LumaWeb/state/evidence/S00-002-auto-orchestrator-68a05c587e33.md

S00-002 executor evidence

Agent: auto-orchestrator-68a05c587e33 (orchestrator). Date: 2026-10-15. Result: proposed stack ADR and one rendering spike, awaiting independent security review.

Actual changes and scope

• docs/decisions/0001-stack.md compares React/TypeScript/Vite and Vue/TypeScript/Vite, proposes exact selected pins, records sources, licenses, browser/runtime constraints and verification limits.
• experiments/0001-stack: exact manifest/lockfile, runtime/engine/TLS pins, strict TSX counter, Vite target, build guard, reproduction instructions, locked license inventory and browser-runtime notices.
• Existing reviewed registry-access/ probe unchanged. Application modules, shared contracts, immutable specifications, plan definitions and system/Git configuration unchanged. Initial git status showed only coordinator claim change in state/tasks.json.
• No secrets, real accounts/conversations or production transports. No encryption/CORS/certificate workaround. Source scope is only the two card paths; evidence/handoff/commit message are workflow metadata.

Read master prompt, role and workflow documents; assigned resume/show/packet; previous blocker handoff; exact NFR-007; accepted ADR 0000 and S00-001/S00-011 executor/review evidence and handoffs. S01 schemas are not yet accepted and this spike requires no new shared interface.

Commands and actual results

All npm install/build commands below ran from experiments/0001-stack with: PATH=/private/tmp/luma-stack-runtime/node-v24.21.0-darwin-arm64/bin:$PATH. This uses the downloaded isolated LTS runtime, not the system Node 26.

Command/check	Exit	Actual result
python3 scripts/tasks.py resume --agent auto-orchestrator-68a05c587e33	0	S00-002 assigned in_progress; no repeat claim.
python3 scripts/tasks.py show S00-002 and packet S00-002 --agent auto-orchestrator-68a05c587e33	0 each	Correct scope/requirements and reviewed prerequisites read.
Python subprocess batch of npm view <package> version license engines peerDependencies --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000 --registry=https://registry.npmjs.org/ --strict-ssl=true	0, all children 0	React/React DOM 19.3.1 MIT; Vue 3.5.44 MIT; Vite 8.3.4 MIT; TypeScript 7.0.2 Apache-2.0; both React types 19.3.0 MIT; available Node 24 releases and npm 12.2.0 inspected. Latest npm was not selected.
npm view npm@11.19.0 version license engines --json --cache /private/tmp/luma-stack-npm-cache --strict-ssl=true	0	Bundled npm verified: 11.19.0, Artistic-2.0, node ^20.17.0 or >=22.9.0.
Same metadata batch for @vitejs/plugin-vue, vue-tsc	0, both children 0	6.0.10 / 3.3.13, MIT; plugin peer ranges permit candidate Vue/Vite. Candidate not installed/built.
Python urllib download and hashlib SHA256 verification of official Node v24.21.0 darwin-arm64 archive / checked-path extraction under /private/tmp	0 on final extraction	HTTPS download matched vendor SHASUMS256.txt; exact node/npm commands returned v24.21.0 / 11.19.0. See setup attempts below.
npm install --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000	0	Initial manifest resolution/lockfile creation, 24 installed packages.
npm run build	0	Runtime guard + strict tsc --noEmit + Vite 8.3.4; 14 modules, HTML 0.29 kB, JS 219.87 kB / gzip 68.75 kB.
npm ci --ignore-scripts --no-audit --no-fund --cache /private/tmp/luma-stack-clean-cache-68a05c587e33 --fetch-retries=0 --fetch-timeout=15000	0	Actual clean install with newly created empty cache, 24 packages; lifecycle scripts disabled.
npm run build after npm ci	0	Same strict check/build and same output sizes.
Python hashlib comparison of lockfile and both emitted files against first-build digests	0	Lock and both artifacts unchanged after clean install/rebuild.
Python JSON inspection of lock graph	0	All 67 locked package entries have HTTPS public-registry URL, SHA512 integrity and license; includes optional uninstalled platforms.
Python subprocess wrapper: npm run preview -- --port 4173 --strictPort, urllib HTML/JS fetch and digest assertion	0 wrapper	Both HTTP 200; served JS byte-matches build artifact. Preview process group terminated in finally. No DOM/JavaScript execution claimed.
make check	0	276 tasks, 22 stages, 221 requirements, 211 Web requirements, revision 10; 66 tooling tests passed in 10.205s. Foundation integrity only.
git diff --check, git status --short --untracked-files=all	0 each	No tracked whitespace errors; only scoped source files plus claim/workflow metadata. Authored untracked contents separately inspected.

Setup attempts, not successful checks: the first Python extraction attempt failed (exit 1) because this host Python's tarfile does not support the filter keyword. The download/checksum had already succeeded. A second path guard rejected normal relative symlinks (exit 1) before extracting anything. Final extraction resolved each member/symlink/hardlink target, required containment in the task temporary root, and succeeded (exit 0). No system install or permission changes. An exploratory rg --files ... .agents .codex returned exit 2 for absent optional directories; no task context was missing.

Digests

Official Node archive SHA256: bed7eea5325e1108f32ce5228ddd6a5f0f08a499ee42aa7442aea583702f6057. Downloaded from https://nodejs.org/dist/v24.21.0/node-v24.21.0-darwin-arm64.tar.gz and compared with the official same-origin SHASUMS256.txt. No detached signature verification claimed.

• package-lock.json: 7b2dee5e231629c30501194fa40346ba9f0752cea32a4eb9d91e8f5d4b5ab47f
• dist/index.html: 67962911c9b0bcb45d6a13f9d0e5877cfa0164c09d2e2128407db84889026a73
• dist/assets/index-PZnFDfAT.js: 3cbf3f9adf300aeb52b465fe9e78530103fa5b23fb22e6beae768faa3a8b0f04

Artifacts/node_modules remain ignored. Local same-host hashes do not prove cross-platform reproducibility.

Sources and limitations

Primary pages opened through web tool: React from-scratch/createRoot; Vue quick-start/FAQ/TypeScript overview; TypeScript JSX; Vite getting-started/production; Node release lifecycle; npm ci. Exact links and inspection date are in ADR. Version/license/engine/peer fields obtained through real npm registry queries; installed package LICENSE texts inspected for runtime notices. Optional platforms are inventory-only. Web tool could not fetch versioned GitHub license pages or Node checksum URL; actual HTTPS Node checksum retrieval and local package license inspection supplied those facts instead.

Browser external check: cua.createBrowserTab('iab', 'about:blank', {visible:false}) returned Browser is not available; cua.listBrowsers() returned []. DOM mounting/counter clicks/visual layout have not been verified and are explicitly left as an external check. Card mandatory checks are clean install/build and recorded licenses/constraints, both completed. No browser product matrix, real encrypted/protocol/media/provider interoperability, production hosting, vulnerability audit, package provenance or release readiness is claimed. npm audit was disabled for the bounded install; this is not a security clearance.

ADR remains proposed. Separate security reviewer should reproduce exact clean install/build, inspect stack justification, licenses, pin/lock/runtime guards and scope, then record acceptance or rejection via CLI. Coordinator alone commits and launches the next fresh process.