[MAIN-HEALTH-SEC-002] Eliminate current high dependency vulnerabilities and restore enforced security gates

[ootakazuhiko]

Parent program: #3655
Blocks implementation start: #3658
Historical context: #3591, #2472
Codex lane: security/dependency-audit-recovery-20260730

Background

After PR #3670 merged, current main at c5da6115638fdbfeebbc458b39fa6916db66afb0 has deterministic dependency-security failures that predate and are unrelated to ACP-HARDEN-130:

• SBOM Generation and Security Scanning run 30523479253
  • enforced audit: high=19, critical=0, audit_exit=1
• Security Analysis run 30523479457
  • Dependency Audit: low=10, moderate=29, high=19, critical=0
• Quality Gates run 30523479450
  • DoD security gate: production high=12 > maxHigh=8

The same dependency findings were already present on the preceding main lineage, so PR #3670 did not introduce them. Historical Issue #3591 was completed after its then-current critical/high findings were remediated; the present findings are a new regression or reintroduction and require a new evidence set.

Current workflows intentionally enforce high/critical findings on push. This issue must restore the gates without weakening thresholds or hiding findings.

Objective

Identify the current advisory graph, remediate every feasible high/critical dependency path with minimal compatible changes, and restore all three enforced security surfaces:

1. SBOM dependency audit
2. Security Analysis Dependency Audit
3. Quality Gates DoD security gate

Preflight

Before creating a branch:

• confirm current origin/main and the three source runs above;
• confirm Issue [ACP-HARDEN-130] execution-result/v1を導入しstatus非変換を保証する #3658 has no branch/PR and remains unstarted;
• read Issue Restore main push quality gates after dependency audit and coverage enforcement failures #3591 and its completion evidence to distinguish resolved historical advisories from current reintroduced surfaces;
• inspect package.json, all workspace manifests, pnpm-lock.yaml, pnpm-workspace.yaml, .npmrc, scoped overrides, and the security audit/classification scripts;
• read config/quality-policy.json, .github/workflows/security.yml, .github/workflows/sbom-generation.yml, and Quality Gates workflow/runner;
• use a separate clean worktree from current main;
• report any Context Pack / Boundary Map conflict before changes.

Recommended branch:

security/main-high-audit-recovery-20260730

Required investigation

Generate and retain repository-local, non-secret evidence for both:

pnpm audit --audit-level=moderate --json
pnpm audit --prod --json

Use the existing audit classifier where applicable. For every high/critical advisory, classify:

• advisory ID / package;
• direct or transitive dependency;
• complete dependency paths and workspace importers;
• production, development, test, build, or documentation exposure;
• installed version and patched range;
• whether a compatible direct upgrade exists;
• whether a scoped override is semantically safe;
• whether the vulnerable package/path can be removed;
• runtime reachability and actual ae-framework feature surface;
• license and Node/pnpm compatibility impact.

Compare the current graph with the completion state of #3591 and identify which later dependency changes reintroduced the high findings.

Remediation policy

Prefer, in order:

1. minimal direct dependency patch/minor update within supported compatibility;
2. removal of unused dependency/path;
3. reviewed scoped pnpm override for a transitive dependency with compatibility tests;
4. replacement of an unmaintained dependency where bounded and justified.

Do not use:

• pnpm audit fix --force;
• broad unrelated upgrades;
• threshold increases;
• continue-on-error;
• converting push enforcement to warning;
• deleting or excluding advisories from reports;
• an undocumented baseline/waiver;
• a fabricated reachability claim.

If a high/critical advisory has no available compatible fix, prepare a HUMAN DECISION REQUIRED packet containing the exact path, exposure, available upstream fix status, mitigation, proposed owner, expiry, review date, and alternatives. Do not create or approve a waiver autonomously.

Implementation requirements

• keep one Issue / one branch / one Draft PR;
• organize dependency changes into small reviewable commits by remediation family;
• preserve deterministic pnpm 10.0.0 lockfile behavior;
• regenerate the lockfile twice in clean isolated stores and require byte identity;
• add compatibility/regression tests for affected direct and transitive surfaces;
• update dependency/security documentation only where supported by evidence;
• preserve exact vulnerability counts and status semantics; do not collapse audit errors into clean results;
• retain existing GitHub authority snapshot workflow after the Draft PR is created.

Acceptance criteria

• pnpm audit --audit-level=moderate --json reports critical=0 and high=0;
• pnpm audit --prod --json reports critical=0 and high=0;
• Quality Gates testing DoD security thresholds pass without policy relaxation;
• SBOM Generation and Security Scanning enforced audit succeeds;
• Security Analysis Dependency Audit succeeds in enforced mode;
• current audit JSON is parseable and classified with no hidden advisory paths;
• clean frozen install succeeds;
• lockfile regeneration x2 is byte-identical;
• relevant unit/integration/build tests pass;
• pnpm -s run build, api:check, check:schemas, check:doc-consistency, and verify:lite pass;
• Full CI succeeds on the exact PR head;
• high-risk PR labels/gates are applied and pass on the exact head;
• final GitHub authority snapshot capture x2 has the same semantic digest, all required checks success, and unresolved review threads 0;
• worktree clean.

If zero high findings cannot be achieved without an incompatible major migration, stop with the bounded human-decision packet rather than weakening enforcement.

PR requirements

Draft PR title:

[MAIN-HEALTH-SEC-002] Restore dependency security gates

PR body must include:

• Implements this Issue and blocks/resumes [ACP-HARDEN-130] execution-result/v1を導入しstatus非変換を保証する #3658;
• source run URLs and baseline counts;
• advisory-path inventory;
• direct/transitive and prod/dev/test classification;
• package/version changes and rationale;
• before/after audit counts;
• reachability limits;
• lockfile reproducibility evidence;
• exact-head Security Analysis, SBOM, Quality Gates, Full CI URLs;
• compatibility impact and rollback;
• remaining advisories and human decisions;
• authority snapshot digest;
• Context Pack conflict status.

Stop condition

• existing/new Draft PR;
• base main;
• child-only diff;
• CLEAN / MERGEABLE;
• exact-head enforced security gates and Full CI success;
• final authority capture x2 / no-state-change;
• unresolved review threads 0;
• worktree clean;
• PR not merged, not Ready;
• Issue not closed;
• [ACP-HARDEN-130] execution-result/v1を導入しstatus非変換を保証する #3658 and later ACP-HARDEN Issues not started.