wt
0d97f48929
Changes: Preserve incomplete work and blocker metadata for S00-022. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: All ten live npm metadata queries fail with EAI_AGAIN resolving the configured proxy, including the known libsignal-client control. Required release and artifact verification for S00-022 cannot proceed; failures are not E404 evidence. Task: S00-022 Agent: auto-crypto-316a193d6c3e Role: crypto Action: claim Status: blocked Task title: Confirm or source a verified browser/WASM-capable OMEMO2 backend for the Web client endpoint
60 lines
3.2 KiB
Markdown
60 lines
3.2 KiB
Markdown
# S00-027: Restore approved npm registry connectivity for the OMEMO2 backend investigation
|
||
|
||
- Remediation для: S00-022; root: S00-004; depth: 2
|
||
|
||
> Generated from planning/tasks.json; status is in state/tasks.json.
|
||
|
||
- Этап: S00
|
||
- Оператор: ci-cd
|
||
- Reviewer: security
|
||
- Зависимости: S00-001, S00-002, S00-021
|
||
- Требования: ENC-003, ENC-009, ENC-011
|
||
|
||
## Один результат
|
||
|
||
One independently reviewed connectivity record proving that the fresh project agent can retrieve real libomemo.js and libsignal-client metadata and a pinned candidate artifact through approved HTTPS registry access.
|
||
|
||
## Разрешённые пути
|
||
|
||
- `docs/decisions/0003-registry-connectivity.md`
|
||
|
||
Не изменять другие modules, shared contracts или spec snapshots без изменения плана. Stem без расширения разрешает принятые stack-specific extensions и focused test рядом.
|
||
|
||
## Прочитать
|
||
|
||
- docs/WEB_PROFILE.md
|
||
- docs/ARCHITECTURE.md
|
||
- docs/CONTRACTS.md
|
||
- docs/TESTING.md
|
||
- roles/crypto.md
|
||
- docs/decisions/README.md
|
||
- state/blockers/S00-022.md
|
||
- state/blockers/S00-027.md
|
||
|
||
## Шаги
|
||
|
||
1. Obtain environment-owner confirmation that approved proxy/DNS/registry access is restored for the agent sandbox; never record credentials.
|
||
2. Reproduce the two npm metadata queries using a temporary cache and normal certificate validation.
|
||
3. Verify a pinned candidate artifact can be downloaded and integrity checked in a temporary directory without executing package scripts.
|
||
4. Record exact commands, exit codes, versions and integrity result in the bounded connectivity document; submit for independent review.
|
||
|
||
## Приёмка
|
||
|
||
1. Both known-control and candidate npm metadata queries return actual registry responses without EAI_AGAIN.
|
||
2. A pinned candidate artifact download and integrity check succeed over normal HTTPS.
|
||
3. No TLS/proxy-policy bypass, secrets, crypto implementation or backend acceptance; remediation only restores network access.
|
||
|
||
## Focused checks
|
||
|
||
1. npm view @signalapp/libsignal-client version --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache
|
||
2. npm view libomemo.js version license dist.integrity dist.tarball --json --fetch-retries=0 --fetch-timeout=15000 with a temporary cache
|
||
3. Pinned artifact retrieval and registry integrity verification without install scripts
|
||
|
||
## Блокер и завершение запуска
|
||
|
||
Для всех ролей scope — только эта задача. При блокере создать issue JSON по state/ISSUE_TEMPLATE.json, вызвать escalate с текущим ID/role/agent, проверить status=blocked и resolution_task, затем немедленно завершить запуск. Не решать blocker и не выбирать следующую задачу самому. Новый агент назначается runner. Правки metadata через CLI — единственное исключение scope.
|
||
|
||
## Передача
|
||
|
||
Сохранить evidence/handoff; submit → review и завершить запуск. Reviewer также выполняет только эту задачу, включая обязательное escalate при блокере.
|