{
  "title": "Restore verified npm registry access for the stack spike",
  "reason": "S00-002 cannot verify versions/licenses or run its required clean install/build: local npm lookup fails with getaddrinfo ENOTFOUND registry.npmjs.org. Restricted network and never-approval execution policy cannot be changed by this agent. External owner must supply registry-capable execution while preserving TLS validation and project-only writes.",
  "reproduction": "npm view react version license engines --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000 => exit 1, ENOTFOUND registry.npmjs.org. Evidence: state/evidence/S00-002-auto-orchestrator-3a4f07103316.md",
  "role": "ci-cd",
  "reviewer_role": "security",
  "scope": [
    "experiments/0001-stack/registry-access/**"
  ],
  "outcome": "A documented registry-capable execution path with successful npm metadata and integrity-checked package tarball retrieval, allowing a fresh S00-002 executor to run its own spike.",
  "steps": [
    "External owner: provide working DNS and HTTPS egress to registry.npmjs.org/package tarballs in the agent harness without disabling TLS or the project write sandbox; no secrets requested.",
    "In a fresh resolver process verify public metadata and retrieve one exact-version package tarball in the scoped experiment directory, checking registry integrity metadata.",
    "Record exact commands, exit codes and nonsecret runner environment instructions in the scoped registry-access report; do not select the stack or implement rendering.",
    "Submit connectivity evidence for independent security review."
  ],
  "acceptance": [
    "npm metadata request succeeds with TLS validation enabled in the execution environment used for the next stack task.",
    "One exact-version package tarball is retrieved and checked against registry integrity metadata.",
    "No TLS/CORS bypass, secrets, shared module changes or premature stack selection; reproducible safe execution instructions recorded."
  ],
  "checks": [
    "Repeat the original npm view command and record exit 0 with actual package metadata.",
    "Retrieve and integrity-check one exact-version tarball over HTTPS; record actual result and environment constraints."
  ],
  "depends_on": [],
  "requires_user_input": true
}