S00-011: Verify public npm access and exact-version tarball integrity

Changes: Add a scoped fresh-cache registry probe, safe reproduction instructions and artifact ignore rule; record actual TLS-enabled metadata/download results and review handoff without selecting a stack or changing the harness.
Validation: Original npm view command and verify.py returned exit 0; react@19.3.1 tarball (26394 bytes) matched registry SHA-512. make check passed validation and 66 tooling tests. git diff --check passed. App install/build and different-harness connectivity remain unverified.

Task: S00-011
Agent: auto-ci-cd-d105e8027730
Role: ci-cd
Action: claim
Status: review

Task title: Restore verified npm registry access for the stack spike

state/evidence/S00-011-auto-ci-cd-d105e8027730.md

@@ -0,0 +1,56 @@
+# S00-011 executor evidence
+
+Agent: auto-ci-cd-d105e8027730; role: ci-cd; date: 2026-10-15.
+Result: verified public npm metadata and integrity-checked exact-version tarball
+in the current fresh execution harness; awaiting independent security review.
+
+## Actual changes
+
+- experiments/0001-stack/registry-access/verify.py: dependency-free Python probe
+  runs npm with explicit HTTPS registry/strict TLS, empty configs and fresh cache,
+  retrieves react@19.3.1 without package scripts/install/extraction, checks exact
+  version/URL and independently compares SHA-512 with registry metadata.
+- Scoped README documents exact command forms/options, observed public results,
+  nonsecret environment prerequisites and limits. Scoped .gitignore excludes
+  retrieved artifacts. No stack, runtime pin or shared interface was selected.
+- Task evidence/handoff/commit message only outside that source scope. No Git,
+  harness, DNS, npm config, TLS, CORS, immutable specs or plan definitions changed.
+
+## Commands and actual results
+
+| Command | Exit | Result |
+| --- | --- | --- |
+| `python3 scripts/tasks.py resume --agent auto-ci-cd-d105e8027730` | 0 | Assigned S00-011 in_progress, no repeat claim. |
+| `python3 scripts/tasks.py show S00-011` | 0 | Bounded scope/acceptance read. |
+| `python3 scripts/tasks.py packet S00-011 --agent auto-ci-cd-d105e8027730` | 0 | Current requirements, dependency and no previous handoff. |
+| `npm view react version license engines --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000` | 0 | Original failed command now returns version 19.3.1, license MIT, engines node >=0.10.0. |
+| `node --version` / `npm --version` / `npm config get strict-ssl` | 0 each | v26.3.0 / 11.16.0 / true. Observations only. |
+| `python3 experiments/0001-stack/registry-access/verify.py` | 0 | Both npm children exit 0, fresh-cache metadata/download, 26394-byte tarball; independent SHA-512 match. |
+| `make check` | 0 | Validated 276 tasks, 22 stages, 221 requirements, 211 allocated Web requirements, revision 7; all 66 tooling tests passed in 10.411s. Foundation integrity only. |
+| `git diff --check` | 0 | No tracked whitespace errors; scoped untracked files also inspected directly. |
+
+Probe child commands and all options are recorded in the scoped README and source.
+Public URL: https://registry.npmjs.org/react/-/react-19.3.1.tgz
+
+Observed registry and calculated integrity:
+`sha512-QNhWdt7nrgVWWQG58QuGsAR3jv3Hbe4mb4vz7w2csnHavciZJgda1CPNaldF6eVxv90ud3jUXpKlHL69gO38yw==`.
+Public metadata and result JSON plus actual tarball remain locally in ignored
+artifacts/. Security reviewer should regenerate them, not accept this text alone.
+
+## Context and limits
+
+Read assigned instructions/card/packet, NFR-007 in specs/tz_clear.md, accepted
+ADR 0000 and S00-001 executor/review evidence/handoff. S01 contracts remain future
+work and none are changed/needed. The initial working tree showed only the
+coordinator's state/tasks.json claim change. No S00-011 handoff or stack experiment
+directory existed initially; their read/list attempts returned missing-path errors,
+not test failures or evidence of a network blocker.
+
+Current supplied harness has network enabled, workspace-write sandbox and never
+approval policy. No environment permission changes were necessary. The previous
+DNS failure no longer reproduces; the external correction mechanism is unknown.
+S00-002 must use registry-capable execution with TLS trust intact and perform its
+own version/license assessment, clean install/build and stack decision. Future or
+different harness connectivity, package signatures/provenance, browser/CORS,
+application build and app readiness are not verified by S00-011. No secrets or
+production account data were used. No dependency was added to the application.