wt
2af4f143d8
Changes: Add a bounded reproducible HTTPS/checksum/runtime probe under environment-access, vendor checksums, unchanged parent manifest/lock copies, strict npm settings, result and reproduction notes. Record evidence and QA handoff; submit S00-026 without completing parent tasks. Validation: Run verify.py twice successfully: vendor Linux archive SHA256 matched, Node 24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed eight integrity-locked packages with scripts disabled, parent bytes stayed unchanged and Stanza import passed. tasks.py validate, git diff --check and scoped file whitespace checks passed. No browser/WSS, detached signature or provenance audit performed. Task: S00-026 Agent: auto-ci-cd-4255c34da227 Role: ci-cd Action: claim Status: review Task title: Provide approved access to the pinned Linux experiment artifacts
2.6 KiB
S00-026 Linux environment access probe
Normal configured HTTPS access, authorized by the assigned environment-access probe and this session's enabled network, succeeded on 2026-10-15. The previous configured-proxy DNS failure did not reproduce. No proxy/environment/system configuration was changed and no alternate network route was selected. No separate environment-owner connectivity statement was supplied; the evidence is actual access through the existing configured path, not an assertion about an administrator's network changes.
Run from the project root on Linux x86_64 with Python supporting tarfile's
data extraction filter (Python 3.12+ recommended), curl and xz support:
python3 experiments/0002-xmpp-library/environment-access/verify.py
The probe retrieves the official Node 24.21.0 Linux x64 archive and vendor
SHASUMS256.txt through verified HTTPS. It checks SHA256 before safe extraction
into a fresh /tmp/luma-S00-026-* directory, executes exact Node 24.21.0 and
npm 11.19.0, and installs byte-identical parent manifest/lock copies here using
npm ci --ignore-scripts --strict-ssl=true --engine-strict=true with a fresh
isolated cache. All eight locked dependencies retain HTTPS registry URLs and
SHA512 integrity. It checks every installed version, unchanged manifest/lock
bytes and a real Stanza createClient import. Any command/check failure exits
unsuccessfully; result.json records the last successful run only.
SHASUMS256.txt preserves retrieved vendor checksum material; result.json
records the verified archive hash, input hashes and temporary paths. Reviewer
should repeat the probe with fresh retrieval, rather than trust these reports.
The runtime/archive/cache remain temporary, node_modules is Git-ignored, and no
system installation is performed. These paths are available to later local
sessions until temporary storage is removed; rerun the probe if absent.
No TLS/proxy/engine bypass, dependency additions, stack/lock/spec modification, credentials, real messages, npm lifecycle scripts or Git mutations. The copied parent graph was already inspected in prior experiment tasks; this probe adds no dependency or library-selection decision. Node/npm retain their distribution license files; dependency notices remain in the existing experiment inventories.
Checksum verification trusts the vendor HTTPS origin; no detached signature, package provenance/advisory audit, browser/WSS authentication, application build or interoperability claim is made. This outcome is submitted for independent QA review only. S00-020, S00-024 and S00-003 remain unfinished; this executor does not continue their work or change their statuses directly.