wt
06f353b214
Changes: Accept the bounded S00-011 registry remediation; record independent security evidence and review handoff. Source probe and stack remain unchanged by review. Validation: Original npm view and fresh-cache verify.py returned exit 0; 26394-byte react@19.3.1 matched registry SHA-512. Disabled TLS was refused with exit 1. make check passed 66 tests; executor patch/message, scope, ignore rules and whitespace checked. App build, provenance and future harness connectivity remain unverified. Task: S00-011 Agent: auto-security-1e9200de1765 Role: security Action: review Status: done Task title: Restore verified npm registry access for the stack spike
4.4 KiB
S00-011 — independent security review
Reviewer: auto-security-1e9200de1765 (security). Executor: auto-ci-cd-d105e8027730 (ci-cd). Date: 2026-10-15. Decision: approve the bounded registry-access remediation.
Input: assigned card/context packet, original blocker, NFR-007, executor handoff/evidence, accepted ADR 0000 and S00-001 dependency evidence/review. Output: independent review of the documented TLS-enabled registry path and exact-version tarball retrieval. Acceptance is connectivity and integrity only.
Findings
Examined executor commit e4672fba91,
its message and every changed file, plus prior release checkpoint b8afc70.
The executor message matches the actual scoped probe, README, ignore rule and
workflow artifacts. Initial working tree was clean. Source changes are limited
to experiments/0001-stack/registry-access; other changes are task metadata,
generated matrices, evidence, handoff and commit message. No spec, shared
contract, application dependency, stack decision or harness change was included.
The probe fixes the HTTPS registry, enables strict-ssl explicitly, rejects NODE_TLS_REJECT_UNAUTHORIZED=0, uses empty user/global npmrc files and a fresh temporary cache, and runs outside the project npmrc context. Subprocess arguments are arrays without shell evaluation. Exact metadata version and tarball URL are checked before npm pack; the expected filename is fixed before reading bytes. Package scripts are disabled, no archive is extracted and no package is installed. Python hashlib SHA-512 is compared against both registry and pack integrity. Unexpected versions/origins/algorithms or mismatches terminate without success. The public registry/TLS trust remains the source of expected integrity; this is not independent package provenance or a hostile-registry defense.
Independently repeated the original metadata request and fresh-cache probe in this fresh reviewer harness. Both succeeded. react@19.3.1 was 26394 bytes with registry/actual integrity: sha512-QNhWdt7nrgVWWQG58QuGsAR3jv3Hbe4mb4vz7w2csnHavciZJgda1CPNaldF6eVxv90ud3jUXpKlHL69gO38yw==
No TLS/CORS bypass, secrets, real conversations or credentials found in the reviewed patch. Generated public artifacts are ignored. The README records DNS/HTTPS egress, normal certificate trust, project/temporary write boundaries, exact commands and explicit limits. The next stack executor must retain this network-enabled harness and perform its own clean install/build and decisions.
Actual independent checks
| Command/check | Exit | Result |
|---|---|---|
python3 scripts/tasks.py resume --agent auto-security-1e9200de1765 |
0 | Empty owned-task list, expected for reviewer; no claim. |
python3 scripts/tasks.py show S00-011 and packet S00-011 --agent auto-security-1e9200de1765 |
0 each | Correct review role, owner, scope, acceptance and dependency context. |
git log --all --oneline --grep='^S00-011:', git show e4672fb (all scoped sections) and git show b8afc70 --stat |
0 each | Executor patch/message and release checkpoint examined. |
npm view react version license engines --json --cache /private/tmp/luma-stack-npm-cache --fetch-retries=0 --fetch-timeout=15000 |
0 | version 19.3.1, MIT, node >=0.10.0. |
npm config get strict-ssl |
0 | true. |
python3 experiments/0001-stack/registry-access/verify.py |
0 | Both npm children exit 0; fresh-cache download and SHA-512 match as above. |
| Python subprocess wrapper invoking verify.py with NODE_TLS_REJECT_UNAUTHORIZED=0 | 0 wrapper; 1 child | Asserted exact refusal stderr and empty stdout; exits before npm execution. |
git check-ignore for artifacts/metadata.json, result.json and react-19.3.1.tgz |
0 | All three generated artifacts ignored. |
make check |
0 | 276 tasks, 22 stages, 221 requirements, 211 allocated Web requirements, revision 8; 66 tooling tests passed in 10.382s. |
git diff --check and git status --short before review metadata |
0 each | No whitespace errors; working tree remains clean. |
No blocker or acceptance defect found. Foundation tests do not prove app readiness. No browser/CORS, app install/build, signature/provenance, library compatibility or future/different-harness availability was tested or accepted. The cause of the earlier external DNS repair is not asserted. Approval accepts the observed registry path and reproducible bounded probe only. Git commit and the next fresh session remain coordinator-owned.