fix(overlay-express): serialize GASP failures and document scanner review

[ty-everett]

Program and scope

The final default-branch security review found two GASP handlers logging request-derived raw errors. Route both through the existing serializer and configured logger, preserving the generic HTTP 400 response. Public-route regressions cover CR/LF, C1 and Unicode line separators, and throwing serialization hooks; both fail against the original handlers. The auth middleware migration guide now recommends the actual coordinated SDK 2.8.0 candidate.

Also record the exact source evidence, owner, review date and reopening conditions for 28 existing false-positive CodeQL findings. No scanner query or quality gate is disabled. Actual logging findings must resolve through fresh analysis, not dismissal. Scorecard badge/lock-refresh debt remains explicit. Coordination: #558.

Impact

• Public package source changed: @bsv/overlay-express existing unpublished 2.7.2 candidate. No API/wire/schema change or consumer migration.
• Security-sensitive diagnostics changed; release notes, README and changelog updated.
• Governance evidence added for exact existing alerts; no accepted genuine vulnerability.

Verification

• Full docs build also passes: 129 built pages with valid links.
• pnpm build, pnpm health:check, pnpm lint, pnpm format:check, pnpm typecheck: passed.
• pnpm --filter @bsv/overlay-express test:coverage --runInBand: 17 suites / 507 tests passed.
• pnpm --filter @bsv/overlay-express pack:check: clean ESM/CJS consumers, all exports, types, publint and package contents passed.
• Negative control: both new route tests fail against the original handlers; restored fix passes.
• Parent main full acceptance: CI 35813974981 passed all selected workspace, infrastructure, platform and mutation lanes; property run 35813976926 passed.
• Complete local diff self-reviewed for correctness, compatibility, artifacts and operations.
• Exact-head CI 35817592766, CodeQL 35817592714, conformance and required Codecov patch passed on d0d4aece9d76ebbe8af3c47bd705ede4f6fb1b13; no open CodeQL PR alerts or review threads. Selected work is validated by the successful merge gate.

Security and dependencies

• No dependency or lockfile change.
• Real serializer exercised by negative/boundary regression; no production suppression or skipped test.
• Proposed false-positive dispositions registered with individual evidence, maintainer owner, review date and removal/reopening conditions.
• Exact-head CodeQL and zero-new-Sonar checks terminal and clean.

Release and operations

• No workstation publication. Previous candidate was cancelled before npm approval; a fresh reviewed main candidate is required.
• Changes remain in the existing unpublished patch candidate; generated migration ledger is current.
• No database, wire protocol, image pin or live workload changed by this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Critical maintainer review of exact head d0d4aec: the two GASP catches now use the existing real serializer through the configured logger, preserving the generic 400 response and all public/wire contracts. CR/LF/C1/Unicode separators and throwing serialization are exercised through registered public routes; both regressions fail with the original handlers. No dependencies, authentication behavior, persistence, scanner rules or thresholds changed. The 28 existing scanner dispositions have individually traced guards/callers or test-only scope, a governed owner, exact-source evidence, re-review date and reopening conditions; genuine logging alerts must resolve by fresh main analysis, not dismissal. Existing Scorecard debts remain explicit.

Local required gates, full build, 17 suites/507 tests, packed ESM/CJS/types and the full 129-page docs build pass. Hosted CI 35817592766, CodeQL 35817592714, conformance 35817592736, required Codecov patch and the exact-head zero-new-Sonar gate all pass. No open PR CodeQL alert or review thread. Parent main full acceptance and property fuzzing passed, and the post-publication synchronization preview changes no public-package manifest.

Release condition: merge this reviewed source, require fresh main analysis and CI, apply only the recorded false-positive dispositions with read-back, and replace the cancelled pre-fix candidate before protected npm approval. Maintainer-authored PR; this documented review is a COMMENT because GitHub does not permit self-approval. Admin facilitation follows the repository maintainer policy without bypassing failed or pending checks.