LumaWeb/docs/decisions/0003-registry-connectivity.md

S00-027: Approved npm registry connectivity record

• Status: proposed; awaiting independent security review.
• Executor: auto-ci-cd-40ae46e8efe7 (ci-cd), 2026-10-15.
• Input: S00-027 card, S00-022/S00-027 blockers, accepted ADR 0000/0001 and direct dependency evidence.
• Output: connectivity evidence only for resuming the separate OMEMO2 investigation.

Environment-owner confirmation

Canonical state/tasks.json history revision 74 records coordinator-input-s00-027 releasing the external wait on 2026-10-15T09:45:53+00:00. The confirmation explicitly enables sandbox outbound network while retaining workspace-write restrictions, configured proxy and TLS. It reports successful prior probes and requires fresh executor and reviewer verification. This session reproduced access; it did not alter proxy, DNS, TLS, runner configuration or system tools. No credentials or private proxy values are recorded.

Actual commands and responses

All commands ran from project root. A fresh directory was created with Python tempfile.mkdtemp(prefix='luma-s00-027-'): /tmp/luma-s00-027-kdeu0fv9. Its cache was empty before the first query. Existing coordinator metadata, archive and cache were not used.

Command	Exit	Actual response
node --version	0	v24.1.0
npm --version	0	11.3.0
npm config get strict-ssl	0	true
npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache	0	"0.105.0"
npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/cache	0	3.0.0; GPL-3.0; integrity and URL below
npm view libomemo.js@3.0.0 version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 --cache=/tmp/luma-s00-027-kdeu0fv9/pinned-cache --registry=https://registry.npmjs.org/ --strict-ssl=true	0	Same fields, fresh second cache

No EAI_AGAIN or E404 occurred. npm emitted an update notice on the control query; no update was performed. Host runtime versions are explicitly recorded; these metadata/download-only probes do not build the application or replace ADR 0001 tool pins.

Pinned public artifact: libomemo.js 3.0.0 tarball. Primary metadata source: versioned registry record.

Registry integrity and independently computed SHA512 SRI both equal:

sha512-B4he9DOS+1LQrut+b2xjOjuSkKMAkZGes7ckB5JgVk/EHVNyxLIHx6NvQ3eJVaT1XeNJaWZBonXw3Nl5YKEbig==

Artifact retrieval and integrity verification

An inline Python wrapper ran the pinned command above with subprocess.run(..., capture_output=True, text=True), required exit 0, parsed its JSON into meta, and asserted meta['version'] == '3.0.0'. The following retrieval/check body then ran unchanged inside that wrapper (root is the temporary directory above):

url=meta['dist.tarball'];assert url=='https://registry.npmjs.org/libomemo.js/-/libomemo.js-3.0.0.tgz'
with urllib.request.urlopen(url,context=ssl.create_default_context(),timeout=15) as response:
 assert response.status==200 and response.url==url
 data=response.read()
sri='sha512-'+base64.b64encode(hashlib.sha512(data).digest()).decode()
assert sri==meta['dist.integrity']
(root/'libomemo.js-3.0.0.tgz').write_bytes(data)

Imports were subprocess,json,pathlib,urllib.request,ssl,hashlib,base64. The wrapper also wrote public verification JSON under the temporary root. Actual wrapper exit: 0. HTTP status: 200; final URL unchanged; archive size: 1,061,939 bytes. SHA256: be30116eca7014a35b3372dc1270d462cf5392ae6affc92c4f4778d003e7bbf8. Archive saved only under /tmp; it was neither extracted nor installed nor executed. Python used its default validated SSL context and existing configured environment; no certificate/proxy-policy bypass was used.

Acceptance boundary and review handoff

Both required live metadata queries and the pinned artifact/SRI verification succeeded in the fresh agent session. This proposes acceptance of network restoration only. Registry integrity matches bytes to registry metadata; it does not establish independent provenance, safety or crypto suitability. GPL-3.0 is reported metadata, not a distribution approval.

No crypto/backend decision, browser/WASM/worker execution, SCE mapping, audited interoperability, persistence compatibility, application build or release readiness was tested or accepted. ENC-003/009/011 remain obligations of the original investigation. The existing crypto ADR and experiments, specs, contracts and plan definitions are unchanged.

The assigned independent security reviewer should repeat both queries with a new empty cache, repeat pinned metadata/download/SHA512 comparison under normal TLS and the approved environment, inspect scope and evidence, then record the review through tasks.py. Only reviewed resolver completion may return S00-022 to the queue for a new agent. Coordinator owns Git commits.