S00-002: Approve the pinned UI stack after independent clean build checks

Changes: Accept ADR 0001 for the bounded React/TypeScript/Vite and Node/npm choice; record independent security findings and update S00-002 handoff. Preserve browser interaction and release/interoperability limits.
Validation: Fresh-cache npm ci and strict npm run build passed on Node 24.21.0/npm 11.19.0; lock and artifact SHA256 matched executor evidence. Verified exact pins, 67 locked license/integrity entries and installed runtime license notices. HTTP preview matched built HTML/JS; make check passed 72 tooling tests; scoped diff and whitespace checked. No DOM interaction, vulnerability/provenance or product readiness acceptance is claimed.

Task: S00-002
Agent: auto-security-bd73f4f80779
Role: security
Action: review
Status: done

Task title: Выбрать framework и build runtime

state/evidence/S00-002-review.md

@@ -0,0 +1,34 @@
+# S00-002 independent security review
+
+Reviewer: auto-security-bd73f4f80779 (security). Executor: auto-orchestrator-68a05c587e33 (orchestrator).
+Date: 2026-10-15. Decision: approve bounded framework/build-runtime selection; ADR 0001 accepted.
+
+Input: master/startup/role/workflow documents, assigned CLI card/packet, required TESTING/orchestrator/ADR registry reads, exact NFR-007, accepted ADR 0000, all direct dependency executor/review evidence and handoffs, original handoff and executor evidence/message.
+Output: accepted ADR metadata and independent review report. Acceptance: two-stack comparison, verified exact pins/lock and one rendering spike, clean install/build, licenses/runtime/browser limits and scoped handoff.
+
+## Findings
+
+Examined implementation commit 59b9ff62fed3d912215bf818a20eeba271ff4f4f, its message, scoped source files and lock graph; prior S00-002 registry-block checkpoint f1d7072 is identified in history. The message matches the actual ADR, TSX spike, pins, notices and recorded limitations. Initial and pre-report working trees were clean. Implementation source changes are limited to docs/decisions/0001-stack.md and experiments/0001-stack; other commit paths are workflow/generated artifacts. Registry-access probe is unchanged. No immutable spec, shared contract, application module or plan definition was modified by the stack implementation or this review.
+
+React and Vue are both viable typed static UI candidates. The reason for choosing TSX is explicit and bounded, with no invented superiority claim. Vue was compared through documentation/metadata, not built or benchmarked. Exact React/React DOM 19.3.1, types 19.3.0, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0 are consistent with the manifest/lock and actual install/build. TypeScript is strict with skipLibCheck disabled. Lockfile v3 records public HTTPS URLs and SHA512 integrity for all 67 package entries. License inventory covers each exact locked package, including optional platforms. React/React DOM/Scheduler installed LICENSE texts match THIRD_PARTY_NOTICES.md. Build-only MPL-2.0 and future distribution obligations are recorded without claiming release license clearance.
+
+The authored UI uses createRoot/useState and ordinary JSX, with no unsafe HTML insertion or untrusted input path. It has no account credentials, real messages, crypto/transport, external runtime assets, analytics, gateway or persistent storage. Loopback dev/preview binds 127.0.0.1 and does not bypass a production TLS/CORS boundary. .npmrc retains strict TLS and engines; installs disable lifecycle scripts. Runtime guard rejects missing expected npm context. This guard is a reproducibility check, not authentication against forged environment metadata. Lock integrity similarly does not prove package provenance or absence of vulnerabilities.
+
+Compiler floors, lack of API polyfills, platform-native build binaries and separate S00-006 browser decision are explicit. Clean install/build is mandatory for this card and independently passed. DOM clicks were not executed by this reviewer; executor reports unavailable browsers. This limit is explicitly preserved, not labeled passed. No acceptance defect or review blocker found.
+
+## Actual independent checks
+
+- python3 scripts/tasks.py resume --agent auto-security-bd73f4f80779; show S00-002; packet S00-002 --agent auto-security-bd73f4f80779: exit 0 each. Empty owned list is expected for reviewer; different executor; prerequisites done; no claim.
+- Read-only git status/log/show, scoped file/dependency reads and exact NFR-007 lookup: exit 0. An initial guessed ADR filename 0000-web-scope.md was absent; rg located and read the required existing 0000-scope.md. No required artifact is missing.
+- From experiments/0001-stack with PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH: node --version and npm --version exit 0, v24.21.0/11.19.0. Existing isolated executor runtime reused; no new archive or detached-signature verification claimed.
+- npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-review-bd73f4f80779 --fetch-retries=0 --fetch-timeout=15000: exit 0; new reviewer cache, 24 installed packages in 5 seconds.
+- npm run build: exit 0; guard, strict tsc --noEmit and Vite 8.3.4 build, 14 modules, HTML 0.29 kB and JS 219.87 kB / gzip 68.75 kB.
+- Inline Python JSON/license/hash assertions: exit 0. Verified six exact direct pins, manifest/lock agreement, all 67 HTTPS/SHA512/license entries and full installed runtime license texts. Lock SHA256 7b2dee5e231629c30501194fa40346ba9f0752cea32a4eb9d91e8f5d4b5ab47f; HTML 67962911c9b0bcb45d6a13f9d0e5877cfa0164c09d2e2128407db84889026a73; JS 3cbf3f9adf300aeb52b465fe9e78530103fa5b23fb22e6beae768faa3a8b0f04. All match executor evidence.
+- Same Python wrapper runs pinned node tools/check-runtime.mjs without npm_config_user_agent: child exit 1, asserted expected refusal; wrapper exit 0. No source mutation.
+- Python subprocess/urllib preview wrapper: exit 0. npm run preview -- --port 4173 --strictPort; HTTP 200 HTML and JS both match exact built bytes. Process group terminated/reaped in finally. No DOM execution claimed.
+- make check > /private/tmp/luma-S00-002-bd73f4f80779-check.log 2>&1: exit 0; 72 tests passed in 18.612s. Foundation integrity only.
+- git diff --check and git status --short before review metadata: exit 0, clean working tree. Final scoped review diff/whitespace inspection also exit 0.
+
+Independently opened primary sources on 2026-10-15: [React from-scratch setup](https://react.dev/learn/build-a-react-app-from-scratch), [Vue TypeScript tooling](https://vuejs.org/guide/typescript/overview.html), [Vite production build](https://vite.dev/guide/build.html), [Node release lifecycle](https://nodejs.org/en/about/previous-releases). They support the stated candidate tooling, syntax floors/no automatic API polyfills and LTS choice; this is not browser compatibility execution.
+
+Reviewer changes only ADR acceptance metadata/paragraph, this report, handoff and mandatory commit message plus CLI-generated transition. No browser DOM, cross-platform reproducibility, vulnerability audit, package provenance, XMPP/crypto/media/provider interoperability or application/release readiness was verified or accepted. Coordinator owns commit and next fresh session. Reviewer ends immediately after approve; done without coordinator commit is not a completed automation cycle.