wt
59b9ff62fe
Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review. Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed. Task: S00-002 Agent: auto-orchestrator-68a05c587e33 Role: orchestrator Action: claim Status: review Task title: Выбрать framework и build runtime
S00-002 rendering spike
One local React/TypeScript/Vite experiment for ADR 0001. The registry-access/ subdirectory belongs to the reviewed S00-011 probe and is retained unchanged. No account, network messaging, crypto, media, service worker or application scaffold is implemented here.
Reproduce
Use Node 24.21.0 with bundled npm 11.19.0. .nvmrc is a pin for an
existing version manager; installing the spike never changes system runtimes.
Official binaries: https://nodejs.org/dist/v24.21.0/ — verify the selected archive
against SHASUMS256.txt with normal TLS trust. On this executor, the verified
macOS ARM64 runtime was unpacked at
/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64.
From this directory with the pinned runtime's bin directory first on PATH:
node --version
npm --version
npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-review-cache --fetch-retries=0 --fetch-timeout=15000
npm run build
npm run preview -- --port 4173 --strictPort
Use a new cache path for a network/clean-cache check. npm ci itself removes old node_modules and fails on lock/manifest mismatch. Keep optional platform packages enabled; TypeScript/Vite use platform binaries and build succeeds without lifecycle scripts. TLS verification and exact engine checks remain enabled. The private package is not published. npm install is only for explicitly reviewed lockfile updates, not normal reproduction.
Open http://127.0.0.1:4173 locally: expect “Luma rendering spike” and “Count: 0”.
Click Increment twice: expect Count: 2. This is the manual DOM/interaction check;
it was not run because this harness exposes no browsers. Build/typechecking
were run successfully. Stop the server with Ctrl-C. npm run dev is available
for source development; no React refresh plugin is installed.
Build output/node_modules are ignored. The browser bundle is static and requires no Node server. Explicit compiler floors: Chrome/Edge 111, Firefox 114, Safari 16.4, with no API polyfills; the product browser matrix is a later decision. Preserve THIRD_PARTY_NOTICES.md when distributing this bundle; full lock graph licenses are in LICENSE_INVENTORY.md. CI, release notice automation, app tests and cryptographic/protocol compatibility remain subsequent tasks.