diff --git a/docs/decisions/0003-registry-connectivity.md b/docs/decisions/0003-registry-connectivity.md
index 0714ebe..c4e2932 100644
--- a/docs/decisions/0003-registry-connectivity.md
+++ b/docs/decisions/0003-registry-connectivity.md
@@ -1,6 +1,7 @@
 # S00-027: Approved npm registry connectivity record
 
-- Status: proposed; awaiting independent security review.
+- Status: accepted — independent security review S00-027; evidence: `state/evidence/S00-027-review.md`.
+- Reviewer: auto-security-ccce71646176 (security), 2026-10-15.
 - Executor: auto-ci-cd-40ae46e8efe7 (ci-cd), 2026-10-15.
 - Input: S00-027 card, S00-022/S00-027 blockers, accepted ADR 0000/0001 and direct dependency evidence.
 - Output: connectivity evidence only for resuming the separate OMEMO2 investigation.
@@ -55,3 +56,7 @@ Both required live metadata queries and the pinned artifact/SRI verification suc
 No crypto/backend decision, browser/WASM/worker execution, SCE mapping, audited interoperability, persistence compatibility, application build or release readiness was tested or accepted. ENC-003/009/011 remain obligations of the original investigation. The existing crypto ADR and experiments, specs, contracts and plan definitions are unchanged.
 
 The assigned independent security reviewer should repeat both queries with a new empty cache, repeat pinned metadata/download/SHA512 comparison under normal TLS and the approved environment, inspect scope and evidence, then record the review through tasks.py. Only reviewed resolver completion may return S00-022 to the queue for a new agent. Coordinator owns Git commits.
+
+## Independent acceptance
+
+Security reviewer auto-security-ccce71646176 reproduced both live metadata queries with a new empty temporary cache and the pinned metadata/download/SHA512 check under normal TLS. Responses, 1,061,939-byte archive and SHA256 matched the executor record. No package scripts were executed. `make check` passed 72 tooling tests. This accepts registry connectivity only; all crypto/backend and distribution limits above remain. Coordinator owns the review commit.
diff --git a/planning/TASK_MATRIX.md b/planning/TASK_MATRIX.md
index ef12803..1cec536 100644
--- a/planning/TASK_MATRIX.md
+++ b/planning/TASK_MATRIX.md
@@ -1,6 +1,6 @@
 # Матрица задач
 
-Generated; state revision **88**. Canonical status: state/tasks.json.
+Generated; state revision **89**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -24,12 +24,12 @@ Generated; state revision **88**. Canonical status: state/tasks.json.
 | [S00-019](tasks/S00-019.md) | S00 | crypto | security | done | auto-crypto-c68801170fa4 | S00-001, S00-002, S00-017, S00-018 | Validate browser-compatible SCRAM-SHA-512 through a public mechanism API |
 | [S00-020](tasks/S00-020.md) | S00 | ci-cd | qa | done | auto-ci-cd-2a0186c54ce9 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-024 | Restore access to the pinned Linux XMPP experiment toolchain |
 | [S00-021](tasks/S00-021.md) | S00 | crypto | security | done | auto-crypto-fcef9b6781bf | S00-001, S00-002 | Устранить прерывание: Проверить browser OMEMO backend |
-| [S00-022](tasks/S00-022.md) | S00 | crypto | security | blocked | auto-crypto-316a193d6c3e | S00-001, S00-002, S00-021, S00-027 | Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint |
+| [S00-022](tasks/S00-022.md) | S00 | crypto | security | todo |  | S00-001, S00-002, S00-021, S00-027 | Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint |
 | [S00-023](tasks/S00-023.md) | S00 | storage | qa | blocked | auto-storage-87486895c792 | S00-002, S00-025 | Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |
 | [S00-024](tasks/S00-024.md) | S00 | ci-cd | qa | done | auto-ci-cd-49907d48a6d1 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-026 | Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain |
 | [S00-025](tasks/S00-025.md) | S00 | storage | qa | blocked | auto-storage-ae5930b6fbdf | S00-002, S00-028 | Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |
 | [S00-026](tasks/S00-026.md) | S00 | ci-cd | qa | done | auto-ci-cd-4255c34da227 | S00-001, S00-002, S00-017, S00-018, S00-019 | Provide approved access to the pinned Linux experiment artifacts |
-| [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | review | auto-ci-cd-40ae46e8efe7 | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation |
+| [S00-027](tasks/S00-027.md) | S00 | ci-cd | security | done | auto-ci-cd-40ae46e8efe7 | S00-001, S00-002, S00-021 | Restore approved npm registry connectivity for the OMEMO2 backend investigation |
 | [S00-028](tasks/S00-028.md) | S00 | ci-cd | qa | todo |  | S00-002 | Repair conflicting Codex harness sandbox arguments |
 | [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo |  | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
 | [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo |  | S00-010 | Описать identity/model contracts |
diff --git a/planning/stages/S00.md b/planning/stages/S00.md
index ba0959c..d92241a 100644
--- a/planning/stages/S00.md
+++ b/planning/stages/S00.md
@@ -26,12 +26,12 @@
 - [S00-019](../tasks/S00-019.md): Validate browser-compatible SCRAM-SHA-512 through a public mechanism API — crypto; done.
 - [S00-020](../tasks/S00-020.md): Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; done.
 - [S00-021](../tasks/S00-021.md): Устранить прерывание: Проверить browser OMEMO backend — crypto; done.
-- [S00-022](../tasks/S00-022.md): Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint — crypto; blocked.
+- [S00-022](../tasks/S00-022.md): Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint — crypto; todo.
 - [S00-023](../tasks/S00-023.md): Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.
 - [S00-024](../tasks/S00-024.md): Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; done.
 - [S00-025](../tasks/S00-025.md): Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.
 - [S00-026](../tasks/S00-026.md): Provide approved access to the pinned Linux experiment artifacts — ci-cd; done.
-- [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; review.
+- [S00-027](../tasks/S00-027.md): Restore approved npm registry connectivity for the OMEMO2 backend investigation — ci-cd; done.
 - [S00-028](../tasks/S00-028.md): Repair conflicting Codex harness sandbox arguments — ci-cd; todo.
 - [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
 
diff --git a/planning/task_matrix.csv b/planning/task_matrix.csv
index a16fd65..4bd5b5b 100644
--- a/planning/task_matrix.csv
+++ b/planning/task_matrix.csv
@@ -19,12 +19,12 @@ S00-018,S00,protocol,security,done,auto-protocol-89fe6563092c,"S00-001, S00-002,
 S00-019,S00,crypto,security,done,auto-crypto-c68801170fa4,"S00-001, S00-002, S00-017, S00-018",Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
 S00-020,S00,ci-cd,qa,done,auto-ci-cd-2a0186c54ce9,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-024",Restore access to the pinned Linux XMPP experiment toolchain
 S00-021,S00,crypto,security,done,auto-crypto-fcef9b6781bf,"S00-001, S00-002",Устранить прерывание: Проверить browser OMEMO backend
-S00-022,S00,crypto,security,blocked,auto-crypto-316a193d6c3e,"S00-001, S00-002, S00-021, S00-027",Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
+S00-022,S00,crypto,security,todo,,"S00-001, S00-002, S00-021, S00-027",Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
 S00-023,S00,storage,qa,blocked,auto-storage-87486895c792,"S00-002, S00-025",Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 S00-024,S00,ci-cd,qa,done,auto-ci-cd-49907d48a6d1,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-026",Устранить прерывание: Restore access to the pinned Linux XMPP experiment toolchain
 S00-025,S00,storage,qa,blocked,auto-storage-ae5930b6fbdf,"S00-002, S00-028",Устранить прерывание: Устранить прерывание: Выбрать IndexedDB wrapper и migration policy
 S00-026,S00,ci-cd,qa,done,auto-ci-cd-4255c34da227,"S00-001, S00-002, S00-017, S00-018, S00-019",Provide approved access to the pinned Linux experiment artifacts
-S00-027,S00,ci-cd,security,review,auto-ci-cd-40ae46e8efe7,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation
+S00-027,S00,ci-cd,security,done,auto-ci-cd-40ae46e8efe7,"S00-001, S00-002, S00-021",Restore approved npm registry connectivity for the OMEMO2 backend investigation
 S00-028,S00,ci-cd,qa,todo,,S00-002,Repair conflicting Codex harness sandbox arguments
 S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
 S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts
diff --git a/state/commit_messages/auto-security-ccce71646176.txt b/state/commit_messages/auto-security-ccce71646176.txt
new file mode 100644
index 0000000..da596fc
--- /dev/null
+++ b/state/commit_messages/auto-security-ccce71646176.txt
@@ -0,0 +1,4 @@
+Approve registry connectivity after independent HTTPS checks
+
+Changes: Accept the bounded S00-027 connectivity record and add independent security review evidence and handoff.
+Validation: Fresh-cache control, candidate and pinned npm queries exited 0; fresh HTTPS artifact SHA512 SRI, size and SHA256 matched. make check exited 0 with 72 tests; executor patch/message, owner confirmation, scope and whitespace checked. No crypto/backend or distribution acceptance.
diff --git a/state/evidence/S00-027-review.md b/state/evidence/S00-027-review.md
new file mode 100644
index 0000000..b495b72
--- /dev/null
+++ b/state/evidence/S00-027-review.md
@@ -0,0 +1,38 @@
+# S00-027 independent security review
+
+Reviewer: auto-security-ccce71646176 (security). Executor: auto-ci-cd-40ae46e8efe7 (ci-cd).
+Date: 2026-10-15. Decision: APPROVE connectivity record only.
+
+Input: assigned card/packet, required startup/workflow/TESTING/crypto/ADR index reads, both blocker reports, exact ENC-003/009/011, accepted ADR 0000/0001 and all direct dependency evidence/reviews/handoffs. Output: accepted connectivity metadata and this independent report. Focused acceptance: actual control/candidate registry responses, pinned HTTPS download with matching SRI, no policy bypass or crypto/backend acceptance.
+
+## Patch and boundaries
+
+Read implementation commit 0b60f3d84e860cb71ae783d820ebd726bbad76ad and external-input checkpoint 927728daf1f8661ba05114800a36e0dfe5066e2f. Executor message accurately describes the document, live probes, checks and limits. The implementation changes only the allowed connectivity document plus workflow/generated artifacts. Initial working tree was clean. Revision 74 of canonical history confirms approved sandbox outbound access while retaining configured proxy, TLS and filesystem restrictions; supplied prior caches/archives were not reused.
+
+No credentials, private proxy details or real conversations appear in the task artifacts. Metadata was treated as data; pinned URL was asserted to the official HTTPS tarball before retrieval and final URL remained identical. TLS verification stayed enabled (npm strict-ssl=true, Python default SSL context). No install, extraction, package execution, custom crypto, system/network/Git configuration change, plaintext fallback, immutable spec or shared contract edit occurred. Host Node/npm were used solely for metadata connectivity, with accepted build pins unchanged.
+
+## Independent commands and actual results
+
+- `python3 scripts/tasks.py resume --agent auto-security-ccce71646176`, `show S00-027`, `packet S00-027 --agent auto-security-ccce71646176`: exit 0 each. Reviewer did not claim; owner differs and direct prerequisites are done.
+- Read-only git log/show/status and canonical history inspection: exit 0; patch and executor message agree.
+- `node --version`: exit 0.
+- `npm --version`: exit 0.
+- `npm config get strict-ssl`: exit 0.
+- `npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-review-4ngu6s8g/cache --strict-ssl=true`: exit 0.
+- `npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-review-4ngu6s8g/cache --strict-ssl=true`: exit 0.
+- `npm view libomemo.js@3.0.0 version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-review-4ngu6s8g/pinned-cache --registry=https://registry.npmjs.org/ --strict-ssl=true`: exit 0.
+
+Python tempfile/subprocess/urllib/ssl/hashlib/base64 wrapper: exit 0. Fresh root `/tmp/luma-s00-027-review-4ngu6s8g`; cache absent before first query, separate pinned-cache also new. Control returned 0.105.0; candidate and pinned candidate returned 3.0.0, GPL-3.0 and the documented official tarball/SRI. No EAI_AGAIN or E404. Wrapper asserted metadata version and exact public HTTPS URL, required HTTP 200 and unchanged final URL, downloaded using ssl.create_default_context(), computed SHA512 SRI and asserted equality with registry metadata. Archive and public verification.json were saved only under the fresh temporary root; no package code ran.
+
+- Archive size: 1,061,939 bytes.
+- SHA512 SRI: `sha512-B4he9DOS+1LQrut+b2xjOjuSkKMAkZGes7ckB5JgVk/EHVNyxLIHx6NvQ3eJVaT1XeNJaWZBonXw3Nl5YKEbig==`.
+- SHA256: `be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8`.
+
+These results match the executor record exactly.
+
+- `make check > /tmp/luma-s00-027-review-check.log 2>&1`: exit 0, 72 tests in 18.796s, OK. Foundation integrity only.
+- `git diff --check`: exit 0 before report; final authored metadata/diff inspected for whitespace and scope before approval.
+
+## Acceptance and limits
+
+All three card acceptance conditions pass independently. Registry SRI proves agreement between retrieved bytes and registry metadata, not independent provenance, vulnerability clearance, license distribution approval or crypto suitability. Browser/WASM/worker execution, OMEMO2/SCE mapping, interoperability, audited engine/persistence compatibility and application readiness were not checked or accepted. Existing crypto ADR and experiments remain unchanged. Approval permits only S00-022 to return to the queue for a fresh executor through CLI workflow. Coordinator must commit this review transition; reviewer ends after approve.
diff --git a/state/handoffs/S00-027.md b/state/handoffs/S00-027.md
index 6e433ce..82f8441 100644
--- a/state/handoffs/S00-027.md
+++ b/state/handoffs/S00-027.md
@@ -7,3 +7,5 @@ Result: fresh-cache live npm metadata queries succeeded for @signalapp/libsignal
 Output: docs/decisions/0003-registry-connectivity.md. Exact commands/results and limits: state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md. Temporary archive/verification: /tmp/luma-s00-027-kdeu0fv9. make check exit 0, 72 tests. Host Node 24.1.0/npm 11.3.0 were used only for connectivity metadata probes, not project build or replacement of accepted pins.
 
 Next: assigned fresh security reviewer repeats both queries with a new empty cache, pinned artifact download and SRI check under approved HTTPS/TLS; reviews scope, evidence and commit message. Record review via tasks.py. Coordinator commits; executor exits after submit. Only reviewed resolver completion returns S00-022 for a new executor. This record accepts no crypto/backend/library, license distribution, browser/WASM/worker/SCE, audited interoperability or persistence compatibility result.
+
+Independent security review: auto-security-ccce71646176, 2026-10-15. Approved bounded registry connectivity after new-cache live control/candidate/pinned queries and fresh validated HTTPS artifact retrieval; SHA512 SRI, size and SHA256 match executor record. make check exit 0, 72 tests. Report: state/evidence/S00-027-review.md. No blocker. Crypto/backend/browser/WASM/worker/SCE/interoperability and license distribution remain unaccepted. Coordinator commits this review transition before a new executor resumes S00-022; reviewer exits after approve.
diff --git a/state/tasks.json b/state/tasks.json
index 41bb38f..d8ab42b 100644
--- a/state/tasks.json
+++ b/state/tasks.json
@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 88,
+  "revision": 89,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -1311,18 +1311,18 @@
       "completed_at": "2026-10-15T08:40:27+00:00"
     },
     "S00-022": {
-      "status": "blocked",
-      "owner": "auto-crypto-316a193d6c3e",
+      "status": "todo",
+      "owner": null,
       "external_wait": false,
-      "reason": "All ten live npm metadata queries fail with EAI_AGAIN resolving the configured proxy, including the known libsignal-client control. Required release and artifact verification for S00-022 cannot proceed; failures are not E404 evidence.",
+      "reason": null,
       "started_at": "2026-10-15T09:39:15+00:00",
-      "updated_at": "2026-10-15T09:41:11+00:00",
-      "blocked_by": [
-        "S00-027"
-      ],
+      "updated_at": "2026-10-15T10:14:41+00:00",
+      "blocked_by": [],
       "resume_status": "in_progress",
       "blocker_report": "state/blockers/S00-027.md",
-      "handoff": "state/handoffs/S00-022.md"
+      "handoff": "state/handoffs/S00-022.md",
+      "previous_owner": "auto-crypto-316a193d6c3e",
+      "resumed_after_blocker": true
     },
     "S00-023": {
       "status": "blocked",
@@ -1384,14 +1384,17 @@
       "completed_at": "2026-10-15T10:00:12+00:00"
     },
     "S00-027": {
-      "status": "review",
+      "status": "done",
       "owner": "auto-ci-cd-40ae46e8efe7",
       "external_wait": false,
       "reason": null,
       "started_at": "2026-10-15T10:09:30+00:00",
-      "updated_at": "2026-10-15T10:12:28+00:00",
+      "updated_at": "2026-10-15T10:14:41+00:00",
       "evidence": "state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md",
-      "handoff": "state/handoffs/S00-027.md"
+      "handoff": "state/handoffs/S00-027.md",
+      "reviewer": "auto-security-ccce71646176",
+      "review_evidence": "state/evidence/S00-027-review.md",
+      "completed_at": "2026-10-15T10:14:41+00:00"
     },
     "S00-028": {
       "status": "todo",
@@ -2513,6 +2516,27 @@
       "to": "review",
       "reason": null,
       "evidence": "state/evidence/S00-027-auto-ci-cd-40ae46e8efe7.md"
+    },
+    {
+      "revision": 89,
+      "at": "2026-10-15T10:14:41+00:00",
+      "action": "auto-unblock",
+      "task": "S00-022",
+      "resolved_by": "S00-027",
+      "to": "todo",
+      "fresh_agent_required": true
+    },
+    {
+      "revision": 89,
+      "at": "2026-10-15T10:14:41+00:00",
+      "action": "approve",
+      "task": "S00-027",
+      "agent": "auto-security-ccce71646176",
+      "role": "security",
+      "from": "review",
+      "to": "done",
+      "reason": null,
+      "evidence": "state/evidence/S00-027-review.md"
     }
   ],
   "retired_agents": [