S00-001: Define the Web scope passport and native exclusion boundaries

Changes: Add proposed scope ADR with reasons for all ten excluded IDs, retained Web obligations, lifecycle limits, external provider roles and deferred decisions. Add a document coverage/lifecycle checker with four negative mutations and executor evidence/handoff for security review.
Validation: python3 experiments/0000-scope/check.py passed for ten excluded IDs and seven lifecycle scenarios; all four negative mutations were rejected. make check passed validation and 66 tooling tests. Whitespace and allowed source paths checked. No live browser or provider integration was tested; ADR awaits independent review.

Task: S00-001
Agent: auto-orchestrator-48aab142ecde
Role: orchestrator
Action: claim
Status: review

Task title: Утвердить Web-профиль

state/commit_messages/auto-orchestrator-48aab142ecde.txt

@@ -0,0 +1,4 @@
+Define the Web scope passport and native exclusion boundaries
+
+Changes: Add proposed scope ADR with reasons for all ten excluded IDs, retained Web obligations, lifecycle limits, external provider roles and deferred decisions. Add a document coverage/lifecycle checker with four negative mutations and executor evidence/handoff for security review.
+Validation: python3 experiments/0000-scope/check.py passed for ten excluded IDs and seven lifecycle scenarios; all four negative mutations were rejected. make check passed validation and 66 tooling tests. Whitespace and allowed source paths checked. No live browser or provider integration was tested; ADR awaits independent review.

state/evidence/S00-001-auto-orchestrator-48aab142ecde.md

@@ -0,0 +1,33 @@
+# S00-001 — executor evidence
+
+Agent: auto-orchestrator-48aab142ecde (orchestrator)
+Date: 2026-10-15
+Result: proposed scope passport, awaiting independent security review.
+
+## Actual changes
+
+- `docs/decisions/0000-scope.md`: Web/native boundaries, complete ten-ID exclusion table, retained NET-002 WSS clause, base scope, seven lifecycle states, capability degradation, external provider roles/data boundaries and explicitly deferred passport decisions.
+- `experiments/0000-scope/check.py`: dependency-free document experiment comparing excluded IDs with canonical applicability/spec text and checking lifecycle limits. Four in-memory negative mutations remove an ID/reason or add a false closed-tab socket/media promise. No product runtime is simulated.
+- Workflow evidence, handoff and mandatory executor commit message only; specifications, planning definitions and shared contracts unchanged. Initial `git status --short` showed only coordinator's `state/tasks.json` claim change.
+
+## Commands and actual results
+
+| Command | Exit | Result |
+| --- | --- | --- |
+| `python3 scripts/tasks.py resume --agent auto-orchestrator-48aab142ecde` | 0 | Assigned S00-001 in_progress; no repeat claim. |
+| `python3 scripts/tasks.py show S00-001` | 0 | Scope and acceptance read. |
+| `python3 scripts/tasks.py packet S00-001 --agent auto-orchestrator-48aab142ecde` | 0 | Requirements/context printed; no dependencies or prior handoff. |
+| `python3 experiments/0000-scope/check.py` | 0 | 10 excluded IDs match registry/specs with reasons; 7 lifecycle scenarios; 4 negative mutations rejected. |
+| `make check` | 0 | validate: 275 tasks, 22 stages, 221 requirements, 211 allocated Web requirements, revision 1; 66 tooling tests passed in 10.090s. Includes spec integrity checks; does not prove app readiness. |
+| `git diff --check` | 0 | No tracked diff whitespace errors. |
+| `git status --short` | 0 | Before evidence: only state/tasks.json, scope ADR and experiments tree changed. |
+
+The focused checker uses Python assertions; run the exact command without `-O`. Human review remains necessary for the meaning of prose and provider/privacy boundaries. `git diff --check` does not inspect untracked contents; authored files were read separately and whitespace-checked before submit.
+
+## Primary-source inspection
+
+Read through web tool on 2026-10-15: RFC 7395 §6 (TLS/WSS); XEP-0206 (BOSH alternative); W3C Push API introduction/§4 (event delivery, permission and metadata); W3C Service Workers §2.1.1 (event lifetime/termination); XEP-0357 §2/§5 (two-tier push and separate enable). Exact dated W3C source links are in the ADR. No library/vendor was selected and no new dependency was installed.
+
+## Limits and review input
+
+No actual browser, XMPP server, push registration, TURN relay, upload or maps integration was exercised. The task result is a scope decision/document experiment. Browser matrix, stack, unlock, topology, limits and interoperability remain explicit future decisions S00-002…010. ADR remains proposed until independent review. Review must assess GEN-005, GEN-006 and WEB-002, all exclusion reasons, the retained NET-002 clause, provider data minimization and absence of secrets/out-of-scope implementation.

state/handoffs/S00-001.md

@@ -0,0 +1,10 @@
+# S00-001 handoff
+
+Executor: auto-orchestrator-48aab142ecde, orchestrator
+Outcome: proposed Web-scope passport in `docs/decisions/0000-scope.md`; complete ten-ID native exclusion table and provider inventory. No blocker. No dependencies or previous handoff.
+
+Ready for independent security reviewer. Read the ADR, canonical applicability, GEN-005/006 and WEB-002, then run `python3 experiments/0000-scope/check.py`. Check the NET-002 retained Web clause, conditional push registration, closed-tab/media restrictions, logout/revoke and provider secret/metadata boundaries. Verify executor message against actual diff and evidence. Coordinator owns commit and next fresh process; executor does not set done.
+
+Checks passed: focused document experiment (10 excluded IDs, 7 scenarios, 4 rejected negative mutations), `make check` (validate + 66 tooling tests), whitespace/scope inspection. Evidence: `state/evidence/S00-001-auto-orchestrator-48aab142ecde.md`.
+
+Limits: no browser/provider runtime test; no chosen framework/library/browser versions, persistent unlock model or deployed topology. These remain S00-002…010 decisions, not missing implementation in S00-001. ADR status is proposed; reviewer should explicitly record acceptance or rejection through assigned workflow. Shared contracts/specs/plan definitions were not changed.

state/tasks.json

@@ -1,10 +1,15 @@
 {
   "schema_version": 1,
-  "revision": 0,
+  "revision": 2,
   "tasks": {
     "S00-001": {
-      "status": "todo",
-      "owner": null
+      "status": "review",
+      "owner": "auto-orchestrator-48aab142ecde",
+      "started_at": "2026-10-14T17:57:54+00:00",
+      "reason": null,
+      "updated_at": "2026-10-14T18:01:57+00:00",
+      "evidence": "state/evidence/S00-001-auto-orchestrator-48aab142ecde.md",
+      "handoff": "state/handoffs/S00-001.md"
     },
     "S00-002": {
       "status": "todo",
@@ -1103,5 +1108,29 @@
       "owner": null
     }
   },
-  "events": []
+  "events": [
+    {
+      "revision": 1,
+      "at": "2026-10-14T17:57:54+00:00",
+      "action": "claim",
+      "task": "S00-001",
+      "agent": "auto-orchestrator-48aab142ecde",
+      "role": "orchestrator",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 2,
+      "at": "2026-10-14T18:01:57+00:00",
+      "action": "submit",
+      "task": "S00-001",
+      "agent": "auto-orchestrator-48aab142ecde",
+      "role": null,
+      "from": "in_progress",
+      "to": "review",
+      "reason": null,
+      "evidence": "state/evidence/S00-001-auto-orchestrator-48aab142ecde.md"
+    }
+  ]
 }