# S00-027: Restore approved npm registry connectivity for the OMEMO2 backend investigation

- Remediation для: S00-022; root: S00-004; depth: 2

> Generated from planning/tasks.json; status is in state/tasks.json.

- Этап: S00
- Оператор: ci-cd
- Reviewer: security
- Зависимости: S00-001, S00-002, S00-021
- Требования: ENC-003, ENC-009, ENC-011

## Один результат

One independently reviewed connectivity record proving that the fresh project agent can retrieve real libomemo.js and libsignal-client metadata and a pinned candidate artifact through approved HTTPS registry access.

## Разрешённые пути

- `docs/decisions/0003-registry-connectivity.md`

Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.

## Прочитать

- docs/WEB_PROFILE.md
- docs/ARCHITECTURE.md
- docs/CONTRACTS.md
- docs/TESTING.md
- roles/crypto.md
- docs/decisions/README.md
- state/blockers/S00-022.md
- state/blockers/S00-027.md

## Шаги

1. Obtain environment-owner confirmation that approved proxy/DNS/registry access is restored for the agent sandbox; never record credentials.
2. Reproduce the two npm metadata queries using a temporary cache and normal certificate validation.
3. Verify a pinned candidate artifact can be downloaded and integrity checked in a temporary directory without executing package scripts.
4. Record exact commands, exit codes, versions and integrity result in the bounded connectivity document; submit for independent review.

## Приёмка

1. Both known-control and candidate npm metadata queries return actual registry responses without EAI_AGAIN.
2. A pinned candidate artifact download and integrity check succeed over normal HTTPS.
3. No TLS/proxy-policy bypass, secrets, crypto implementation or backend acceptance; remediation only restores network access.

## Focused checks

1. npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache
2. npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache
3. Pinned artifact retrieval and registry integrity verification without install scripts

## Блокер и завершение запуска

Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.

## Передача

Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.