBrowsers()` returned []. DOM mounting/counter clicks/visual layout have not been verified and are explicitly left as an external check. Card mandatory checks are clean install/build and recorded licenses/constraints, both completed. No browser product matrix, real encrypted/protocol/media/provider interoperability, production hosting, vulnerability audit, package provenance or release readiness is claimed. npm audit was disabled for the bounded install; this is not a security clearance.
+
+ADR remains proposed. Separate security reviewer should reproduce exact clean install/build, inspect stack justification, licenses, pin/lock/runtime guards and scope, then record acceptance or rejection via CLI. Coordinator alone commits and launches the next fresh process.

state/handoffs/S00-002.md

@@ -1,10 +1,10 @@
-# S00-002 blocker handoff
+# S00-002 handoff for independent security review
 
-Executor: auto-orchestrator-3a4f07103316, orchestrator.
-Outcome reached: required instructions, task packet, NFR-007, accepted ADR 0000 and S00-001 evidence/review read. React/Vite and Vue/Vite primary documentation opened for comparison; no selection made. No source changes, stack ADR, package.json or lockfile authored.
+Executor: auto-orchestrator-68a05c587e33 (orchestrator), 2026-10-15.
+Outcome: proposed ADR 0001 compares React and Vue, selects exact React/TypeScript/Vite pins and Node 24.21.0 LTS / bundled npm 11.19.0. One isolated TSX rendering spike, lockfile, runtime/TLS guards, license inventory and runtime notices created in experiments/0001-stack. Registry-access probe retained unchanged. No blocker; prior registry failure did not recur.
 
-Blocker: local npm metadata lookup fails with `getaddrinfo ENOTFOUND registry.npmjs.org`; cannot verify package versions/licenses or perform required clean install/build. Reproduce with `npm view react version license engines --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000` (actual exit 1). Node v26.3.0 and npm 11.16.0 observed; not accepted runtime choices. Evidence: state/evidence/S00-002-auto-orchestrator-3a4f07103316.md.
+Actual checks: clean npm ci with fresh empty cache, strict TypeScript/Vite build before/after ci, identical local artifact/lock SHA256, HTTP preview HTML and byte-matching JS, make check (66 tests) all exit 0. Full commands, pins, digests, setup failures and limits: state/evidence/S00-002-auto-orchestrator-68a05c587e33.md.
 
-One external remediation requests an execution environment with working DNS/HTTPS to the public npm registry and package tarballs. Keep TLS validation and project write sandbox. No credentials or secret values requested. Resolver must verify metadata and one integrity-checked tarball retrieval, document the safe runner configuration/action, and obtain independent review. Resolver must not choose stack or implement rendering; those remain S00-002.
+Next step belongs only to separate assigned security reviewer. Read ADR/card/evidence and executor commit/message. From experiments/0001-stack with Node 24.21.0 / npm 11.19.0, run the README's clean npm ci and npm run build. Existing verified macOS ARM64 runtime is at /private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64, or retrieve the official exact runtime with verified HTTPS/checksum. Inspect exact manifest/lock pins, licenses including build-only MPL-2.0, runtime notices, no production transport/secrets and no source changes outside card scope. Record acceptance and reviewer metadata in ADR only if warranted, then approve/reject through tasks.py.
 
-After reviewed remediation, coordinator launches a fresh S00-002 executor. Continue candidate comparison from primary sources, choose and pin supported runtime/tool versions, create one minimal rendering spike only within experiments/0001-stack, perform actual clean install/build and record license/browser limits in docs/decisions/0001-stack.md. Current reporter exits after escalate and must not resume or resolve remediation.
+DOM rendering/counter interaction is an external check: no browser is exposed by this harness. README gives manual steps; do not label them passed. Current compiler floors are not the product browser matrix. Vue was not built or benchmarked. Crypto/XMPP compatibility, full app CI, notices for future libraries, other build-host platforms, provider integration and release readiness remain subsequent cards. Shared contracts/specs/plan definitions unchanged. ADR remains proposed; executor does not set done or perform Git mutations. Coordinator commits this submission and launches the reviewer.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 9,
+  "revision": 11,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -15,17 +15,18 @@
       "completed_at": "2026-10-14T18:03:56+00:00"
     },
     "S00-002": {
-      "status": "todo",
-      "owner": null,
-      "started_at": "2026-10-14T18:03:56+00:00",
+      "status": "review",
+      "owner": "auto-orchestrator-68a05c587e33",
+      "started_at": "2026-10-14T18:11:33+00:00",
       "reason": null,
-      "updated_at": "2026-10-14T18:11:33+00:00",
+      "updated_at": "2026-10-14T18:18:53+00:00",
       "blocked_by": [],
       "resume_status": "in_progress",
       "blocker_report": "state/blockers/S00-011.md",
       "handoff": "state/handoffs/S00-002.md",
       "previous_owner": "auto-orchestrator-3a4f07103316",
-      "resumed_after_blocker": true
+      "resumed_after_blocker": true,
+      "evidence": "state/evidence/S00-002-auto-orchestrator-68a05c587e33.md"
     },
     "S00-003": {
       "status": "todo",
@@ -1243,6 +1244,29 @@
       "to": "done",
       "reason": null,
       "evidence": "state/evidence/S00-011-review.md"
+    },
+    {
+      "revision": 10,
+      "at": "2026-10-14T18:11:33+00:00",
+      "action": "claim",
+      "task": "S00-002",
+      "agent": "auto-orchestrator-68a05c587e33",
+      "role": "orchestrator",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 11,
+      "at": "2026-10-14T18:18:53+00:00",
+      "action": "submit",
+      "task": "S00-002",
+      "agent": "auto-orchestrator-68a05c587e33",
+      "role": null,
+      "from": "in_progress",
+      "to": "review",
+      "reason": null,
+      "evidence": "state/evidence/S00-002-auto-orchestrator-68a05c587e33.md"
     }
   ],
   "retired_agents": [