S00-002: Record blocked task and remediation handoff

Changes: Preserve incomplete work and blocker metadata for S00-002. This checkpoint does not mark implementation accepted.
Validation: Session ended with status blocked.
Blocker: S00-002 cannot verify versions/licenses or run its required clean install/build: local npm lookup fails with getaddrinfo ENOTFOUND registry.npmjs.org. Restricted network and never-approval execution policy cannot be changed by this agent. External owner must supply registry-capable execution while preserving TLS validation and project-only writes.

Task: S00-002
Agent: auto-orchestrator-3a4f07103316
Role: orchestrator
Action: claim
Status: blocked

Task title: Выбрать framework и build runtime

planning/tasks/S00-002.md

@@ -5,7 +5,7 @@
 - Этап: S00
 - Оператор: orchestrator
 - Reviewer: security
-- Зависимости: S00-001
+- Зависимости: S00-001, S00-011
 - Требования: NFR-007
 
 ## Один результат

planning/tasks/S00-011.md

@@ -0,0 +1,57 @@
+# S00-011: Restore verified npm registry access for the stack spike
+
+- Remediation для: S00-002; root: S00-002; depth: 1
+
+> Generated from planning/tasks.json; status is in state/tasks.json.
+
+- Этап: S00
+- Оператор: ci-cd
+- Reviewer: security
+- Зависимости: S00-001
+- Требования: NFR-007
+
+## Один результат
+
+A documented registry-capable execution path with successful npm metadata and integrity-checked package tarball retrieval, allowing a fresh S00-002 executor to run its own spike.
+
+## Разрешённые пути
+
+- `experiments/0001-stack/registry-access/**`
+
+Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
+
+## Прочитать
+
+- docs/WEB_PROFILE.md
+- docs/ARCHITECTURE.md
+- docs/CONTRACTS.md
+- docs/TESTING.md
+- roles/orchestrator.md
+- docs/decisions/README.md
+- state/blockers/S00-011.md
+
+## Шаги
+
+1. External owner: provide working DNS and HTTPS egress to registry.npmjs.org/package tarballs in the agent harness without disabling TLS or the project write sandbox; no secrets requested.
+2. In a fresh resolver process verify public metadata and retrieve one exact-version package tarball in the scoped experiment directory, checking registry integrity metadata.
+3. Record exact commands, exit codes and nonsecret runner environment instructions in the scoped registry-access report; do not select the stack or implement rendering.
+4. Submit connectivity evidence for independent security review.
+
+## Приёмка
+
+1. npm metadata request succeeds with TLS validation enabled in the execution environment used for the next stack task.
+2. One exact-version package tarball is retrieved and checked against registry integrity metadata.
+3. No TLS/CORS bypass, secrets, shared module changes or premature stack selection; reproducible safe execution instructions recorded.
+
+## Focused checks
+
+1. Repeat the original npm view command and record exit 0 with actual package metadata.
+2. Retrieve and integrity-check one exact-version tarball over HTTPS; record actual result and environment constraints.
+
+## Блокер и завершение запуска
+
+Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
+
+## Передача
+
+Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.