[Change] Patch certifi and resolve official scanner dependency security #780

Approved scope, 2026-10-21 Europe/Berlin

The owner requires removing the rejected Semgrep fork from PR #782 and using official packages only. If the upstream pin prevents patched MCP, an exact temporary advisory exception is authorized.

Retain official certifi 2026.10.19 and coherent core 0.55.11. Keep official Semgrep 1.179.0 / MCP 1.29.0. Latest official Semgrep 1.182.0 still requires exactly MCP 1.29.0; a fresh normal resolver cannot select patched MCP >=1.30.0,<2. Add only the existing strict-gate record for MCP 1.29.0 / CVE-2026-59951 and GHSA-84m7-p3x7-pcfv, reviewed 2026-10-21 through 2026-11-04 inclusive. The package remains affected. Use ordinary scans and do not expose a stateful Streamable HTTP MCP server. Review weekly and remove upon a verified compatible official upstream fix.

All three strict audit inputs and all required CI checks remain enforced. Other advisories, versions, skipped subjects and expiry fail closed. Signing is CI/CD only. No Semgrep fork project, publisher or downstream module migration is approved. Candidate code/workflows/tests/mappings and superseded planning are removed from the final PR diff; Git preserves history.

Acceptance and release boundaries

• Real frozen and installed certificate regression passes.
• Exact MCP exception acceptance and negative/expiry tests pass.
• Normal hooks, independent review and required CI pass without bypasses.
• Final Requirements admission and exact commit/tree human authority remain genuine prerequisites.
• A dependency-only hotfix release must start from published v0.55.4 tag d579970, excluding unreleased dev runtime changes.
• Link verified replacement coverage before closing related dependency PRs. No merge, promotion or package publication is authorized here.

Parent #747 and baseline Z3 blocker #783 remain. Modules nold-ai/specfact-cli-modules#523 applies only to a future separately reviewed integration replacement/removal. The active OpenSpec id remains isolate-semgrep-security-runtime for traceability.

Current evidence checkpoint

Core0262dbe5 passes native Security Audit and exact-head authority. Eleven selected Requirements tests pass, but protected provenance admission remains red. Draft nold-ai/.github#4 is an inactive one-file contract, not an implemented or deployed exception. Its separate review must precede protected implementation, authenticated transport, distinct approval and core consumption.