S00-020: Approve pinned Linux XMPP toolchain restoration

Changes: Accept S00-020 with independent QA evidence and handoff; refresh scoped runtime/cache result paths after fresh retrieval and installation.
Validation: verify.py passed official HTTPS checksum, Node 24.21.0/npm 11.19.0, isolated strict npm ci and Stanza import. Independent archive/input/eight-version/strict-setting assertions, tasks.py validate and diff/scope checks passed. Browser/WSS and product readiness remain untested.

Task: S00-020
Agent: auto-qa-9e1e289654ba
Role: qa
Action: review
Status: done

Task title: Restore access to the pinned Linux XMPP experiment toolchain

state/evidence/S00-020-review.md

@@ -0,0 +1,81 @@
+# S00-020 independent QA review
+
+Reviewer: auto-qa-9e1e289654ba (qa), 2026-10-15.
+Executor: auto-ci-cd-2a0186c54ce9. Decision: approve bounded environment restoration.
+
+Input: master/AGENTS/README/common/qa; profile, architecture, contracts,
+workflow, automation and Git instructions; resume/show/card/packet, previous
+handoff, required TESTING/protocol/decisions registry and S00-020 blocker;
+accepted scope/stack/SASL/parser/SHA512 ADRs and direct prerequisite evidence;
+S00-024 review/handoff and original S00-003 environment evidence. Exact
+ACC-004/NET-003/NET-004 inspected in immutable specs/tz_clear.md.
+Output: this independent report, refreshed scoped result paths, handoff note,
+reviewer commit message and approval transition for S00-020 only.
+
+## Patch and scope review
+
+Read git log --all --oneline --grep='^S00-020:', latest executor commit
+ ae00f3502eea6e3f3bfa5bda6210404bbe566da9 and earlier checkpoints 7afc642/1947444.
+Latest source diff clarifies environment-access README and updates two temporary
+result.json paths. Other changes are workflow metadata/generated status.
+Executor commit message matches the actual diff and bounded checks. Probe code,
+parent manifest/lock, stack, shared interfaces and specs are unchanged. Initial
+working tree was clean. Prior release checkpoint documents approved configured
+HTTPS access. This review changed no network/system policy or alternate route.
+
+## Actual commands and results
+
+- python3 scripts/tasks.py resume --agent auto-qa-9e1e289654ba: exit 0, [].
+  Reviewer did not claim executor work.
+- python3 scripts/tasks.py show S00-020 and packet S00-020 --agent
+  auto-qa-9e1e289654ba: exit 0 each; review status and done dependencies confirmed.
+- python3 experiments/0002-xmpp-library/environment-access/verify.py: exit 0.
+  Fresh official HTTPS checksum/archive retrieval succeeded through existing
+  configuration. Vendor SHA256 matched before tarfile data-filter extraction.
+  Node v24.21.0/npm 11.19.0 executed on Linux x86_64; fresh-cache npm ci installed
+  eight packages in 1s. Actual Stanza createClient ESM import passed.
+  Installation used --ignore-scripts --no-audit --no-fund --strict-ssl=true
+  --engine-strict=true --registry=https://registry.npmjs.org/
+  --fetch-retries=0 --fetch-timeout=15000 and a fresh isolated cache.
+  Informational npm upgrade notice was not acted on.
+- Independent inline Python assertions: exit 0. Rehashed actual downloaded
+  archive against result and matching vendor checksum line; fresh and persisted
+  checksum files byte-match. Copied manifests/lock byte-match parent and recorded
+  SHA256. All eight installed versions match HTTPS/SHA512 lock entries; actual
+  Stanza version is 12.22.1. Re-executed exact node/npm version commands.
+  Pinned npm config get strict-ssl, engine-strict and ignore-scripts with the
+  installation flags each returned true. NODE_TLS_REJECT_UNAUTHORIZED is not 0.
+  Parent node_modules/stanza remains absent. Python 3.14.7, Linux x86_64.
+- python3 scripts/tasks.py validate: exit 0; 293 tasks, 22 stages,
+  221 requirements, 211 allocated Web requirements, revision 85.
+- git diff --check, git diff --stat and git status --short --untracked-files=all:
+  successful; after probe only scoped result.json runtime/cache paths changed.
+  Final individual diff/whitespace/scope checks are recorded below.
+
+Archive SHA256: fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6.
+Parent manifest SHA256: e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766.
+Parent lock SHA256: 9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05.
+Review runtime: /tmp/luma-S00-026-j1pmys7w/node-v24.21.0-linux-x64/bin.
+Review cache: /tmp/luma-S00-026-j1pmys7w/npm-cache.
+
+## Acceptance and limitations
+
+1. Pass: exact pinned Linux runtime executes; freshly retrieved official
+   vendor HTTPS checksum authenticates the archive within the specified method.
+2. Pass: unchanged parent lock installs in isolation with package integrity,
+   lifecycle scripts disabled and Stanza 12.22.1 available/importable.
+3. Pass: no stack/parent lock/spec change, TLS/engine/proxy bypass or secrets.
+   Strict flags and actual copied/installed graph were independently checked.
+
+Authentication trusts same-origin vendor HTTPS checksums; detached signatures
+were not verified. No advisory/provenance audit, actual browser/WSS/server/client
+interoperability, app build or release readiness check was performed or claimed.
+No tooling suite rerun for this unchanged probe; actual focused environment
+checks and plan validation cover this card. ACC/NET product acceptance remains
+S00-003. Temporary tools/cache may expire; rerun verify.py when necessary.
+Coordinator commits this review before assigning any fresh parent executor.
+No Git mutation, other task selection or agent launch. Reviewer exits on approve.
+
+Final verification: individual git diff --check exited 0; inline Python
+changed-path scope and authored final-newline/trailing-whitespace assertions
+exited 0. Only scoped result.json and allowed review metadata changed.