55 Commits
Author SHA1 Message Date
wt 06f353b214 S00-011: Approve verified npm access after independent TLS and integrity checks
Changes: Accept the bounded S00-011 registry remediation; record independent security evidence and review handoff. Source probe and stack remain unchanged by review.
Validation: Original npm view and fresh-cache verify.py returned exit 0; 26394-byte react@19.3.1 matched registry SHA-512. Disabled TLS was refused with exit 1. make check passed 66 tests; executor patch/message, scope, ignore rules and whitespace checked. App build, provenance and future harness connectivity remain unverified.

Task: S00-011
Agent: auto-security-1e9200de1765
Role: security
Action: review
Status: done

Task title: Restore verified npm registry access for the stack spike
2026-10-15 01:11:33 +07:00
wt e4672fba91 S00-011: Verify public npm access and exact-version tarball integrity
Changes: Add a scoped fresh-cache registry probe, safe reproduction instructions and artifact ignore rule; record actual TLS-enabled metadata/download results and review handoff without selecting a stack or changing the harness.
Validation: Original npm view command and verify.py returned exit 0; react@19.3.1 tarball (26394 bytes) matched registry SHA-512. make check passed validation and 66 tooling tests. git diff --check passed. App install/build and different-harness connectivity remain unverified.

Task: S00-011
Agent: auto-ci-cd-d105e8027730
Role: ci-cd
Action: claim
Status: review

Task title: Restore verified npm registry access for the stack spike
2026-10-15 01:10:10 +07:00
wt b8afc70e5f S00-011: Release the npm access remediation for independent verification
Changes: Record user-authorized network configuration and release S00-011 external wait. Keep S00-002 blocked pending resolver implementation and independent security review.
Validation: Public npm metadata returned React 19.3.1 and MIT over TLS in a Codex sandbox allowing project and temporary writes plus network access. Actual runner connectivity and tarball integrity remain S00-011 acceptance checks.

Task: S00-011
Agent: coordinator-network-0bc0fcf09c86
Role: orchestrator
Action: release-external
Status: todo

Task title: Restore verified npm registry access for the stack spike
2026-10-15 01:07:56 +07:00
wt d91103ea1c S00-001: Approve the Web scope passport after independent security review
Changes: Accept ADR 0000 and record the independent reviewer, acceptance findings and handoff. Confirm native exclusion reasons, retained Web obligations, conditional push lifecycle and provider secret/metadata boundaries; transition S00-001 through the review CLI.
Validation: Reviewed executor commit d5ed7eaaed and its message against scope and evidence. python3 experiments/0000-scope/check.py passed ten IDs, seven states and four negative mutations. make check passed validation and all 66 tooling tests. No live browser/provider integration or crypto implementation was tested or accepted.

Task: S00-001
Agent: auto-security-bff4cfd4d38e
Role: security
Action: review
Status: done

Task title: Утвердить Web-профиль
2026-10-15 01:03:56 +07:00
wt d5ed7eaaed S00-001: Define the Web scope passport and native exclusion boundaries
Changes: Add proposed scope ADR with reasons for all ten excluded IDs, retained Web obligations, lifecycle limits, external provider roles and deferred decisions. Add a document coverage/lifecycle checker with four negative mutations and executor evidence/handoff for security review.
Validation: python3 experiments/0000-scope/check.py passed for ten excluded IDs and seven lifecycle scenarios; all four negative mutations were rejected. make check passed validation and 66 tooling tests. Whitespace and allowed source paths checked. No live browser or provider integration was tested; ADR awaits independent review.

Task: S00-001
Agent: auto-orchestrator-48aab142ecde
Role: orchestrator
Action: claim
Status: review

Task title: Утвердить Web-профиль
2026-10-15 01:01:57 +07:00