[pranems]

Summary

Current reviewed-master integration

Exact published head: a5f4c0aab2ad81a770d688f461b7234ae07bd696.
Ordinary merge parents are original #262 7379a97e and reviewed master
cffc64c8 (merged #261, version 0.55.64). This proposed 0.55.66 rollback
unit now targets master; all original constituent commits are preserved.

The complete qualified API manifests, locks and fixtures equal original
7379a97e. Against master, the only non-root package change is the selected
Hono adapter 2.1.3. The web graph and serving source, schema and estate
registry preserve reviewed master. Both narrative histories are retained.

New-head evidence:

• Normal PREPUSH_MODE=Validate tracking push: 28/28 PASS, exit 0,
  1,042.7 seconds. No skipped/bypassed hook.
• API unit: 6,254 passed / 216 suites.
• API E2E: 2,514 passed / 118 suites, with 42 tests / 2 suites
  explicitly skipped by the existing inmemory matrix.
• Web: 1,661 passed / 125 files.
• Owned API-only clean restore: PASS, both source lock hashes unchanged;
  both complete npm ls --all --json inventories and isolated
  npm run prisma:generate: exit 0.
• Separate read-only technical review at this exact head: no significant
  introduced defects, published in
  fix(api): qualify Hono adapter for actual Prisma parent (0.55.66) #262 (comment).
  The reviewer did not execute tests or independently authenticate historical
  raw qualification artifacts. This is not a GitHub-hosted human approval.
• All five new-head hosted runs completed successfully:
  PR Build Test Image,
  push Build Test Image,
  CodeQL,
  Docs freshness,
  and coordinated clean lock regeneration.
  Every run's metadata binds to exact a5f4c0aa.
• Clean-CI artifact 12945160301: raw ZIP SHA-256
  7cb51ac7a990393fcf59fee3ee66022097ecc3fcbbdf7233b481fe808bb39e2c
  authenticated against GitHub metadata before safe absolute-path extraction.
  Both lockfiles equal the exact committed Git blob bytes; Windows CRLF
  checkout differences are separately explained, not normalized into archive
  authentication. Seven-day floor preserved, zero changed packages.
  No local regeneration, import, reinstall or repeated protected push needed.

No new actual-parent workload was repeated: the entire qualified API graph
and fixture source are unchanged. Natural process exit remains unproved.
No live estate, shared database, deployment or customer resource was changed.
Performance #251 remains unmerged with its failed qualification preserved.
This PR does not establish release admission. If 0.55.66 merges first,
held 0.55.65 must be reconciled/versioned forward rather than downgrade master.

Original qualification checkpoint (historical)

Qualify and select @hono/node-server 2.1.3 for its actual Prisma 7.8.0 / dev
0.24.3 parent, addressing GHSA-rmxm-3fg6-px4f in a separate proposed 0.55.66
rollback unit stacked on unmerged draft #261.

The real parent's startup, HTTP requests, synthetic primary/shadow database
writes, dump, public port-conflict rejection, close and listener/data cleanup
pass with both adapters. The actual HTTP exploit exposes a synthetic protected
file at 1.19.15 and returns 404 at 2.1.3. Upstream still declares exact 1.19.11:
this is bounded behavioral qualification, not semver acceptance.

Both versions retain a post-close process. Natural process exit is NOT claimed.
The isolated runner records that state and stops/verifies/removes its exact
owned container. It does not patch the parent or change Jest workers/exit rules.
No shared database, host listener, existing container, live estate or cloud
resource is mutated.

Linked Defect / Plan Reference

• DELIVERY_PLAN.md defect ID: Bounded final API advisory follow-up to fix(api): qualify qs and fast-uri advisory patches (0.55.64) #261.
• Audit doc reference: docs/HONO_PRISMA_PARENT_QUALIFICATION.md, including execution RCA.
• ADR (if applicable): N/A: no application architecture or public SCIM contract changes.

TDD Process

• RED test written first; observed it fail for the expected reason
• GREEN: minimal implementation that turns the test green
• Refactor (if any) keeps the test green
• Permanent regression guard added (where applicable - see existing patterns in api/src/security/)

Pre-manifest permanent RED: four failed / two passed of six, including
200 !== 404 on the real double-decode exploit and the old selected pin.
The complete inventory also rejected the initial wrong installed graph.
Final clean-installed GREEN is six passed in one suite. The real-parent
runner passes all 12 claims from that graph and removes its owned container.

Feature / Bug-Fix Commit Checklist (standing rule)

Every behavioral change must include all that apply. Tick or strike through with N/A + reason.

• Unit Tests - service-level and controller-level coverage of the new behavior. Six package/owner/inventory/contract regressions; no application service/controller change.
• E2E Tests - end-to-end spec under api/test/e2e/ exercising the feature through HTTP. N/A for a new SCIM spec: no SCIM path changes; existing HTTP suite remains a protected gate, and the actual parent HTTP lifecycle is exercised separately.
• Live Integration Tests - new section in scripts/live-test.ps1 runnable against local + Docker + Azure. N/A: this task authorizes disposable local real-parent proof, not shared/live/cloud mutation. Reusable isolated runner added instead.
• Feature Documentation - dedicated doc in docs/ with architecture, RFC references, Mermaid diagrams, test coverage. Qualification report includes text flow, upstream advisory/fix references, comparison table, commands, limits and RCA; no SCIM RFC behavior or Mermaid content changes.
• INDEX.md Update - add the new doc reference to docs/INDEX.md
• CHANGELOG.md Update - [Unreleased] entry with full test counts and feature summary
• Session & Context Updates - Session_starter.md and docs/CONTEXT_INSTRUCTIONS.md
• Version Management - bump api/package.json (and any other version refs) when behavior changed
• Response Contract Tests - API responses contain ONLY documented fields (key allowlist assertion at unit + E2E + live). Actual parent health/dump exact-key assertions; no SCIM response change.

Validation Output

Focused: 6/6 in one suite; targeted ESLint passes.
Final clean-installed actual-parent runner: 12/12 claims; exact-container cleanup.
Complete unfiltered API npm inventory: exit 0, empty stderr.
Native actual-parent fixture invocation: expected fail-closed refusal.
Protected Validate: 28/28 PASS, 1,014.9 seconds; normal push succeeded.
Final protected API unit: 6,254/6,254 in 216 suites.
Final protected HTTP E2E: 2,514 passed, 42 existing skipped; 118 passing/2 skipped suites.
Final protected web Vitest: 1,655/1,655 in 124 files.
Exact-tip Build Test Image push run 40953652162: SUCCESS.
Hosted validate and build-and-push jobs: SUCCESS, including container smoke and HIGH/CRITICAL Trivy gate.
Bootstrap protected Fast: 25/25 gates, 623.6 seconds.
Bootstrap unit: 6,248/6,248, 215 suites.
Bootstrap HTTP: 2,514 passed, 42 existing skipped, 118 passing/2 skipped suites.
Real-parent baseline and candidate: 12 lifecycle assertions plus explicit owned cleanup.
Actual HTTP security reproduction: old RED 200, candidate GREEN 404.

Exact command and working directory	Result
From api: npm test -- --runTestsByPath src\scripts\check-hono-parent-qualification.spec.ts	PASS, 6/6 in one suite; pre-manifest RED was 4 failed/2 passed
From api: npx eslint src\scripts\check-hono-parent-qualification.spec.ts	PASS
npm --prefix api ls --all --json	PASS, complete unfiltered inventory, exit 0 and empty stderr
pwsh -NoProfile -File scripts\qualify-prisma-hono-parent.ps1	PASS, final clean-installed parent: 12 claims and exact owned-container cleanup
node --check scripts\fixtures\prisma-hono-parent.cjs	PASS
node scripts\fixtures\prisma-hono-parent.cjs	Expected fail-closed native refusal, before actual-parent loading
npm --prefix api run prisma:generate with process-only checked-in CI configuration	PASS, client 7.8.0; no database connection
pwsh -NoProfile -File scripts\audit-doc-freshness.ps1	PASS
git diff --check	PASS
$env:PREPUSH_MODE='Validate'; git push with CI configuration in that same shell	PASS 28/28 gates in 1,014.9 seconds; normal push to 7379a97 succeeded; first attempt correctly blocked on missing process DATABASE_URL

Clean-CI lock run 40948177653 used source
38b1a781eed63905d429feef2480c899dd203161.
Artifact 12929363808 authenticated SHA-256:
bf1c5791b9cfddf1a9e22beacd71a4549835c3d37ebf32db413e0d4629048946.
The only non-root API lock change is the adapter; web has no non-root
change. Approved-feed tarball bytes match the public SHA-512 lock.

The bootstrap source image run 40948154638 failed on the intentionally
not-yet-regenerated lock (1.19.15 versus 2.1.3). It is not counted as
final validation. This is corrected by importing the authenticated locks,
not by loosening installation or supply-chain checks.

The first final Validate attempt correctly blocked the push at Prisma
generation because its fresh process lacked DATABASE_URL, after unit and
HTTP suites passed. The unchanged generate command passes with the exact
checked-in CI value scoped only to that process. The normal protected push
passed with that setup, without changing a gate or contacting a database.

Published exact head: 7379a97e3f64cb054fac2a5ff34cdbe144027993.
Available hosted CI is the exact-tip push run
40953652162.
Both jobs succeeded, including container startup/smoke and the HIGH/CRITICAL
Trivy gate. This stacked base does not imply a master-targeted pull-request
coupling matrix ran. No other workflow run is reported for this exact tip.

Immutable test image:
ghcr.io/pranems/scimserver@sha256:551e2db38843ddaf8da4bd2fe667ebd030c3eecccb9c9e33f067d4ac45842bb6.
The workflow published the branch test tag and
sha-7379a97e3f64cb054fac2a5ff34cdbe144027993, not latest.
Nothing was deployed.

Standing Rules Acknowledgment

• No em-dash (Unicode U+2014) anywhere in the diff. Verified via Select-String -Pattern ([char]0x2014).
• No git commit --amend on history that has been pushed.
• No new credentials, tokens, or secrets committed to source. Forbidden patterns regression spec at api/src/security/forbidden-source-patterns.spec.ts will catch known anti-patterns.
• Migrations are additive-only (expand-contract for column changes). Migration linter at api/src/scripts/lint-migrations.ts enforces this. N/A: no migration changes.

Destructive Migration Override (skip if not applicable)

• This PR contains a NEW destructive Prisma migration (DROP TABLE/COLUMN, ALTER COLUMN ... TYPE, RENAME, INSERT ... SELECT FROM)
• I have set ALLOW_DESTRUCTIVE_MIGRATION=1 in the CI environment for this PR
• Justification (required if box above is ticked):

  <!-- Why this destructive change is necessary, what the rollback path is, and which release window it ships in -->
  

N/A: this change has no Prisma schema or migration edits.

Reviewer Hint

Diff areas worth special attention from the reviewer:

• Exact Prisma/dev identity and original constraint versus tested major override.
• Actual parent lifecycle fixture, isolated Docker runner, port/data assertions
  and honest retained-process cleanup boundary.
• Full installed inventory and every locked adapter occurrence.
• CI artifact provenance and adapter-only dependency graph delta.
• Explicit limits: no authenticated accelerated query-engine downloads,
  arbitrary streaming/load, native Windows parent listener or production proof.
• Keep draft until actual review. Do not merge/retarget/admit latest/deploy.
  fix: remediate web Seroval and Undici pins (0.55.62) #259, fix: restore complete API npm inventory with shared override contexts (0.55.63) #260, fix(api): qualify qs and fast-uri advisory patches (0.55.64) #261 and ci: qualify membership performance on isolated Linux runners #251 remain unmerged; integration/order needs fresh
  reconciliation, with 0.55.65 still reserved for untouched ci: qualify membership performance on isolated Linux runners #251.
• One ordinary Copilot reviewer request failed with
  Could not resolve user with login 'copilot' (requestReviewsByLogin).
  The actual review/request lists and decision are empty. No retry loop or
  comment automation followed; actual external review is still required.
• Preserve historical performance failure/skipped campaigns and the customer
  data, cleanup-403, browser/human-visual, native/renderer, stopped-authentication
  and production-approval holds.
• Self-improvement applied: real-parent and complete-graph guards. Architecture
  disposition accepted: cohesive dependency/test change; no speculative seam.

[pranems]

Independent read-only technical review

Exact candidate: a5f4c0a
Tree: e5cd7ad65deaea8205bf393a86c820bf93a6ebff
Reviewer: separate code-review agent85814f5b-15ce-407d-a266-a8d3a5929bb8
Reviewed against mastercffc64c8 and original2627379a97e.

Result: No significant introduced defects found in the reviewed changes.

Review limits: Read-only review of the exact candidate, exclusively in the
owned worktree. Source comparisons confirmed the preserved API graph/fixtures
and Hono-only non-root dependency delta. HANDOFF.md and parent-union-proof.json
were inspected as recorded evidence, not independent verification of raw
execution artifacts.

No tests, installs, or Docker commands were run by this reviewer. This review
does not establish natural process exit, independently verify historical
cleanup, clear performance251, or establish release admission. It is not a
GitHub-hosted human approval.