S00-011: Verify public npm access and exact-version tarball integrity

Changes: Add a scoped fresh-cache registry probe, safe reproduction instructions and artifact ignore rule; record actual TLS-enabled metadata/download results and review handoff without selecting a stack or changing the harness.
Validation: Original npm view command and verify.py returned exit 0; react@19.3.1 tarball (26394 bytes) matched registry SHA-512. make check passed validation and 66 tooling tests. git diff --check passed. App install/build and different-harness connectivity remain unverified.

Task: S00-011
Agent: auto-ci-cd-d105e8027730
Role: ci-cd
Action: claim
Status: review

Task title: Restore verified npm registry access for the stack spike

state/commit_messages/auto-ci-cd-d105e8027730.txt

@@ -0,0 +1,4 @@
+Verify public npm access and exact-version tarball integrity
+
+Changes: Add a scoped fresh-cache registry probe, safe reproduction instructions and artifact ignore rule; record actual TLS-enabled metadata/download results and review handoff without selecting a stack or changing the harness.
+Validation: Original npm view command and verify.py returned exit 0; react@19.3.1 tarball (26394 bytes) matched registry SHA-512. make check passed validation and 66 tooling tests. git diff --check passed. App install/build and different-harness connectivity remain unverified.

state/evidence/S00-011-auto-ci-cd-d105e8027730.md

@@ -0,0 +1,56 @@
+# S00-011 executor evidence
+
+Agent: auto-ci-cd-d105e8027730; role: ci-cd; date: 2026-10-15.
+Result: verified public npm metadata and integrity-checked exact-version tarball
+in the current fresh execution harness; awaiting independent security review.
+
+## Actual changes
+
+- experiments/0001-stack/registry-access/verify.py: dependency-free Python probe
+  runs npm with explicit HTTPS registry/strict TLS, empty configs and fresh cache,
+  retrieves react@19.3.1 without package scripts/install/extraction, checks exact
+  version/URL and independently compares SHA-512 with registry metadata.
+- Scoped README documents exact command forms/options, observed public results,
+  nonsecret environment prerequisites and limits. Scoped .gitignore excludes
+  retrieved artifacts. No stack, runtime pin or shared interface was selected.
+- Task evidence/handoff/commit message only outside that source scope. No Git,
+  harness, DNS, npm config, TLS, CORS, immutable specs or plan definitions changed.
+
+## Commands and actual results
+
+| Command | Exit | Result |
+| --- | --- | --- |
+| `python3 scripts/tasks.py resume --agent auto-ci-cd-d105e8027730` | 0 | Assigned S00-011 in_progress, no repeat claim. |
+| `python3 scripts/tasks.py show S00-011` | 0 | Bounded scope/acceptance read. |
+| `python3 scripts/tasks.py packet S00-011 --agent auto-ci-cd-d105e8027730` | 0 | Current requirements, dependency and no previous handoff. |
+| `npm view react version license engines --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000` | 0 | Original failed command now returns version 19.3.1, license MIT, engines node >=0.10.0. |
+| `node --version` / `npm --version` / `npm config get strict-ssl` | 0 each | v26.3.0 / 11.16.0 / true. Observations only. |
+| `python3 experiments/0001-stack/registry-access/verify.py` | 0 | Both npm children exit 0, fresh-cache metadata/download, 26394-byte tarball; independent SHA-512 match. |
+| `make check` | 0 | Validated 276 tasks, 22 stages, 221 requirements, 211 allocated Web requirements, revision 7; all 66 tooling tests passed in 10.411s. Foundation integrity only. |
+| `git diff --check` | 0 | No tracked whitespace errors; scoped untracked files also inspected directly. |
+
+Probe child commands and all options are recorded in the scoped README and source.
+Public URL: https://registry.npmjs.org/react/-/react-19.3.1.tgz
+
+Observed registry and calculated integrity:
+`sha512-QNhWdt7nrgVWWQG58QuGsAR3jv3Hbe4mb4vz7w2csnHavciZJgda1CPNaldF6eVxv90ud3jUXpKlHL69gO38yw==`.
+Public metadata and result JSON plus actual tarball remain locally in ignored
+artifacts/. Security reviewer should regenerate them, not accept this text alone.
+
+## Context and limits
+
+Read assigned instructions/card/packet, NFR-007 in specs/tz_clear.md, accepted
+ADR 0000 and S00-001 executor/review evidence/handoff. S01 contracts remain future
+work and none are changed/needed. The initial working tree showed only the
+coordinator's state/tasks.json claim change. No S00-011 handoff or stack experiment
+directory existed initially; their read/list attempts returned missing-path errors,
+not test failures or evidence of a network blocker.
+
+Current supplied harness has network enabled, workspace-write sandbox and never
+approval policy. No environment permission changes were necessary. The previous
+DNS failure no longer reproduces; the external correction mechanism is unknown.
+S00-002 must use registry-capable execution with TLS trust intact and perform its
+own version/license assessment, clean install/build and stack decision. Future or
+different harness connectivity, package signatures/provenance, browser/CORS,
+application build and app readiness are not verified by S00-011. No secrets or
+production account data were used. No dependency was added to the application.

state/handoffs/S00-011.md

@@ -0,0 +1,21 @@
+# S00-011 handoff
+
+Executor: auto-ci-cd-d105e8027730 (ci-cd).
+Result: the current fresh harness can reach the public npm registry with TLS
+verification enabled. The original npm view command returned exit 0. A fresh-cache
+probe retrieved react@19.3.1 (26394 bytes) and independently matched SHA-512 against
+registry metadata. No blocker; no external/harness configuration was modified.
+
+Review the scoped README, verify.py and .gitignore under
+experiments/0001-stack/registry-access. Repeat the original npm view command and
+run `python3 experiments/0001-stack/registry-access/verify.py`; generated artifacts
+are ignored. Verify explicit strict TLS, exact package/origin, empty npmrc/fresh
+cache, ignored lifecycle scripts, independent integrity comparison and scope.
+Evidence: state/evidence/S00-011-auto-ci-cd-d105e8027730.md.
+
+Security reviewer must independently accept or reject via CLI. Executor does not
+set done or unblock S00-002. After reviewed done, the coordinator queues a fresh
+S00-002 executor, which must retain working DNS/HTTPS egress and perform its own
+clean install/build. Current observed Node/npm versions and sample React version
+are not a stack selection. No app readiness, browser/provider behavior, signature
+verification or future/different-harness network availability is claimed.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 6,
+  "revision": 8,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -1120,10 +1120,14 @@
       "owner": null
     },
     "S00-011": {
-      "status": "todo",
-      "owner": null,
+      "status": "review",
+      "owner": "auto-ci-cd-d105e8027730",
       "external_wait": false,
-      "reason": "User authorized network access. runner.local.json now passes sandbox_workspace_write.network_access=true with workspace-write. Public npm metadata probe succeeded with TLS in a project-write/network-enabled Codex sandbox; S00-011 must independently verify the actual runner environment and package integrity before S00-002 is unblocked."
+      "reason": null,
+      "started_at": "2026-10-14T18:07:56+00:00",
+      "updated_at": "2026-10-14T18:10:10+00:00",
+      "evidence": "state/evidence/S00-011-auto-ci-cd-d105e8027730.md",
+      "handoff": "state/handoffs/S00-011.md"
     }
   },
   "events": [
@@ -1192,6 +1196,29 @@
       "task": "S00-011",
       "agent": "coordinator-network-0bc0fcf09c86",
       "reason": "User authorized network access. runner.local.json now passes sandbox_workspace_write.network_access=true with workspace-write. Public npm metadata probe succeeded with TLS in a project-write/network-enabled Codex sandbox; S00-011 must independently verify the actual runner environment and package integrity before S00-002 is unblocked."
+    },
+    {
+      "revision": 7,
+      "at": "2026-10-14T18:07:56+00:00",
+      "action": "claim",
+      "task": "S00-011",
+      "agent": "auto-ci-cd-d105e8027730",
+      "role": "ci-cd",
+      "from": "todo",
+      "to": "in_progress",
+      "reason": null
+    },
+    {
+      "revision": 8,
+      "at": "2026-10-14T18:10:10+00:00",
+      "action": "submit",
+      "task": "S00-011",
+      "agent": "auto-ci-cd-d105e8027730",
+      "role": null,
+      "from": "in_progress",
+      "to": "review",
+      "reason": null,
+      "evidence": "state/evidence/S00-011-auto-ci-cd-d105e8027730.md"
     }
   ],
   "retired_agents": [