wt
59b9ff62fe
Changes: Compare React and Vue in ADR 0001; pin React 19.3.1, TypeScript 7.0.2, Vite 8.3.4 and Node 24.21.0/npm 11.19.0. Add isolated TSX counter, exact lockfile, runtime/TLS guards, reproduction instructions and license inventory/runtime notices. Preserve the reviewed registry probe and leave ADR proposed for security review. Validation: Clean npm ci with a fresh cache and npm run build passed on the pinned tools; strict typechecking and repeated local build hashes matched. HTTP preview served HTML and matching JS. make check passed all 66 tooling tests; git diff --check passed. Browser interaction was unavailable and is recorded as an external check; no app, crypto/protocol interoperability or release readiness is claimed. Task: S00-002 Agent: auto-orchestrator-68a05c587e33 Role: orchestrator Action: claim Status: review Task title: Выбрать framework и build runtime
2.0 KiB
S00-002 handoff for independent security review
Executor: auto-orchestrator-68a05c587e33 (orchestrator), 2026-10-15. Outcome: proposed ADR 0001 compares React and Vue, selects exact React/TypeScript/Vite pins and Node 24.21.0 LTS / bundled npm 11.19.0. One isolated TSX rendering spike, lockfile, runtime/TLS guards, license inventory and runtime notices created in experiments/0001-stack. Registry-access probe retained unchanged. No blocker; prior registry failure did not recur.
Actual checks: clean npm ci with fresh empty cache, strict TypeScript/Vite build before/after ci, identical local artifact/lock SHA256, HTTP preview HTML and byte-matching JS, make check (66 tests) all exit 0. Full commands, pins, digests, setup failures and limits: state/evidence/S00-002-auto-orchestrator-68a05c587e33.md.
Next step belongs only to separate assigned security reviewer. Read ADR/card/evidence and executor commit/message. From experiments/0001-stack with Node 24.21.0 / npm 11.19.0, run the README's clean npm ci and npm run build. Existing verified macOS ARM64 runtime is at /private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64, or retrieve the official exact runtime with verified HTTPS/checksum. Inspect exact manifest/lock pins, licenses including build-only MPL-2.0, runtime notices, no production transport/secrets and no source changes outside card scope. Record acceptance and reviewer metadata in ADR only if warranted, then approve/reject through tasks.py.
DOM rendering/counter interaction is an external check: no browser is exposed by this harness. README gives manual steps; do not label them passed. Current compiler floors are not the product browser matrix. Vue was not built or benchmarked. Crypto/XMPP compatibility, full app CI, notices for future libraries, other build-host platforms, provider integration and release readiness remain subsequent cards. Shared contracts/specs/plan definitions unchanged. ADR remains proposed; executor does not set done or perform Git mutations. Coordinator commits this submission and launches the reviewer.