diff --git a/experiments/0002-xmpp-library/environment-access/README.md b/experiments/0002-xmpp-library/environment-access/README.md index ea9dc28..e0a3648 100644 --- a/experiments/0002-xmpp-library/environment-access/README.md +++ b/experiments/0002-xmpp-library/environment-access/README.md @@ -1,4 +1,4 @@ -# S00-026 Linux environment access probe +# S00-020 Linux environment access probe Normal configured HTTPS access, authorized by the assigned environment-access probe and this session's enabled network, succeeded on 2026-10-15. The previous @@ -40,9 +40,9 @@ license files; dependency notices remain in the existing experiment inventories. Checksum verification trusts the vendor HTTPS origin; no detached signature, package provenance/advisory audit, browser/WSS authentication, application build -or interoperability claim is made. This outcome is submitted for independent -QA review only. S00-020, S00-024 and S00-003 remain unfinished; this executor -does not continue their work or change their statuses directly. +or interoperability claim is made. The S00-026 access prerequisite and S00-024 continuation checkpoint are now +independently accepted. S00-020 is submitted for its own independent QA review; +S00-003 remains separate unfinished work. Historical checkpoints follow. ## S00-024 continuation checkpoint @@ -59,3 +59,23 @@ command above, verify result.json and use its runtime_bin with an isolated cache within its own card. Host Node/npm are not the pinned runtime. Temporary paths can expire. This checkpoint does not install dependencies into the parent experiment or complete S00-020/S00-003; their own acceptance remains required. + +## S00-020 environment restoration result + +On 2026-10-15 executor auto-ci-cd-2a0186c54ce9 repeated the reviewed probe in +this fresh assigned session. Official checksum/archive HTTPS retrieval succeeded +through the existing configured route. Vendor SHA256 matched before extraction; +Linux Node v24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed all eight +unchanged parent locked dependencies and Stanza 12.22.1 createClient imported. +Separate assertions rechecked downloaded artifacts, copied input hashes, every +installed version and effective strict TLS/engine/script settings. No probe code, +parent manifest/lock, stack, specs or network/system configuration changed. + +See state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md and the current result.json. +QA must rerun verify.py with fresh retrieval and inspect scope before accepting +S00-020. After its reviewed acceptance the coordinator may assign S00-003 to a +fresh executor. That executor can use result.json runtime_bin for pinned tools; +the verified Stanza installation is confined here, not in the parent experiment. +The parent task must perform its own scoped dependency installation and WSS/ +authentication checks. Temporary paths may expire; rerun the probe if needed. +No browser, WSS, application readiness or interoperability result is supplied. diff --git a/experiments/0002-xmpp-library/environment-access/result.json b/experiments/0002-xmpp-library/environment-access/result.json index f0862f9..b6895a1 100644 --- a/experiments/0002-xmpp-library/environment-access/result.json +++ b/experiments/0002-xmpp-library/environment-access/result.json @@ -7,8 +7,8 @@ "node": "v24.21.0", "npm": "11.19.0" }, - "runtime_bin": "/tmp/luma-S00-026-mil9mnes/node-v24.21.0-linux-x64/bin", - "cache": "/tmp/luma-S00-026-mil9mnes/npm-cache", + "runtime_bin": "/tmp/luma-S00-026-g156ah2_/node-v24.21.0-linux-x64/bin", + "cache": "/tmp/luma-S00-026-g156ah2_/npm-cache", "parent_sha256": { "package.json": "e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766", "package-lock.json": "9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05" diff --git a/planning/TASK_MATRIX.md b/planning/TASK_MATRIX.md index a7346e3..42f4610 100644 --- a/planning/TASK_MATRIX.md +++ b/planning/TASK_MATRIX.md @@ -1,6 +1,6 @@ # Матрица задач -Generated; state revision **83**. Canonical status: state/tasks.json. +Generated; state revision **85**. Canonical status: state/tasks.json. | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача | | --- | --- | --- | --- | --- | --- | --- | --- | @@ -22,7 +22,7 @@ Generated; state revision **83**. Canonical status: state/tasks.json. | [S00-017](tasks/S00-017.md) | S00 | protocol | security | done | auto-protocol-599343cd9e3f | S00-001, S00-002 | Establish fail-closed SCRAM server-final validation | | [S00-018](tasks/S00-018.md) | S00 | protocol | security | done | auto-protocol-89fe6563092c | S00-001, S00-002, S00-017 | Validate bounded standalone XML ingress for the XMPP candidate | | [S00-019](tasks/S00-019.md) | S00 | crypto | security | done | auto-crypto-c68801170fa4 | S00-001, S00-002, S00-017, S00-018 | Validate browser-compatible SCRAM-SHA-512 through a public mechanism API | -| [S00-020](tasks/S00-020.md) | S00 | ci-cd | qa | todo | | S00-001, S00-002, S00-017, S00-018, S00-019, S00-024 | Restore access to the pinned Linux XMPP experiment toolchain | +| [S00-020](tasks/S00-020.md) | S00 | ci-cd | qa | review | auto-ci-cd-2a0186c54ce9 | S00-001, S00-002, S00-017, S00-018, S00-019, S00-024 | Restore access to the pinned Linux XMPP experiment toolchain | | [S00-021](tasks/S00-021.md) | S00 | crypto | security | done | auto-crypto-fcef9b6781bf | S00-001, S00-002 | Устранить прерывание: Проверить browser OMEMO backend | | [S00-022](tasks/S00-022.md) | S00 | crypto | security | blocked | auto-crypto-316a193d6c3e | S00-001, S00-002, S00-021, S00-027 | Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint | | [S00-023](tasks/S00-023.md) | S00 | storage | qa | blocked | auto-storage-87486895c792 | S00-002, S00-025 | Устранить прерывание: Выбрать IndexedDB wrapper и migration policy | diff --git a/planning/stages/S00.md b/planning/stages/S00.md index 6b50944..f4a9d66 100644 --- a/planning/stages/S00.md +++ b/planning/stages/S00.md @@ -24,7 +24,7 @@ - [S00-017](../tasks/S00-017.md): Establish fail-closed SCRAM server-final validation — protocol; done. - [S00-018](../tasks/S00-018.md): Validate bounded standalone XML ingress for the XMPP candidate — protocol; done. - [S00-019](../tasks/S00-019.md): Validate browser-compatible SCRAM-SHA-512 through a public mechanism API — crypto; done. -- [S00-020](../tasks/S00-020.md): Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; todo. +- [S00-020](../tasks/S00-020.md): Restore access to the pinned Linux XMPP experiment toolchain — ci-cd; review. - [S00-021](../tasks/S00-021.md): Устранить прерывание: Проверить browser OMEMO backend — crypto; done. - [S00-022](../tasks/S00-022.md): Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint — crypto; blocked. - [S00-023](../tasks/S00-023.md): Устранить прерывание: Выбрать IndexedDB wrapper и migration policy — storage; blocked. diff --git a/planning/task_matrix.csv b/planning/task_matrix.csv index 81b02d2..46de0bc 100644 --- a/planning/task_matrix.csv +++ b/planning/task_matrix.csv @@ -17,7 +17,7 @@ S00-016,S00,ci-cd,qa,done,auto-ci-cd-351a0cbbabef,"S00-001, S00-011, S00-013, S0 S00-017,S00,protocol,security,done,auto-protocol-599343cd9e3f,"S00-001, S00-002",Establish fail-closed SCRAM server-final validation S00-018,S00,protocol,security,done,auto-protocol-89fe6563092c,"S00-001, S00-002, S00-017",Validate bounded standalone XML ingress for the XMPP candidate S00-019,S00,crypto,security,done,auto-crypto-c68801170fa4,"S00-001, S00-002, S00-017, S00-018",Validate browser-compatible SCRAM-SHA-512 through a public mechanism API -S00-020,S00,ci-cd,qa,todo,,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-024",Restore access to the pinned Linux XMPP experiment toolchain +S00-020,S00,ci-cd,qa,review,auto-ci-cd-2a0186c54ce9,"S00-001, S00-002, S00-017, S00-018, S00-019, S00-024",Restore access to the pinned Linux XMPP experiment toolchain S00-021,S00,crypto,security,done,auto-crypto-fcef9b6781bf,"S00-001, S00-002",Устранить прерывание: Проверить browser OMEMO backend S00-022,S00,crypto,security,blocked,auto-crypto-316a193d6c3e,"S00-001, S00-002, S00-021, S00-027",Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint S00-023,S00,storage,qa,blocked,auto-storage-87486895c792,"S00-002, S00-025",Устранить прерывание: Выбрать IndexedDB wrapper и migration policy diff --git a/state/commit_messages/auto-ci-cd-2a0186c54ce9.txt b/state/commit_messages/auto-ci-cd-2a0186c54ce9.txt new file mode 100644 index 0000000..5c02f20 --- /dev/null +++ b/state/commit_messages/auto-ci-cd-2a0186c54ce9.txt @@ -0,0 +1,4 @@ +Verify pinned Linux XMPP toolchain restoration + +Changes: Refresh the environment-access result and document S00-020 restoration, accepted prerequisites and independent QA handoff; preserve probe code and parent dependency graph. +Validation: verify.py passed official HTTPS vendor checksum, Node 24.21.0/npm 11.19.0, fresh-cache strict npm ci and Stanza import. Separate artifact/input/version/strict-setting assertions and tasks.py validate passed. No browser/WSS or product readiness check performed. diff --git a/state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md b/state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md new file mode 100644 index 0000000..bb4563f --- /dev/null +++ b/state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md @@ -0,0 +1,71 @@ +# S00-020 executor evidence + +Agent: auto-ci-cd-2a0186c54ce9 (ci-cd), 2026-10-15. +Result: pinned Linux environment restoration demonstrated; independent QA pending. + +Input: master/AGENTS/README/common/ci-cd and required profile, architecture, +contracts, workflow, automation, Git, TESTING, protocol and decisions registry; +resume/show/card/packet, previous handoff and S00-020 blocker; original S00-003 +environment evidence, accepted scope/stack/SASL/parser/SHA512 ADRs and direct +dependency executor evidence; S00-024 executor/review evidence and handoff. +Exact ACC-004/NET-003/NET-004 read from immutable specs/tz_clear.md. +No required artifact missing. Initial git status: coordinator state/tasks.json only. + +One output: current reproducible environment-access probe result and handoff. +Existing reviewed verify.py needed no code change. Scoped README now identifies +S00-020, distinguishes accepted prerequisite checkpoints and records current +restoration/review instructions. result.json refreshes temporary runtime/cache +paths. Parent manifests/locks, stack, shared interfaces, specs and system/network +configuration unchanged. No new dependencies or Git mutations/agent launches. + +## Actual commands and results + +- python3 scripts/tasks.py resume --agent auto-ci-cd-2a0186c54ce9: exit 0, + assigned S00-020 in_progress; no repeated claim. +- python3 scripts/tasks.py show S00-020 and packet S00-020 --agent auto-ci-cd-2a0186c54ce9: + exit 0 each; scope, exact requirements and done prerequisites confirmed. +- python3 experiments/0002-xmpp-library/environment-access/verify.py: exit 0. + Normal configured HTTPS retrieval of official SHASUMS256.txt/archive succeeded; + prior proxy DNS failure did not reproduce. SHA256 matched vendor before safe + data-filter extraction. Node v24.21.0/npm 11.19.0 executed on Linux x86_64. + Fresh-cache npm ci installed eight unchanged parent locked packages in 1s: + --ignore-scripts --no-audit --no-fund --strict-ssl=true --engine-strict=true + --registry=https://registry.npmjs.org/ --fetch-retries=0 --fetch-timeout=15000. + All locked packages retain HTTPS/SHA512 integrity; actual Stanza createClient + ESM import passed. npm upgrade notice was informational; no upgrade performed. +- Separate inline Python assertions: exit 0. Rehashed downloaded archive; + compared fresh/persisted checksum bytes and matching vendor line; copied input + bytes/hashes equal parent; all eight installed versions equal lock; installed + Stanza is 12.22.1. Re-executed exact node/npm versions. Pinned npm config get + strict-ssl, engine-strict and ignore-scripts with installation flags each + returned true; inherited NODE_TLS_REJECT_UNAUTHORIZED is not 0. +- python3 scripts/tasks.py validate: exit 0; 293 tasks, 22 stages, + 221 requirements, 211 allocated Web requirements, revision 84. + +Archive SHA256: fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6. +Parent package.json SHA256: e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766. +Parent package-lock.json SHA256: 9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05. +Runtime: /tmp/luma-S00-026-g156ah2_/node-v24.21.0-linux-x64/bin. +Cache: /tmp/luma-S00-026-g156ah2_/npm-cache. + +## Acceptance and limits + +Runtime/vendor checksum and unchanged isolated lock installation acceptance +checks pass locally. Independent reviewer must repeat them before acceptance. +No TLS/engine/proxy bypass, alternate network route, credentials or real messages. +Checksum authentication trusts the vendor HTTPS origin; detached signatures were +not verified. No package advisory/provenance, browser/WSS/server/client, +application build or release-readiness check was run or claimed. ACC/NET product +acceptance remains S00-003 work. The tooling test suite was not rerun because +probe implementation/tooling did not change; focused actual checks cover this +card. Temporary tools/cache can expire. Parent node_modules is not populated: +installation is confined to environment-access as required. + +QA should rerun verify.py and inspect checksum, strict flags, installed graph, +unchanged parent inputs and diff scope. Approval only accepts S00-020; coordinator +commits then assigns parent S00-003 to a fresh process. Executor exits on submit. + +Final verification: git diff --check, git diff --stat and git status --short +--untracked-files=all each exited 0. Inline changed-path scope and authored +final-newline/trailing-whitespace assertions exited 0; scoped README/result +and allowed workflow metadata only. diff --git a/state/handoffs/S00-020.md b/state/handoffs/S00-020.md index 061d9f7..cd62c49 100644 --- a/state/handoffs/S00-020.md +++ b/state/handoffs/S00-020.md @@ -1,9 +1,24 @@ +# S00-020 handoff for independent QA +Executor: auto-ci-cd-2a0186c54ce9 (ci-cd), 2026-10-15. +Supersedes interrupted-session handoff after reviewed S00-024 continuation. +Existing reviewed probe repeated successfully: normal configured official HTTPS, +vendor archive checksum, Linux Node v24.21.0/npm 11.19.0, fresh-cache npm ci of +eight byte-identical parent locked dependencies, scripts disabled and strict +TLS/engines. Stanza 12.22.1 installed and actual createClient import passed. +Separate artifact/input/version/strict-setting assertions passed; validate passed. -# Blocked handoff +Evidence: state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md. +Reproduce: python3 experiments/0002-xmpp-library/environment-access/verify.py. +Current runtime: /tmp/luma-S00-026-g156ah2_/node-v24.21.0-linux-x64/bin. +Current cache: /tmp/luma-S00-026-g156ah2_/npm-cache. +Current result.json contains checksum and parent hashes; temp paths may expire. +Source changes only README clarification/current result paths. Probe code, +parent dependency graph, stack, shared contracts/specs and system/network policy +unchanged. No browser/WSS/interoperability, detached-signature, advisory/provenance +or product readiness result. Parent dependency installation remains separate. -Original: S00-020; reporter: auto-ci-cd-5a18c8aa1b42; resolution: S00-024. - -Previous runner session was interrupted before submit/escalate; processes stopped. User now explicitly requests resuming development. Preserve partial artifacts, verify them in a fresh bounded remediation, and return original to a new executor only after independent review. - -Next: complete and review the remediation; only a fresh session may continue. +QA must independently rerun probe and inspect scope/strict flags/checksum/input +bytes/installed versions before accepting S00-020. Coordinator alone commits and +launches a fresh S00-003 executor after reviewed acceptance. This executor does +not continue the parent task and exits immediately after submit. diff --git a/state/tasks.json b/state/tasks.json index 4ccdcaa..7ca89c5 100644 --- a/state/tasks.json +++ b/state/tasks.json @@ -1,6 +1,6 @@ { "schema_version": 1, - "revision": 83, + "revision": 85, "tasks": { "S00-001": { "status": "done", @@ -1282,18 +1282,19 @@ "completed_at": "2026-10-14T19:52:28+00:00" }, "S00-020": { - "status": "todo", - "owner": null, + "status": "review", + "owner": "auto-ci-cd-2a0186c54ce9", "external_wait": false, "reason": null, - "started_at": "2026-10-15T07:27:20+00:00", - "updated_at": "2026-10-15T10:04:38+00:00", + "started_at": "2026-10-15T10:04:44+00:00", + "updated_at": "2026-10-15T10:07:10+00:00", "blocked_by": [], "resume_status": "in_progress", "blocker_report": "state/blockers/S00-024.md", "handoff": "state/handoffs/S00-020.md", "previous_owner": "auto-ci-cd-5a18c8aa1b42", - "resumed_after_blocker": true + "resumed_after_blocker": true, + "evidence": "state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md" }, "S00-021": { "status": "done", @@ -2440,6 +2441,29 @@ "to": "done", "reason": null, "evidence": "state/evidence/S00-024-review.md" + }, + { + "revision": 84, + "at": "2026-10-15T10:04:44+00:00", + "action": "claim", + "task": "S00-020", + "agent": "auto-ci-cd-2a0186c54ce9", + "role": "ci-cd", + "from": "todo", + "to": "in_progress", + "reason": null + }, + { + "revision": 85, + "at": "2026-10-15T10:07:10+00:00", + "action": "submit", + "task": "S00-020", + "agent": "auto-ci-cd-2a0186c54ce9", + "role": null, + "from": "in_progress", + "to": "review", + "reason": null, + "evidence": "state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md" } ], "retired_agents": [