S00-020: Approve pinned Linux XMPP toolchain restoration

Changes: Accept S00-020 with independent QA evidence and handoff; refresh scoped runtime/cache result paths after fresh retrieval and installation.
Validation: verify.py passed official HTTPS checksum, Node 24.21.0/npm 11.19.0, isolated strict npm ci and Stanza import. Independent archive/input/eight-version/strict-setting assertions, tasks.py validate and diff/scope checks passed. Browser/WSS and product readiness remain untested.

Task: S00-020
Agent: auto-qa-9e1e289654ba
Role: qa
Action: review
Status: done

Task title: Restore access to the pinned Linux XMPP experiment toolchain

experiments/0002-xmpp-library/environment-access/result.json

@@ -7,8 +7,8 @@
     "node": "v24.21.0",
     "npm": "11.19.0"
   },
-  "runtime_bin": "/tmp/luma-S00-026-g156ah2_/node-v24.21.0-linux-x64/bin",
-  "cache": "/tmp/luma-S00-026-g156ah2_/npm-cache",
+  "runtime_bin": "/tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin",
+  "cache": "/tmp/luma-S00-026-j1pmys7w/npm-cache",
   "parent_sha256": {
     "package.json": "e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766",
     "package-lock.json": "9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05"

planning/TASK_MATRIX.md

@@ -1,12 +1,12 @@
 # Матрица задач
 
-Generated; state revision **85**. Canonical status: state/tasks.json.
+Generated; state revision **86**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | done | auto-orchestrator-48aab142ecde |  | Утвердить Web-профиль |
 | [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | done | auto-orchestrator-68a05c587e33 | S00-001, S00-011, S00-012 | Выбрать framework и build runtime |
-| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | blocked | auto-protocol-59f4d359b339 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-020 | Проверить XMPP WSS/auth библиотеку |
+| [S00-003](tasks/S00-003.md) | S00 | protocol | qa | todo |  | S00-001, S00-002, S00-017, S00-018, S00-019, S00-020 | Проверить XMPP WSS/auth библиотеку |
 | [S00-004](tasks/S00-004.md) | S00 | crypto | security | blocked | auto-crypto-fe1c81c17ded | S00-001, S00-002, S00-021, S00-022 | Проверить browser OMEMO backend |
 | [S00-005](tasks/S00-005.md) | S00 | storage | qa | blocked | auto-storage-88c3286c6641 | S00-002, S00-023 | Выбрать IndexedDB wrapper и migration policy |
 | [S00-006](tasks/S00-006.md) | S00 | orchestrator | security | todo |  | S00-002 | Зафиксировать browser/reference matrix |
@@ -22,7 +22,7 @@ Generated; state revision **85**. Canonical status: state/tasks.json.
 | [S00-017](tasks/S00-017.md) | S00 | protocol | security | done | auto-protocol-599343cd9e3f | S00-001, S00-002 | Establish fail-closed SCRAM server-final validation |
 | [S00-018](tasks/S00-018.md) | S00 | protocol | security | done | auto-protocol-89fe6563092c | S00-001, S00-002, S00-017 | Validate bounded standalone XML ingress for the XMPP candidate |
 | [S00-019](tasks/S00-019.md) | S00 | crypto | security | done | auto-crypto-c68801170fa4 | S00-001, S00-002, S00-017, S00-018 | Validate browser-compatible SCRAM-SHA-512 through a public mechanism API |
-| [S00-020](tasks/S00-020.md) | S00 | ci-cd | qa | review | auto-ci-cd-2a0186c54ce9 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-024 | Restore access to the pinned Linux XMPP experiment toolchain |
+| [S00-020](tasks/S00-020.md) | S00 | ci-cd | qa | done | auto-ci-cd-2a0186c54ce9 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-024 | Restore access to the pinned Linux XMPP experiment toolchain |
 | [S00-021](tasks/S00-021.md) | S00 | crypto | security | done | auto-crypto-fcef9b6781bf | S00-001, S00-002 | Устранить прерывание: Проверить browser OMEMO backend |
 | [S00-022](tasks/S00-022.md) | S00 | crypto | security | blocked | auto-crypto-316a193d6c3e | S00-001, S00-002, S00-021, S00-027 | Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint |
 | [S00-023](tasks/S00-023.md) | S00 | storage | qa | blocked | auto-storage-87486895c792 | S00-002, S00-025 | Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |

planning/stages/S00.md

@@ -8,7 +8,7 @@
 
 - [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; done.
 - [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; done.
-- [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; blocked.
+- [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; todo.
 - [S00-004](../tasks/S00-004.md): Проверить browser OMEMO backend — crypto; blocked.
 - [S00-005](../tasks/S00-005.md): Выбрать IndexedDB wrapper и migration policy — storage; blocked.
 - [S00-006](../tasks/S00-006.md): Зафиксировать browser/reference matrix — orchestrator; todo.
@@ -24,7 +24,7 @@
 - [S00-017](../tasks/S00-017.md): Establish fail-closed SCRAM server-final validation — protocol; done.
 - [S00-018](../tasks/S00-018.md): Validate bounded standalone XML ingress for the XMPP candidate — protocol; done.
 - [S00-019](../tasks/S00-019.md): Validate browser-compatible SCRAM-SHA-512 through a public mechanism API — crypto; done.
-- [S00-020](../tasks/S00-020.md): Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; review.
+- [S00-020](../tasks/S00-020.md): Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; done.
 - [S00-021](../tasks/S00-021.md): Устранить прерывание: Проверить browser OMEMO backend — crypto; done.
 - [S00-022](../tasks/S00-022.md): Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint — crypto; blocked.
 - [S00-023](../tasks/S00-023.md): Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.

planning/task_matrix.csv

@@ -1,7 +1,7 @@
 id,stage,operator,reviewer,status,owner,depends_on,title
 S00-001,S00,orchestrator,security,done,auto-orchestrator-48aab142ecde,,Утвердить Web-профиль
 S00-002,S00,orchestrator,security,done,auto-orchestrator-68a05c587e33,"S00-001, S00-011, S00-012",Выбрать framework и build runtime
-S00-003,S00,protocol,qa,blocked,auto-protocol-59f4d359b339,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-020",Проверить XMPP WSS/auth библиотеку
+S00-003,S00,protocol,qa,todo,,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-020",Проверить XMPP WSS/auth библиотеку
 S00-004,S00,crypto,security,blocked,auto-crypto-fe1c81c17ded,"S00-001, S00-002, S00-021, S00-022",Проверить browser OMEMO backend
 S00-005,S00,storage,qa,blocked,auto-storage-88c3286c6641,"S00-002, S00-023",Выбрать IndexedDB wrapper и migration policy
 S00-006,S00,orchestrator,security,todo,,S00-002,Зафиксировать browser/reference matrix
@@ -17,7 +17,7 @@ S00-016,S00,ci-cd,qa,done,auto-ci-cd-351a0cbbabef,"S00-001, S00-011, S00-013, S0
 S00-017,S00,protocol,security,done,auto-protocol-599343cd9e3f,"S00-001, S00-002",Establish fail-closed SCRAM server-final validation
 S00-018,S00,protocol,security,done,auto-protocol-89fe6563092c,"S00-001, S00-002, S00-017",Validate bounded standalone XML ingress for the XMPP candidate
 S00-019,S00,crypto,security,done,auto-crypto-c68801170fa4,"S00-001, S00-002, S00-017, S00-018",Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
-S00-020,S00,ci-cd,qa,review,auto-ci-cd-2a0186c54ce9,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-024",Restore access to the pinned Linux XMPP experiment toolchain
+S00-020,S00,ci-cd,qa,done,auto-ci-cd-2a0186c54ce9,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-024",Restore access to the pinned Linux XMPP experiment toolchain
 S00-021,S00,crypto,security,done,auto-crypto-fcef9b6781bf,"S00-001, S00-002",Устранить прерывание: Проверить browser OMEMO backend
 S00-022,S00,crypto,security,blocked,auto-crypto-316a193d6c3e,"S00-001, S00-002, S00-021, S00-027",Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
 S00-023,S00,storage,qa,blocked,auto-storage-87486895c792,"S00-002, S00-025",Устранить прерывание: Выбрать IndexedDB wrapper и migration policy

state/commit_messages/auto-qa-9e1e289654ba.txt

@@ -0,0 +1,4 @@
+Approve pinned Linux XMPP toolchain restoration
+
+Changes: Accept S00-020 with independent QA evidence and handoff; refresh scoped runtime/cache result paths after fresh retrieval and installation.
+Validation: verify.py passed official HTTPS checksum, Node 24.21.0/npm 11.19.0, isolated strict npm ci and Stanza import. Independent archive/input/eight-version/strict-setting assertions, tasks.py validate and diff/scope checks passed. Browser/WSS and product readiness remain untested.

state/evidence/S00-020-review.md

@@ -0,0 +1,81 @@
+# S00-020 independent QA review
+
+Reviewer: auto-qa-9e1e289654ba (qa), 2026-10-15.
+Executor: auto-ci-cd-2a0186c54ce9. Decision: approve bounded environment restoration.
+
+Input: master/AGENTS/README/common/qa; profile, architecture, contracts,
+workflow, automation and Git instructions; resume/show/card/packet, previous
+handoff, required TESTING/protocol/decisions registry and S00-020 blocker;
+accepted scope/stack/SASL/parser/SHA512 ADRs and direct prerequisite evidence;
+S00-024 review/handoff and original S00-003 environment evidence. Exact
+ACC-004/NET-003/NET-004 inspected in immutable specs/tz_clear.md.
+Output: this independent report, refreshed scoped result paths, handoff note,
+reviewer commit message and approval transition for S00-020 only.
+
+## Patch and scope review
+
+Read git log --all --oneline --grep='^S00-020:', latest executor commit
+ ae00f3502eea6e3f3bfa5bda6210404bbe566da9 and earlier checkpoints 7afc642/1947444.
+Latest source diff clarifies environment-access README and updates two temporary
+result.json paths. Other changes are workflow metadata/generated status.
+Executor commit message matches the actual diff and bounded checks. Probe code,
+parent manifest/lock, stack, shared interfaces and specs are unchanged. Initial
+working tree was clean. Prior release checkpoint documents approved configured
+HTTPS access. This review changed no network/system policy or alternate route.
+
+## Actual commands and results
+
+- python3 scripts/tasks.py resume --agent auto-qa-9e1e289654ba: exit 0, [].
+  Reviewer did not claim executor work.
+- python3 scripts/tasks.py show S00-020 and packet S00-020 --agent
+  auto-qa-9e1e289654ba: exit 0 each; review status and done dependencies confirmed.
+- python3 experiments/0002-xmpp-library/environment-access/verify.py: exit 0.
+  Fresh official HTTPS checksum/archive retrieval succeeded through existing
+  configuration. Vendor SHA256 matched before tarfile data-filter extraction.
+  Node v24.21.0/npm 11.19.0 executed on Linux x86_64; fresh-cache npm ci installed
+  eight packages in 1s. Actual Stanza createClient ESM import passed.
+  Installation used --ignore-scripts --no-audit --no-fund --strict-ssl=true
+  --engine-strict=true --registry=https://registry.npmjs.org/
+  --fetch-retries=0 --fetch-timeout=15000 and a fresh isolated cache.
+  Informational npm upgrade notice was not acted on.
+- Independent inline Python assertions: exit 0. Rehashed actual downloaded
+  archive against result and matching vendor checksum line; fresh and persisted
+  checksum files byte-match. Copied manifests/lock byte-match parent and recorded
+  SHA256. All eight installed versions match HTTPS/SHA512 lock entries; actual
+  Stanza version is 12.22.1. Re-executed exact node/npm version commands.
+  Pinned npm config get strict-ssl, engine-strict and ignore-scripts with the
+  installation flags each returned true. NODE_TLS_REJECT_UNAUTHORIZED is not 0.
+  Parent node_modules/stanza remains absent. Python 3.14.7, Linux x86_64.
+- python3 scripts/tasks.py validate: exit 0; 293 tasks, 22 stages,
+  221 requirements, 211 allocated Web requirements, revision 85.
+- git diff --check, git diff --stat and git status --short --untracked-files=all:
+  successful; after probe only scoped result.json runtime/cache paths changed.
+  Final individual diff/whitespace/scope checks are recorded below.
+
+Archive SHA256: fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6.
+Parent manifest SHA256: e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766.
+Parent lock SHA256: 9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05.
+Review runtime: /tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin.
+Review cache: /tmp/luma-S00-026-j1pmys7w/npm-cache.
+
+## Acceptance and limitations
+
+1. Pass: exact pinned Linux runtime executes; freshly retrieved official
+   vendor HTTPS checksum authenticates the archive within the specified method.
+2. Pass: unchanged parent lock installs in isolation with package integrity,
+   lifecycle scripts disabled and Stanza 12.22.1 available/importable.
+3. Pass: no stack/parent lock/spec change, TLS/engine/proxy bypass or secrets.
+   Strict flags and actual copied/installed graph were independently checked.
+
+Authentication trusts same-origin vendor HTTPS checksums; detached signatures
+were not verified. No advisory/provenance audit, actual browser/WSS/server/client
+interoperability, app build or release readiness check was performed or claimed.
+No tooling suite rerun for this unchanged probe; actual focused environment
+checks and plan validation cover this card. ACC/NET product acceptance remains
+S00-003. Temporary tools/cache may expire; rerun verify.py when necessary.
+Coordinator commits this review before assigning any fresh parent executor.
+No Git mutation, other task selection or agent launch. Reviewer exits on approve.
+
+Final verification: individual git diff --check exited 0; inline Python
+changed-path scope and authored final-newline/trailing-whitespace assertions
+exited 0. Only scoped result.json and allowed review metadata changed.

state/handoffs/S00-020.md

@@ -22,3 +22,14 @@ QA must independently rerun probe and inspect scope/strict flags/checksum/input
 bytes/installed versions before accepting S00-020. Coordinator alone commits and
 launches a fresh S00-003 executor after reviewed acceptance. This executor does
 not continue the parent task and exits immediately after submit.
+
+## Independent QA acceptance note
+
+Reviewer auto-qa-9e1e289654ba independently repeated verify.py successfully;
+see state/evidence/S00-020-review.md. Current result.json runtime is
+/tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin with sibling npm-cache.
+Official checksum, unchanged parent inputs, eight installed versions and strict
+settings passed independent checks. Approval accepts only S00-020 environment
+restoration. Coordinator must commit before fresh S00-003 continuation; parent
+installation and browser/WSS/interoperability acceptance remain separate work.
+Temporary paths may expire; repeat the scoped probe if needed.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 85,
+  "revision": 86,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -32,18 +32,16 @@
       "completed_at": "2026-10-14T19:06:23+00:00"
     },
     "S00-003": {
-      "status": "blocked",
-      "owner": "auto-protocol-59f4d359b339",
+      "status": "todo",
+      "owner": null,
       "started_at": "2026-10-15T04:12:38+00:00",
-      "reason": "S00-003 cannot reproduce accepted Node 24.21.0/npm 11.19.0 or install locked Stanza: host tools are 24.1.0/11.3.0, parent node_modules is absent, and normal official HTTPS retrieval fails with unresolved configured proxy.",
-      "updated_at": "2026-10-15T04:14:07+00:00",
-      "blocked_by": [
-        "S00-020"
-      ],
+      "reason": null,
+      "updated_at": "2026-10-15T10:09:24+00:00",
+      "blocked_by": [],
       "resume_status": "in_progress",
       "blocker_report": "state/blockers/S00-020.md",
       "handoff": "state/handoffs/S00-003.md",
-      "previous_owner": "auto-protocol-dcdf92cd067e",
+      "previous_owner": "auto-protocol-59f4d359b339",
       "resumed_after_blocker": true
     },
     "S00-004": {
@@ -1282,19 +1280,22 @@
       "completed_at": "2026-10-14T19:52:28+00:00"
     },
     "S00-020": {
-      "status": "review",
+      "status": "done",
       "owner": "auto-ci-cd-2a0186c54ce9",
       "external_wait": false,
       "reason": null,
       "started_at": "2026-10-15T10:04:44+00:00",
-      "updated_at": "2026-10-15T10:07:10+00:00",
+      "updated_at": "2026-10-15T10:09:24+00:00",
       "blocked_by": [],
       "resume_status": "in_progress",
       "blocker_report": "state/blockers/S00-024.md",
       "handoff": "state/handoffs/S00-020.md",
       "previous_owner": "auto-ci-cd-5a18c8aa1b42",
       "resumed_after_blocker": true,
-      "evidence": "state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md"
+      "evidence": "state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md",
+      "reviewer": "auto-qa-9e1e289654ba",
+      "review_evidence": "state/evidence/S00-020-review.md",
+      "completed_at": "2026-10-15T10:09:24+00:00"
     },
     "S00-021": {
       "status": "done",
@@ -2464,6 +2465,27 @@
       "to": "review",
       "reason": null,
       "evidence": "state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md"
+    },
+    {
+      "revision": 86,
+      "at": "2026-10-15T10:09:24+00:00",
+      "action": "auto-unblock",
+      "task": "S00-003",
+      "resolved_by": "S00-020",
+      "to": "todo",
+      "fresh_agent_required": true
+    },
+    {
+      "revision": 86,
+      "at": "2026-10-15T10:09:24+00:00",
+      "action": "approve",
+      "task": "S00-020",
+      "agent": "auto-qa-9e1e289654ba",
+      "role": "qa",
+      "from": "review",
+      "to": "done",
+      "reason": null,
+      "evidence": "state/evidence/S00-020-review.md"
     }
   ],
   "retired_agents": [