S00-002: Approve the pinned UI stack after independent clean build checks

Changes: Accept ADR 0001 for the bounded React/TypeScript/Vite and Node/npm choice; record independent security findings and update S00-002 handoff. Preserve browser interaction and release/interoperability limits.
Validation: Fresh-cache npm ci and strict npm run build passed on Node 24.21.0/npm 11.19.0; lock and artifact SHA256 matched executor evidence. Verified exact pins, 67 locked license/integrity entries and installed runtime license notices. HTTP preview matched built HTML/JS; make check passed 72 tooling tests; scoped diff and whitespace checked. No DOM interaction, vulnerability/provenance or product readiness acceptance is claimed.

Task: S00-002
Agent: auto-security-bd73f4f80779
Role: security
Action: review
Status: done

Task title: Выбрать framework и build runtime

docs/decisions/0001-stack.md

@@ -1,10 +1,10 @@
 # ADR 0001: Framework and build runtime for Luma Web
 
-- Status: proposed — awaits independent security review of S00-002.
+- Status: accepted — independent security review of S00-002; evidence: `state/evidence/S00-002-review.md`.
 - Task / requirement: S00-002 / NFR-007.
 - Date: 2026-10-15.
 - Decision owner: auto-orchestrator-68a05c587e33 (orchestrator).
-- Reviewer: assigned security role; acceptance and reviewer ID are not yet recorded.
+- Reviewer: auto-security-bd73f4f80779 (security), 2026-10-15.
 
 ## Context and required capabilities
 
@@ -39,7 +39,7 @@ Sources:
 
 ## Decision
 
-Propose React 19.3.1 / React DOM 19.3.1, TypeScript 7.0.2 and Vite 8.3.4, built with Node 24.21.0 LTS and its bundled npm 11.19.0. Use `.ts` for non-UI typed modules and `.tsx` for React UI; ESM imports and strict TypeScript checking. This is a project engineering choice, not a requirement imposed by the product specification. TSX keeps ordinary typed module imports and UI checks on the same compiler path, fitting the existing domain/application/ports boundaries. Vue is viable; no claim of React performance/security superiority is made.
+Select React 19.3.1 / React DOM 19.3.1, TypeScript 7.0.2 and Vite 8.3.4, built with Node 24.21.0 LTS and its bundled npm 11.19.0. Use `.ts` for non-UI typed modules and `.tsx` for React UI; ESM imports and strict TypeScript checking. This is a project engineering choice, not a requirement imposed by the product specification. TSX keeps ordinary typed module imports and UI checks on the same compiler path, fitting the existing domain/application/ports boundaries. Vue is viable; no claim of React performance/security superiority is made.
 
 The six direct dependencies have exact versions, with no range operators. `package-lock.json` version 3 locks transitive/optional platform packages with registry URLs and integrity. `.nvmrc`, exact engines, packageManager and the build runtime guard establish tool pins; `.npmrc` requires strict engines and verified HTTPS. Node and npm are build tools; they are not a browser runtime or a selected push gateway stack. Lockfile updates require explicit review, not automatic floating upgrades.
 
@@ -75,3 +75,7 @@ The loopback HTTP dev/preview server serves only this synthetic local UI. It doe
 After separate acceptance, downstream tasks may create stack-specific `.ts`/`.tsx` modules within their own cards, establish application CI/build and implement reviewed S01 contracts. No other module, plan definition, requirement snapshot or shared contract is changed here. The reviewed registry-access probe is retained unchanged.
 
 A need for validated older browsers, unavailable native build-host packages, an incompatible required crypto/protocol dependency, or unacceptable measured UI behavior triggers a new bounded ADR/plan change and experiment. Do not replace this stack or introduce plaintext/stub fallbacks silently. A future revision may select Vue after real evidence; the unbuilt candidate is not represented as tested. Reviewer should verify exact pins/lock integrity/license notices, reproduce clean install/build, assess stated limits and record acceptance before consumers treat this ADR as accepted.
+
+## Independent acceptance
+
+Security reviewer auto-security-bd73f4f80779 repeated fresh-cache npm ci and strict typecheck/build on Node 24.21.0/npm 11.19.0, verified manifest/lock pins, all 67 locked license/integrity entries and runtime notice texts, and matched executor artifact hashes. Loopback preview served identical HTML/JS; make check passed 72 tooling tests. The bounded stack decision is accepted. DOM interaction was not executed in this review; product browser matrix, interoperability, vulnerability/provenance assessment and release readiness remain outside this acceptance. Review evidence records commands and limits; coordinator owns the review commit.

planning/TASK_MATRIX.md

@@ -1,11 +1,11 @@
 # Матрица задач
 
-Generated; state revision **35**. Canonical status: state/tasks.json.
+Generated; state revision **36**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | done | auto-orchestrator-48aab142ecde |  | Утвердить Web-профиль |
-| [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | review | auto-orchestrator-68a05c587e33 | S00-001, S00-011, S00-012 | Выбрать framework и build runtime |
+| [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | done | auto-orchestrator-68a05c587e33 | S00-001, S00-011, S00-012 | Выбрать framework и build runtime |
 | [S00-003](tasks/S00-003.md) | S00 | protocol | qa | todo |  | S00-001, S00-002 | Проверить XMPP WSS/auth библиотеку |
 | [S00-004](tasks/S00-004.md) | S00 | crypto | security | todo |  | S00-001, S00-002 | Проверить browser OMEMO backend |
 | [S00-005](tasks/S00-005.md) | S00 | storage | qa | todo |  | S00-002 | Выбрать IndexedDB wrapper и migration policy |

planning/stages/S00.md

@@ -7,7 +7,7 @@
 ## Задачи
 
 - [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; done.
-- [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; review.
+- [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; done.
 - [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; todo.
 - [S00-004](../tasks/S00-004.md): Проверить browser OMEMO backend — crypto; todo.
 - [S00-005](../tasks/S00-005.md): Выбрать IndexedDB wrapper и migration policy — storage; todo.

planning/task_matrix.csv

@@ -1,6 +1,6 @@
 id,stage,operator,reviewer,status,owner,depends_on,title
 S00-001,S00,orchestrator,security,done,auto-orchestrator-48aab142ecde,,Утвердить Web-профиль
-S00-002,S00,orchestrator,security,review,auto-orchestrator-68a05c587e33,"S00-001, S00-011, S00-012",Выбрать framework и build runtime
+S00-002,S00,orchestrator,security,done,auto-orchestrator-68a05c587e33,"S00-001, S00-011, S00-012",Выбрать framework и build runtime
 S00-003,S00,protocol,qa,todo,,"S00-001, S00-002",Проверить XMPP WSS/auth библиотеку
 S00-004,S00,crypto,security,todo,,"S00-001, S00-002",Проверить browser OMEMO backend
 S00-005,S00,storage,qa,todo,,S00-002,Выбрать IndexedDB wrapper и migration policy

state/commit_messages/auto-security-bd73f4f80779.txt

@@ -0,0 +1,4 @@
+Approve the pinned UI stack after independent clean build checks
+
+Changes: Accept ADR 0001 for the bounded React/TypeScript/Vite and Node/npm choice; record independent security findings and update S00-002 handoff. Preserve browser interaction and release/interoperability limits.
+Validation: Fresh-cache npm ci and strict npm run build passed on Node 24.21.0/npm 11.19.0; lock and artifact SHA256 matched executor evidence. Verified exact pins, 67 locked license/integrity entries and installed runtime license notices. HTTP preview matched built HTML/JS; make check passed 72 tooling tests; scoped diff and whitespace checked. No DOM interaction, vulnerability/provenance or product readiness acceptance is claimed.

state/evidence/S00-002-review.md

@@ -0,0 +1,34 @@
+# S00-002 independent security review
+
+Reviewer: auto-security-bd73f4f80779 (security). Executor: auto-orchestrator-68a05c587e33 (orchestrator).
+Date: 2026-10-15. Decision: approve bounded framework/build-runtime selection; ADR 0001 accepted.
+
+Input: master/startup/role/workflow documents, assigned CLI card/packet, required TESTING/orchestrator/ADR registry reads, exact NFR-007, accepted ADR 0000, all direct dependency executor/review evidence and handoffs, original handoff and executor evidence/message.
+Output: accepted ADR metadata and independent review report. Acceptance: two-stack comparison, verified exact pins/lock and one rendering spike, clean install/build, licenses/runtime/browser limits and scoped handoff.
+
+## Findings
+
+Examined implementation commit 59b9ff62fed3d912215bf818a20eeba271ff4f4f, its message, scoped source files and lock graph; prior S00-002 registry-block checkpoint f1d7072 is identified in history. The message matches the actual ADR, TSX spike, pins, notices and recorded limitations. Initial and pre-report working trees were clean. Implementation source changes are limited to docs/decisions/0001-stack.md and experiments/0001-stack; other commit paths are workflow/generated artifacts. Registry-access probe is unchanged. No immutable spec, shared contract, application module or plan definition was modified by the stack implementation or this review.
+
+React and Vue are both viable typed static UI candidates. The reason for choosing TSX is explicit and bounded, with no invented superiority claim. Vue was compared through documentation/metadata, not built or benchmarked. Exact React/React DOM 19.3.1, types 19.3.0, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0 are consistent with the manifest/lock and actual install/build. TypeScript is strict with skipLibCheck disabled. Lockfile v3 records public HTTPS URLs and SHA512 integrity for all 67 package entries. License inventory covers each exact locked package, including optional platforms. React/React DOM/Scheduler installed LICENSE texts match THIRD_PARTY_NOTICES.md. Build-only MPL-2.0 and future distribution obligations are recorded without claiming release license clearance.
+
+The authored UI uses createRoot/useState and ordinary JSX, with no unsafe HTML insertion or untrusted input path. It has no account credentials, real messages, crypto/transport, external runtime assets, analytics, gateway or persistent storage. Loopback dev/preview binds 127.0.0.1 and does not bypass a production TLS/CORS boundary. .npmrc retains strict TLS and engines; installs disable lifecycle scripts. Runtime guard rejects missing expected npm context. This guard is a reproducibility check, not authentication against forged environment metadata. Lock integrity similarly does not prove package provenance or absence of vulnerabilities.
+
+Compiler floors, lack of API polyfills, platform-native build binaries and separate S00-006 browser decision are explicit. Clean install/build is mandatory for this card and independently passed. DOM clicks were not executed by this reviewer; executor reports unavailable browsers. This limit is explicitly preserved, not labeled passed. No acceptance defect or review blocker found.
+
+## Actual independent checks
+
+- python3 scripts/tasks.py resume --agent auto-security-bd73f4f80779; show S00-002; packet S00-002 --agent auto-security-bd73f4f80779: exit 0 each. Empty owned list is expected for reviewer; different executor; prerequisites done; no claim.
+- Read-only git status/log/show, scoped file/dependency reads and exact NFR-007 lookup: exit 0. An initial guessed ADR filename 0000-web-scope.md was absent; rg located and read the required existing 0000-scope.md. No required artifact is missing.
+- From experiments/0001-stack with PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH: node --version and npm --version exit 0, v24.21.0/11.19.0. Existing isolated executor runtime reused; no new archive or detached-signature verification claimed.
+- npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-review-bd73f4f80779 --fetch-retries=0 --fetch-timeout=15000: exit 0; new reviewer cache, 24 installed packages in 5 seconds.
+- npm run build: exit 0; guard, strict tsc --noEmit and Vite 8.3.4 build, 14 modules, HTML 0.29 kB and JS 219.87 kB / gzip 68.75 kB.
+- Inline Python JSON/license/hash assertions: exit 0. Verified six exact direct pins, manifest/lock agreement, all 67 HTTPS/SHA512/license entries and full installed runtime license texts. Lock SHA256 7b2dee5e231629c30501194fa40346ba9f0752cea32a4eb9d91e8f5d4b5ab47f; HTML 67962911c9b0bcb45d6a13f9d0e5877cfa0164c09d2e2128407db84889026a73; JS 3cbf3f9adf300aeb52b465fe9e78530103fa5b23fb22e6beae768faa3a8b0f04. All match executor evidence.
+- Same Python wrapper runs pinned node tools/check-runtime.mjs without npm_config_user_agent: child exit 1, asserted expected refusal; wrapper exit 0. No source mutation.
+- Python subprocess/urllib preview wrapper: exit 0. npm run preview -- --port 4173 --strictPort; HTTP 200 HTML and JS both match exact built bytes. Process group terminated/reaped in finally. No DOM execution claimed.
+- make check > /private/tmp/luma-S00-002-bd73f4f80779-check.log 2>&1: exit 0; 72 tests passed in 18.612s. Foundation integrity only.
+- git diff --check and git status --short before review metadata: exit 0, clean working tree. Final scoped review diff/whitespace inspection also exit 0.
+
+Independently opened primary sources on 2026-10-15: [React from-scratch setup](https://react.dev/learn/build-a-react-app-from-scratch), [Vue TypeScript tooling](https://vuejs.org/guide/typescript/overview.html), [Vite production build](https://vite.dev/guide/build.html), [Node release lifecycle](https://nodejs.org/en/about/previous-releases). They support the stated candidate tooling, syntax floors/no automatic API polyfills and LTS choice; this is not browser compatibility execution.
+
+Reviewer changes only ADR acceptance metadata/paragraph, this report, handoff and mandatory commit message plus CLI-generated transition. No browser DOM, cross-platform reproducibility, vulnerability audit, package provenance, XMPP/crypto/media/provider interoperability or application/release readiness was verified or accepted. Coordinator owns commit and next fresh session. Reviewer ends immediately after approve; done without coordinator commit is not a completed automation cycle.

state/handoffs/S00-002.md

@@ -10,3 +10,6 @@ Next step belongs only to separate assigned security reviewer. Read ADR/card/evi
 DOM rendering/counter interaction is an external check: no browser is exposed by this harness. README gives manual steps; do not label them passed. Current compiler floors are not the product browser matrix. Vue was not built or benchmarked. Crypto/XMPP compatibility, full app CI, notices for future libraries, other build-host platforms, provider integration and release readiness remain subsequent cards. Shared contracts/specs/plan definitions unchanged. ADR remains proposed; executor does not set done or perform Git mutations. Coordinator commits this submission and launches the reviewer.
 
 Review startup blocker reported by manual-security-stdin-20261015a: assigned reviewer never received complete stdin/EOF. Runner stopped cleanly by supervisor; no acceptance review performed. Diagnostic evidence: state/evidence/S00-002-manual-security-stdin-20261015a.md. Implementation commit 59b9ff6 remains preserved. Separate runner transport remediation must be reviewed before original review resumes.
+
+
+Independent security review: auto-security-bd73f4f80779, 2026-10-15. Accepted bounded S00-002 and ADR 0001 after fresh-cache npm ci/build, matching lock/artifact hashes, exact pin/license/notice checks, HTTP preview and make check (72 tests), all exit 0. Review evidence: state/evidence/S00-002-review.md. No blocker. DOM interaction remains unexecuted; browser product matrix, protocol/crypto compatibility and release checks remain later cards. Previous startup blocker was resolved through independently reviewed S00-012; this fresh review received complete inputs. Coordinator must commit the review transition before any next fresh session.

state/tasks.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "revision": 35,
+  "revision": 36,
   "tasks": {
     "S00-001": {
       "status": "done",
@@ -15,18 +15,21 @@
       "completed_at": "2026-10-14T18:03:56+00:00"
     },
     "S00-002": {
-      "status": "review",
+      "status": "done",
       "owner": "auto-orchestrator-68a05c587e33",
       "started_at": "2026-10-14T18:11:33+00:00",
       "reason": null,
-      "updated_at": "2026-10-14T19:03:50+00:00",
+      "updated_at": "2026-10-14T19:06:23+00:00",
       "blocked_by": [],
       "resume_status": "review",
       "blocker_report": "state/blockers/S00-012.md",
       "handoff": "state/handoffs/S00-002.md",
       "previous_owner": "auto-orchestrator-68a05c587e33",
       "resumed_after_blocker": true,
-      "evidence": "state/evidence/S00-002-auto-orchestrator-68a05c587e33.md"
+      "evidence": "state/evidence/S00-002-auto-orchestrator-68a05c587e33.md",
+      "reviewer": "auto-security-bd73f4f80779",
+      "review_evidence": "state/evidence/S00-002-review.md",
+      "completed_at": "2026-10-14T19:06:23+00:00"
     },
     "S00-003": {
       "status": "todo",
@@ -1663,6 +1666,18 @@
       "to": "done",
       "reason": null,
       "evidence": "state/evidence/S00-012-review.md"
+    },
+    {
+      "revision": 36,
+      "at": "2026-10-14T19:06:23+00:00",
+      "action": "approve",
+      "task": "S00-002",
+      "agent": "auto-security-bd73f4f80779",
+      "role": "security",
+      "from": "review",
+      "to": "done",
+      "reason": null,
+      "evidence": "state/evidence/S00-002-review.md"
     }
   ],
   "retired_agents": [