[pranems]

Summary

Restore actual API npm ls --all --json acceptance with four shared exact
root overrides at existing locked versions, without changing package versions.

Product 0.55.63 now normally integrates reviewed web #259's merged master,
0a9b3d04535dc51dcfc58e9a2360c1c9e112a41a, while preserving the original
API correction 6eb1b59c and every constituent commit. The API graph retains
its four root overrides; the web graph inherits merged Seroval 1.6.11 and
Undici 7.30.1. No new application, auth, UI, schema or performance
implementation is added.

Current integration head: 15618fffd7d1ff4e206b68c8c0bdacbe173a83b7.
Final protected Validate, refreshed independent review and all seven
exact-head hosted checks pass. This is not deployment or release
artifact admission. Historical independent-branch results below are labeled
and are not substituted for the integrated head's evidence.

Linked Defect / Plan Reference

• DELIVERY_PLAN.md defect ID: N/A, bounded inventory correction related to [security] pinned dependency review needed #256; does not close its remaining advisories.
• Audit doc reference: docs/API_OVERRIDE_CONTEXT_VALIDITY.md, including execution RCA and independently preserved RED/GREEN inventories.
• ADR (if applicable): N/A; reuse the established flat shared exact override pattern.

TDD Process

• RED test written first; observed it fail for the expected reason
• GREEN: minimal implementation that turns the test green
• Refactor (if any) keeps the test green - no production refactor
• Permanent regression guard added (where applicable - see existing patterns in api/src/security/)

Initial RED: 4 failed /3 passed (three missing shared contexts and real full-tree inventory).
After three pins: real inventory still fails for hasown, reproduced after clean restore.
Fourth-pin RED: 2 failed /7 passed; final GREEN: 9 new +29 existing checks, 38 PASS.
The tests enumerate every real owner, compare installed owner ranges, resolve
actual installed versions, verify all lock occurrences/provenance, require one
exact root context per package and execute the real full npm command.

Feature / Bug-Fix Commit Checklist (standing rule)

Every behavioral change must include all that apply. Tick or strike through with N/A + reason.

• Unit Tests - service-level and controller-level coverage of the new behavior. Dependency-only correction: nine focused inventory/context checks; no service/controller behavior changed.
• E2E Tests - end-to-end spec under api/test/e2e/ exercising the feature through HTTP. N/A additions: no HTTP change; existing broad HTTP gate retained.
• Live Integration Tests - new section in scripts/live-test.ps1 runnable against local + Docker + Azure. N/A: no live behavior or estate mutation.
• Feature Documentation - dedicated doc in docs/ with architecture, RFC references, Mermaid diagrams, test coverage. Dependency-only mechanism, owner table, flow, TDD, RCA and boundary documented; no SCIM RFC or diagram behavior changed.
• INDEX.md Update - add the new doc reference to docs/INDEX.md
• CHANGELOG.md Update - [Unreleased] entry with full test counts and feature summary
• Session & Context Updates - Session_starter.md and docs/CONTEXT_INSTRUCTIONS.md
• Version Management - bump api/package.json (and any other version refs) when behavior changed. Both roots 0.55.63; CI-only lock roots and freshness headers aligned.
• Response Contract Tests - API responses contain ONLY documented fields (key allowlist assertion at unit + E2E + live). N/A additions: no response source change.

Validation Output

Current integrated source

• Normal integration merge d6b8044d preserves API 6eb1b59c and reviewed
  web master 0a9b3d04; no rebase, squash, amend, force or hook bypass.
• Bootstrap $env:PREPUSH_MODE='Fast'; git push origin fix/api-override-context-20261029:
  PASS, 25/25 gates in 503.1 seconds; API 6,229/214 suites; HTTP 2,514/118
  suites plus the existing 42 skipped tests.
• Serial npm --prefix api ci --no-audit --no-fund and
  npm --prefix web ci --no-audit --no-fund: PASS, existing CI lock hashes
  unchanged. The final imported locks have the identical non-root graph.
• Integrated clean-CI regeneration
  40963173363:
  PASS at exact source d6b8044dfd4fb28ab61c2ac7de7a49789e828492.
  Artifact 12935469827, authenticated ZIP SHA-256
  0c955883595cfe75041e6bb135b60132430d96f64d9d9f8ceb3f4422642a69f7,
  verified before extraction. Both roots are 0.55.63, with zero non-root
  drift. The seven-day publication-age report has no changed packages.
• Manifest/lock structural checks: PASS. API graph equals the original API
  correction; web graph equals merged fix: remediate web Seroval and Undici pins (0.55.62) #259. No local lock generation.
• Fresh independent integration review: no significant introduced defects
  at exact 15618fff against 0a9b3d04; parent-union graphs, coordinated
  roots and committed lock hashes independently checked. No test execution
  or GitHub approval is claimed by this review.
• Final $env:PREPUSH_MODE='Validate'; git push origin fix/api-override-context-20261029:
  PASS, 28/28 gates in 989.4 seconds, exit 0. Published exact head is
  15618fffd7d1ff4e206b68c8c0bdacbe173a83b7; working tree remains clean.
  API units: 6,229 passed /214 suites. HTTP: 2,514 passed /118 suites,
  plus 42 existing skipped tests /2 skipped suites. Web: 1,661 passed
  /125 files, including the six inherited merged-web regressions.
  API/web TypeScript, lint, production build, Mermaid rendering, provenance,
  documentation, Prisma generation and additive migration checks all pass.
  Existing Windows worker teardown warnings remain explicitly unresolved;
  no worker, timeout, forceExit, test exclusion or baseline was changed.
• All four exact-head hosted runs completed SUCCESS, with all seven
  checks successful:
  push Build Test Image 40965922000,
  PR Build Test Image 40965931480,
  CodeQL 40965931015
  and docs freshness 40965931172.
  Both builds pass their validation, container smoke and HIGH/CRITICAL
  Trivy steps. The independently built test-image digests are:
  push sha256:a16b558c82311d6c8148cf2d1f8f1eadfd9f890ffb072607b23554c3d28491c5;
  PR sha256:0610d0f7c7da72ed6bb0efeb66464bc5432473dbb716780ff706a0fe5ad01bc3.
  Neither is a final merged release artifact or deployment.
• Independent exact-head technical review is published at
  comment 6509821300.
  No unresolved review threads were present. Required branch protection
  remains unchanged; no admin bypass or approval fabrication is used.
• The archive extraction path incident was corrected by verifying and
  moving only three generated files into the owned worktree. No
  other-worktree source file was edited; RCA and prevention are documented.

Historical independent API candidate

The following measurements and image digests belong to original head
6eb1b59c, before web #259 was integrated. They remain provenance, not
proof for 15618fff.

Focused RED: 4 failed /3 passed; fourth-context RED 2 failed /7 passed.
Restored focused GREEN: 38 passed /2 suites.
Actual full API npm inventory: baseline EXIT 1; restored final EXIT 0.
Bootstrap normal Fast push: 25/25 PASS, 536.4 seconds.
Final normal PREPUSH_MODE=Validate push: 28/28 PASS.
Final API units: 6,229 passed /214 suites.
Final HTTP: 2,514 passed /118 suites; existing 42 tests +2 suites skipped.
Final web: 1,655 passed /124 files.
API lint: 0 errors /507 existing warnings.
Exact-tip repository CI: 4 successful runs /7 successful checks.
Real review: BLOCKED, requested normally; no actual review or threads.
Comment-triggered Copilot automation: FAILED, monthly quota exceeded.

Exact executed commands and their separate evidence:

• npm --prefix api test -- --runInBand src/scripts/check-dependency-override-context.spec.ts: expected RED, then GREEN after the minimal pins.
• npm --prefix api test -- --runInBand src/scripts/check-dependency-override-context.spec.ts src/scripts/check-dependency-pins.spec.ts: PASS, 38/38 after CI-lock restore.
• npm --prefix api ls --all --json: EXIT 1 before correction; EXIT 1 for the coupled hasown context after three pins and clean restore; EXIT 0 after final authenticated-lock restore.
• npm --prefix api ci --no-audit --no-fund: PASS; API lock hash byte-identical.
• npm --prefix web ci --no-audit --no-fund: PASS, serialized; web lock hash byte-identical.
• npm run docs:freshness:fix, npm run docs:content, npm run rfcs:check: PASS after updating the README version badge caught by the cheap content preflight.
• node scripts/check-lockfile-provenance.mjs: PASS.
• $env:PREPUSH_MODE='Validate'; git push origin fix/api-override-context-20261029: PASS, 28/28 unchanged gates at 6eb1b59cb1a8ea324bb1a32b17355fabc605279d. API/web TypeScript, web production build, doc rendering/provenance/currency, Prisma generation, additive migration linter and existing unit/HTTP/web suites all PASS. The checked-in build-test DATABASE_URL prerequisite was supplied only in the process environment without printing it.
• scripts/assert-dependency-ownership.ps1 -RepositoryRoot <owned-worktree>: PASS before restore/build; physical in-scope node_modules, no linked dependency mutation.
• npm --prefix web ls --all --json: EXIT 0; existing master Seroval 1.6.3 and Undici 7.29.1 deliberately remain outside this correction.
• npm --prefix api run check:pins: EXIT 1, 31 API pins checked /6 advisory records, 8 web pins /13 records, zero unchecked. This is not advisory clearance: the independent web remediation is draft fix: remediate web Seroval and Undici pins (0.55.62) #259 and the six API records remain separate.

Clean CI-only lock provenance:

• Unchanged regen-lockfile.yml, successful run 40913629689, exact bootstrap source c9cddb3dfdbb1b7b022ce39404f647c9782006db.
• Artifact 12914787144, authenticated ZIP SHA-256 bad38ee1bd6a8fed20170e71aa8090d589ed0785d449525da91873b123c09d21, verified before import.
• Both complete lock graphs have zero non-root changes. Only top-level and root package version fields become 0.55.63.
• Public registry/SHA-512 checks pass. No package changed, so CI age report is empty, with the seven-day floor retained. All four selected already-locked versions have independently verified publication timestamps older than seven days; approved-feed bytes match existing locked SHA-512.
• API lock SHA-256 0dd66eb53bc7c508cbbef80dc63417ef7178bf9a36f44066299b03f2634b3fb3.
• Web lock SHA-256 fc6121573eb5de28bbc2a70b9f9d9c2eae16d54f660628d7a33d0a2b34269899.
• No local lock generation, feed/config change, npm upgrade, quarantine bypass, baseline adoption, test suppression or protected-hook bypass.

All repository workflows below completed SUCCESS at exact source
6eb1b59cb1a8ea324bb1a32b17355fabc605279d:

Workflow	Run	Result
Build Test Image, push	40916774244	Validate, build, container smoke and HIGH/CRITICAL Trivy PASS
Build Test Image, pull request	40916867926	Validate, build, container smoke and HIGH/CRITICAL Trivy PASS
CodeQL	40916867685	PASS, not zero-alert certification
Docs freshness	40916867497	PASS

Hosted tests independently include the new real-inventory regression.
Both immutable test images were smoke-tested at their own digest:
push sha256:f80c9c633b5611ff42f051ddcae3e9b0b489e8aa18d3823659e307188ab92e62;
PR sha256:42cf3d416a6c1cc73f150f562340cf37b1950fa40ffd43c20c75d75aec6f2bdc.
These are separate builds of one source, not a promoted or latest candidate.
Image scan success does not clear the held browser/API advisories.

Standing Rules Acknowledgment

• No em-dash (Unicode U+2014) anywhere in the diff. Verified via Select-String -Pattern ([char]0x2014).
• No git commit --amend on history that has been pushed.
• No new credentials, tokens, or secrets committed to source. Forbidden patterns regression spec at api/src/security/forbidden-source-patterns.spec.ts will catch known anti-patterns.
• Migrations are additive-only (expand-contract for column changes). Migration linter at api/src/scripts/lint-migrations.ts enforces this. No migration changes.

Destructive Migration Override (skip if not applicable)

• This PR contains a NEW destructive Prisma migration (DROP TABLE/COLUMN, ALTER COLUMN ... TYPE, RENAME, INSERT ... SELECT FROM)
• I have set ALLOW_DESTRUCTIVE_MIGRATION=1 in the CI environment for this PR
• Justification (required if box above is ticked):

  <!-- Why this destructive change is necessary, what the rollback path is, and which release window it ships in -->
  N/A. No schema or migration changes.
  

Reviewer Hint

Diff areas worth special attention from the reviewer:

• Four exact API root pins must unify override ancestry without changing any real owner version or removing previous security overrides.
• The fourth pin, hasown, is necessary: the real complete-tree command rejected it after the first three fixes and after clean restore.
• The new spec must remain discriminating if any pin is removed, an owner changes, an installed resolution drifts, or the real full npm tree fails.
• Check CI artifact authentication and all-entry lock comparison, not just a targeted npm ls or diff summary.
• Self-improvement applied: full-tree exit and actual installed owners are permanent regression assertions.
• Design disposition accepted: cohesive flat pins reuse the existing pattern; no speculative abstraction.
• Remaining release holds: API advisory corrections are queued separately in fix(api): qualify qs and fast-uri advisory patches (0.55.64) #261/fix(api): qualify Hono adapter for actual Prisma parent (0.55.66) #262; performance tooling ci: qualify membership performance on isolated Linux runners #251, stopped auth work, performance ratio 1.23928982 >1.10, customer-data/restore proof, cleanup 403, browser/human visual proof, native/OS Windows worker-exit attribution and competing global Mermaid renderer remain distinct. Web fix: remediate web Seroval and Undici pins (0.55.62) #259 is now merged. No deadline, worker, exclusion or forceExit change.
• Current integration receipts are in ignored test-results/integration-api-web-20261029/. Original independent receipts remain in test-results/api-override-context-20261029/; neither older bootstrap nor independent image results substitute for final exact-tip qualification.

Historical hosted-review request evidence: gh pr edit 260 --add-reviewer '@copilot' returns
success, but actual reviews, threads and pending requests remain empty.
The single ordinary @copilot follow-up comment triggered platform
Addressing comment on PR #260 run 40917030477,
which FAILED before a review with You have exceeded your monthly quota.
This failed comment automation is separate from repository CI and is not
review approval. No further comment/request loops or quota bypass will run.
The canonical policy requires green independent review and CI, not a
particular hosted reviewer. A separate exact-head technical review is
recorded transparently; it is not a fabricated human or GitHub approval.
The integration's refreshed review and exact-head CI must be green before
ordinary merge. No repository protection or required check is removed.

[pranems]

@copilot Please provide an actual code review of exact head 6eb1b59. This draft is one independent API override-context rollback unit, with four same-version shared root pins and a real complete-tree npm regression. Check every installed owner and the authenticated zero-churn CI locks. The reviewer request returned success but the review, thread and pending-request collections remain empty; acknowledgment is not review approval. Keep the PR draft and do not merge or deploy.

[pranems]

Refreshed independent technical review of the integration

Exact reviewed head: 15618fffd7d1ff4e206b68c8c0bdacbe173a83b7.
Exact reviewed base: 0a9b3d04535dc51dcfc58e9a2360c1c9e112a41a.
Separate read-only reviewer: c5e14ba3-ed82-4c3f-82d1-6d162d15f728.

Result: no significant introduced defects found.

The bounded refresh independently verified:

• Normal merge d6b8044d preserves the original API correction and merged
  web master.
• API manifests and every non-root lock entry retain the original fix: restore complete API npm inventory with shared override contexts (0.55.63) #260
  graph; web manifests and entries inherit merged fix: remediate web Seroval and Undici pins (0.55.62) #259.
• Both coordinated roots are 0.55.63, and committed lock hashes match the
  clean-CI import proof. The final lock change is limited to the two web
  root-version fields.
• API source/schema and web source, including their previously reviewed
  regressions, are unchanged from the respective inherited sources.
• Integration-specific documentation resolutions preserve the relevant
  historical records and add current scope and RCA.

The reviewer did not execute tests, builds or installs, and did not
independently download the hosted artifacts. Artifact authentication is
the parent's separately recorded claim; protected Validate and exact-head
CI remain independent evidence.

This author-posted receipt records an independently executed automated
technical review. It is not a human or GitHub approval and does not
certify performance admission, natural Prisma process exit, a merged
release artifact or deployment.