wt
2af4f143d8
Changes: Add a bounded reproducible HTTPS/checksum/runtime probe under environment-access, vendor checksums, unchanged parent manifest/lock copies, strict npm settings, result and reproduction notes. Record evidence and QA handoff; submit S00-026 without completing parent tasks. Validation: Run verify.py twice successfully: vendor Linux archive SHA256 matched, Node 24.21.0/npm 11.19.0 executed, fresh-cache npm ci installed eight integrity-locked packages with scripts disabled, parent bytes stayed unchanged and Stanza import passed. tasks.py validate, git diff --check and scoped file whitespace checks passed. No browser/WSS, detached signature or provenance audit performed. Task: S00-026 Agent: auto-ci-cd-4255c34da227 Role: ci-cd Action: claim Status: review Task title: Provide approved access to the pinned Linux experiment artifacts
46 lines
2.6 KiB
Markdown
46 lines
2.6 KiB
Markdown
# S00-026 Linux environment access probe
|
|
|
|
Normal configured HTTPS access, authorized by the assigned environment-access
|
|
probe and this session's enabled network, succeeded on 2026-10-15. The previous
|
|
configured-proxy DNS failure did not reproduce. No proxy/environment/system
|
|
configuration was changed and no alternate network route was selected. No
|
|
separate environment-owner connectivity statement was supplied; the evidence is
|
|
actual access through the existing configured path, not an assertion about an
|
|
administrator's network changes.
|
|
|
|
Run from the project root on Linux x86_64 with Python supporting tarfile's
|
|
`data` extraction filter (Python 3.12+ recommended), curl and xz support:
|
|
|
|
```sh
|
|
python3 experiments/0002-xmpp-library/environment-access/verify.py
|
|
```
|
|
|
|
The probe retrieves the official Node 24.21.0 Linux x64 archive and vendor
|
|
SHASUMS256.txt through verified HTTPS. It checks SHA256 before safe extraction
|
|
into a fresh `/tmp/luma-S00-026-*` directory, executes exact Node 24.21.0 and
|
|
npm 11.19.0, and installs byte-identical parent manifest/lock copies here using
|
|
`npm ci --ignore-scripts --strict-ssl=true --engine-strict=true` with a fresh
|
|
isolated cache. All eight locked dependencies retain HTTPS registry URLs and
|
|
SHA512 integrity. It checks every installed version, unchanged manifest/lock
|
|
bytes and a real Stanza createClient import. Any command/check failure exits
|
|
unsuccessfully; `result.json` records the last successful run only.
|
|
|
|
`SHASUMS256.txt` preserves retrieved vendor checksum material; `result.json`
|
|
records the verified archive hash, input hashes and temporary paths. Reviewer
|
|
should repeat the probe with fresh retrieval, rather than trust these reports.
|
|
The runtime/archive/cache remain temporary, node_modules is Git-ignored, and no
|
|
system installation is performed. These paths are available to later local
|
|
sessions until temporary storage is removed; rerun the probe if absent.
|
|
|
|
No TLS/proxy/engine bypass, dependency additions, stack/lock/spec modification,
|
|
credentials, real messages, npm lifecycle scripts or Git mutations. The copied
|
|
parent graph was already inspected in prior experiment tasks; this probe adds
|
|
no dependency or library-selection decision. Node/npm retain their distribution
|
|
license files; dependency notices remain in the existing experiment inventories.
|
|
|
|
Checksum verification trusts the vendor HTTPS origin; no detached signature,
|
|
package provenance/advisory audit, browser/WSS authentication, application build
|
|
or interoperability claim is made. This outcome is submitted for independent
|
|
QA review only. S00-020, S00-024 and S00-003 remain unfinished; this executor
|
|
does not continue their work or change their statuses directly.
|