[pranems]

Summary

Reserve 0.55.62 for minimal exact web Seroval 1.6.3 -> 1.6.11 and Undici
7.29.1 -> 7.30.1 patches, using authenticated CI-only locks and actual
installed-owner checks. Keep this PR DRAFT. Do not merge or deploy.

The full API package map is unchanged. The reviewed merged request-body and
logging-fixture corrections are preserved from master
727860866c53c7ec8d01d1ff5bae858f80a1715d. PR #251 is untouched.

Linked Defect / Plan Reference

• DELIVERY_PLAN.md defect ID: [security] pinned dependency review needed #256, web portion only. Six API advisory records remain open.
• Audit doc reference: docs/WEB_SEROVAL_UNDICI_SECURITY_REMEDIATION.md, actual owners, CI artifacts and RCA.
• ADR (if applicable): N/A, exact dependency patches use the existing process.

TDD Process

• RED test written first; observed it fail for the expected reason
• GREEN: minimal implementation that turns the test green
• Refactor (if any) keeps the test green
• Permanent regression guard added (where applicable - see existing patterns in api/src/security/)

RED: six real assertions fail on old versions in manifests, all lock
occurrences and all installed owner contexts. Tests were retained as an
ignored draft for the normal bootstrap publication, then added to source
after authenticated CI lock import. No temporary skip or hook bypass.
Initial GREEN: all 35 existing/new focused tests passed after clean restores.
Hosted CI then caught API tests reading web packages before the web install
step. All six new regressions now live in web's existing post-install Vitest
lane and pass there. No assertion, exclusion or workflow order was relaxed.

Feature / Bug-Fix Commit Checklist (standing rule)

Every behavioral change must include all that apply. Tick or strike through with N/A + reason.

• Unit Tests - service-level and controller-level coverage of the new behavior. Six dependency-regression tests in the owning web workspace; service/controller additions N/A, no application behavior change.
• E2E Tests - end-to-end spec under api/test/e2e/ exercising the feature through HTTP. New HTTP behavior coverage N/A; existing HTTP suite remains required regression evidence.
• Live Integration Tests - new section in scripts/live-test.ps1 runnable against local + Docker + Azure. N/A, no endpoint behavior change and no live/cloud mutation authorized.
• Feature Documentation - dedicated doc in docs/ with architecture, RFC references, Mermaid diagrams, test coverage. Bounded ownership/validation/RCA report added; new protocol/diagram N/A.
• INDEX.md Update - add the new doc reference to docs/INDEX.md
• CHANGELOG.md Update - [Unreleased] entry with full test counts and feature summary
• Session & Context Updates - Session_starter.md and docs/CONTEXT_INSTRUCTIONS.md
• Version Management - bump api/package.json (and any other version refs) when behavior changed
• Response Contract Tests - API responses contain ONLY documented fields (key allowlist assertion at unit + E2E + live). New response tests N/A; no response contract changes.

Validation Output

RED: six expected assertion failures before manifest edits.
GREEN: npm --prefix api test -- --runInBand --runTestsByPath src/scripts/web-advisory-pins.spec.ts src/scripts/check-dependency-pins.spec.ts
       Historical PASS, 35 tests in two suites on a machine with both installs.
Corrected GREEN: npm --prefix web test -- src/test/web-advisory-pins.test.ts
                PASS, all six preserved assertions in the post-install lane.
Bootstrap: ordinary git push Fast hook PASS, 25/25 gates, 618.2 seconds.
           Units 6,220; HTTP 2,514 plus 42 skips; old installed tree only.
Restore: npm --prefix api ci --no-audit --no-fund
         npm --prefix web ci --no-audit --no-fund
         PASS; both locks byte-identical to authenticated CI artifacts.
Inventory: npm --prefix web ls --all --json PASS, exit 0, no problems.
           API top-level npm ls exits 0 but full --all exits 1 on existing
           debug/get-intrinsic/call-bind-apply-helpers context errors.
Advisories: npm --prefix api run check:pins
            web 8 pins / 0 findings; overall exit 1 for 6 API records.
Docs: npm run docs:content PASS, 27 documents.
      npm run docs:freshness PASS, 27 documents.
      npm run rfcs:check PASS, C1-C5 offline.
Historical local Validate at 52200e33:
                       git push origin fix/web-seroval-undici-20261029
                       with PREPUSH_MODE=Validate and the checked-in CI
                       DATABASE_URL prerequisite (value not printed).
                       PASS, 28/28 gates, 783.1 seconds.
                       Units 6,226 / 214 suites, no unit-worker warning.
                       HTTP 2,514 / 118 suites, 42 tests + 2 suites skipped;
                       existing separate native/OS worker warning retained.
                       Web Vitest 1,655 / 124 files.
                       API lint 0 errors / 507 existing warnings.
                       API/web TypeScript, web production build, Prisma
                       generation, migration linter and all static gates PASS.
Hosted correction: source 40899500545 and PR 40899546495 FAIL four web
                   filesystem assertions before web install. Original
                   failures retained; not intentional RED or final proof.
Corrected final Validate: normal protected git push, PREPUSH_MODE=Validate,
                         at d0f988e73de9d058fea3fb5e9f52778cc56f4bad.
                         PASS, 28/28 gates, 1011.5 seconds.
                         API units 6,220 /213 suites; HTTP 2,514 /118 suites
                         plus 42 skips; web Vitest 1,661 /125 files.
                         No unit-worker warning. Existing separate HTTP
                         native/OS warning retained. API lint 0 errors /
                         507 existing warnings; static/build gates PASS.
Exact-tip hosted checks at d0f988e7:
  Source Build Test Image 40903132242: SUCCESS.
  PR Build Test Image 40903139752: SUCCESS.
  Both validate/build jobs, actual boot/discovery smoke and configured
  HIGH+CRITICAL Trivy steps PASS.
  CodeQL 40903139885: SUCCESS.
  Documentation freshness 40903139773: SUCCESS.
Hosted review: BLOCKED/PENDING, not approval. Normal @copilot requests
  exit 0 but actual GitHub state shows no review/request/thread.

CI regeneration run
40895972413
succeeded at bootstrap source 419596869f3f2de0aa605290d958dcda7ad57e80.
Authenticated artifact 12906712562 ZIP digest:
sha256:a84a0114a0cd91bcb2596815fa7ce72f0711b65f3c8778f802f4ad759980e928.
Every non-root package-map entry was compared. Only two web packages change;
API changes only release metadata. CI ages are 11.1289 and 14.0243 days.
Approved-feed integrity matches both public-registry sha512 values.

Exact-tip immutable push-source image:
ghcr.io/pranems/scimserver@sha256:57eeb05503aa9724b0e59c14dc55e6510826dcc1abcfcc1adc24f5d88f7ca2ae.
The separate PR merge-ref image is
ghcr.io/pranems/scimserver@sha256:c6d22d61bea03c3356aaec642845a64c0130c3597f641a6564d3b8b40bdf30c5.
Neither candidate is merged, deployed or a substitute for the independently
verified merged-base image. Source run:
40903132242.
PR run:
40903139752.
CodeQL check 123551914552 specifically reports no new alerts in changed
code; the repository's 107 pre-existing alerts remain a separate baseline.

Review remains required. GitHub acknowledges the installed CLI's
documented @copilot requests and the same ordinary bot-review mutation,
but subsequent actual REST/GraphQL reads expose no review or pending
reviewer. No review comments currently exist to fix. Do not interpret that
absence as a completed review, COMMENTED bot review or human approval.
Keep this PR draft until a real hosted review is obtained and every
relevant comment has been addressed through normal protected commits.

No High/Critical-image-scan result is represented as browser-bundle clearance.
No new UI behavior means no synthetic Playwright coverage is claimed.
The existing HTTP native/OS worker warning, global pre-existing CodeQL
alerts, performance ratio 1.23928982 >1.10, customer data/restore, cleanup 403,
measured browser/human visual verification and Mermaid viewer conflict
remain separate holds.

Self-improvement: applied through every-occurrence and actual-owner tests.
Design disposition: accepted; existing exact overrides are cohesive and
an application refactor would be speculative. API full-inventory and broader
browser-bundle scan questions remain bounded follow-ups, not hidden passes.

Standing Rules Acknowledgment

• No em-dash (Unicode U+2014) anywhere in the diff. Verified via Select-String -Pattern ([char]0x2014).
• No git commit --amend on history that has been pushed.
• No new credentials, tokens, or secrets committed to source. Forbidden patterns regression spec at api/src/security/forbidden-source-patterns.spec.ts will catch known anti-patterns.
• Migrations are additive-only (expand-contract for column changes). Migration linter at api/src/scripts/lint-migrations.ts enforces this. N/A, no migration changes.

Destructive Migration Override (skip if not applicable)

• This PR contains a NEW destructive Prisma migration (DROP TABLE/COLUMN, ALTER COLUMN ... TYPE, RENAME, INSERT ... SELECT FROM)
• I have set ALLOW_DESTRUCTIVE_MIGRATION=1 in the CI environment for this PR
• Justification (required if box above is ticked):

  <!-- Why this destructive change is necessary, what the rollback path is, and which release window it ships in -->
  

N/A: this PR changes no database schema or migration.

Reviewer Hint

Diff areas worth special attention from the reviewer:

• web/package.json and CI-owned locks: exactly two compatible web package
  updates, no API advisory upgrades.
• web/src/test/web-advisory-pins.test.ts: all locked/installed
  occurrences and both Seroval owner contexts plus jsdom's Undici.
• Evidence boundaries: bootstrap versus final dependency proof, full
  inventory versus top-level inventory, image versus browser security.

[pranems]

Exact-head independent technical review

Reviewed head: d97fa7e59c0ecd11c9036bfa1123891fb09f0a73.
Reviewed base: 727860866c53c7ec8d01d1ff5bae858f80a1715d.

A separate read-only code-review agent examined this candidate and reported
no significant issues. Principal web surfaces included the manifests,
selective lock deltas and web/src/test/web-advisory-pins.test.ts, with the
recorded implementation and qualification context. Reviewer session:
c5e14ba3-ed82-4c3f-82d1-6d162d15f728.

This is an independently executed automated technical review, not a human
approval or a GitHub Copilot approval. This comment is posted by the author
to preserve the review result; it is not an approval submitted through a
second account.

Parent independently verified all seven exact-head check entries complete
successfully: both validate entries, both build-and-push entries, CodeQL,
Analyze (javascript-typescript) and docs freshness. No unresolved review
threads remain. The review did not rerun project test suites or certify a
merged release artifact.

The canonical delivery process requires green CI and review before merge;
it does not require that this technical review originate from GitHub's
hosted reviewer. Actual branch protection has no required approval count.
The previously recorded hold for a GitHub-hosted review was stricter than
that written policy. The completed independent technical review supplies
the review evidence without changing protections or fabricating approval.

Only ordinary PR integration is intended. Final merged-artifact,
performance, data/restore, live/browser, operator visual and production
approval requirements remain separate and unchanged.