S00-002: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-002. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-002 cannot verify versions/licenses or run its required clean install/build: local npm lookup fails with getaddrinfo ENOTFOUND registry.npmjs.org. Restricted network and never-approval execution policy cannot be changed by this agent. External owner must supply registry-capable execution while preserving TLS validation and project-only writes.

Task: S00-002
Agent: auto-orchestrator-3a4f07103316
Role: orchestrator
Action: claim
Status: blocked

Task title: Выбрать framework и build runtime

planning/ROADMAP.md

@@ -6,7 +6,7 @@
 
 Зафиксировать Web scope, browser targets и проверенные кандидаты, не устанавливая непроверенный framework по догадке.
 
-Задач: 10; entry: нет; exit: S00-010.
+Задач: 11; entry: нет; exit: S00-010.
 
 ## [S01: Предметные контракты](stages/S01.md)
 

planning/TASK_MATRIX.md

@@ -1,11 +1,11 @@
 # Матрица задач
 
-Generated; state revision **3**. Canonical status: state/tasks.json.
+Generated; state revision **5**. Canonical status: state/tasks.json.
 
 | ID | Этап | Оператор | Reviewer | Статус | Owner | Зависимости | Задача |
 | --- | --- | --- | --- | --- | --- | --- | --- |
 | [S00-001](tasks/S00-001.md) | S00 | orchestrator | security | done | auto-orchestrator-48aab142ecde |  | Утвердить Web-профиль |
-| [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | todo |  | S00-001 | Выбрать framework и build runtime |
+| [S00-002](tasks/S00-002.md) | S00 | orchestrator | security | blocked | auto-orchestrator-3a4f07103316 | S00-001, S00-011 | Выбрать framework и build runtime |
 | [S00-003](tasks/S00-003.md) | S00 | protocol | qa | todo |  | S00-001, S00-002 | Проверить XMPP WSS/auth библиотеку |
 | [S00-004](tasks/S00-004.md) | S00 | crypto | security | todo |  | S00-001, S00-002 | Проверить browser OMEMO backend |
 | [S00-005](tasks/S00-005.md) | S00 | storage | qa | todo |  | S00-002 | Выбрать IndexedDB wrapper и migration policy |
@@ -13,6 +13,7 @@ Generated; state revision **3**. Canonical status: state/tasks.json.
 | [S00-007](tasks/S00-007.md) | S00 | security | orchestrator | todo |  | S00-004, S00-005 | Утвердить password и crypto unlock модель |
 | [S00-008](tasks/S00-008.md) | S00 | ci-cd | qa | todo |  | S00-003, S00-004 | Описать WSS/upload/TURN/push topology |
 | [S00-009](tasks/S00-009.md) | S00 | orchestrator | security | todo |  | S00-003, S00-004, S00-005, S00-006, S00-007, S00-008 | Согласовать результаты spikes |
+| [S00-011](tasks/S00-011.md) | S00 | ci-cd | security | blocked |  | S00-001 | Restore verified npm registry access for the stack spike |
 | [S00-010](tasks/S00-010.md) | S00 | qa | orchestrator | todo |  | S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009 | Gate: Профиль и проверка стека |
 | [S01-001](tasks/S01-001.md) | S01 | orchestrator | security | todo |  | S00-010 | Описать identity/model contracts |
 | [S01-002](tasks/S01-002.md) | S01 | orchestrator | security | todo |  | S00-010, S01-001 | Описать async account context |

planning/TRACEABILITY.md

@@ -204,7 +204,7 @@ Allocated означает наличие плана/приёмки, а не р
 | NFR-004 | web | Web requirement; cross-platform clauses apply only in Web context. | S02-012, S09-012, S21-007 |
 | NFR-005 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-006, S02-012, S09-012, S20-006, S21-011 |
 | NFR-006 | web | Web requirement; cross-platform clauses apply only in Web context. | S02-012, S09-012 |
-| NFR-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-002, S02-001, S02-002, S09-012, S21-008, S21-009 |
+| NFR-007 | web | Web requirement; cross-platform clauses apply only in Web context. | S00-002, S00-011, S02-001, S02-002, S09-012, S21-008, S21-009 |
 | NFR-008 | web | Web requirement; cross-platform clauses apply only in Web context. | S02-004, S02-005, S02-006, S09-012, S21-009 |
 | NFR-009 | web | Web requirement; cross-platform clauses apply only in Web context. | S02-012, S09-012, S19-006, S20-003, S21-010 |
 | UI-001 | web | Web requirement; cross-platform clauses apply only in Web context. | S03-002, S20-001, S21-006 |

planning/stages/S00.md

@@ -7,7 +7,7 @@
 ## Задачи
 
 - [S00-001](../tasks/S00-001.md): Утвердить Web-профиль — orchestrator; done.
-- [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; todo.
+- [S00-002](../tasks/S00-002.md): Выбрать framework и build runtime — orchestrator; blocked.
 - [S00-003](../tasks/S00-003.md): Проверить XMPP WSS/auth библиотеку — protocol; todo.
 - [S00-004](../tasks/S00-004.md): Проверить browser OMEMO backend — crypto; todo.
 - [S00-005](../tasks/S00-005.md): Выбрать IndexedDB wrapper и migration policy — storage; todo.
@@ -15,6 +15,7 @@
 - [S00-007](../tasks/S00-007.md): Утвердить password и crypto unlock модель — security; todo.
 - [S00-008](../tasks/S00-008.md): Описать WSS/upload/TURN/push topology — ci-cd; todo.
 - [S00-009](../tasks/S00-009.md): Согласовать результаты spikes — orchestrator; todo.
+- [S00-011](../tasks/S00-011.md): Restore verified npm registry access for the stack spike — ci-cd; blocked.
 - [S00-010](../tasks/S00-010.md): Gate: Профиль и проверка стека — qa; todo.
 
 ## Граница этапа

planning/task_matrix.csv

@@ -1,6 +1,6 @@
 id,stage,operator,reviewer,status,owner,depends_on,title
 S00-001,S00,orchestrator,security,done,auto-orchestrator-48aab142ecde,,Утвердить Web-профиль
-S00-002,S00,orchestrator,security,todo,,S00-001,Выбрать framework и build runtime
+S00-002,S00,orchestrator,security,blocked,auto-orchestrator-3a4f07103316,"S00-001, S00-011",Выбрать framework и build runtime
 S00-003,S00,protocol,qa,todo,,"S00-001, S00-002",Проверить XMPP WSS/auth библиотеку
 S00-004,S00,crypto,security,todo,,"S00-001, S00-002",Проверить browser OMEMO backend
 S00-005,S00,storage,qa,todo,,S00-002,Выбрать IndexedDB wrapper и migration policy
@@ -8,6 +8,7 @@ S00-006,S00,orchestrator,security,todo,,S00-002,Зафиксировать brows
 S00-007,S00,security,orchestrator,todo,,"S00-004, S00-005",Утвердить password и crypto unlock модель
 S00-008,S00,ci-cd,qa,todo,,"S00-003, S00-004",Описать WSS/upload/TURN/push topology
 S00-009,S00,orchestrator,security,todo,,"S00-003, S00-004, S00-005, S00-006, S00-007, S00-008",Согласовать результаты spikes
+S00-011,S00,ci-cd,security,blocked,,S00-001,Restore verified npm registry access for the stack spike
 S00-010,S00,qa,orchestrator,todo,,"S00-001, S00-002, S00-003, S00-004, S00-005, S00-006, S00-007, S00-008, S00-009",Gate: Профиль и проверка стека
 S01-001,S01,orchestrator,security,todo,,S00-010,Описать identity/model contracts
 S01-002,S01,orchestrator,security,todo,,"S00-010, S01-001",Описать async account context

planning/tasks.json

@@ -215,7 +215,8 @@
       "title": "Выбрать framework и build runtime",
       "outcome": "ADR сравнивает два допустимых стека, фиксирует конкретные проверенные versions, lockfile и один минимальный rendering spike.",
       "depends_on": [
-        "S00-001"
+        "S00-001",
+        "S00-011"
       ],
       "requirements": [
         "NFR-007"
@@ -617,6 +618,56 @@
       ],
       "context_budget_chars": 48000
     },
+    {
+      "id": "S00-011",
+      "stage": "S00",
+      "kind": "blocker",
+      "root_task": "S00-002",
+      "blocker_depth": 1,
+      "unblocks": [
+        "S00-002"
+      ],
+      "role": "ci-cd",
+      "reviewer_role": "security",
+      "title": "Restore verified npm registry access for the stack spike",
+      "outcome": "A documented registry-capable execution path with successful npm metadata and integrity-checked package tarball retrieval, allowing a fresh S00-002 executor to run its own spike.",
+      "depends_on": [
+        "S00-001"
+      ],
+      "requirements": [
+        "NFR-007"
+      ],
+      "scope": [
+        "experiments/0001-stack/registry-access/**"
+      ],
+      "inputs": [
+        "docs/WEB_PROFILE.md",
+        "docs/ARCHITECTURE.md",
+        "docs/CONTRACTS.md",
+        "docs/TESTING.md",
+        "roles/orchestrator.md",
+        "docs/decisions/README.md",
+        "state/blockers/S00-011.md"
+      ],
+      "spec_sections": [],
+      "ui_sections": [],
+      "steps": [
+        "External owner: provide working DNS and HTTPS egress to registry.npmjs.org/package tarballs in the agent harness without disabling TLS or the project write sandbox; no secrets requested.",
+        "In a fresh resolver process verify public metadata and retrieve one exact-version package tarball in the scoped experiment directory, checking registry integrity metadata.",
+        "Record exact commands, exit codes and nonsecret runner environment instructions in the scoped registry-access report; do not select the stack or implement rendering.",
+        "Submit connectivity evidence for independent security review."
+      ],
+      "acceptance": [
+        "npm metadata request succeeds with TLS validation enabled in the execution environment used for the next stack task.",
+        "One exact-version package tarball is retrieved and checked against registry integrity metadata.",
+        "No TLS/CORS bypass, secrets, shared module changes or premature stack selection; reproducible safe execution instructions recorded."
+      ],
+      "checks": [
+        "Repeat the original npm view command and record exit 0 with actual package metadata.",
+        "Retrieve and integrity-check one exact-version tarball over HTTPS; record actual result and environment constraints."
+      ],
+      "context_budget_chars": 48000
+    },
     {
       "id": "S00-010",
       "stage": "S00",

planning/tasks/S00-002.md

@@ -5,7 +5,7 @@
 - Этап: S00
 - Оператор: orchestrator
 - Reviewer: security
-- Зависимости: S00-001
+- Зависимости: S00-001, S00-011
 - Требования: NFR-007
 
 ## Один результат

planning/tasks/S00-011.md

@@ -0,0 +1,57 @@
+# S00-011: Restore verified npm registry access for the stack spike
+
+- Remediation для: S00-002; root: S00-002; depth: 1
+
+> Generated from planning/tasks.json; status is in state/tasks.json.
+
+- Этап: S00
+- Оператор: ci-cd
+- Reviewer: security
+- Зависимости: S00-001
+- Требования: NFR-007
+
+## Один результат
+
+A documented registry-capable execution path with successful npm metadata and integrity-checked package tarball retrieval, allowing a fresh S00-002 executor to run its own spike.
+
+## Разрешённые пути
+
+- `experiments/0001-stack/registry-access/**`
+
+Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
+
+## Прочитать
+
+- docs/WEB_PROFILE.md
+- docs/ARCHITECTURE.md
+- docs/CONTRACTS.md
+- docs/TESTING.md
+- roles/orchestrator.md
+- docs/decisions/README.md
+- state/blockers/S00-011.md
+
+## Шаги
+
+1. External owner: provide working DNS and HTTPS egress to registry.npmjs.org/package tarballs in the agent harness without disabling TLS or the project write sandbox; no secrets requested.
+2. In a fresh resolver process verify public metadata and retrieve one exact-version package tarball in the scoped experiment directory, checking registry integrity metadata.
+3. Record exact commands, exit codes and nonsecret runner environment instructions in the scoped registry-access report; do not select the stack or implement rendering.
+4. Submit connectivity evidence for independent security review.
+
+## Приёмка
+
+1. npm metadata request succeeds with TLS validation enabled in the execution environment used for the next stack task.
+2. One exact-version package tarball is retrieved and checked against registry integrity metadata.
+3. No TLS/CORS bypass, secrets, shared module changes or premature stack selection; reproducible safe execution instructions recorded.
+
+## Focused checks
+
+1. Repeat the original npm view command and record exit 0 with actual package metadata.
+2. Retrieve and integrity-check one exact-version tarball over HTTPS; record actual result and environment constraints.
+
+## Блокер и завершение запуска
+
+Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
+
+## Передача
+
+Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.