[pranems]

Summary

Patch five assessed API advisory records with qs 6.16.1 and fast-uri 4.2.3,
using actual locked and installed consumers rather than an engine-only check.
Leave the Hono adapter advisory explicitly blocked.

Current integration: proposed 0.55.64 now targets reviewed master
287ea671abf1619d7b172c495310769078bd685b after #259 and #260 merged.
Ordinary merge 1334c7cd7d95a30c79166a91e83c9f6b67af5240 preserves
original #261 f4fcfe3c, reviewed master and every constituent commit.
API retains its bounded advisory correction and four root contexts; web
inherits merged Seroval 1.6.11 and Undici 7.30.1. #251 and #262 stay separate.

qs's three real owners accept the patch; body-parser already requires it.
Actual nested Ajv 8.20.0 requires ^3.0.1, which does NOT accept either
the previous forced 4.1.5 or new 4.2.3. Compiler and resolver tests provide
bounded compatibility evidence for the existing forced-major seam.
@prisma/dev 0.24.3 exact-pins the adapter to 1.19.11. Its actual
initialization/error/request/shutdown lifecycle has not been qualified on
2.1.3, and this task forbids starting its database/server. The override stays
1.19.15; GHSA-rmxm-3fg6-px4f remains active, not suppressed.

No runtime source, endpoint, API response contract, UI behavior, schema,
authentication, live service, Docker engine or deployment is changed.
Protected Validate and all seven exact-head hosted checks pass. Fresh
separately executed technical review found no significant introduced
defects. This is not a release-complete claim or fabricated human/GitHub
approval.

Linked Defect / Plan Reference

• DELIVERY_PLAN.md defect ID: N/A, bounded follow-up to [security] pinned dependency review needed #256 and fix: restore complete API npm inventory with shared override contexts (0.55.63) #260.
• Audit doc reference: docs/API_ADVISORY_CONSUMER_COMPATIBILITY.md.
• ADR (if applicable): N/A, two existing flat overrides; no runtime architecture change.

TDD Process

• RED test written first; observed it fail for the expected reason
• GREEN: minimal implementation that turns the test green
• Refactor (if any) keeps the test green
• Permanent regression guard added (where applicable - see existing patterns in api/src/security/)

Pre-manifest RED: 11 assertion failures / three passes across 14 cases.
Subsequent real-old-byte replay validates the corrected URI fixtures:
four advisory mechanisms fail while the actual Ajv compiler passes.
Final clean authenticated-restore focus: 57/57, including 19 new cases and
38 existing pin/inventory checks. The RCA records the original fixture
mistakes rather than presenting them as valid compatibility evidence.

Feature / Bug-Fix Commit Checklist (standing rule)

Every behavioral change must include all that apply. Tick or strike through with N/A + reason.

• Unit Tests - service-level and controller-level coverage of the new behavior
  • Actual dependency-consumer regression in api/src/scripts/check-api-advisory-consumers.spec.ts; no service/controller implementation changes.
• E2E Tests - end-to-end spec under api/test/e2e/ exercising the feature through HTTP
  • Existing full HTTP gate covers unchanged API contracts. No new endpoint or HTTP contract was added.
• Live Integration Tests - new section in scripts/live-test.ps1 runnable against local + Docker + Azure N/A: no service/database starts or live mutation permitted; no runtime API change.
• Feature Documentation - dedicated doc in docs/ with architecture, RFC references, Mermaid diagrams, test coverage
  • Consumer graph, public changes, RFC URI references, claims/limits and execution RCA. Text graph intentionally needs no new renderer dependency.
• INDEX.md Update - add the new doc reference to docs/INDEX.md
• CHANGELOG.md Update - [Unreleased] entry with full test counts and feature summary
  • Measured focused/bootstrap counts committed; final exact-tip totals below and in ignored handoff.
• Session & Context Updates - Session_starter.md and docs/CONTEXT_INSTRUCTIONS.md
• Version Management - bump api/package.json (and any other version refs) when behavior changed
  • 0.55.64 in both workspaces; locks generated only by unchanged clean CI workflow.
• Response Contract Tests - API responses contain ONLY documented fields (key allowlist assertion at unit + E2E + live) N/A for new assertions: no response/runtime fields change; existing complete API tests retained without weakening.

Validation Output

Current integrated source

• Both manifests and complete lock graphs match the exact intended parent
  union: API equals original f4fcfe3c; web equals reviewed master
  287ea671, except coordinated 0.55.64 root metadata. Zero non-root drift.
• npm --prefix api ci --no-audit --no-fund: PASS, both lock hashes unchanged.
  The web installed graph is physically unchanged, so no redundant restore.
• npm --prefix api ls --all --json and
  npm --prefix web ls --all --json: both EXIT 0.
• Fresh independent read-only review of exact 1334c7cd against 287ea671:
  no significant introduced defects. Parent preservation, all manifest/lock
  entries, inherited source/schema/regressions and integration docs checked.
  No tests or artifact download were performed by the reviewer.
• Final $env:PREPUSH_MODE='Validate'; git push origin fix/api-advisory-pins-20261029:
  PASS, 28/28 gates in 1045.4 seconds, exit 0. Published exact head is
  1334c7cd7d95a30c79166a91e83c9f6b67af5240; worktree remains clean.
  API 6,248 passed /215 suites; HTTP 2,514 passed /118 suites,
  plus 42 existing skipped tests /2 skipped suites; web 1,661 passed
  /125 files. Existing worker warnings remain, without teardown, timeout,
  exclusion or forceExit changes.
• All four exact-head hosted runs completed SUCCESS, with all seven
  checks successful:
  push Build Test Image 40969764640,
  PR Build Test Image 40969771306,
  CodeQL 40969771263
  and docs freshness 40969771265.
  Both builds pass validation, container smoke and existing HIGH/CRITICAL
  Trivy steps. Test-image digests:
  push sha256:ef0131a329581bf6d284faf422a6d3354c22dd89aa78b05fcbee417998a060e2;
  PR sha256:2a9237ba45f18cb72623cd21fc721721a7d3a9b90e7d2a405dcf5af15fb15d7c.
  Neither is an admitted merged-master release artifact or deployment.
• Independent exact-head review is published at
  comment 6510494070.
  Fresh review-thread query found no threads or further page.
• Clean-CI confirmation 40969793262:
  PASS at exact 1334c7cd. Artifact 12938963537, ZIP SHA-256
  27821e7c6f7e0247bdb80028418c79c663ff98476a7bf052be538ea787c6a42d,
  authenticated before extraction into an absolute owned destination.
  Both regenerated locks are byte-identical to their exact committed
  Git blobs, with unchanged seven-day floor and zero changed packages.
  No import, source change, reinstall or second protected push is needed.
• Diagnostic correction: a raw working-file comparison initially stopped
  on Windows CRLF checkout bytes. Complete JSON structures and exact Git
  blobs matched CI; only checkout line endings differ. The corrected check
  requires exact committed-byte equality and separately proves newline-only
  checkout differences. A changed-content negative control is rejected.
  Archive authentication remains raw-byte verification, never normalized.
• All 40 worktrees rechecked read-only: eight dirty, other 39 worktrees'
  heads/status-path entries unchanged from the previous checkpoint.
  This is status monitoring, not a backup or hash of dirty contents.

Historical independent advisory candidate

The following results belong to original f4fcfe3c, before reviewed master
was integrated. They remain provenance, not proof for 1334c7cd.

Focused:     57/57 pass, 3 suites
API units:   6,248 pass, 215 suites
API HTTP:    2,514 pass, 118 passing suites; existing 42 skipped tests / 2 skipped suites
Web units:   1,655 pass, 124 files
Lint:        0 errors / 507 inherited warnings; new fixture 0 errors / 0 warnings
Inventory:   real complete API npm ls --all --json EXIT 0; no problems
Locks:       exactly 2 API package entries changed; zero non-root web changes
Em-dash:     clean

Exact commands and results:

• npm --prefix api test -- --runInBand src/scripts/check-api-advisory-consumers.spec.ts
  • Pre-manifest RED: failed 11 / passed 3; retained assertion output.
• Old 4.1.5 byte replay with
  npm --prefix api test -- --runInBand src/scripts/check-api-advisory-consumers.spec.ts -t 'actual nested Ajv|rejects encoded|preserves relative|rejects host|escapes suffix'
  • Expected RED: four failures / one compiler pass.
• npm --prefix api ci --no-audit --no-fund and
  npm --prefix web ci --no-audit --no-fund
  • PASS after authenticated CI-lock import, locks byte-identical.
• npm --prefix api test -- --runInBand src/scripts/check-api-advisory-consumers.spec.ts src/scripts/check-dependency-override-context.spec.ts src/scripts/check-dependency-pins.spec.ts
  • PASS 57/57 in three suites after final lint correction.
• npx eslint src\scripts\check-api-advisory-consumers.spec.ts from api
  • PASS, zero errors and zero warnings.
• npm --prefix api ls --all --json
  • PASS, EXIT 0, no problems, empty stderr.
• node scripts\check-lockfile-provenance.mjs
  • PASS.
• pwsh -NoProfile -File scripts\audit-doc-freshness.ps1
  • PASS.
• node scripts\audit-doc-content.mjs
  • PASS.
• $env:PREPUSH_MODE='Validate'; git push
  • PASS, all 28/28 gates; 966 seconds. Actual final source
    f4fcfe3ccac83de6548ed9991ed44048ee8d660a.

Supply-chain evidence: regeneration run
40923567650,
source eb797fd69ef2b371e3a1812198fe6f159eeafc1c,
artifact 12918583682, authenticated ZIP SHA-256
bb3b81a1a4dd2eeb14f04e4838d50f6f883fae666057d0ece60e05d42ff29edf.
Approved-feed tarball bytes match both locked SHA-512 digests; CI ages
14.815 and 9.784 days exceed the unchanged seven-day floor.

Bootstrap Build Test Image 40923545248 failed on the deliberately stale two
lock entries. The retained failure is fixed by the authenticated CI locks,
not waived. An initial final-hook attempt was stopped before publication to
remove one new unnecessary type assertion. Its partial receipt is not the
authoritative final validation.

Exact-tip hosted results, all at
f4fcfe3ccac83de6548ed9991ed44048ee8d660a:

Workflow	Event	Run	Actual result
Build Test Image	source push	40929640559	PASS: validate and build-and-push, including container smoke and existing Trivy gate
CodeQL	workflow_dispatch	40929800240	PASS: JavaScript/TypeScript analysis
Docs freshness	workflow_dispatch	40929805500	PASS: currency-only dispatch path (-SkipCoupling); not PR coupling coverage

The PR check view currently exposes three successful contexts:
validate, build-and-push and CodeQL. These three runs/four jobs are
the actual available coverage, not the master-targeted PR matrix.

Immutable test image:
ghcr.io/pranems/scimserver@sha256:d6b90a9df5ac5d0575012c3364cf53b2ad462f6a347ada5d80e48dc26057c3ed.
Docker build artifact 12921733626, GitHub digest
sha256:269e566b3a72af21e823e701d44436f6c75bf70b92057229728936e2c9a943fe.
This is not a merged-master/latest-admitted deployment candidate.

Historical hosted-review request: the ordinary @copilot request returned this PR URL,
but actual review requests, reviews and review threads are empty. The
uncorrected copilot login attempt failed resolution and was corrected
once; there were no repeated unchanged requests or comment automation.
No independent review was claimed by that historical receipt. Current
separate technical review is recorded above; no release approval is claimed.

Standing Rules Acknowledgment

• No em-dash (Unicode U+2014) anywhere in the diff. Verified via Select-String -Pattern ([char]0x2014).
• No git commit --amend on history that has been pushed.
• No new credentials, tokens, or secrets committed to source. Forbidden patterns regression spec at api/src/security/forbidden-source-patterns.spec.ts will catch known anti-patterns.
• Migrations are additive-only (expand-contract for column changes). Migration linter at api/src/scripts/lint-migrations.ts enforces this.
  • No migrations changed.

Destructive Migration Override (skip if not applicable)

• This PR contains a NEW destructive Prisma migration (DROP TABLE/COLUMN, ALTER COLUMN ... TYPE, RENAME, INSERT ... SELECT FROM)
• I have set ALLOW_DESTRUCTIVE_MIGRATION=1 in the CI environment for this PR
• Justification (required if box above is ticked):

  <!-- Why this destructive change is necessary, what the rollback path is, and which release window it ships in -->
  

N/A: no migration or schema changes.

Reviewer Hint

Diff areas worth special attention from the reviewer:

• Exact CI lock delta and every actual installed owner resolution.
• Ajv's documented pre-existing forced-major range exception and the limits of
  compiler/resolver behavioral qualification.
• The unchanged exact-pinned Prisma/Hono adapter and remaining medium advisory.
• URI fixture corrections and baseline replay in the execution RCA.
• History-preserving reviewed-master integration, exact-head CI and inherited
  performance/customer-data/cleanup-403/live/browser/visual/native/renderer/
  latest-admission holds and user-stopped authentication work.
• Self-improvement applied: actual-consumer and per-advisory regressions.
  Design accepted: cohesive flat pins; a new runtime abstraction is speculative.

#260 is now reviewed and normally merged. This PR was retargeted to master
only afterwards. Current independent technical review and exact-head CI,
not a provider-specific request or an author approval, govern merge.
No protection change, admin bypass, billing/account change or repeated
unchanged automation request is authorized.

[pranems]

Refreshed independent technical review of the integration

Exact head: 1334c7cd7d95a30c79166a91e83c9f6b67af5240.
Exact base: 287ea671abf1619d7b172c495310769078bd685b.
Separate read-only reviewer: c5e14ba3-ed82-4c3f-82d1-6d162d15f728.

Result: no significant introduced defects found.

The bounded refresh verified the ordinary two-parent merge preserves
original #261 and reviewed master; API manifest/lock bytes equal original
f4fcfe3c; web manifest and complete lock structure equal master except
coordinated 0.55.64 root metadata. There is zero non-root drift.

API source, regression tests, schema and test tree match original #261;
web source matches master. Scripts and workflows are unchanged from master.
Current integration summaries and preserved historical records were checked.
The unchanged original review was not repeated.

The reviewer ran no tests, installs, inventories, restores or services,
and did not independently authenticate hosted artifacts. Protected Validate,
exact-head CI and clean-CI confirmation are separately recorded claims.

This author-posted receipt records independently executed automated technical
review, not human or GitHub approval, deployment authorization, release
admission or clearance of existing performance/Prisma-exit holds.