S00-002: Propose a pinned React stack with a reproducible rendering spike

Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review.
Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed.

Task: S00-002
Agent: auto-orchestrator-68a05c587e33
Role: orchestrator
Action: claim
Status: review

Task title: Выбрать framework и build runtime

state/evidence/S00-002-auto-orchestrator-68a05c587e33.md

@@ -0,0 +1,60 @@
+# S00-002 executor evidence
+
+Agent: auto-orchestrator-68a05c587e33 (orchestrator). Date: 2026-10-15.
+Result: proposed stack ADR and one rendering spike, awaiting independent security review.
+
+## Actual changes and scope
+
+- docs/decisions/0001-stack.md compares React/TypeScript/Vite and Vue/TypeScript/Vite, proposes exact selected pins, records sources, licenses, browser/runtime constraints and verification limits.
+- experiments/0001-stack: exact manifest/lockfile, runtime/engine/TLS pins, strict TSX counter, Vite target, build guard, reproduction instructions, locked license inventory and browser-runtime notices.
+- Existing reviewed registry-access/ probe unchanged. Application modules, shared contracts, immutable specifications, plan definitions and system/Git configuration unchanged. Initial git status showed only coordinator claim change in state/tasks.json.
+- No secrets, real accounts/conversations or production transports. No encryption/CORS/certificate workaround. Source scope is only the two card paths; evidence/handoff/commit message are workflow metadata.
+
+Read master prompt, role and workflow documents; assigned resume/show/packet; previous blocker handoff; exact NFR-007; accepted ADR 0000 and S00-001/S00-011 executor/review evidence and handoffs. S01 schemas are not yet accepted and this spike requires no new shared interface.
+
+## Commands and actual results
+
+All npm install/build commands below ran from experiments/0001-stack with:
+`PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH`.
+This uses the downloaded isolated LTS runtime, not the system Node 26.
+
+| Command/check | Exit | Actual result |
+| --- | --- | --- |
+| `python3 scripts/tasks.py resume --agent auto-orchestrator-68a05c587e33` | 0 | S00-002 assigned in_progress; no repeat claim. |
+| `python3 scripts/tasks.py show S00-002` and `packet S00-002 --agent auto-orchestrator-68a05c587e33` | 0 each | Correct scope/requirements and reviewed prerequisites read. |
+| Python subprocess batch of `npm view <package> version license engines peerDependencies --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000 --registry=https://registry.npmjs.org/ --strict-ssl=true` | 0, all children 0 | React/React DOM 19.3.1 MIT; Vue 3.5.44 MIT; Vite 8.3.4 MIT; TypeScript 7.0.2 Apache-2.0; both React types 19.3.0 MIT; available Node 24 releases and npm 12.2.0 inspected. Latest npm was not selected. |
+| `npm view npm@11.19.0 version license engines --json --cache /private/tmp/luma-stack-npm-cache --strict-ssl=true` | 0 | Bundled npm verified: 11.19.0, Artistic-2.0, node ^20.17.0 or >=22.9.0. |
+| Same metadata batch for `@vitejs/plugin-vue`, `vue-tsc` | 0, both children 0 | 6.0.10 / 3.3.13, MIT; plugin peer ranges permit candidate Vue/Vite. Candidate not installed/built. |
+| Python urllib download and hashlib SHA256 verification of official Node v24.21.0 darwin-arm64 archive / checked-path extraction under /private/tmp | 0 on final extraction | HTTPS download matched vendor SHASUMS256.txt; exact node/npm commands returned v24.21.0 / 11.19.0. See setup attempts below. |
+| `npm install --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000` | 0 | Initial manifest resolution/lockfile creation, 24 installed packages. |
+| `npm run build` | 0 | Runtime guard + strict tsc --noEmit + Vite 8.3.4; 14 modules, HTML 0.29 kB, JS 219.87 kB / gzip 68.75 kB. |
+| `npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-clean-cache-68a05c587e33 --fetch-retries=0 --fetch-timeout=15000` | 0 | Actual clean install with newly created empty cache, 24 packages; lifecycle scripts disabled. |
+| `npm run build` after npm ci | 0 | Same strict check/build and same output sizes. |
+| Python hashlib comparison of lockfile and both emitted files against first-build digests | 0 | Lock and both artifacts unchanged after clean install/rebuild. |
+| Python JSON inspection of lock graph | 0 | All 67 locked package entries have HTTPS public-registry URL, SHA512 integrity and license; includes optional uninstalled platforms. |
+| Python subprocess wrapper: `npm run preview -- --port 4173 --strictPort`, urllib HTML/JS fetch and digest assertion | 0 wrapper | Both HTTP 200; served JS byte-matches build artifact. Preview process group terminated in finally. No DOM/JavaScript execution claimed. |
+| `make check` | 0 | 276 tasks, 22 stages, 221 requirements, 211 Web requirements, revision 10; 66 tooling tests passed in 10.205s. Foundation integrity only. |
+| `git diff --check`, `git status --short --untracked-files=all` | 0 each | No tracked whitespace errors; only scoped source files plus claim/workflow metadata. Authored untracked contents separately inspected. |
+
+Setup attempts, not successful checks: the first Python extraction attempt failed (exit 1) because this host Python's tarfile does not support the `filter` keyword. The download/checksum had already succeeded. A second path guard rejected normal relative symlinks (exit 1) before extracting anything. Final extraction resolved each member/symlink/hardlink target, required containment in the task temporary root, and succeeded (exit 0). No system install or permission changes. An exploratory `rg --files ... .agents .codex` returned exit 2 for absent optional directories; no task context was missing.
+
+## Digests
+
+Official Node archive SHA256:
+`bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057`.
+Downloaded from https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-arm64.tar.gz
+and compared with the official same-origin SHASUMS256.txt. No detached signature verification claimed.
+
+- package-lock.json: `7b2dee5e231629c30501194fa40346ba9f0752cea32a4eb9d91e8f5d4b5ab47f`
+- dist/index.html: `67962911c9b0bcb45d6a13f9d0e5877cfa0164c09d2e2128407db84889026a73`
+- dist/assets/index-PZnFDfAT.js: `3cbf3f9adf300aeb52b465fe9e78530103fa5b23fb22e6beae768faa3a8b0f04`
+
+Artifacts/node_modules remain ignored. Local same-host hashes do not prove cross-platform reproducibility.
+
+## Sources and limitations
+
+Primary pages opened through web tool: React from-scratch/createRoot; Vue quick-start/FAQ/TypeScript overview; TypeScript JSX; Vite getting-started/production; Node release lifecycle; npm ci. Exact links and inspection date are in ADR. Version/license/engine/peer fields obtained through real npm registry queries; installed package LICENSE texts inspected for runtime notices. Optional platforms are inventory-only. Web tool could not fetch versioned GitHub license pages or Node checksum URL; actual HTTPS Node checksum retrieval and local package license inspection supplied those facts instead.
+
+Browser external check: `cua.createBrowserTab('iab', 'about:blank', {visible:false})` returned Browser is not available; `cua.listBrowsers()` returned []. DOM mounting/counter clicks/visual layout have not been verified and are explicitly left as an external check. Card mandatory checks are clean install/build and recorded licenses/constraints, both completed. No browser product matrix, real encrypted/protocol/media/provider interoperability, production hosting, vulnerability audit, package provenance or release readiness is claimed. npm audit was disabled for the bounded install; this is not a security clearance.
+
+ADR remains proposed. Separate security reviewer should reproduce exact clean install/build, inspect stack justification, licenses, pin/lock/runtime guards and scope, then record acceptance or rejection via CLI. Coordinator alone commits and launches the next fresh process.