S00-020: Verify pinned Linux XMPP toolchain restoration

Changes: Refresh the environment-access result and document S00-020 restoration, accepted prerequisites and independent QA handoff; preserve probe code and parent dependency graph.
Validation: verify.py passed official HTTPS vendor checksum, Node 24.21.0/npm 11.19.0, fresh-cache strict npm ci and Stanza import. Separate artifact/input/version/strict-setting assertions and tasks.py validate passed. No browser/WSS or product readiness check performed.

Task: S00-020
Agent: auto-ci-cd-2a0186c54ce9
Role: ci-cd
Action: claim
Status: review

Task title: Restore access to the pinned Linux XMPP experiment toolchain

experiments/0002-xmpp-library/environment-access/README.md

@@ -1,4 +1,4 @@
-# S00-026 Linux environment access probe
+# S00-020 Linux environment access probe
 
 Normal configured HTTPS access, authorized by the assigned environment-access
 probe and this session's enabled network, succeeded on 2026-10-15. The previous
@@ -40,9 +40,9 @@ license files; dependency notices remain in the existing experiment inventories.
 
 Checksum verification trusts the vendor HTTPS origin; no detached signature,
 package provenance/advisory audit, browser/WSS authentication, application build
-or interoperability claim is made. This outcome is submitted for independent
-QA review only. S00-020, S00-024 and S00-003 remain unfinished; this executor
-does not continue their work or change their statuses directly.
+or interoperability claim is made. The S00-026 access prerequisite and S00-024 continuation checkpoint are now
+independently accepted. S00-020 is submitted for its own independent QA review;
+S00-003 remains separate unfinished work. Historical checkpoints follow.
 
 ## S00-024 continuation checkpoint
 
@@ -59,3 +59,23 @@ command above, verify result.json and use its runtime_bin with an isolated cache
 within its own card. Host Node/npm are not the pinned runtime. Temporary paths
 can expire. This checkpoint does not install dependencies into the parent
 experiment or complete S00-020/S00-003; their own acceptance remains required.
+
+## S00-020 environment restoration result
+
+On 2026-10-15 executor auto-ci-cd-2a0186c54ce9 repeated the reviewed probe in
+this fresh assigned session. Official checksum/archive HTTPS retrieval succeeded
+through the existing configured route. Vendor SHA256 matched before extraction;
+Linux Node v24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed all eight
+unchanged parent locked dependencies and Stanza 12.22.1 createClient imported.
+Separate assertions rechecked downloaded artifacts, copied input hashes, every
+installed version and effective strict TLS/engine/script settings. No probe code,
+parent manifest/lock, stack, specs or network/system configuration changed.
+
+See state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md and the current result.json.
+QA must rerun verify.py with fresh retrieval and inspect scope before accepting
+S00-020. After its reviewed acceptance the coordinator may assign S00-003 to a
+fresh executor. That executor can use result.json runtime_bin for pinned tools;
+the verified Stanza installation is confined here, not in the parent experiment.
+The parent task must perform its own scoped dependency installation and WSS/
+authentication checks. Temporary paths may expire; rerun the probe if needed.
+No browser, WSS, application readiness or interoperability result is supplied.

experiments/0002-xmpp-library/environment-access/result.json

@@ -7,8 +7,8 @@
     "node": "v24.21.0",
     "npm": "11.19.0"
   },
-  "runtime_bin": "/tmp/luma-S00-026-mil9mnes/node-v24.21.0-linux-x64/bin",
-  "cache": "/tmp/luma-S00-026-mil9mnes/npm-cache",
+  "runtime_bin": "/tmp/luma-S00-026-g156ah2_/node-v24.21.0-linux-x64/bin",
+  "cache": "/tmp/luma-S00-026-g156ah2_/npm-cache",
   "parent_sha256": {
     "package.json": "e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766",
     "package-lock.json": "9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05"

planning/TASK_MATRIX.md

@@ -1,6 +1,6 @@
 # Матрица задач
 
-Generated; state revision **83**. Canonical status: state/tasks.json.
+Generated; state revision **85**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
@@ -22,7 +22,7 @@ Generated; state revision **83**. Canonical status: state/tasks.json.
 | [S00-017](tasks/S00-017.md) | S00 | protocol | security | done | auto-protocol-599343cd9e3f | S00-001, S00-002 | Establish fail-closed SCRAM server-final validation |
 | [S00-018](tasks/S00-018.md) | S00 | protocol | security | done | auto-protocol-89fe6563092c | S00-001, S00-002, S00-017 | Validate bounded standalone XML ingress for the XMPP candidate |
 | [S00-019](tasks/S00-019.md) | S00 | crypto | security | done | auto-crypto-c68801170fa4 | S00-001, S00-002, S00-017, S00-018 | Validate browser-compatible SCRAM-SHA-512 through a public mechanism API |
-| [S00-020](tasks/S00-020.md) | S00 | ci-cd | qa | todo |  | S00-001, S00-002, S00-017, S00-018, S00-019, S00-024 | Restore access to the pinned Linux XMPP experiment toolchain |
+| [S00-020](tasks/S00-020.md) | S00 | ci-cd | qa | review | auto-ci-cd-2a0186c54ce9 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-024 | Restore access to the pinned Linux XMPP experiment toolchain |
 | [S00-021](tasks/S00-021.md) | S00 | crypto | security | done | auto-crypto-fcef9b6781bf | S00-001, S00-002 | Устранить прерывание: Проверить browser OMEMO backend |
 | [S00-022](tasks/S00-022.md) | S00 | crypto | security | blocked | auto-crypto-316a193d6c3e | S00-001, S00-002, S00-021, S00-027 | Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint |
 | [S00-023](tasks/S00-023.md) | S00 | storage | qa | blocked | auto-storage-87486895c792 | S00-002, S00-025 | Устранить прерывание: Выбрать IndexedDB wrapper и migration policy |

planning/stages/S00.md

@@ -24,7 +24,7 @@
 - [S00-017](../tasks/S00-017.md): Establish fail-closed SCRAM server-final validation — protocol; done.
 - [S00-018](../tasks/S00-018.md): Validate bounded standalone XML ingress for the XMPP candidate — protocol; done.
 - [S00-019](../tasks/S00-019.md): Validate browser-compatible SCRAM-SHA-512 through a public mechanism API — crypto; done.
-- [S00-020](../tasks/S00-020.md): Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; todo.
+- [S00-020](../tasks/S00-020.md): Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; review.
 - [S00-021](../tasks/S00-021.md): Устранить прерывание: Проверить browser OMEMO backend — crypto; done.
 - [S00-022](../tasks/S00-022.md): Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint — crypto; blocked.
 - [S00-023](../tasks/S00-023.md): Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked.

planning/task_matrix.csv

@@ -17,7 +17,7 @@ S00-016,S00,ci-cd,qa,done,auto-ci-cd-351a0cbbabef,"S00-001, S00-011, S00-013, S0
 S00-017,S00,protocol,security,done,auto-protocol-599343cd9e3f,"S00-001, S00-002",Establish fail-closed SCRAM server-final validation
 S00-018,S00,protocol,security,done,auto-protocol-89fe6563092c,"S00-001, S00-002, S00-017",Validate bounded standalone XML ingress for the XMPP candidate
 S00-019,S00,crypto,security,done,auto-crypto-c68801170fa4,"S00-001, S00-002, S00-017, S00-018",Validate browser-compatible SCRAM-SHA-512 through a public mechanism API
-S00-020,S00,ci-cd,qa,todo,,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-024",Restore access to the pinned Linux XMPP experiment toolchain
+S00-020,S00,ci-cd,qa,review,auto-ci-cd-2a0186c54ce9,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-024",Restore access to the pinned Linux XMPP experiment toolchain
 S00-021,S00,crypto,security,done,auto-crypto-fcef9b6781bf,"S00-001, S00-002",Устранить прерывание: Проверить browser OMEMO backend
 S00-022,S00,crypto,security,blocked,auto-crypto-316a193d6c3e,"S00-001, S00-002, S00-021, S00-027",Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
 S00-023,S00,storage,qa,blocked,auto-storage-87486895c792,"S00-002, S00-025",Устранить прерывание: Выбрать IndexedDB wrapper и migration policy

state/commit_messages/auto-ci-cd-2a0186c54ce9.txt

@@ -0,0 +1,4 @@
+Verify pinned Linux XMPP toolchain restoration
+
+Changes: Refresh the environment-access result and document S00-020 restoration, accepted prerequisites and independent QA handoff; preserve probe code and parent dependency graph.
+Validation: verify.py passed official HTTPS vendor checksum, Node 24.21.0/npm 11.19.0, fresh-cache strict npm ci and Stanza import. Separate artifact/input/version/strict-setting assertions and tasks.py validate passed. No browser/WSS or product readiness check performed.

state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md

@@ -0,0 +1,71 @@
+# S00-020 executor evidence
+
+Agent: auto-ci-cd-2a0186c54ce9 (ci-cd), 2026-10-15.
+Result: pinned Linux environment restoration demonstrated; independent QA pending.
+
+Input: master/AGENTS/README/common/ci-cd and required profile, architecture,
+contracts, workflow, automation, Git, TESTING, protocol and decisions registry;
+resume/show/card/packet, previous handoff and S00-020 blocker; original S00-003
+environment evidence, accepted scope/stack/SASL/parser/SHA512 ADRs and direct
+dependency executor evidence; S00-024 executor/review evidence and handoff.
+Exact ACC-004/NET-003/NET-004 read from immutable specs/tz_clear.md.
+No required artifact missing. Initial git status: coordinator state/tasks.json only.
+
+One output: current reproducible environment-access probe result and handoff.
+Existing reviewed verify.py needed no code change. Scoped README now identifies
+S00-020, distinguishes accepted prerequisite checkpoints and records current
+restoration/review instructions. result.json refreshes temporary runtime/cache
+paths. Parent manifests/locks, stack, shared interfaces, specs and system/network
+configuration unchanged. No new dependencies or Git mutations/agent launches.
+
+## Actual commands and results
+
+- python3 scripts/tasks.py resume --agent auto-ci-cd-2a0186c54ce9: exit 0,
+  assigned S00-020 in_progress; no repeated claim.
+- python3 scripts/tasks.py show S00-020 and packet S00-020 --agent auto-ci-cd-2a0186c54ce9:
+  exit 0 each; scope, exact requirements and done prerequisites confirmed.
+- python3 experiments/0002-xmpp-library/environment-access/verify.py: exit 0.
+  Normal configured HTTPS retrieval of official SHASUMS256.txt/archive succeeded;
+  prior proxy DNS failure did not reproduce. SHA256 matched vendor before safe
+  data-filter extraction. Node v24.21.0/npm 11.19.0 executed on Linux x86_64.
+  Fresh-cache npm ci installed eight unchanged parent locked packages in 1s:
+  --ignore-scripts --no-audit --no-fund --strict-ssl=true --engine-strict=true
+  --registry=https://registry.npmjs.org/ --fetch-retries=0 --fetch-timeout=15000.
+  All locked packages retain HTTPS/SHA512 integrity; actual Stanza createClient
+  ESM import passed. npm upgrade notice was informational; no upgrade performed.
+- Separate inline Python assertions: exit 0. Rehashed downloaded archive;
+  compared fresh/persisted checksum bytes and matching vendor line; copied input
+  bytes/hashes equal parent; all eight installed versions equal lock; installed
+  Stanza is 12.22.1. Re-executed exact node/npm versions. Pinned npm config get
+  strict-ssl, engine-strict and ignore-scripts with installation flags each
+  returned true; inherited NODE_TLS_REJECT_UNAUTHORIZED is not 0.
+- python3 scripts/tasks.py validate: exit 0; 293 tasks, 22 stages,
+  221 requirements, 211 allocated Web requirements, revision 84.
+
+Archive SHA256: fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6.
+Parent package.json SHA256: e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766.
+Parent package-lock.json SHA256: 9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05.
+Runtime: /tmp/luma-S00-026-g156ah2_/node-v24.21.0-linux-x64/bin.
+Cache: /tmp/luma-S00-026-g156ah2_/npm-cache.
+
+## Acceptance and limits
+
+Runtime/vendor checksum and unchanged isolated lock installation acceptance
+checks pass locally. Independent reviewer must repeat them before acceptance.
+No TLS/engine/proxy bypass, alternate network route, credentials or real messages.
+Checksum authentication trusts the vendor HTTPS origin; detached signatures were
+not verified. No package advisory/provenance, browser/WSS/server/client,
+application build or release-readiness check was run or claimed. ACC/NET product
+acceptance remains S00-003 work. The tooling test suite was not rerun because
+probe implementation/tooling did not change; focused actual checks cover this
+card. Temporary tools/cache can expire. Parent node_modules is not populated:
+installation is confined to environment-access as required.
+
+QA should rerun verify.py and inspect checksum, strict flags, installed graph,
+unchanged parent inputs and diff scope. Approval only accepts S00-020; coordinator
+commits then assigns parent S00-003 to a fresh process. Executor exits on submit.
+
+Final verification: git diff --check, git diff --stat and git status --short
+--untracked-files=all each exited 0. Inline changed-path scope and authored
+final-newline/trailing-whitespace assertions exited 0; scoped README/result
+and allowed workflow metadata only.

state/handoffs/S00-020.md

@@ -1,9 +1,24 @@
+# S00-020 handoff for independent QA
 
+Executor: auto-ci-cd-2a0186c54ce9 (ci-cd), 2026-10-15.
+Supersedes interrupted-session handoff after reviewed S00-024 continuation.
+Existing reviewed probe repeated successfully: normal configured official HTTPS,
+vendor archive checksum, Linux Node v24.21.0/npm 11.19.0, fresh-cache npm ci of
+eight byte-identical parent locked dependencies, scripts disabled and strict
+TLS/engines. Stanza 12.22.1 installed and actual createClient import passed.
+Separate artifact/input/version/strict-setting assertions passed; validate passed.
 
-# Blocked handoff
+Evidence: state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md.
+Reproduce: python3 experiments/0002-xmpp-library/environment-access/verify.py.
+Current runtime: /tmp/luma-S00-026-g156ah2_/node-v24.21.0-linux-x64/bin.
+Current cache: /tmp/luma-S00-026-g156ah2_/npm-cache.
+Current result.json contains checksum and parent hashes; temp paths may expire.
+Source changes only README clarification/current result paths. Probe code,
+parent dependency graph, stack, shared contracts/specs and system/network policy
+unchanged. No browser/WSS/interoperability, detached-signature, advisory/provenance
+or product readiness result. Parent dependency installation remains separate.
 
-Original: S00-020; reporter: auto-ci-cd-5a18c8aa1b42; resolution: S00-024.
-
-Previous runner session was interrupted before submit/escalate; processes stopped. User now explicitly requests resuming development. Preserve partial artifacts, verify them in a fresh bounded remediation, and return original to a new executor only after independent review.
-
-Next: complete and review the remediation; only a fresh session may continue.
+QA must independently rerun probe and inspect scope/strict flags/checksum/input
+bytes/installed versions before accepting S00-020. Coordinator alone commits and
+launches a fresh S00-003 executor after reviewed acceptance. This executor does
+not continue the parent task and exits immediately after submit.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 83,
+  "revision": 85,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -1282,18 +1282,19 @@
       "completed_at": "2026-10-14T19:52:28+00:00"
     },
     "S00-020": {
-      "status": "todo",
-      "owner": null,
+      "status": "review",
+      "owner": "auto-ci-cd-2a0186c54ce9",
       "external_wait": false,
       "reason": null,
-      "started_at": "2026-10-15T07:27:20+00:00",
-      "updated_at": "2026-10-15T10:04:38+00:00",
+      "started_at": "2026-10-15T10:04:44+00:00",
+      "updated_at": "2026-10-15T10:07:10+00:00",
       "blocked_by": [],
       "resume_status": "in_progress",
       "blocker_report": "state/blockers/S00-024.md",
       "handoff": "state/handoffs/S00-020.md",
       "previous_owner": "auto-ci-cd-5a18c8aa1b42",
-      "resumed_after_blocker": true
+      "resumed_after_blocker": true,
+      "evidence": "state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md"
     },
     "S00-021": {
       "status": "done",
@@ -2440,6 +2441,29 @@
       "to": "done",
       "reason": null,
       "evidence": "state/evidence/S00-024-review.md"
+    },
+    {
+      "revision": 84,
+      "at": "2026-10-15T10:04:44+00:00",
+      "action": "claim",
+      "task": "S00-020",
+      "agent": "auto-ci-cd-2a0186c54ce9",
+      "role": "ci-cd",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 85,
+      "at": "2026-10-15T10:07:10+00:00",
+      "action": "submit",
+      "task": "S00-020",
+      "agent": "auto-ci-cd-2a0186c54ce9",
+      "role": null,
+      "from": "in_progress",
+      "to": "review",
+      "reason": null,
+      "evidence": "state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md"
     }
   ],
   "retired_agents": [