chore(release): prepare 0.55.67 tenant10 migration under scoped exception

CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### 0.55.67 tenant 10 migration release under a scoped exception
+
+- Record explicit operator authorization
+  `T10-0.55.67-PERF-EXCEPTION-2026-11-03` for this dev-and-canary migration
+  only. Performance remains unqualified; every other gate is mandatory.
+  Customer production must not change. Failed qualification evidence and
+  normal qualification rules remain unchanged.
+- Import the existing 0.55.67 API/web manifests and lockfiles without
+  regeneration or dependency changes. Complete API/web trees match integrated
+  candidate5823a225; runtime source and schema are unchanged from reviewed
+  mastera80fafb2. Keep diagnostic research in draft PR251 rather than starting
+  campaigns through its ready-for-review event.
+- Root/web dependency restores, unchanged-lock checks, API Prisma generation
+  and complete lock provenance pass. Protected and hosted test counts,
+  reviewed merge, final artifact identity and actual dev/canary validation
+  are pending; no unchanged parent count is presented as a fresh run.
+- Self-improvement applied: record the bounded exception separately from
+  passing evidence and require final source/digest binding. Architecture
+  disposition accepted: no general gate bypass or runtime abstraction.
+
 ### Tenant rollover tooling consolidation
 
 - Record PR267's normal reviewed merge at84099293570a and authoritative

DEPLOYMENT.md

@@ -1,6 +1,6 @@
 # SCIMServer Deployment Options
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 > Updated: 2026-10-16 - Scope: production + local deployment paths
 

README.md

@@ -1,14 +1,22 @@
 # SCIMServer
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.67`
 
 > Production-ready, multi-tenant SCIM 2.0 server for Microsoft Entra ID provisioning and any RFC 7643/7644-compliant identity client.
 
 **What's new and how to upgrade:** [User-facing release notes](docs/RELEASE_NOTES.md)
-cover 0.55.58 correction preparation, merged 0.55.57 source, the deployed 0.55.56 checkpoint,
-cumulative changes since 0.55.20, migration/rollback steps and known limits.
+cover the proposed 0.55.67 tenant 10 dev-and-canary migration, earlier correction
+history, cumulative changes since 0.55.20, migration/rollback steps and known limits.
 See [CHANGELOG.md](CHANGELOG.md) for detailed engineering history.
 
+**0.55.67 migration release preparation:** the operator authorized a
+performance-admission exception for this dev-and-canary migration only.
+Performance remains unqualified; every other gate remains mandatory.
+Customer production must not change. The
+[migration execution record](docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md)
+records the scope and pending final artifact, target acceptance and cutover.
+No deployed release is claimed.
+
 **Current Hono source integration:** [Actual Prisma parent qualification](docs/HONO_PRISMA_PARENT_QUALIFICATION.md)
 records proposed 0.55.66 integrating reviewed master after #259, #260 and
 #261 merged. It preserves the bounded adapter compatibility proof and all
@@ -29,7 +37,7 @@ For actual supported shapes and integration limits, see
 Keep strict validation enabled for Entra; diagnose the request and effective
 schema before applying a targeted compatibility setting.
 
-[![Version](https://img.shields.io/badge/version-0.55.66-blue)]()
+[![Version](https://img.shields.io/badge/version-0.55.67-blue)]()
 [![Node.js](https://img.shields.io/badge/Node.js-24-green)]()
 [![NestJS](https://img.shields.io/badge/NestJS-11.1-red)]()
 [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-17-blue)]()

Session_starter.md

@@ -1,5 +1,24 @@
 ## SCIMServer - Condensed Session Memory
 
+**2026-11-03 authorized migration release:** the operator explicitly authorized
+`T10-0.55.67-PERF-EXCEPTION-2026-11-03` for this 0.55.67 tenant 10 dev/canary
+migration only. Performance remains unqualified; all other security,
+data-integrity, functional, browser and migration gates stay mandatory.
+Customer production must not change. The exact authorization and boundaries
+are recorded in `docs/TENANT_10_MIGRATION_EXECUTION_2026_10_30.md`.
+Release-only branch `ops/tenant10-release-exception-20261103` starts at reviewed
+mastera80fafb2 and imports the four existing 0.55.67 manifest/lock blobs.
+Its complete API/web trees match integrated candidate5823a225; no dependency
+graph, runtime source, schema, workflow or qualification rule changes.
+Keep PR251 research draft: ready_for_review explicitly starts its campaigns.
+Root/web restores, unchanged-lock checks, API Prisma generation and full
+lock provenance pass. Protected publication, reviewed merge and immutable
+artifact binding are pending. No target app, verified source-writer freeze,
+final carry or cutover is claimed. Historical no-waiver statements below are
+superseded, not failed benchmark receipts. Self-improvement applied: explicit
+scope/artifact binding and separate release/research units. Design disposition
+accepted: no general gate bypass or runtime abstraction is justified.
+
 **Last verified:** 2026-11-03
 
 ### Current handoff: tooling merged; release and deployment remain held

api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scimserver-api",
-  "version": "0.55.66",
+  "version": "0.55.67",
   "description": "SCIMServer backend service providing SCIM 2.0 endpoints and logging for troubleshooting.",
   "license": "MIT",
   "main": "dist/main.js",

docs/AUTHENTICATION_GUIDE.md

@@ -1,6 +1,6 @@
 # Authentication Guide
 
-> **Status:** Living reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.66`
+> **Status:** Living reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.67`
 >
 > **The captured protocol examples below were measured against a running server.** Request and response bodies are verbatim wire captures. Status codes and `reason_code` values are what the server actually returned. The reason-code table in [Section 8](#8-troubleshooting) is generated from [auth-reason-catalog.ts](../api/src/oauth/auth-reason-catalog.ts), so it cannot drift from the implementation.
 >

docs/AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md

@@ -1,8 +1,8 @@
 # Azure Deployment & Usage Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-08-12 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** June 3, 2026
+> **Version:** 0.55.67 - **Updated:** June 3, 2026
 > **Source of truth:** [deploy.ps1](../deploy.ps1), [scripts/deploy-azure.ps1](../scripts/deploy-azure.ps1), [infra/](../infra/)
 
 ---

docs/COMPLETE_API_REFERENCE.md

@@ -1,8 +1,8 @@
 # Complete API Reference
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** 2026-10-16
+> **Version:** 0.55.67 - **Updated:** 2026-10-16
 > **Current release:** [Release notes, upgrade steps and validation limits](RELEASE_NOTES.md). Earlier isolated P1-P9 receipts remain historical; the correctness consolidation is included in the deployed release.
 > **Base URL:** `http://localhost:{PORT}/scim` (configurable via `API_PREFIX` env var)
 > **121 route handlers** across 33 controllers (includes 2 dashboard analytics routes and the web SPA catch-all). Counted from the `@Get`/`@Post`/`@Put`/`@Patch`/`@Delete`/`@Sse` decorators in `api/src/**/*.controller.ts` with comments stripped; the count is enforced by `node scripts/audit-doc-content.mjs`.

docs/CONTEXT_INSTRUCTIONS.md

@@ -1,14 +1,31 @@
 # SCIMServer - Context Instructions for AI Assistants
 
 > **Purpose**: This file provides complete project context for AI coding assistants (GitHub Copilot, etc.) to enable productive sessions without re-discovery of architecture, patterns, and decisions.
-> **Version**: 0.55.66
+> **Version**: 0.55.67
 > **Last Updated**: November 3, 2026
 > **Last verified:** 2026-10-29
 
 ---
 
 ## Active Delivery Process
 
+**Current operator-authorized release path:** performance-admission exception
+`T10-0.55.67-PERF-EXCEPTION-2026-11-03` applies only to this 0.55.67 tenant 10
+dev/canary migration. Performance remains unqualified. Every other security,
+data-integrity, functional, browser and migration gate remains mandatory;
+customer production must not change. The existing migration execution document
+records the exact authorization, scope and required merged-commit/image-digest
+binding. Historical no-waiver holds below are superseded, not failed receipts.
+Use release-only branch `ops/tenant10-release-exception-20261103`; keep
+qualification research PR251 draft. Complete API/web trees match integrated
+candidate5823a225 after importing four unchanged version-bearing blobs.
+No runtime, schema, dependency graph, workflow or normal qualification logic
+changes. Root/web dependency restore, unchanged-lock verification, API Prisma
+generation and public-registry/sha512 provenance pass. Normal protected review,
+final immutable artifact, actual target acceptance, source freeze/final carry
+and cutover remain pending. Self-improvement applied: bounded authorization
+and honest pending evidence. Design disposition accepted: no general bypass.
+
 **Authoritative current state:** PR267 is merged at84099293570af5ab06f7d8e2f93e7e6ae2c0236f.
 Reviewed883fb6c6 passes29 protected gates, and exact-tip5757623103 reports
 no open issues (COMMENTED, not formal APPROVED). Postmerge41696483989,

docs/CUSTOM_EXTENSIONS_RFC_GUIDE.md

@@ -9,7 +9,7 @@ or fetching them. See [minimal-schema validation](GOOGLE_MINIMAL_GROUP_MEMBERSHI
 [reference persistence and compatibility](GROUP_MEMBER_REFERENCE_PRESERVATION.md)
 and [release notes](RELEASE_NOTES.md).
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 > **P7a behavior, included since 0.55.36:** [Profile validation](SCIM_P7A_PROFILE_VALIDATION.md)
 > adds declaration/type/cardinality checks, required extension enforcement,

docs/DOCKER_GUIDE_AND_TEST_REPORT.md

@@ -1,8 +1,8 @@
 # Docker Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** June 3, 2026
+> **Version:** 0.55.67 - **Updated:** June 3, 2026
 > **Source of truth:** [Dockerfile](../Dockerfile), [docker-compose.yml](../docker-compose.yml)
 
 ---

docs/ENDPOINT_CONFIG_FLAGS_REFERENCE.md

@@ -1,8 +1,8 @@
 # Endpoint Configuration Flags Reference
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-29 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-09-29 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** September 29, 2026
+> **Version:** 0.55.67 - **Updated:** September 29, 2026
 > **Source of truth:** [endpoint-profile.types.ts](../api/src/modules/scim/endpoint-profile/endpoint-profile.types.ts) (`ProfileSettings`)
 > 39 registered settings in the unreleased lifetime port: 20 boolean + 16 numeric (11 runtime-egress overrides + 3 active-credential caps + 2 token lifetimes) + 3 other typed values. `PersistRequestSecrets` is inert and `CredentialSecretVisibility` supports only `always`. See the [behavioral evidence and explicit coverage gaps](SCIM_SETTINGS_BEHAVIOR_EVIDENCE.md) and [Entra compatibility guide](SCIM_ENTRA_COMPATIBILITY.md). Registry membership is not evidence of enforcement.
 > 6 value types: `boolean`, `logLevel`, `primaryEnforcement`, `credentialVisibility`, `structured`, and `number` (the last added for the runtime JWKS-fetch egress knobs).

docs/ENDPOINT_CREATION_WIKI.md

@@ -1,8 +1,8 @@
 # Create Your Own SCIM Endpoint - Self-Service Wiki
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** 2026-10-16
+> **Version:** 0.55.67 - **Updated:** 2026-10-16
 > Beginner-friendly, copy-paste guide for standing up a SCIM endpoint in minutes.
 > **Source of truth:** [endpoint.controller.ts](../api/src/modules/endpoint/controllers/endpoint.controller.ts) - [built-in-presets.ts](../api/src/modules/scim/endpoint-profile/built-in-presets.ts)
 

docs/ENDPOINT_LIFECYCLE_AND_USAGE.md

@@ -1,8 +1,8 @@
 # Endpoint Lifecycle & Usage Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-12 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-12 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** June 3, 2026
+> **Version:** 0.55.67 - **Updated:** June 3, 2026
 > Quick-start recipes for common SCIMServer operations
 
 ---

docs/ENDPOINT_PROFILE_ARCHITECTURE.md

@@ -1,6 +1,6 @@
 # Endpoint Profile Architecture
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.67`
 
 > **Updated:** 2026-10-17
 > **Source of truth:** [endpoint-profile/](../api/src/modules/scim/endpoint-profile/) and [endpoint.service.ts](../api/src/modules/endpoint/services/endpoint.service.ts)

docs/GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md

@@ -1,6 +1,6 @@
 # Global navigation and workflow context
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 See [current release notes](RELEASE_NOTES.md) for deployment and acceptance
 boundaries. Endpoints now uses available window height, Dashboard uses compact

docs/INDEX.md

@@ -1,8 +1,8 @@
 # SCIMServer Documentation Index
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-21 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** 2026-10-21
+> **Version:** 0.55.67 - **Updated:** 2026-10-21
 > 6 presets - **39 endpoint settings controls** in the unreleased lifetime port (20 boolean flags + 3 other typed settings + 16 numerics) - profile-driven User, Group, and custom ResourceType forms
 
 **Unreleased preparation:** [endpoint token lifetime integration and original

docs/LOGGING_AND_OBSERVABILITY.md

@@ -1,6 +1,6 @@
 # Logging & Observability Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 **Current UI presentation:** absolute timestamps in Logs, Activity, Operations
 and live/detail drawers include full UTC date/time and milliseconds. Copy

docs/MULTI_ENDPOINT_GUIDE.md

@@ -1,8 +1,8 @@
 # Multi-Endpoint Architecture Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66 - **Updated:** June 3, 2026
+> **Version:** 0.55.67 - **Updated:** June 3, 2026
 > **Source of truth:** [endpoint.service.ts](../api/src/modules/endpoint/services/endpoint.service.ts)
 
 ---

docs/OBSERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md

@@ -1,6 +1,6 @@
 # Observability, Traceability, Correlation IDs, Logging, Error Handling and Diagnostics
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 **Current operator presentation:** all absolute UI timestamps carry complete
 UTC date/time, milliseconds and timezone; invalid expiry values are explicit,

docs/PATCH_OPERATIONS_COMPLETE_GUIDE.md

@@ -11,7 +11,7 @@ rejected later operation saves no earlier mutation. See
 [reference persistence and rollback compatibility](GROUP_MEMBER_REFERENCE_PRESERVATION.md)
 and [current release notes](RELEASE_NOTES.md).
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
 > Comprehensive, source-verified reference for every PATCH option, mode, setting, path form, verb, and persistence outcome across Users, Groups, custom extensions, and custom resource types - grounded in RFC 7644 / RFC 7643 and the SCIMServer implementation.
 

docs/PROD_TO_DEV_MIRRORING_AND_FIXTURES.md

@@ -1,8 +1,8 @@
 # Prod -> Dev mirroring + synthetic shape-coverage fixtures
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-16 - **Product version:** `0.55.67`
 
-> **Version:** 0.55.66  -  **Date:** May 6, 2026
+> **Version:** 0.55.67  -  **Date:** May 6, 2026
 > **Scope:** dev-tooling, no API surface change
 > **Affects:** [api/src/scripts/mirror-prod-to-dev.ts](../api/src/scripts/mirror-prod-to-dev.ts), [api/src/scripts/seed-shape-coverage.ts](../api/src/scripts/seed-shape-coverage.ts), [scripts/mirror-prod-to-dev.ps1](../scripts/mirror-prod-to-dev.ps1)
 

docs/RELEASE_NOTES.md

@@ -1,6 +1,6 @@
 # SCIMServer release notes
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-23 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-23 - **Product version:** `0.55.67`
 
 These curated notes explain what changes for operators and integrators, how to
 upgrade, and what remains limited. The [engineering changelog](../CHANGELOG.md)
@@ -15,6 +15,25 @@ notes rather than assuming that a patch label makes every rollback lossless.
 
 ## Unreleased
 
+### 0.55.67 tenant 10 dev-and-canary migration
+
+The operator authorized a performance-admission exception for this migration
+only. **Performance remains unqualified.** Every other security,
+data-integrity, functional, browser and migration gate remains mandatory.
+Customer production must not change.
+
+The [migration execution record](TENANT_10_MIGRATION_EXECUTION_2026_10_30.md)
+contains the exact authorization, decision scope and required final
+merged-source/image-digest binding. Release metadata advances from 0.55.66 to
+0.55.67 without changing runtime source, database schema or dependency graphs.
+Qualification-method research remains separate in draft #251; this exception
+does not change normal qualification protocols or turn failed evidence green.
+
+Protected validation, normal review, merged artifact publication and actual
+target acceptance are pending. The final source-writer freeze, fresh data carry
+and cutover are not complete. This is not a deployed-release announcement.
+Earlier unreleased preparation entries below are historical context.
+
 ### Current source consolidation: 0.55.66
 
 Reviewed #259, #260 and #261 are merged, most recently at `cffc64c8`.

docs/REMOTE_DEBUGGING_AND_DIAGNOSIS.md

@@ -1,6 +1,6 @@
 # Remote Debugging & Diagnosis Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-10-09 - **Product version:** `0.55.67`
 
 > **Version:** 3.2 - **Source-verified against:** v0.55.36 - **Updated:** 2026-10-01
 > Request-history identity and authenticated stream transport re-verified against v0.55.36 on 2026-10-01; the full line-by-line pass dates from v0.53.0.

docs/SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md

@@ -1,6 +1,6 @@
 # Schema Attribute Customization Guide
 
-> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.66`
+> **Status:** User-facing reference - **Last verified:** 2026-09-28 - **Product version:** `0.55.67`
 
 > **Version**: 1.1 - **Date**: 2026-08-04 - **Status**: Complete (PATCH merge semantics re-verified against `mergeProfilePartial()` on 2026-08-04; the full line-by-line source pass dates from v0.40.0)  
 > **Audience**: Operators, ISV admins, Entra ID integration engineers