[pranems]

Summary

Correct the dormant web ip-address override to exact 10.7.4 for the remaining
pin findings in #248, with synchronized 0.55.60 metadata and CI-only locks.
This PR must remain unmerged under this handoff.

Linked Defect / Plan Reference

• DELIVERY_PLAN.md defect ID: [security] pinned dependency review needed #248 (remaining dependency pin)
• Audit doc reference: docs/WEB_IP_ADDRESS_SECURITY_REMEDIATION.md
• ADR (if applicable): N/A, existing override seam.

TDD Process

• RED test written first; observed it fail for the expected reason
• GREEN: minimal implementation that turns the test green
• Refactor (if any) keeps the test green
• Permanent regression guard added (where applicable - see existing patterns in api/src/security/)

RED: expected 10.7.4, received 10.7.1; 22 passed, one failed.
Final focused GREEN after CI-lock import and web restore: 23/23.
The actual web lock has no ip-address occurrence or incoming dependency edge,
and the installed tree has no parser. This is NOT a patched-parser install
or evidence of exploitable browser shipment. Adding a parser to claim such
proof would be an unrelated dependency change.

Feature / Bug-Fix Commit Checklist (standing rule)

Every behavioral change must include all that apply. Tick or strike through with N/A + reason.

• Unit Tests - service-level and controller-level coverage of the new behavior. Existing pin-check regression +2; no service/controller behavior changes.
• E2E Tests - end-to-end spec under api/test/e2e/ exercising the feature through HTTP. N/A new cases: dependency-only change; existing HTTP regression suite runs in the ordinary hook and CI.
• Live Integration Tests - new section in scripts/live-test.ps1 runnable against local + Docker + Azure. N/A: no live mutation authorized and no API behavior changes.
• Feature Documentation - dedicated doc in docs/ with architecture, RFC references, Mermaid diagrams, test coverage. docs/WEB_IP_ADDRESS_SECURITY_REMEDIATION.md; existing build boundary is explained without speculative new diagrams or protocol claims.
• INDEX.md Update - add the new doc reference to docs/INDEX.md
• CHANGELOG.md Update - [Unreleased] entry with full test counts and feature summary
• Session & Context Updates - Session_starter.md and docs/CONTEXT_INSTRUCTIONS.md
• Version Management - bump api/package.json (and any other version refs) when behavior changed. Both product manifests and CI-generated locks reserve 0.55.60.
• Response Contract Tests - API responses contain ONLY documented fields (key allowlist assertion at unit + E2E + live). N/A new assertions: no response code or contract changes.

No new UI behavior: no invented UI or Playwright feature is included.
Existing PR #251 performance, customer-data, capacity, cleanup403 and
target-specific operator visual verification holds remain unchanged.
No merge, deployment, performance retry, threshold/quota change or waiver.

Validation Output

Focused RED: one expected exact-pin failure, 22 passed.
Focused GREEN: 23 passed.
Bootstrap Fast: 25/25 gates PASS, 619.4 seconds.
API unit bootstrap: 6,214 passed, 213 suites.
API HTTP bootstrap: 2,514 passed, 42 existing skips, 118 suites.
Final protected Validate push: 28/28 PASS, 772.1 seconds at 4312cc1b.
Final API unit: 6,214 passed, 213 suites.
Final API HTTP: 2,514 passed, 42 existing skips, 118 suites.
Web vitest: 1,655 passed, 124 files.
Exact-tip CI: all required checks PASS at 4312cc1bc31fdb8842d1ad4a032913bcead6a0bf.
Hosted Copilot review5631220376: COMMENTED, no inline findings.

• API: npm test -- --runInBand --runTestsByPath src/scripts/check-dependency-pins.spec.ts: RED before manifest edit; final PASS 23/23.
• Web: npm ci --no-audit --no-fund: PASS; lock SHA-256 unchanged, parser remains absent.
• API: npm run check:pins: PASS, API26/web8 pins, zero findings/unchecked.
• Web: npm audit --json: exit1, three existing Moderate affected Vitest packages, zero High/Critical; no ip-address finding. Separate from this bounded change.
• Root: npm run docs:freshness:fix, npm run docs:content, git diff --check: PASS.
• Final publication command: process-local credential-free generation-only
  DATABASE_URL=postgresql://localhost:1/scim_codegen, PREPUSH_MODE=Validate,
  git push: PASS, 28/28. Includes API build/lint, web TypeScript/production
  build, real Mermaid rendering, unit/HTTP/web tests, Prisma generation
  and migration linter. First Validate attempt failed only for missing
  DATABASE_URL after all 25 Fast gates passed; retained, not erased.
• Sanctioned regen-lockfile.yml run 39980968858: PASS at source d6e95717591aed8c8b3a09f1e429ebe44b51f7fb.
• Artifact12513751137 ZIP digest sha256:714cc0d18f35dcb1c61e600b17843f5765d79b721532681c782c17f7da093b15 authenticated against GitHub. Every non-root package unchanged; both locks only synchronize product version metadata. Public URLs/sha512 and empty changed-package age report verified.
• Override age: approved proxy publication2026-10-11T19:34:42Z, eligible2026-10-18T19:34:42Z. No quarantine exception.
• Exact-tip Build Test Image 39985408698: SUCCESS, validate and build-and-push green, including container smoke and HIGH/CRITICAL Trivy gate.
• Exact-tip CodeQL 39985408881: SUCCESS, Analyze green.
• Exact-tip Docs freshness39985408693 and automatic regeneration39985367319: SUCCESS. No replacement artifact is needed after the already verified locks.
• Hosted review5631220376 at exact final tip: no inline findings. Its initial CI-pending observation is superseded by the exact-tip results above. COMMENTED is not human approval; no configured required human review was observed. The explicit no-merge handoff remains.

Standing Rules Acknowledgment

• No em-dash (Unicode U+2014) anywhere in the diff. Verified via Select-String -Pattern ([char]0x2014).
• No git commit --amend on history that has been pushed.
• No new credentials, tokens, or secrets committed to source. Forbidden patterns regression spec at api/src/security/forbidden-source-patterns.spec.ts will catch known anti-patterns.
• Migrations are additive-only (expand-contract for column changes). Migration linter at api/src/scripts/lint-migrations.ts enforces this. No migration changes.

Destructive Migration Override (skip if not applicable)

• This PR contains a NEW destructive Prisma migration (DROP TABLE/COLUMN, ALTER COLUMN ... TYPE, RENAME, INSERT ... SELECT FROM)
• I have set ALLOW_DESTRUCTIVE_MIGRATION=1 in the CI environment for this PR
• Justification (required if box above is ticked):

  <!-- Why this destructive change is necessary, what the rollback path is, and which release window it ships in -->
  N/A. No migration.
  

Reviewer Hint

Diff areas worth special attention from the reviewer:

• Confirm the exact override and dormant dependency graph are tested honestly.
• Generated locks change no package; headers across 27 manifest-bound docs
  synchronize the version only. No CI/workflow/application implementation changes.
• Active GHSA-rxp7-6hxx-x8q5 and withdrawn duplicate GHSA-p3hm-x653-5rc6
  describe one distinct flaw, not two independent blockers.
• Self-improvement applied: exact-pin and deliberate no-parser graph guard.
  Design disposition accepted: no runtime abstraction needed.
• Hosted COMMENTED review is not human approval. Strict validate,
  build-and-push and Analyze checks must be green at the exact final tip.

[Copilot]

🔵 Needs a closer look

Passing required checks at the exact final commit is not yet confirmed, and the handoff retains final human review and a no-merge hold.

No open issues 🎉

2 files not reviewed

• api/package-lock.json: Generated file
• web/package-lock.json: Generated file

What changed in this PR

This PR addresses the remaining dependency pin in #248 by updating SCIMServer’s dormant web ip-address override to exactly 10.7.4. It does not install the parser or change application behavior.

Changes:

• Corrects the override and adds regressions for the advisory boundary, exact pin, and absent dependency graph.
• Synchronizes API/web manifests, lockfile version metadata, and documentation to 0.55.60, without changing resolved packages.
• Records validation evidence and preserves existing merge, deployment, and performance holds.

File	Description
web/​package.json	Pins ip-address to 10.7.4; updates product version.
web/​package-lock.json	Synchronizes version metadata only.
Session_starter.md	Records remediation scope, evidence, and holds.
README.md	Updates product version and badge.
docs/​WEB_IP_ADDRESS_SECURITY_REMEDIATION.md	Documents dormant override scope and validation evidence.
docs/​UI_GUIDE.md	Synchronizes version headers.
docs/​strategy/​NPM_SUPPLY_CHAIN_QUARANTINE_POLICY.md	Records patch eligibility and regeneration constraints.
docs/​SOVEREIGN_AND_GOV_CLOUD_DEPLOYMENT.md	Synchronizes version headers.
docs/​SCHEMA_CUSTOMIZATION_GUIDE.md	Synchronizes product version header.
docs/​SCHEMA_ATTRIBUTE_CUSTOMIZATION_GUIDE.md	Synchronizes product version header.
docs/​REMOTE_DEBUGGING_AND_DIAGNOSIS.md	Synchronizes product version header.
docs/​RELEASE_NOTES.md	Explains the proposed correction and its limits.
docs/​PROD_TO_DEV_MIRRORING_AND_FIXTURES.md	Synchronizes version headers.
docs/​PATCH_OPERATIONS_COMPLETE_GUIDE.md	Synchronizes product version header.
docs/​OBSERVABILITY_TRACEABILITY_AND_DIAGNOSTICS.md	Synchronizes product version header.
docs/​MULTI_ENDPOINT_GUIDE.md	Synchronizes version headers.
docs/​LOGGING_AND_OBSERVABILITY.md	Synchronizes product version header.
docs/​INDEX.md	Links remediation evidence and updates version headers.
docs/​GLOBAL_NAVIGATION_AND_WORKFLOW_CONTEXT.md	Synchronizes product version header.
docs/​ENDPOINT_PROFILE_ARCHITECTURE.md	Synchronizes product version header.
docs/​ENDPOINT_LIFECYCLE_AND_USAGE.md	Synchronizes version headers.
docs/​ENDPOINT_CREATION_WIKI.md	Synchronizes version headers.
docs/​ENDPOINT_CONFIG_FLAGS_REFERENCE.md	Synchronizes version headers.
docs/​DOCKER_GUIDE_AND_TEST_REPORT.md	Synchronizes version headers.
docs/​CUSTOM_EXTENSIONS_RFC_GUIDE.md	Synchronizes product version header.
docs/​CONTEXT_INSTRUCTIONS.md	Updates version and remediation handoff context.
docs/​COMPLETE_API_REFERENCE.md	Synchronizes version headers.
docs/​AZURE_DEPLOYMENT_AND_USAGE_GUIDE.md	Synchronizes version headers.
docs/​AUTHENTICATION_GUIDE.md	Synchronizes product version header.
DEPLOYMENT.md	Synchronizes product version header.
CHANGELOG.md	Records correction, test counts, and release limits.
api/​src/​scripts/​check-dependency-pins.spec.ts	Adds advisory, exact-pin, and dependency-absence regressions.
api/​package.json	Synchronizes API product version.
api/​package-lock.json	Synchronizes version metadata only.

_{Review effort: Balanced}

[pranems]

Exact-tip closeout at 4312cc1: required validate and build-and-push passed in39985408698; Analyze passed in39985408881. Freshness and regeneration also passed. Hosted review5631220376 has zero inline findings; its CI-pending observation is now resolved by exact-tip evidence. COMMENTED is not human approval. This handoff deliberately stops UNMERGED; no release/deployment/performance hold is waived. Final Validate hook28/28, API6214 units/2514 HTTP tests(42 existing skips), web1655 tests. Final receipts complement the source documentation's pre-publication authoring checkpoint.

[Copilot]

🟢 Approval recommended

The bounded override correction has targeted regression coverage, consistent metadata and successful exact-tip build and security checks, with no blocking findings.

No open issues 🎉

2 files not reviewed

• api/package-lock.json: Generated file
• web/package-lock.json: Generated file

_{Review effort: Balanced}

[pranems]

Review5631220376: exact-tip evidence and phase authorization

The earlier review explicitly said Needs a closer look, because exact-final
checks were not yet confirmed and the handoff retained human-review/no-merge
wording. That was not approval recommended and is not being relabeled.
The later hosted review5631349090 at the same source now says Approval
recommended, still with GitHub state COMMENTED, not human approval.

The user has explicitly advanced the initial bounded no-merge checkpoint:
ordinary non-admin matching-head merge/publication is authorized only after
review concerns and actual protected checks are cleared. Inspection of
docs/WEB_IP_ADDRESS_SECURITY_REMEDIATION.md, Session_starter and context
finds no unfulfilled human action specific to this dormant override code.
The old no-merge wording described this earlier checkpoint. Customer visual,
actual-data/migration, cleanup403, capacity and operational observations
remain genuinely unfulfilled release/deployment holds and are NOT waived.
PR251's retained performance failure remains unchanged.

Exact source and all six final checks

Head: 4312cc1bc31fdb8842d1ad4a032913bcead6a0bf.

Check	Actual final result
validate	SUCCESS
build-and-push	SUCCESS
Analyze javascript-typescript	SUCCESS
freshness	SUCCESS
regen	SUCCESS
CodeQL	SUCCESS

Actual master protections require strict validate/build-and-push/Analyze;
required_pull_request_reviews is null. COMMENTED is never called required
human approval. No admin/bypass/squash/rebase/force merge is authorized.

Generated lockfiles: independently verified, NOT bot-reviewed

Both hosted reviews correctly skip generated locks. The machine verification
is independent of bot review:

• Existing sanctioned regeneration run39980968858
  succeeded at bootstrap source d6e95717591aed8c8b3a09f1e429ebe44b51f7fb.
• Artifact regenerated-lockfiles, ID12513751137, ZIP SHA-256
  714cc0d18f35dcb1c61e600b17843f5765d79b721532681c782c17f7da093b15
  was authenticated against GitHub before extraction/import.
• Every package entry was compared against the original tracked lock.
  Zero changed resolved-package entries, no package additions/removals.
  Both locks change only intended product/root metadata0.55.59 ->0.55.60.
• All684 API and395 web non-root entries retain public registry.npmjs.org
  URLs and sha512. CI's age report at2026-10-23T15:45:22.541Z has packages[],
  correctly reflecting zero changed resolved packages.
• The exact override10.7.4 was independently age-checked through approved
  registry metadata: publication2026-10-11T19:34:42Z,
  seven-day eligibility2026-10-18T19:34:42Z. No exception/control change.
• API lock SHA-256:
  ba189af63651aab01697d4e9ec2ed4ca68643ef89c2c256147bef94b6f02b3db.
• Web lock SHA-256:
  38022ee29a31f483602e4fbb8c0cb103a391832b8dfaea603a82ec9a3405940f.
• npm ci --no-audit --no-fund restored web without changing that lock hash.
  Healthy npm ls --all --json exits0, problems[],1,460 dependency nodes,
  zero ip-address occurrences. Locked graph likewise has zero parser entries
  and incoming edges. The exact10.7.4 override is dormant, not installed
  patched parser code. No browser-shipment/exploitability claim.
• Active Medium GHSA-rxp7-6hxx-x8q5/CVE-2026-111997 affects<=10.7.3,
  first patch10.7.4. GHSA-p3hm-x653-5rc6 is a withdrawn duplicate,
  not a second flaw or evidence of no available fix.

Machine receipts are retained in
test-results/ip-address-security-20261023/: regen-run.json,
regen-artifacts.json, regenerated-lockfiles.zip, lock-comparison.json,
artifact/publish-ages.json, web-ci.log, installed-web-tree.json,
active-advisory.json, withdrawn-advisory.json, and closeout.md.
Bootstrap/failed Validate logs remain retained, including missing-DATABASE_URL
failure and the documented generation-only environment correction.

Please provide a fresh hosted review/clarification against this unchanged
exact source, with now-complete CI and phase authorization. No unchanged
full suite or source edit will be used to manufacture a green review.

[pranems]

Review closeout before authorized ordinary merge: original5631220376 remains accurately recorded as Needs a closer look. Later exact-source review5631349090 independently says Approval recommended/no blocking findings after exact-tip CI completed; both are COMMENTED, not human approval. Complete lockfile machine-verification and explicit phase authorization are recorded in6369692908. A further hosted review request was sent after that comment; no third review appeared in the bounded five-minute wait, and none is invented. No source or full-suite rerun was made to influence review. The actual code has no separate pending human action; the user explicitly advanced the old no-merge checkpoint, while all deployment/customer/performance holds stay unchanged. All six exact-head checks remain green and there are zero review threads. Proceeding only with non-admin matching-head merge under the user's authorization.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

2 open issues

• __dirname is CJS-specific and makes this test sensitive to module-system changes (and to how the… · New
• These headers now state product version 0.55.60 but keep the earlier verification/updated dates.… · New

2 files not reviewed

• api/package-lock.json: Generated file
• web/package-lock.json: Generated file

_{Review effort: Lite}

[pranems]

Publication checkpoint verified. Ordinary merge5bfff2dea1dec6f3e4b99c9a4cc0e6cb8e27388d is the exact source of the single authoritative postmerge matrix39988309661 SUCCESS, automatic CodeQL39988244899 SUCCESS, and sanctioned pin review39988244921 SUCCESS(API26/Web8 pins, zero records). Publication39989347764 SUCCESS guarded expectedSha before login; version0.55.60 and source-sha tags resolve to immutable index sha256:316a645f021b5c9b833c295d94248e7df00ee37aa13d6d5614e55f9f04c83a4b. Registry BuildKit provenance identifies that run and exact merge in all four inspected source fields. Downloaded build artifact12516682880 digestsha256:12283bfb010d43162815cf53f1a4f3d560dc2333c336c5028ea5f768261a863d matches GitHub. Offline read-only/network-none/zero-mount Node metadata inventory exits0, reads247 package metadata files: product0.55.60, zero ip-address, Hono4.13.11; helper removed. Dormant web10.7.4 override remains NOT an installed parser. Latest tag not promoted. Late review5631619263 arrived after merge/publication, with full-agentic startup timeout plus two fallback suggestions; both answered with actual CommonJS and marker-versus-dated-claim contracts in4362057654/4362057848; threads resolved with complete pagination. Neither late review nor original5631220376 is relabeled approval. Actual later premerge5631349090 was Approval recommended/COMMENTED, not human approval. Complete private receipts: test-results/ip-address-security-20261023/publication-closeout.md. No source changes or duplicate matrix followed feedback. No deployment, performance retry, PR251 merge or release waiver; all genuine customer/visual/capacity/cleanup holds remain.