S00-020: Verify pinned Linux XMPP toolchain restoration

Changes: Refresh the environment-access result and document S00-020 restoration, accepted prerequisites and independent QA handoff; preserve probe code and parent dependency graph.
Validation: verify.py passed official HTTPS vendor checksum, Node 24.21.0/npm 11.19.0, fresh-cache strict npm ci and Stanza import. Separate artifact/input/version/strict-setting assertions and tasks.py validate passed. No browser/WSS or product readiness check performed.

Task: S00-020
Agent: auto-ci-cd-2a0186c54ce9
Role: ci-cd
Action: claim
Status: review

Task title: Restore access to the pinned Linux XMPP experiment toolchain

state/evidence/S00-020-auto-ci-cd-2a0186c54ce9.md

@@ -0,0 +1,71 @@
+# S00-020 executor evidence
+
+Agent: auto-ci-cd-2a0186c54ce9 (ci-cd), 2026-10-15.
+Result: pinned Linux environment restoration demonstrated; independent QA pending.
+
+Input: master/AGENTS/README/common/ci-cd and required profile, architecture,
+contracts, workflow, automation, Git, TESTING, protocol and decisions registry;
+resume/show/card/packet, previous handoff and S00-020 blocker; original S00-003
+environment evidence, accepted scope/stack/SASL/parser/SHA512 ADRs and direct
+dependency executor evidence; S00-024 executor/review evidence and handoff.
+Exact ACC-004/NET-003/NET-004 read from immutable specs/tz_clear.md.
+No required artifact missing. Initial git status: coordinator state/tasks.json only.
+
+One output: current reproducible environment-access probe result and handoff.
+Existing reviewed verify.py needed no code change. Scoped README now identifies
+S00-020, distinguishes accepted prerequisite checkpoints and records current
+restoration/review instructions. result.json refreshes temporary runtime/cache
+paths. Parent manifests/locks, stack, shared interfaces, specs and system/network
+configuration unchanged. No new dependencies or Git mutations/agent launches.
+
+## Actual commands and results
+
+- python3 scripts/tasks.py resume --agent auto-ci-cd-2a0186c54ce9: exit 0,
+  assigned S00-020 in_progress; no repeated claim.
+- python3 scripts/tasks.py show S00-020 and packet S00-020 --agent auto-ci-cd-2a0186c54ce9:
+  exit 0 each; scope, exact requirements and done prerequisites confirmed.
+- python3 experiments/0002-xmpp-library/environment-access/verify.py: exit 0.
+  Normal configured HTTPS retrieval of official SHASUMS256.txt/archive succeeded;
+  prior proxy DNS failure did not reproduce. SHA256 matched vendor before safe
+  data-filter extraction. Node v24.21.0/npm 11.19.0 executed on Linux x86_64.
+  Fresh-cache npm ci installed eight unchanged parent locked packages in 1s:
+  --ignore-scripts --no-audit --no-fund --strict-ssl=true --engine-strict=true
+  --registry=https://registry.npmjs.org/ --fetch-retries=0 --fetch-timeout=15000.
+  All locked packages retain HTTPS/SHA512 integrity; actual Stanza createClient
+  ESM import passed. npm upgrade notice was informational; no upgrade performed.
+- Separate inline Python assertions: exit 0. Rehashed downloaded archive;
+  compared fresh/persisted checksum bytes and matching vendor line; copied input
+  bytes/hashes equal parent; all eight installed versions equal lock; installed
+  Stanza is 12.22.1. Re-executed exact node/npm versions. Pinned npm config get
+  strict-ssl, engine-strict and ignore-scripts with installation flags each
+  returned true; inherited NODE_TLS_REJECT_UNAUTHORIZED is not 0.
+- python3 scripts/tasks.py validate: exit 0; 293 tasks, 22 stages,
+  221 requirements, 211 allocated Web requirements, revision 84.
+
+Archive SHA256: fd8e59d5a511510f6a298afb548f18c7d2b1be404d8b4a27d94fbe49f56cb2d6.
+Parent package.json SHA256: e0ffb0c94e198e26f8e44e9b22ff4e121760d9f1197ed7bd5a90e1b4bb112766.
+Parent package-lock.json SHA256: 9c85ad62721eb2deacb298f29fa2bae211a29c964707d52c2dfbf8614b7dbb05.
+Runtime: /tmp/luma-S00-026-g156ah2_/node-v24.21.0-linux-x64/bin.
+Cache: /tmp/luma-S00-026-g156ah2_/npm-cache.
+
+## Acceptance and limits
+
+Runtime/vendor checksum and unchanged isolated lock installation acceptance
+checks pass locally. Independent reviewer must repeat them before acceptance.
+No TLS/engine/proxy bypass, alternate network route, credentials or real messages.
+Checksum authentication trusts the vendor HTTPS origin; detached signatures were
+not verified. No package advisory/provenance, browser/WSS/server/client,
+application build or release-readiness check was run or claimed. ACC/NET product
+acceptance remains S00-003 work. The tooling test suite was not rerun because
+probe implementation/tooling did not change; focused actual checks cover this
+card. Temporary tools/cache can expire. Parent node_modules is not populated:
+installation is confined to environment-access as required.
+
+QA should rerun verify.py and inspect checksum, strict flags, installed graph,
+unchanged parent inputs and diff scope. Approval only accepts S00-020; coordinator
+commits then assigns parent S00-003 to a fresh process. Executor exits on submit.
+
+Final verification: git diff --check, git diff --stat and git status --short
+--untracked-files=all each exited 0. Inline changed-path scope and authored
+final-newline/trailing-whitespace assertions exited 0; scoped README/result
+and allowed workflow metadata only.