Skip to content

[RETIRED] TypeScript stack health, security, standardization, testing, docs, and performance #324

Closed
Closed
[RETIRED] TypeScript stack health, security, standardization, testing, docs, and performance#324
Assignees
ty-everett
Labels
dependenciesPull requests that update a dependency filedocumentationImprovements or additions to documentationhardeningReliability, governance, and release hardeninginfrareleaseCoordinated package publication and release readinesssecuritySecurity vulnerability, hardening, or supply-chain work

Description

@ty-everett
ty-everett
opened on Jul 25, 2026

Important

Retired on 2026-07-30. This modernization program is complete at main@889508eb1 after the contributor-governance and dependency-discovery closeout in #403, #405, and #406. The body below is retained as the historical execution record; its unchecked boxes no longer assign work to this retired issue.

Durable repository policy now lives in root AGENTS.md, CONTRIBUTING.md, .github/, governance/contributor-policy.json, and the executable repository-health controls. Deliberately deferred work continues only in #400 (QA/coverage/fuzzing/runtime validation), #401 (separately authorized releases, provenance reconciliation, and external assurance), and #402 (Sonar administration decision and further CI-efficiency measurement). The existing low-severity OpenSSF Best Practices badge posture alert is explicitly owned by #401 and has not been dismissed.

No npm package, container image, tag, GitHub release, deployment, DNS change, or secret change was made by this closeout.

Purpose

This is the authoritative execution tracker for bringing the consolidated TypeScript stack to a fully healthy, current, secure, uniform, documented, tested, publishable, browser-aware, and operationally maintainable end state.

It captures the full-repository audit as of 2026-07-30 and converts every material finding into explicit work, ordering, evidence requirements, and completion gates. Child issues and PRs should link here, and this issue should be updated as facts change so no work remains implicit or gets lost between PRs.

Scope, assumptions, and explicit exclusions

  • Baseline: main@f9137ff.
  • Treat PRs feat(wallet-toolbox): plan noSend batches locally and commit atomically #289 and Make VeriFast production-ready and accelerate WASM verification #290, and all other non-draft consolidation/dependency work preceding this baseline, as merged.
  • Operator hold (2026-07-27): do not modify, rebase, comment on, review, close, merge, or otherwise act on draft PR fix(wallet-toolbox): derive ChainTracks from Arcade host, drop babbage defaults #306. It is not a dependency or source of truth for this work.
  • Publication hold (2026-07-27): do not publish npm packages and do not create releases or tags. Source candidate versions may advance so artifacts remain version-correct, but registry publication is a separately authorized final action.
  • BDK issue refactor(sdk): reduce cognitive complexity in Hash.ts (#44) #49 is out of scope.
  • SonarCloud organization/project administration cannot be changed immediately. Repository-side remediation proceeds now; the automatic-analysis-to-CI switch is a separately gated later step only if the validation in this issue confirms it remains necessary.
  • CI speed improvements must preserve the coverage and quality of checks. No check may be dropped merely to make the pipeline faster.
  • Execution sequencing update (2026-07-30): retain every remaining testing and QA-hardening gate, but execute that work as the final program phase after the non-QA backlog. The deferred final phase includes coverage-guided fuzzing, aggregate/risk-tier coverage closure, manual/live test review, conformance completion, final deep CLI/runtime QA, runtime benchmark execution, and the corresponding final evidence. Wave 38 completed the release-preparation artifact/browser/dependency gates and restored the repository-owned patch-coverage gate. GitHub-hosted runner CPU, memory, and action-internal cache-hit metrics are not exposed by the Actions APIs; unsupported in-run instrumentation for those fields was removed completely rather than creating unactionable CI overhead. Actions-supported run/job/step/queue/artifact timing and variance remain governed. No deferred checkbox is waived or treated as complete.
  • Public protocol interoperability is a permanent compatibility invariant: Overlay/Overlay Express, WAB, UHRP/Storage, message-box, chaintracks, and comparable public APIs must remain usable from arbitrary deployed web origins, WUI, mobile/webviews, native shells, and unknown future callers. Their default browser policy is credential-free wildcard CORS, including compatible handling of opaque Origin: null; exact-origin allowlists, credentialed exact-origin mode, or disabled CORS are operator opt-ins, and wildcard origin must never be combined with credentials. CSP is a separate, configurable document/UI boundary policy—not API access control—and must not be used to silently restrict these public service contracts.
  • Repository administration must remain practical: one qualified maintainer approval is sufficient; no independent-last-pusher restriction is required; maintainers/admins, including ty-everett, may approve and merge when authorized. Required checks and resolved review conversations still apply.

How to run this program

  • Keep this issue’s baseline, status table, linked child issues/PRs, exceptions, and measured outcomes current.
  • Create thematic, reviewable child issues/PRs for the waves below; do not accumulate a single repository-wide mega-PR.
  • Link every child issue and PR back to this tracker and name the program gate(s) it advances.
  • Mark a checkbox complete only with evidence: merged PR, passing run, published version, resolved alert, measurement, or documented/time-bounded exception.
  • Rebase each wave on current main, run the relevant changed-package checks plus the full merge gate, and re-measure affected baselines after merge.
  • Treat published public behavior as immutable throughout this program: exported names/signatures/types, import and package paths, wire/protocol codecs, serialized and persisted formats, storage semantics, errors/codes/messages, ordering, defaults, side effects, browser/mobile/Node behavior, and public-service CORS/CSP behavior. Begin every refactor with characterization or differential evidence and finish it with direct regression coverage plus packed-consumer/runtime checks where applicable. Never change public behavior merely to satisfy static analysis; retain a visible, governed compatibility exception when the only “fix” would break a consumer.
  • Resolve review conversations before merge. Dependabot-generated code receives human review for changelog/runtime impact, peer compatibility, audit output, and full CI; it is not blindly auto-merged.
  • Treat “quality gate passed” as an exact-head compound result: every required repository check has succeeded on the current PR head; Sonar quality status is OK; the PR has zero new issue records in OPEN, CONFIRMED, ACCEPTED, or FALSE_POSITIVE state; and it has zero TO_REVIEW security hotspots. The repository-owned Quality gate — zero new Sonar findings job must verify the exact head and remain a dependency of the required merge-gate. Sonar’s aggregate badge/comment alone is advisory and never authorizes a merge.
  • Use one maintainer approval. Permit administrator/maintainer facilitation and ty-everett approval/merge where needed; do not restore a two-reviewer or non-last-pusher requirement.
  • For every source or manifest change affecting a public package, patch-bump every affected package and record the source candidate version. While the publication hold is active, stop before npm publication, release/tag creation, release-sync, or infrastructure rollout. When separately authorized later, use only the existing protected OIDC/provenance workflow; never publish locally.
  • Maintain an exception register for every temporary advisory dismissal, dependency hold, override, skipped test, coverage exclusion, or quality-rule suppression. Every exception needs owner, rationale, evidence, expiry/review date, and removal condition.
  • Cross-link and update Sonar bulk: auto-fixable code style smells (~1,200 issues) #43, Sonar: 250+ functions exceed cognitive complexity threshold #44, Sonar: 138 issues around error handling, dead code, and TODOs #45, Sonar: duplication — 9,792 duplicated lines (4.8%) across 139 files in 439 blocks #46, and Sonar: long-tail TypeScript smells (~600 issues across 50+ rules) #48 as their findings are retired. All five legacy bulk ledgers were closed as completed on 2026-07-30 with exact-main evidence; Wave 38 resolved the final two QA smells, and the 20 visible compatibility/consensus boundaries remain centrally owned here.

Execution status

Current program tip: main@c8261dfb0.

Active execution: Wave 38 is complete: PR #399 completed the non-publishing release-readiness pass. It refreshed every mature compatible direct dependency under a registry-backed 24-hour release-age floor; classified every remaining first-party, coordinated-major, toolchain, peer, and forward-vendor hold; rehearsed removal of all 19 overrides and retained only those that reproduce a vulnerable graph or preserve deterministic code generation; prepared patch source candidates for all 30 public packages and seven infrastructure artifacts; restored a fail-closed repository-owned 90% changed-line and changed-branch coverage gate; completed deep exact-tarball validation for every public package; completed all 13 browser composition/splitting dispositions plus Wallet Metro/Hermes; and completed the public-service CORS/CSP contract without changing public API, wire, storage, error, default, browser, mobile, Node, or service-access behavior.

The exact reviewed head 33656c3d1 had all 75 reported contexts terminal: 74 successful and one scope-appropriate skip. PR CI 30563216942 passed 58 jobs with one expected scope skip; both CodeQL analyzers, strict repository Sonar enforcement, Dependency Review, Socket, Codecov patch, all package/platform/coverage/mutation/infrastructure/runtime contracts, and merge-gate passed. Sonar reported zero new issues in every state and zero hotspots, Codecov reported every modified coverable line covered, and exact-head maintainer review 4821315300 recorded the compatibility/security evidence before the authorized admin squash merge.

Exact merged main passed CI 30564165765 with 56 successful jobs and three expected push-context skips, CodeQL 30564165746, Conformance 30564165724, Codegen 30564165771, Scorecard 30564165915, Docs 30564165883, and Container runtime contracts 30564165825. Exact-main Sonar is OK with 20 code smells / 0 bugs / 0 vulnerabilities / 0 blockers / 0 critical / 0 hotspots, two major and 18 minor records, 125 minutes of debt, 9,646 duplicated lines / 1.5%, cognitive complexity 26,063, total complexity 37,977, and 390,922 NCLOC; reliability, security, and maintainability are A. The 20 records are visible, registered compatibility/consensus boundaries: 17 public WERR_* protocol identifiers, two Curve singleton-constructor records, and one exhaustive opcode dispatch. Dependabot and secret scanning are zero. Code scanning has one low-severity external-posture alert, Scorecard CIIBestPracticesID #204.

No npm package, package release, tag, service image, service workload, DNS record, or secret was published or changed. The normal documentation deployment refreshed from merged main.

Current remaining non-QA accounting (2026-07-30)

Wave 38 completed the three release-preparation items that were open after Wave 37:

  1. Complete — final dependency freeze and disposition. The current direct inventory has 631 current declarations, 114 first-party release holds, 18 release-age holds, 13 coordinated-major holds, 43 TypeScript compiler-bridge holds, three supported peer ranges, one forward Hermes build, and zero unexplained compatible-update or major-migration declarations. Mature updates include @rspack/cli/@rspack/core 2.1.7, @types/node 26.1.2 for public workspace packages while Node 24 infrastructure types remain supported, better-sqlite3 13.0.2, oxlint 1.76.0, tsx 4.23.1, webpack 5.109.2, and webpack-cli 7.2.2. All 19 override removals were rehearsed; none can presently be removed without recreating a vulnerability or breaking deterministic codegen. Seventeen active exceptions are current, owned, evidenced, review-dated, and removal-conditioned.
  2. Complete — release-artifact contract. All 30 exact packed tarballs pass clean-consumer validation for every concrete conditional/wildcard runtime subpath, declarations, source maps, bins, side-effect declarations, optional/peer dependencies, and advertised ESM/CJS/runtime modes. Additive SDK and Overlay export-pattern fixes preserve every prior import while making the more-specific .ts paths reachable.
  3. Complete — public-service and browser release contracts. A governed seven-context CORS/CSP matrix and three contract tests cover eight integrations while preserving wildcard/no-credentials and opaque-origin access by default; exact allowlists, credentials, and disabled CORS remain opt-in, wildcard-plus-credentials is rejected, and CSP remains independent. All 13 browser targets have exact Vite/esbuild or governed-platform composition, raw/gzip/Brotli budgets, package/module/chunk evidence, Node-only dependency exclusion, and explicit splitting disposition; Wallet Metro/Hermes remains green.

Still open before a coordinated full package/image release:

  1. Run the protected release train and record real evidence. Publish only through protected OIDC/provenance workflows in topological order; reconcile source to npm latest; verify registry integrity, signatures, SLSA provenance, SBOMs, and clean installs; create the reviewed release-sync PR; then release governed images by immutable digest and record version, source SHA, scan, SPDX SBOM, GitHub provenance, keyless Cosign signature/attestation, rollback, and any separately authorized deployment smoke evidence. Wave 38 intentionally stopped before this action.
  2. Make the two external assurance decisions. Resolve Scorecard fix(release): drop cross-ref/infra rewrites from #203, keep only version bumps #204 by registering the project for the OpenSSF Best Practices badge or recording a time-bounded exception, and decide scope/procurement for the independent cryptographic/wallet/payment/network review. Neither is evidence of a current code vulnerability; both remain open program-governance handles.

Non-release-blocking maintenance still open: the deferred Sonar administration switch only if automatic analysis cannot provide a needed capability beyond the repository gate plus Codecov; historical test-shard balancing, repeated setup/install and external-Codecov critical-path optimization; and optional deeper CLI/runtime benchmark work. Aggregate/risk-tier coverage, fuzzing, manual/live execution, conformance-skip disposition, deterministic-fixture expansion, and assertion/skip closure remain the deliberately deferred final QA phase. The two formerly residual Sonar QA records were safely remediated in Wave 38 and are no longer part of that backlog.

Docker provenance is already enabled for releases. The release workflow scans the exact image, generates an SPDX SBOM, pushes the reviewed digest, creates GitHub SLSA/SBOM attestations, signs and attests it keylessly with Cosign, and verifies digest/signature/provenance/SBOM before success. provenance: false remains only on no-push CI builds whose purpose is runtime validation; those are not release artifacts.

Wave 38 source candidate versions (not published)
Package Source candidate
@bsv/amountinator 2.1.4
@bsv/wallet-helper 0.1.6
create-bsv-app 1.0.4
@bsv/did 0.2.4
@bsv/did-client 1.2.3
@bsv/fund-wallet 1.4.3
@bsv/simple 0.4.8
@bsv/templates 1.9.5
@bsv/authsocket 2.1.4
@bsv/authsocket-client 2.1.3
@bsv/message-box-client 2.2.6
@bsv/paymail 2.4.5
@bsv/402-pay 0.2.4
@bsv/auth 0.1.3
@bsv/auth-express-middleware 2.1.5
@bsv/payment-express-middleware 2.1.4
@bsv/teranode-listener 1.1.4
@bsv/gasp 1.3.5
@bsv/overlay 2.2.7
@bsv/overlay-discovery-services 2.1.6
@bsv/overlay-express 2.4.9
@bsv/overlay-topics 1.6.8
@bsv/sdk 2.2.14
@bsv/verifast 0.3.4
@bsv/btms 1.1.4
@bsv/btms-permission-module 1.1.3
@bsv/wallet-relay 0.3.3
@bsv/wallet-toolbox 2.4.19
@bsv/wallet-toolbox-client 2.4.19
@bsv/wallet-toolbox-mobile 2.4.19
Infrastructure artifact Source candidate
Chaintracks Server 1.0.14
Message Box Server 1.1.19
Overlay Server 2.1.22
UHRP Server Basic 0.1.15
UHRP Server Cloud Bucket 0.2.17
WAB 1.4.16
Wallet Infrastructure 2.0.18
Wave Status Evidence / next gate
0 — authoritative ledger and guardrails Complete PR #325 merged 2026-07-25. CI 30149013720 passed all 25 jobs in 4m13s; CodeQL 30149012950 and Conformance 30149013718 passed; Sonar PR analysis had 0 open/confirmed issues and an OK quality gate.
1 — CodeQL helper/SDK fixes Complete PR #326 merged at main@172f37a1. CI 30149650621, Conformance 30149650627, and CodeQL 30149649850 passed; CodeQL PR results, Sonar issues/hotspots, and coverage misses were all zero.
2 — service-edge path/resource/error hardening Complete PR #327 merged at main@7278be16. CI 30150486667, Conformance 30150486666, and CodeQL 30150486611 passed on main; alerts #90, #91, #92, and #112 are fixed. PR analysis had zero CodeQL alerts, zero Sonar issues/hotspots, and 100% Codecov patch coverage. Repository-health findings decreased from 243 to 242.
3 — shared service rate limiting and edge policy Complete PR #328 and PR #329 merged at main@6826bc6f. Rate limits, endpoint inventories, public/configurable CORS, headers, body/file quotas, timeouts/backpressure, boundary review, threat models, and manual security evidence are complete. CI 30172472690, Conformance 30172472698, CodeQL 30172472476, and docs deploy 30172472706 passed on main; CodeQL and secret scanning report zero open alerts.
4 — current dependency advisories and direct-major review Complete PR #330 merged at main@51c96923. React Router 8, direct esbuild builds, all compatible direct majors, a normalized frozen graph, explicit peers, and one tracked Jest security substitution leave pnpm audit and all GitHub alert APIs at zero. CI 30174141425, Conformance 30174141433, CodeQL 30174141220, and docs deploy 30174141434 passed on main; Dependabot security updates are enabled.
5 — deterministic codegen and lifecycle controls Complete PR #331 merged at main@f7fca9c0. OpenAPI TypeScript/Go/Python generation is read-only, deterministic, and fully locked; workspace lifecycle scripts are disabled by default with an explicit esbuild rebuild; action SHAs, first-party release-sync ownership, and generated-artifact ownership are enforced. The newly disclosed critical kin-openapi advisory was fixed with v0.145.0 before merge. CI 30175242619, Codegen 30175242630, Conformance 30175242611, and CodeQL 30175241209 passed; Dependency Review, Socket, and pnpm audit were clean, and Sonar reported zero open/confirmed PR issues.
1b — security-extended and manual review follow-up Complete PRs #333–#339 are merged at main@9496f8c0. Corrected advanced CodeQL run 30180480265 passed authored Actions and JavaScript/TypeScript with security-extended; default setup is off, the advanced workflow is active, and its gate is enabled. CodeQL, Dependabot, and secret scanning each report zero open alerts. Generated OpenRPC alerts #168/#169/#183 closed as fixed at the owned generated boundary; public BRC-104 handshake alert #165 closed after exact-path/signed-dispatch evidence with no dismissal. CI 30180313340, Conformance 30180313327, and docs deploy 30180313331 passed on main.
1c — current CodeQL follow-up Complete PR #353 merged by ty-everett at main@6ebeb710. Five wallet-wire remote-property-injection sinks were replaced by safe entry construction with trust-boundary key validation, and two deterministic Base58 remainder operations were rewritten without cryptographic-random modulo semantics. Alerts #205–#211 are fixed on main with no dismissal or suppression. PR evidence: all 31 checks green, CodeQL/Sonar APIs at zero PR issues/hotspots, and 100% coverage of modified coverable lines. Exact-main CI 30192558880, CodeQL 30192558878, Conformance 30192558874, and Scorecard 30192558876 passed; Dependabot and secret scanning remain at zero, and only the two owned Scorecard posture gaps remain open. No artifact was published.
6 — container and artifact supply chain Complete — implementation and dry-run evidence; first live npm release evidence remains a final release gate PR #340 completed reproducible locked infrastructure builds, digest-pinned bases, immutable image references, complete OCI labels, blocking Trivy scans, CycloneDX SBOMs, and signed/attested container provenance; PR #341 completed the Scorecard control and evidence-backed exception register; PR #342 repaired image-refresh automation. PR #372 then admin squash-merged the npm artifact boundary at main@59d0234a4: uncredentialed preparation and protected OIDC publication are separated; 30 exact tarballs are built once and carried immutably through per-package/aggregate CycloneDX SBOMs, complete license inventory, Trivy scanning, GitHub attestations, provenance verification, exact-tarball npm publish, registry SHA-512 reconciliation, retained evidence, and a separately privileged release-sync job. Candidate naming makes failed-job retries reuse the original bytes. Exact-head passed 65/65 checks with CodeQL, Sonar (0 issues/hotspots), Codecov, Dependency Review, Socket, full package/platform/infrastructure/mutation/coverage matrices, and a local 30-tarball/30-SBOM/330-component/0-license-finding/0-high-or-critical dry run. Exact-main CI 30292915701, CodeQL 30292915285, Conformance 30292916017, Scorecard 30292915833, codegen, and docs validation are the final merged-tree evidence. All 30 current exact package versions were already present on npm, so no version, tag, package, image, or other artifact was published. The first future release must retain the production attestation/SBOM/integrity evidence and final version inventory before the program closes. GitHub forbids author self-approval; ty-everett therefore performed the requested exact-head admin merge after review without adding a two-reviewer or independent-last-pusher requirement.
7 — package contracts Complete PR #344 standardized all 30 public manifests on Node.js 22 consumer support, explicit public access, side-effect metadata, export maps/files allowlists, and private-workspace documentation. The wallet-toolbox export map preserves its published SDK subpath for ESM/CJS consumers. Repository-health debt fell from 241 to 148 with 0 control errors. Exact-main dc8071a0 CI, CodeQL, Conformance, Scorecard, and docs deploy all passed. Open BSV License Version 6 was completed in Wave 9. All 30 modern strict public-package profiles are complete through PR #363. No artifact was published.
8 — dependency automation consolidation Complete PR #345 merged at main@d215223a. All compatible Action updates are current and immutable; TypeScript 7 was completed as the owned Wave 16 migration, while Node 26, MySQL 9, and MongoDB 8 remain explicit owned migrations instead of unsafe bot merges. Every PR build, test, coverage, CodeQL, dependency-review, Socket, infra, docs, repository-health, and Sonar check passed; Sonar reported zero new issues and zero hotspots. Exact-main CI 30183507155 passed on retry after a documented Docker Hub timeout; CodeQL, Conformance, Scorecard, codegen, and docs deploy also passed.
9 — uniform licensing Complete PR #346 merged at main@979f4a63. All 46 npm manifests, exact package-local files, standalone lock roots, and seven OCI metadata records use Open BSV License Version 6. CI enforces canonical SHA-256 bac995a0c84dd533f7d5335b6d870aae9fee7d28d189b8aa78b103e0c9932bc0, manifest/filename/allowlist/lock consistency, and a parallel 30-public-package dry-pack release gate. PR #351 removed the final WAB marketplace Version 4 hardcoding, derives the governed image license dynamically from the canonical record, and made contribution/licensing guidance explicit. All owned package and image license surfaces are now uniform and drift-blocking. No artifact was published.
10 — package quality and artifact contracts Complete — 30 of 30 PRs #347, #348, #350–#352, #354, #356–#359, #361–#363 completed the modern strict profile for every public package. PR #363 delivered the final dependency-coherent Overlay pass for @bsv/overlay@2.2.1, @bsv/overlay-discovery-services@2.1.1, @bsv/overlay-topics@1.6.1, and @bsv/overlay-express@2.4.2: warning-free non-mutating format/lint, strict typecheck, build/test/coverage, exact tarballs, conditional ESM/CommonJS declarations, publint, strict type-resolution, clean consumers, and exact local-tarball dependency verification. It repaired Overlay’s ./storage contract, guarded malformed/missing topic data and unknown errors, added 24 boundary regressions, removed source/dist coverage double counting, and preserved public-by-default cross-domain deployment assumptions. The four packages run 740 tests with four pre-existing skips; honest source coverage is Overlay 34.17% line / 27.64% branch, Discovery 50.09% / 32.57%, Topics 55.79% / 47.53%, and Express 66.32% / 58.14%, so Tier 0/1 coverage remains an explicit later gate rather than being hidden. Repository health is now 12 findings, 11 active exceptions, and 0 control errors, down from 24 findings. Exact head ce814152 passed all 31 PR checks. The first external reports correctly blocked the PR at 3.6% Sonar new-code duplication, two Sonar findings, and 44.83% Codecov patch coverage; source refactors and targeted tests—not exclusions or bypasses—produced the final OK Sonar gate with A reliability/security/maintainability, 0 open/confirmed issues, 0 hotspots, 0.7% new duplication, and 100% Codecov patch coverage (30 hits, 0 misses, 0 partials). Sonar still cannot ingest authoritative aggregate coverage under automatic analysis, which remains the separately deferred administration item. ty-everett recorded a substantive exact-head review and admin squash-merged the identical tree at main@996aa6f699. Exact-main CI 30226677156 (29 successful jobs), CodeQL 30226677167, Conformance 30226677150, and Scorecard 30226677160 passed. CodeQL has zero owned open findings, Dependabot and secret scanning are zero, and only owned Scorecard posture findings #202 and #204 remain. Licensing and package versions were unchanged, and no artifact was published.
10a — compact action-batch transport Complete PR #360 was exact-head reviewed, security-hardened, and admin squash-merged at main@96ad2b2e1; the reviewed and merged trees are identical. Compact authenticated action-batch transport reduces the benchmark from 501 to 2 RPCs for 250 actions and from 1,085 ms to 150 ms for a 4 MiB payload. Storage upload is fail-closed to prepared/requested digests, untrusted Express bodies are runtime type-checked before binary parsing, and six critical CodeQL type-confusion findings (#213–#218) were fixed in code with no dismissal. PR CI, Sonar (OK / 0 open or confirmed issues / 0 hotspots), and exact-main CI 30224483443, CodeQL 30224483426, Conformance 30224483452, and Scorecard 30224483418 passed. No version, publication, or licensing change.
11 — repository quality and metadata contract Complete PR #364 ratcheted all 37 projects and 30 public packages to 0 repository-health findings with 10 governed exceptions and 0 errors; completed canonical public metadata; made root/workspace lint warning-free and blocking; enforced read-only formatting; added real docs, conformance, UHRP, and Wallet Toolbox example quality gates; and resolved all 14 Sonar findings raised during the PR. Exact reviewed head 1fb5ead3e passed all 39 PR checks, 100% Codecov patch coverage, and 0 Sonar issues/hotspots; its tree is identical to main@ac8128dba. Exact-main CI 30229090424 (29 successful jobs), CodeQL 30229090438, Conformance 30229090456, Codegen 30229090465, Scorecard 30229090598, and Docs 30229090439 passed. The next broad pass was completed in PR #365 and TypeScript 7 in PR #373; remaining documentation/runtime/operations, coverage/performance, Sonar administration, and release-governance gates remain explicit below.
12 — test governance and property-based testing Complete PR #365 established a machine-enforced test-quality contract: 550 required test files, only 6 governed direct skips, 40 classified manual/live/resource files, and 211 owned conformance gaps across 19 vector files. All 33 package manifests are now classified: 25 packages own meaningful fast-check suites with 88 independent properties, while 8 adapter/composition/example/platform packages have dated, owned exclusions instead of cosmetic tests. PR tests run at least 300 cases/property; the weekly/manual campaign runs 5,000 with seed/path replay and retained failure logs. Final local exact-tree validation exercised at least 88,000 generated cases; exact head a59cdc604b87a367ef170c5c6c4793ffa2f49e30 passed CI 30235006722, CodeQL 30235006706, Conformance 30235006695, Dependency Review, Socket, Codecov patch, browser/mobile, package, infrastructure, docs, and codegen gates. Sonar was used as a blocking semantic review despite its nominal gate: two findings were fixed, then the exact head reported quality gate OK, 0 open/confirmed issues, and 0 hotspots. Generated property testing found and drove fixes for malformed/canonical encodings, unsafe integer/varint boundaries, GASP timestamp/limit/response validation, Message Box destination grammar, BTMS amount parsing and per-origin authorization, relay/pairing origins and expiry, reorg/event JSON, script framing, and related trust boundaries. ty-everett recorded the exact-head maintainer attestation and admin squash-merged as main@27986ed7f. Exact-main CI 30235327776, CodeQL 30235327817, Conformance 30235327764, Scorecard 30235327746, codegen, and docs deploy all passed. The merged-main tree is identical to the reviewed head; Scorecard fuzzing finding #202 is closed, Dependabot and secret scanning remain at zero, and CII Best Practices registration #204 is the only open code-scanning posture item. No package version changed and nothing was published.
13 — workspace typecheck and dual-package boundary Complete PR #367 makes root pnpm typecheck a governed post-build contract in PR and release CI, and fixes Fund Wallet’s real SDK ESM/Wallet Toolbox CommonJS nominal-identity split by aligning its runtime and declaration resolution to the CommonJS SDK condition without weakening the SDK’s valid dual exports. Exact head b33aa1f3a passed all 39 PR checks, including full build/typecheck/lint/test/coverage, packed consumers, browser/mobile, infrastructure, CodeQL, Codecov patch, Dependency Review, Socket, and Sonar (OK, 0 open/confirmed issues, 0 hotspots). ty-everett recorded exact-head review and admin squash-merged the identical tree (c7eefe3b5e2ebd15a7befbd13cf055e0065465cf) at main@6c3559764b. Exact-main CI 30236754069, CodeQL 30236754039, Conformance 30236754044, Codegen 30236754036, Scorecard 30236754027, and Docs 30236754060 passed. No version changed and nothing was published; mutation quality is complete in Wave 14, while Tier 0/1 coverage remains retained for the final QA phase.
14 — stack-wide mutation-quality validation Complete PR #369 mapped all 25 governed property suites across 25 packages to exact Stryker 9.6.1 mutation targets, with per-target score ratchets, zero allowed no-coverage/invalid mutants, fixed fast-check seed 3242026, 300 generated cases/property, affected-target PR selection, global-control fan-out, a six-way parallel weekly/manual full campaign, shared build artifacts, and retained machine-readable reports. The exact campaign exercised 3,073 valid mutants: 2,662 detected, 411 survived, 86.63% aggregate; every target passed between 80.30% and 100%, with 0 uncovered and 0 invalid. Surviving-mutant review strengthened tests and removed or corrected superficial/dead behavior across SDK codecs, wallet action/script/pairing, Overlay linkage/advertisement/integrity/reorg, Paymail, DID, Mandala, P2P, auth/payment/replay, GASP, BTMS, Message Box, Amountinator, Fund Wallet, Create BSV App, and VeriFast. Exact-head CI 30241380054, CodeQL 30241380149, Conformance, Socket, Dependency Review, Codecov, and Sonar passed; Sonar had 0 open/confirmed issues and 0 hotspots after both findings were fixed. ty-everett admin squash-merged as main@8edb09665; exact-main CI 30241920702, CodeQL 30241920773, Conformance 30241920683, Scorecard 30241920714, codegen, and docs passed. A newly disclosed development-only qs advisory in Stryker’s typed-rest-client chain was initially fixed by PR #370, moving the sole lock resolution from 6.15.1 to 6.15.3; all 25 mutation targets passed again and ty-everett admin squash-merged as main@8e1c5af92. Exact-final-main CI 30243173940, CodeQL 30243173941, Conformance 30243173955, and Scorecard 30243173987 passed. The TypeScript 7 lock refresh later proved that lock-only selection was not durable, so PR #373 added the narrow parent-scoped typed-rest-client@2.3.1>qs override to 6.15.3, registered with owner, evidence, a 2026-08-27 review date, and removal when upstream adopts a fixed dependency. Root and infrastructure audits and all 25 mutation targets remained green. Dependabot and secret scanning are zero; CII registration #204 is the sole open code-scanning posture item. No package version changed and nothing was published.
15 — coverage-guided stack fuzzing Deferred to final QA phase — WIP preserved, unmerged The exact work-in-progress is preserved on codex/stack-wide-fuzzing@63485ce3c, based on exact main@8e1c5af92. It expands the governed property/mutation layer from 25 suites/targets across 25 packages to 30 suites/targets across all 29 implementation packages, eliminating four inaccurate exclusions and adding DID-client instructions, Simple DID key validation, AuthSocket server/client differential event codecs, and Wallet Toolbox header guards. The coverage-guided draft now defines 29 Jazzer.js 4.0.0 targets across all 29 implementation packages and all eight stack areas, with semantic oracles, dictionaries, two committed seeds per target, built-in command-injection/path-traversal/prototype-pollution detectors, a governed runner, and affected-target selection. Static governance (4/4 tests and 29-target validation) and the full workspace property build pass; five new mutation targets passed at 92.31%, 96.15%, 100%, 100%, and 95.12%, with zero no-coverage or invalid mutants. Corpus replay passed the first 13 targets and then correctly exposed an empty-input bug in the unfinished fund-wallet-cli harness; later targets, CI/scheduled workflows, documentation, complete discovery campaigns, hosted checks, review, merge, and exact-main validation remain deliberately unfinished. There is no PR and this branch must be rebased and completed only in the final QA phase. No package version changed and nothing was published.
16 — coordinated TypeScript 7 migration Complete PR #373 established the supported side-by-side compiler boundary in all 43 governed TypeScript manifests: native @typescript/native 7.0.2 performs compiler builds/typechecks, while the official @typescript/typescript6 compatibility package supplies the stable TypeScript API required by ts-jest@29.4.12; there is no peer override. The independently locked deterministic codegen toolchain remains on TypeScript 5.9.3. A filesystem-scanning toolchain contract, tests, CI gate, Dependabot major holds, documentation, dependency policy, and health exceptions now block drift across the root and all seven standalone infrastructure roots. The migration removed obsolete TypeScript 7 options, repaired Auth resolution, made the development-only qs advisory durable with the narrow owned parent override recorded in Wave 14, and removed the TypeScript native binary and all other dev dependencies from the WAB runtime image through a production prune. The final exact head 4a2450553 passed 65/65 PR checks, including build/typecheck, 53 script tests, every package test/property/coverage/consumer/browser/mobile/CLI/WASM profile, all 25 mutation targets, all seven infrastructure roots and Linux images, zero root/infra audit findings, CodeQL, Dependency Review, Socket, Codecov, and Sonar (OK, A ratings, 0 open/confirmed issues, 0 hotspots). ty-everett recorded a substantive exact-head maintainer review and admin squash-merged the identical tree as main@de8df4d1c. Exact-main CI 30296126490 passed 55 jobs with one intentional skip; CodeQL 30296126586, Conformance 30296124736, Scorecard 30296124700, Codegen 30296125121, and Docs 30296126588 also passed. No package version, tag, image, or artifact was published.
17 — authentication correctness and documentation/operations coherence Complete PR #368 completed the justified authentication session-binding fix at main@4ea4a530f. PR #374 then admin squash-merged exact reviewed head 443011429507eb4d2306f210963f42d7dcb4b9c1 (tree 540edf37564ef5e0320c2ee4abfd49a15af4d4b4) as the identical tree at main@5f1f5d533. It generates source-derived facts for 37 projects, 30 public packages, seven infrastructure roots, and 74 conformance files / 6,650 vectors; enforces 30 README contracts, exactly 40 package pages, 87 freshness records, consolidated source links, and eight compiled clean-consumer examples over 21 exact tarballs; publishes required Express declaration dependencies for six public packages; aligns Window CWI declarations with canonical wallet types without implementation or wire changes; and validates transitive workspace runtime closures in exact artifact checks. Current Node/toolchain, dependency, security, reliability, conformance, release, release-sync, image rollout, rollback, incident, and public-service guidance is now enforceable. Public CORS/CSP behavior, routes, persistence, manifests, and network behavior are unchanged; Overlay, Wallet Storage, WAB, Message Box, and Wallet Relay remain public/configurable by default. Nine Sonar findings raised during iteration were fixed, not dismissed; the exact head had zero issues/hotspots and 100% Codecov patch coverage (21/21 lines, zero misses/partials), with all 64 reported checks green. GitHub forbade formal author self-approval, so ty-everett recorded the exact-head admin attestation and merged the pinned SHA. Exact-main CI 30306158123 passed 55 jobs with one intentional skip; CodeQL 30306158089, Conformance 30306158042, Codegen 30306158038, Scorecard 30306157998, and Docs 30306158025 passed. Source version candidates are SDK 2.2.1, Paymail 2.4.3, Auth Express 2.1.3, Payment Express 2.1.2, Overlay Express 2.4.3, Wallet Relay 0.2.3, and Wallet Toolbox core/client/mobile 2.4.5. The docs site was updated by the normal main workflow; no npm package, tag, service image, application deployment, DNS, or secret changed. Deferred QA remains preserved and unmerged on codex/stack-wide-fuzzing.
18 — critical production Sonar correctness cleanup Complete PR #375 resolved the three non-complexity critical production findings without protocol, storage-ordering, notification, public API, CORS/CSP, or deployment changes. Exact reviewed head bdf5a226b passed all 57 PR checks, CodeQL, Sonar (0 new issues / 0 hotspots / 0.0% new duplication), and 100% coverage of modified coverable lines; its tree is identical to admin squash merge main@088b44928. Exact-main CI 30309578296 passed 55 jobs with one intentional push-only skip; CodeQL 30309578371, Conformance 30309578255, Scorecard 30309578290, and Docs 30309578274 passed. Exact-main Sonar decreased from 1,179 to 1,176 open issues: critical 173→170, debt 8,786→8,741 minutes, and cognitive complexity 26,731→26,723; vulnerabilities remain 0, security/maintainability remain A, and all 89 blockers plus all 4 bugs are test-only work retained for the final QA phase. Source candidates are @bsv/sdk@2.2.2 and @bsv/overlay@2.2.2; npm remains at 2.2.0 and 2.2.1 respectively. No package, release, tag, image, service, DNS, or secret was published or changed.
19 — bounded cross-package production complexity remediation Complete PR #376 used characterization-backed refactors across SDK, Amountinator, Simple, Overlay Topics, and Wallet Toolbox without dependency, public protocol/API, CORS/CSP, persistence, deployment, or service behavior changes. Exact reviewed head 588861bf5 passed all 57 checks, including CodeQL, Dependency Review, Socket, every build/type/lint/test/coverage/platform/mutation lane, Sonar (0 new issues / 0 hotspots / 0.0% new duplication), Codecov patch (96.24%, five partial branch lines, required check green), and merge-gate. GitHub forbade author self-approval, so ty-everett used the authorized exact-head admin squash merge; merged main@226c1241a has the identical reviewed tree 31ce6b615888d05fca7ec5a19e58d38e32ec0995. Exact-main CI 30311958678 passed 55 jobs with the expected push-only Dependency Review skip; CodeQL 30311958671, Conformance 30311958672, Scorecard 30311958687, and Docs 30311958679 passed. Exact-main Sonar removed seven critical production S3776 findings: 1,176→1,169 open issues, critical 170→163, cognitive complexity 26,723→26,684, and debt 8,741→8,689 minutes; 0 vulnerabilities and 0 unreviewed hotspots remain. The separate BigNumber.toBaseString finding remains at 16 versus 15 and is explicitly carried into Wave 20. Source candidates are @bsv/sdk@2.2.3, @bsv/amountinator@2.1.2, @bsv/simple@0.4.2, @bsv/overlay-topics@1.6.2, and Wallet Toolbox core/client/mobile 2.4.6; npm remains at 2.2.0, 2.1.1, 0.4.1, 1.6.1, and 2.4.4 respectively. No package, release, tag, image, service, DNS, or secret was published or changed.
20 — continued bounded production complexity remediation Complete PR #377 used behavior-preserving helper extraction across SDK BigNumber formatting, downloader fallback/stream validation, and HTTP wallet errors/browser detection; Simple output construction; Message Box PeerPay parsing/proof/cancellation/classification/acknowledgement; Wallet Helper OP_RETURN validation; Overlay Discovery URI classification; Overlay Topics supply-chain validation; Wallet Toolbox sync summaries; and docs-manifest frontmatter parsing. No public protocol/API, CORS/CSP, origin policy, persistence schema, fallback/validation ordering, deployment, or service behavior changed. The first Sonar pass exposed two issues despite a nominally green gate; both were fixed, and exact reviewed head 7109c7cea then passed all 57 checks with final Sonar 0 open/confirmed issues and 0 hotspots, CodeQL, Dependency Review, Socket, Codecov patch 94.69%, every coverage/platform/mutation lane, mutation quality, and merge-gate. There were no review threads or change requests. GitHub forbade author self-approval, so ty-everett recorded a substantive COMMENT review on the exact head and used the authorized SHA-pinned admin squash merge. Merged main@f104ed9a9 has the identical tree a24f76328f53a440224d818cb366b7cf8b4b4681. Exact-main CI 30314808921 passed 55 jobs with the expected push-only Dependency Review skip; CodeQL 30314808915, Conformance 30314808922, Scorecard 30314808920, and Docs 30314808916 passed. Exact-main Sonar removed 11 issues and 10 critical findings: 1,169→1,158 open, critical 163→153, cognitive complexity 26,684→26,618, and debt 8,689→8,594 minutes; vulnerabilities and unreviewed hotspots remain 0. Source candidates are @bsv/sdk@2.2.4, @bsv/simple@0.4.3, @bsv/message-box-client@2.2.3, @bsv/wallet-helper@0.1.2, @bsv/overlay-discovery-services@2.1.2, @bsv/overlay-topics@1.6.3, and Wallet Toolbox core/client/mobile 2.4.7; npm remains at 2.2.0, 0.4.1, 2.2.2, 0.1.1, 2.1.1, 1.6.1, and 2.4.4 respectively. A source-only staging dry run found that SBOM temporary installs rewrite dependencies/optionalDependencies but not peerDependencies, allowing unpublished peers to fall through to npm; this is an explicit Wave 21 tooling defect, not a reason to publish. No package, release, tag, image, service, DNS, or secret was published or changed.
21 — reproducible coordinated source-only release closure Complete PR #378 closes the unpublished first-party runtime/optional/peer dependency graph entirely over staged local tarballs, rejects missing/version-mismatched/registry-fallback lockfile resolution, removes resolver-only root relationships and local filesystem references from final CycloneDX output, and canonicalizes final isolated package snapshots without reordering conditional exports. The exact governed build runtime is Node 24.18.0, pnpm 10.33.2, and npm >=11.5.1, checked before output creation. Focused tests are 12/12; the final full source-only stage produced 16 artifacts, 197 aggregate components, zero license findings, no file: references, and passed verification. Two independently generated full evidence trees were byte-identical. The first Sonar pass found one new complexity issue despite a green quality gate; it was refactored and final exact head 8ecaae9b5 passed 33/33 checks, Codecov coverage of every modified coverable line, Sonar 0 open/confirmed issues and 0 hotspots, CodeQL, Dependency Review, Socket, conformance, all coverage shards, browser/mobile, and merge-gate. No review thread or change request remained. GitHub rejected author self-approval, so ty-everett recorded the substantive exact-head COMMENT review and used the authorized SHA-pinned admin squash merge. Merged main@082a4bee5 has the identical reviewed tree bda2af230b3f286eccb4bfad006dc796f97bfcbc. Exact-main CI 30317519416, CodeQL 30317519378, Conformance 30317519402, Scorecard 30317519336, and Docs 30317519327 passed. Exact-main Sonar remains 1,158 open issues (89 blocker, 153 critical, 4 bugs, 1,154 code smells), 8,594 minutes debt, 0 vulnerabilities, and 0 unreviewed hotspots; aggregate cognitive complexity is 26,649 after adding the governed release logic, with no new threshold violation. Dependabot and secret scanning remain zero; Scorecard CII registration #204 remains the sole open low-severity posture item. No package version, npm package, release, tag, image, service, DNS, or secret was published or changed.
22 — broad production complexity remediation Complete PR #379 closed 23 targeted production S3776 findings across SDK, Overlay, Overlay Express, BTMS, Wallet Toolbox, and Wallet Helper using behavior-preserving helper extraction and 21 direct characterization tests. Exact reviewed head a25b633c6 passed all 57 hosted checks: every CI/build/type/lint/test/coverage/platform/mutation lane, CodeQL, Dependency Review, Socket, 6,650-vector conformance, Sonar with 0 new issues / 0 hotspots / 0.0% new duplication, Codecov patch 90.43% at the unchanged 90% threshold, and merge-gate. The initial exact head failed only Codecov at 83.13%; the gate was not bypassed, and additional behavior-level ordinal and ARC callback tests raised the patch result above threshold. Repository aggregate Codecov improved 70.74%→70.98%. There were no inline review comments, review threads, or change requests. GitHub rejected author self-approval, so ty-everett recorded substantive exact-head COMMENT review 4793012842 and used an authorized SHA-pinned admin squash merge. Merged main@c9f5d1d5d has the identical reviewed tree 5112d53caf4358fe28fec510e9447e0793989a24. Exact-main CI 30321348394 passed 55 jobs with one expected push-only Dependency Review skip; CodeQL 30321348396, Conformance 30321348404, Scorecard 30321348412, and Docs 30321348393 passed. Exact-main Sonar is 1,132 open issues (−26), 89 blocker (unchanged and test-QA-deferred), 130 critical (−23), 4 bugs, 1,128 code smells (−26), 8,404 minutes debt (−190), and cognitive complexity 26,472 (−177), with maintainability A, security A, 0 vulnerabilities, and 0 unreviewed hotspots. Dependabot and secret scanning remain zero; Scorecard CII registration #204 remains the sole open low-severity posture item. Source candidates are @bsv/sdk@2.2.5, @bsv/overlay@2.2.3, @bsv/overlay-express@2.4.4, @bsv/btms@1.1.2, Wallet Toolbox core/client/mobile 2.4.8, and @bsv/wallet-helper@0.1.3; generated docs and health baselines are synchronized. Public CORS/CSP/origin behavior is unchanged. No package, release, tag, image, service, DNS, or secret was published or changed.
23 — broad production-runtime complexity and maintainability remediation Complete PR #380 closed 25 production S3776 findings across SDK, Overlay Topics, Overlay Discovery, and Wallet Toolbox; consolidated shared registry/discovery validation; hardened BTMS untrusted-key accounting with Map; and added focused malformed-token/envelope/script/input coverage. Exact reviewed head 593d7059b passed every hosted build/type/lint/policy/test/coverage/platform/mutation/security/docs/conformance/merge check. Codecov patch passed at 91.20198% (736 hits, 23 misses, 48 partials) with the 90% threshold unchanged; Sonar had 0 new issues, 0 hotspots, and 0.7% new duplication. There were no unresolved review threads; ty-everett recorded substantive exact-head COMMENT review 4793376417 and used the authorized SHA-pinned admin squash merge. Merged main@bb7d3f298 has the identical reviewed tree af558c0d6dbae5ccb0201937966f19dce4d0af7f. Exact-main CI 30325477190 passed 53 jobs with one expected push-only Dependency Review skip; CodeQL 30325477204, Conformance 30325477206, Scorecard 30325477218, and Docs 30325477188 passed. Exact-main Sonar moved 1,132→1,105 open issues, 130→105 critical, 1,128→1,101 code smells, 8,404→7,936 minutes debt, cognitive complexity 26,472→26,129, and duplication density 1.7%→1.6%, with 0 vulnerabilities and 0 hotspots. Aggregate Codecov moved 70.98%→71.48%. Source candidates are @bsv/sdk@2.2.6, @bsv/overlay-topics@1.6.4, @bsv/overlay-discovery-services@2.1.3, and Wallet Toolbox core/client/mobile 2.4.9; npm remains at 2.2.0, 1.6.1, 2.1.1, and 2.4.4 respectively. Public CORS/CSP/origin behavior is unchanged. No package, release, tag, image, service, DNS, or secret was published or changed.
24 — broad non-complexity source modernization and lint-policy uniformity Complete PR #382 resolved 167 of its 210 selected findings across SDK, Wallet Toolbox, Overlay Express, Overlay Topics, Message Box Client, Simple, WAB, infrastructure, config, scripts, and docs; 43 style-only/test-coverage or SDK benchmark findings remain explicitly final-QA owned rather than weakening the 90% patch gate. It added the shared root Oxlint profile and environment overrides, removed the three orphan ESLint files, hardened safe stringification/WAB response parsing/SDK mutation-range governance, synchronized generated facts and docs, and patch-bumped affected source candidates. Final exact head de8c1576d passed CI 30329465728, CodeQL 30329465741, Conformance 30329465797, Codegen 30329465734, Dependency Review, Socket, all platform/infrastructure/coverage/mutation gates, Codecov 100% patch coverage (76 hits, 0 misses, 0 partials), and Sonar with 0 new issues, 0 hotspots, and 1.7% new duplication. There were no unresolved review threads or change requests. ty-everett recorded substantive exact-head COMMENT review 4793821231 and used the authorized SHA-pinned admin squash merge. Merged main@b51212277 has the identical reviewed tree d9c2b27f457c80f54ff2f17e6c0fb6ac23ca185a. Exact-main CI 30329963645 passed 53 jobs with the expected push-only Dependency Review skip; CodeQL 30329963621, Conformance 30329963683, Scorecard 30329963634, Docs 30329963665, and Codegen 30329963729 passed. Exact-main Sonar moved 1,105→935 open issues (−170), 1,101→931 smells, 196→138 major, 705→603 minor, 10→0 info, and 7,936→7,132 debt minutes; blocker 89, critical 105, and bugs 4 are unchanged because they are complexity/test-QA work. Cognitive complexity moved 26,129→26,103, code complexity 35,444→35,426, and duplicated lines 9,622→9,620 at 1.6%, with 0 vulnerabilities and 0 hotspots. Source candidates are @bsv/sdk@2.2.7, Wallet Toolbox core/client/mobile 2.4.10, @bsv/overlay-topics@1.6.5, @bsv/message-box-client@2.2.4, @bsv/overlay-express@2.4.5, and @bsv/simple@0.4.4. Lockfiles and vendored BDK artifacts are byte-unchanged; public CORS/CSP/origin behavior is unchanged. No package, release, tag, image, service, DNS, or secret was published or changed.
25 — broad documentation, operational uniformity, and safe production-quality closure Complete PR #383 established a machine-readable seven-service operations contract and generated reference; enforced real Docker health checks, non-root images, digest-pinned manifests, secret-free/config-driven YAML, disabled service-account tokens, and hardened application workload probes/resources/security contexts; repaired the Overlay runtime command/port contract; hardened Overlay/WAB/Wallet samples; added true post-bootstrap UHRP readiness; removed dynamic Firebase credential execution/logging from Message Box; made UHRP secret synchronization shell-free with private temporary files and guaranteed cleanup; validated Overlay environment boundaries; and made every retained plan explicitly authoritative, historical, resolved, or unapproved. Exact reviewed head a048d6d4a passed all 65 PR checks: both CodeQL languages, Sonar with 0 new issues/hotspots and 0.0% new duplication, Codecov with every modified coverable line covered, Dependency Review, Socket, seven service builds/tests/Linux images/Trivy scans, full package/platform/coverage/mutation matrices, docs, codegen, conformance, and merge gate. There were no review threads or change requests; ty-everett recorded substantive exact-head COMMENT review 4794201091 and used the authorized SHA-pinned admin squash merge. Merged main@f1a8f8271 has the identical reviewed tree 2e49f439c571e69956e76a3eb35d0f9cf55b757e. Exact-main CI 30332970100 passed 55 jobs with the expected push-only Dependency Review skip; CodeQL 30332970029, Conformance 30332970105, Codegen 30332970041, Scorecard 30332970122, and Docs 30332970043 passed. Exact-main Sonar moved 935→916 open issues, 931→912 smells, 105→101 critical, 138→133 major, 603→593 minor, and 7,132→7,042 debt minutes; vulnerabilities and hotspots remain 0, duplication remains 9,620 lines / 1.6%, and the quality gate is green. Dependabot and secret scanning remain zero; Scorecard CII registration #204 is the sole open code-scanning posture item. Source service candidates are chaintracks-server@1.0.11, @bsv/messagebox-server@1.1.15, @bsv/overlay-express-examples@2.1.19, @bsv/uhrp-lite@0.1.9, @bsv/uhrp-storage-server@0.2.11, @bsv/wab-server@1.4.12, and @bsv/wallet-infra@2.0.14; first-party dependency ranges remain on current installable releases until a separately authorized coordinated publication order exists. Public CORS/CSP/origin behavior and vendored BDK artifacts are unchanged. No package, release, tag, image, service, DNS, or secret was published or changed.
26 — broad documentation, release-readiness, observability, and remaining operations closure Complete PR #384 was exact-SHA reviewed and squash-merged by ty-everett from e7058e482 at main@8a4d0ef8; reviewed and merged trees are identical. It completed generated API/declaration/migration and release-note ownership for all 30 public packages and all 18 unpublished candidates; generated schema-v2 operator, configuration/secret-name, observability, SLO/error-budget, alert/dashboard, incident, state/migration/backup/restore, lifecycle/disruption/topology/scaling, and public-edge contracts for all seven governed services; documented the production-owned stateful boundary; aligned telemetry dependencies/preloads while retaining evidence-backed service-local implementations; and added idempotent release-ordered shutdown support to AuthSocket, Overlay Express, UHRP, WAB, Wallet Infra, and the safely closable Message Box paths without changing public wildcard-CORS defaults. All 64 exact-head checks passed, including full coverage and mutation matrices, seven service matrices, browser/mobile, CodeQL, Dependency Review, Socket, Sonar (0 PR issues/hotspots), Codecov (all modified coverable lines covered), docs/codegen/conformance, audits, and merge gate; there were no unresolved review threads. Exact-main CI 30383269210, CodeQL 30383267190, Conformance 30383269066, Scorecard 30383269179, Codegen 30383269983, and Docs 30383267068 all passed. Exact-main Sonar fell 14 findings to 902 (898 smells, 4 test bugs, 0 vulnerabilities; 89 blocker/100 critical/127 major/586 minor), with 0 hotspots and an OK gate. Dependabot and secret scanning remain at zero; Scorecard CII registration #204 is the sole open code-scanning posture alert. No package, image, release, or tag was published; no application/service deployment, secret, or DNS change occurred. The normal git-triggered docs workflow completed.
27 — broad production quality, dependency, CI-security, and workstation-safety closure Complete PR #385 was reviewed at exact head 71c4546ea and SHA-pinned squash-merged by ty-everett as main@6ccf7407; reviewed and merged trees are identical at 9966423532757b82cff86e75139c929f26da7480. It completed compatible dependency/lock modernization, production and traversal cleanup across Overlay Discovery, UHRP, Templates, SDK, VeriFast, Wallet Toolbox, and Teranode, all warranted compatibility changes plus 10 direct tests from #381, synchronized release candidates/docs, and deterministic Wallet Toolbox fixture cleanup. It made advanced CodeQL unconditional for fork-origin PRs and removed the obsolete repository variable after merge. The repository-owned strict Sonar job now waits for the exact PR head and requires quality OK, zero open/confirmed issues, and zero unreviewed hotspots; its first hosted run correctly blocked one S8786 finding even while Sonar’s aggregate gate was green, and the finding was fixed without suppression. Exact-head CI passed every build/lint/policy, seven-service, coverage, mutation, browser/mobile, audit, CodeQL, Socket, Sonar, docs, codegen, and conformance lane. Exact-main CI 30389369570 passed 55 jobs with two expected push-only skips; CodeQL 30389369497, Conformance 30389369569, Scorecard 30389369485, Codegen 30389369553, and Docs 30389369546 passed. Exact-main Sonar moved 902→858 open findings, 898→854 smells, 6,976→6,821 debt minutes, and 9,630→9,592 duplicated lines, with 0 vulnerabilities, 0 hotspots, 1.6% duplication, and an OK gate. Dependabot and secret scanning remain zero; only Scorecard CII registration #204 is open. A local audit removed 31 confirmed ignored historical SQLite fixture directories totaling 550.9 GiB and increased free disk from 8.1 GiB to 574 GiB; source/worktrees were untouched, and CI now prevents recurrence. Current source candidates are @bsv/templates@1.9.2, @bsv/teranode-listener@1.1.2, @bsv/overlay-discovery-services@2.1.4, @bsv/sdk@2.2.8, @bsv/verifast@0.3.1, Wallet Toolbox core/client/mobile 2.4.11, @bsv/authsocket@2.1.2, @bsv/message-box-client@2.2.4, @bsv/overlay-express@2.4.6, @bsv/overlay-topics@1.6.5, @bsv/simple@0.4.4, Chaintracks 1.0.12, Message Box Server 1.1.17, Overlay Server 2.1.20, UHRP Lite 0.1.11, UHRP Storage 0.2.13, WAB 1.4.14, and Wallet Infra 2.0.16. No package, image, release, tag, service, DNS, or secret was published or changed.
28 — broad non-QA long-tail closure and exact-head quality-gate hardening Complete PR #386 was reviewed at exact head 7b084d233 and SHA-pinned admin-merged by ty-everett as main@a45341b27; the reviewed head is the merge commit’s second parent. It closed 149 exact-main Sonar findings across SDK, Wallet Toolbox, Overlay, helpers, WAB, UHRP, scripts, config, and docs; registered four narrow compatibility boundaries; modernized deterministic generators without changing vectors; strengthened diagnostics/input handling/accessibility/URL normalization; synchronized docs and candidate versions; and added focused compatibility and branch coverage. The repository definition of quality gate passed now requires every required exact-head check plus Sonar quality OK, zero new issue records in OPEN, CONFIRMED, ACCEPTED, or FALSE_POSITIVE, and zero unreviewed hotspots. The dedicated Quality gate — zero new Sonar findings job is a dependency of merge-gate; Sonar’s aggregate green badge alone is explicitly advisory. Exact-head CI 30398700176 passed all 65 check runs, including both CodeQL languages, strict Sonar at the matching SHA with zero findings/hotspots, Codecov patch 96.14148%, all 25 mutation targets plus mutation quality, full coverage/platform/service/docs/conformance/security gates, and merge-gate. There were no requested reviewers or unresolved review threads; maintainer review 4801847083 records the exact-head ty-everett review before the authorized admin merge. Exact-main CI 30399545561 passed 55 jobs with two expected push-only skips; CodeQL 30399546403, Conformance 30399546346, Scorecard 30399545696, and Docs 30399545744 passed. Exact-main Sonar moved 858→709 findings: smells 854→705, critical 100→90, major 127→69, minor 542→461, debt 6,821→5,329 minutes, cognitive complexity 26,309→26,103, and duplicated lines 9,592→9,554 at 1.6%; bugs remain 4, blocker remains 89, vulnerabilities/hotspots remain zero, and the gate is OK. Source candidates are @bsv/simple@0.4.5, @bsv/gasp@1.3.2, @bsv/overlay-express@2.4.7, @bsv/overlay-topics@1.6.6, @bsv/sdk@2.2.9, @bsv/wallet-relay@0.3.0, Wallet Toolbox core/client/mobile 2.4.12, @bsv/uhrp-lite@0.1.12, and @bsv/uhrp-storage-server@0.2.14. Public CORS/CSP/origin behavior is unchanged. No package, image, release, tag, service, DNS, or secret was published or changed.
29 — broad non-QA complexity and dependency/tooling exception review Complete PR #387 was reviewed at exact head b899b54ef and SHA-pinned admin squash-merged by ty-everett as main@d426e381b. It closed 21 exact-main production findings across SDK, Wallet Helper, Simple, Wallet Toolbox, wallet examples, and both UHRP services; decomposed transaction building, DID resolution, token parsing, permissions, monitoring, chain ingestion, and renewal flows with focused characterization; retained all public contracts, error/empty/signing behavior, persisted formats, and CORS/edge defaults; synchronized docs and source candidate versions; and published nothing. The strict gate first rejected duplicated UHRP/DID code and then rejected 71.39% patch coverage; the PR removed the duplication without exclusions and added direct behavior tests until exact head passed all 59 reported checks, including CI 30405101676, CodeQL 30405101608, Conformance 30405101477, Sonar OK with 0 issue records/0 hotspots, Codecov patch 91.19% (373 hits, 5 misses, 31 partials), all 25 mutation targets, and merge-gate. There were no unresolved review threads; maintainer review 4802415950 records the exact-head ty-everett review. PR #381 was explicitly verified as fully incorporated through reviewed successor #385 at ancestor 6ccf7407, so no work was omitted or duplicated. Exact-main CI 30405738926 passed 55 jobs with two expected push-only skips; CodeQL 30405738976, Conformance 30405738911, Scorecard 30405738983, and Docs 30405738951 passed. Exact-main Sonar moved 709→688 findings: smells 705→684, critical 90→72, minor 461→458, debt 5,329→4,981 minutes, cognitive complexity 26,103→25,876, and duplicated lines 9,554→9,383 at 1.6%; bugs remain 4, blocker remains 89, major remains 69, vulnerabilities/hotspots remain zero, and the gate is OK. Production findings moved 96→75: 53 actionable and 22 registered visible boundaries; the deferred QA inventory remains 613. The current graph proves all three narrow dependency/tooling exceptions remain required without widening them. Source candidates are @bsv/sdk@2.2.10, @bsv/wallet-helper@0.1.4, @bsv/simple@0.4.6, Wallet Toolbox core/client/mobile 2.4.13, @bsv/uhrp-lite@0.1.13, and @bsv/uhrp-storage-server@0.2.15. Dependabot and secret scanning remain at zero; only Scorecard CII registration #204 is open. No package, image, release, tag, service, DNS, or secret was published or changed.
30 — remaining production finding closure and strict quality evidence Complete PR #388 closed 12 production S3776 findings and the final actionable optional-chain finding across SDK, Overlay, Wallet Toolbox, and mock services; added direct branch/fork, bulk-file, header-boundary, BEEF graph, GASP, proof-policy, and send-state regression coverage; and synchronized source candidates. Exact reviewed head 3a6ce91e6 passed 50/50 CI jobs and all 58 reported checks/contexts, both CodeQL languages, strict Sonar at the matching revision with quality OK, 0 new findings, and 0 unreviewed hotspots, plus Codecov patch 91.67% (297 hits, 6 misses, 21 partials) above the unchanged 90% gate. No review thread remained; maintainer review 4802881572 records the exact-head ty-everett review before the SHA-pinned admin squash merge at main@a330aad02. The main docs deploy then correctly rejected an expert-source verification that expired at the intervening UTC rollover; PR #389 revalidated the source ledger, retained the 90-day cadence, passed its exact-head strict gate, and merged as main@a1e46a26f. Exact-main CI 30410488238, CodeQL 30410488089, Conformance 30410488205, Scorecard 30410488026, and Docs 30410488180 passed. Exact-main Sonar moved 688→675 findings: smells 684→671, critical 72→60, minor 458→457, debt 4,981→4,793 minutes, cognitive complexity 25,876→25,753, and duplication 1.6%→1.5% while duplicated lines remained 9,383; bugs remain 4, blockers 89, major 69, vulnerabilities/hotspots zero, and quality OK. Production findings moved 75→62: 40 actionable and the same 22 registered boundaries; deferred QA remains 613. Source candidates are @bsv/sdk@2.2.11, @bsv/overlay@2.2.4, and Wallet Toolbox core/client/mobile 2.4.14. Dependabot and secret scanning remain zero; only Scorecard CII registration #204 is open. No package, image, release, tag, deployment, DNS, or secret was published or changed.
31 — production complexity closure with compatibility proofs Complete PR #390 closed every remaining actionable production finding across Message Box, SDK, Overlay, and Wallet Toolbox while treating API, wire/storage/error/serialization/order/default behavior as immutable. The final reviewed head 98607e32 and squash-merged main@f9f2ecdd4 have the identical tree e5aed2eab010a5622f60a6f8e4cc3c7a7b5df985. All 58 exact-head checks passed, including CI 30419109237, both CodeQL languages with security-extended, Conformance, strict Sonar at the matching revision with quality OK / 0 new or accepted issues / 0 hotspots, Codecov patch 90.62% (2,406 hits, 104 misses, 145 partials), all mutation/coverage/platform/consumer/package/merge gates, clean SDK/Overlay ESM+CJS and Wallet CJS packed consumers, and a zero-high/critical audit. Maintainer review 4803703301 records the exact-head ty-everett review; GitHub does not permit author self-approval, so the identical tree was SHA-pinned and admin squash-merged. Exact-main CI 30419599947 passed 55 jobs with two expected push-only skips, including all 25 mutation targets and merge-gate; CodeQL 30419599907, Conformance 30419599844, Scorecard 30419599868, and Docs 30419599921 passed. Sonar moved 675→633 findings: smells 671→629, critical 60→18, debt 4,793→2,509 minutes, cognitive complexity 25,753→25,094, and duplicated lines 9,383→9,376 at 1.5%; blocker 89, bugs 4, major 69, minor 457, vulnerabilities/hotspots zero, security A, maintainability A, and quality OK. The remaining 613 QA findings and 20 visible registered compatibility boundaries contain zero actionable production findings. Source candidates are @bsv/sdk@2.2.12, @bsv/overlay@2.2.5, and Wallet Toolbox core/client/mobile 2.4.15; no package, image, release, tag, deployment, DNS, or secret was published or changed.
32 — automatic QA correctness closure without API changes Complete PR #391 resolved all four incompatible-equality bugs and all 29 automatic blocker findings in 20 test/conformance files. It added explicit delivery, certificate, timeout, cleanup, storage-transition, monitor-task, live-result, packed-file, optional-hook, acknowledgement, and conformance-dispatch assertions; deleted only duplicate/incomplete placeholders with existing complete coverage; and converted the governed Topics identity placeholder to an explicit todo. There is no production source, export, declaration, package version, lockfile, wire/storage/error/default, CORS/CSP, or artifact change. Exact reviewed head b0c2e15db passed all 58 reported checks, including CI 30428000587, CodeQL 30428000722, Conformance 30428000785, strict Sonar at the matching SHA with 0 issue records/0 hotspots, all coverage/mutation/platform/WAB/security/docs/health gates, and Codecov confirmation that every modified coverable line is tested. The PR had no review threads or change requests. GitHub forbids author self-approval, so ty-everett used the authorized admin squash merge; merged main@2bc3a8da9 has the identical tree 0be9cfd8b254c3bf3d4eb5105db60168f6c50488. Exact-main CI 30428564083 passed 55 jobs with two expected push-only skips; CodeQL 30428564054, Conformance 30428564088, and Scorecard 30428564061 passed. Exact-main Sonar moved 633→600 findings: smells 629→600, bugs 4→0, blockers 89→60, critical 18→14, and debt 2,509→2,244 minutes; major 69, minor 457, cognitive complexity 25,094, code complexity 36,087, duplicated lines 9,376 / 1.5%, and NCLOC 380,642 are unchanged. Reliability, security, and maintainability are A; vulnerabilities/hotspots are zero; quality is OK. The remaining 580 QA findings and 20 visible registered compatibility boundaries are explicitly retained. No version, package, image, release, tag, deployment, DNS, or secret was changed or published.
33 — Wallet Toolbox manual/live disposition and operator extraction Complete — scheduled execution evidence remains final-QA work PR #392 retained 30 genuine environment-backed Wallet Toolbox suites with assertions and exact governance; extracted eight operator-oriented Jest files into 15 guarded commands and four tested examples; preserved every useful diagnostic, repair, reconciliation, export/import, monitor, and wallet workflow; and retired only explicitly documented unsafe/stale/no-op/duplicate fragments. The ledger is machine-enforced at 589 required test files, six governed direct skips, 25 property suites/targets, 32 classified manual/live/resource files, 30 exact Wallet Toolbox dispositions, and 211 conformance skips across 19 files. Operator coverage is 99.36% lines / 91.86% branches / 98.33% functions / 98.59% statements; five focused suites pass 92 tests, and the full Wallet Toolbox suite passes 1,495 tests with five governed skips. Exact head bb4bbdc09 passed all 57 checks, both CodeQL analyzers, Sonar 0/0, Codecov patch 94.27%, audit, lint, typecheck, format, docs, health, platform, consumer, mutation, and coverage gates; it was admin squash-merged as main@1741897c4. All repository-owned exact-main workflows passed. The external main Sonar aggregate alone is red because it newly includes 1,064 generated AsyncAPI HTML markup findings; the tracker therefore keeps a precise generated-scope correction open and does not misrepresent them as production defects. Wallet Toolbox core/client/mobile candidates are 2.4.16; nothing was published.
33a — WAB root URL normalization invariant Complete PR #393 was exact-head reviewed at e3068e972 and admin squash-merged as main@4b227ab03. It returns an explicit slash-free normalized WAB base URL so root services cannot generate //auth/start; current behavior is preserved for root/repeated-slash/nested-prefix/default-port/custom-port/IPv6/dot-segment/encoded-path inputs, and no accepted-URL, API, wire, error, origin, CORS/CSP, version, dependency, or publication contract changes. Exact-head passed 29 checks plus five expected scope skips, Codecov patch 100%, CodeQL/Sonar 0/0, security/dependency/conformance/mutation/coverage/package/docs gates, and 15 focused tests; there were no unresolved threads. Exact-main CI, CodeQL, Conformance, and Scorecard passed with 36 successful checks and two expected push skips. The sole external main failure remains the separately tracked 1,064 generated AsyncAPI HTML findings, not a WAB regression.
34 — generated ownership, browser contracts, and CI rebuild elimination Complete PR #394 precisely excludes governed generated WASM/codegen/docs artifacts from automatic Sonar while retaining authored source and synchronized edge-policy copies in issue analysis; a repository test prevents broad exclusions. It reuses the one audited immutable workspace build across coverage/browser lanes, safely skips empty affected-scope lanes, dynamically uses one or two shards, and warms Mongo only where required. The exact full-scope PR run completed in 8m47s versus Wave 33’s 14m52s, an observed 41% reduction pending the planned 20-run median/p95 baseline; prepare fell from 3m40s to 3m01s. Exact-tarball Vite+esbuild checks and raw/gzip/Brotli budgets now cover all 11 conventional browser-library profiles plus Wallet Relay, with SDK and Wallet Client in dedicated lanes and existing mobile/UMD contracts retained. A shared transitive-workspace tarball closure resolves clean consumers without publication. GASP gains complete source maps and Jest dist isolation only; no public API/runtime/wire/storage/error/CORS/CSP behavior changes. Exact head a3107812d passed 67 checks and review 4813968832; admin squash-merged main@e34e8ae86 passed exact-main CI, CodeQL, Conformance, Scorecard, and Docs. Exact-main Sonar is OK, 524 smells / 0 bugs / 0 vulnerabilities / 0 hotspots, with reliability/security/maintainability A. Candidates: DID 0.2.2, Templates 1.9.3, 402 Pay 0.2.2, GASP 1.3.3; nothing published.
35 — consumer profiles, VeriFast distribution, and CI trends Complete — broader artifact/runtime depth and resource instrumentation remain open PR #395 assigns and enforces eight consumer profiles across all 30 public packages, completes declared Node ESM/CJS and the sole advertised Metro/Hermes profile, closes VeriFast exact-tarball Node/browser/WASM/worker/UMD/CSP/streaming-fallback coverage, and adds raw/gzip/Brotli composition budgets plus UMD source maps. It also commits a validated 40-run full/targeted CI baseline and weekly median/p95 regression gate. All eight initial Sonar findings were fixed before merge. Exact head 5ec9965c1 passed 66 checks plus one expected skip and review 4814254444; admin squash-merged main@47e7f22d3 passed exact-main CI, CodeQL, Conformance, Scorecard, and Docs with 64 successful checks and three expected skips. Sonar remains 524/0/0/0 issues by smells/bugs/vulnerabilities/hotspots and A/A/A. Candidate VeriFast is 0.3.2; nothing was published.
36 — zero-warning lint, uniform formatting, and strict TypeScript completion Complete PR #397 remediated 683 lint diagnostics, 245 strict TypeScript diagnostics, 10 exact-head Sonar findings, and 13 overlapping existing main Sonar records; governs 1,909 authored files and 121 tsconfigs; and preserves all compatibility contracts. Exact head passed 67 checks plus one expected skip, Codecov 92.60%, CodeQL, Sonar 0/0, 25 mutation targets, and all standalone service/package/platform gates. Review 4814742055 preceded the admin squash merge at main@235b82ed6; exact-main CI, CodeQL, Conformance, Codegen, Scorecard, and Docs passed. All 30 public source candidates were patch-bumped; nothing was published.
37 — non-QA closeout, release governance, and real container runtime contracts Complete — release execution and final QA remain open PR #398 merged as main@2acc82b0b. It left 20 governed compatibility records plus two safely addressable QA Sonar records, closed the non-QA production backlog, governed dependencies/overrides/duplication, and proved all seven no-push Linux runtime contracts. Exact-main CI/CodeQL/conformance/codegen/Scorecard/docs/container workflows passed; its 75% external Codecov patch result was corrected by Wave 38 without weakening the gate. Nothing was published.
38 — release-readiness dependency, artifact, browser, edge-policy, patch-coverage, and CI cleanup Complete — protected publication remains open PR #399 exact-head reviewed at 33656c3d1 and admin squash-merged as main@c8261dfb0. It completed preparatory items 1–3, safely resolved both residual QA smells, retained 20 governed compatibility boundaries, restored fail-closed 90% repository patch line/branch coverage, deep-checked all 30 package artifacts, governed all 13 browser compositions/splitting dispositions and the seven-context public CORS/CSP matrix, refreshed mature dependencies, rehearsed all 19 overrides, and removed unsupported CPU/memory/cache-hit instrumentation while preserving every check. Exact-head had 74 successful contexts and one expected skip; exact-main CI passed 56 jobs with three expected skips and all six sibling workflows passed. Nothing was published.

Audited baseline

Area Current state Program implication
Repository 37 workspace projects: 33 package-area projects, 30 public packages, 3 private package projects, plus root/docs/conformance A uniform contract must cover all relevant profiles without forcing unlike packages into one build model.
Current releases All 30 public package manifests match npm latest at audit time The baseline is published, but every program source/manifest change must create and publish new patch versions.
CI Latest audited CI run green; merge gate about 4m55s Preserve coverage while optimizing the critical path, caching, fan-out, and redundant builds.
Conformance Latest audited conformance run: 6,439 passed, 211 skipped, 6,650 total; 74 vector files Required tests pass, but skips and documentation require ownership and correction.
Lint 846 warnings, 0 errors in audited non-mutating package run; changed-package lint is allowed to fail Establish shared rules, a measured ratchet, then reach zero warnings and make lint blocking.
TypeScript Root strictness disabled; 31 effective configs vary substantially Adopt profile-based configs and progressively enable strict correctness options.
Coverage Codecov about 66.97% overall; current project threshold applies only to SDK source; patch threshold 90% Add tiered repository/package thresholds and close critical untested paths.
CodeQL 17 open alerts: 14 high, 3 medium Triage and resolve every alert, then run security-extended queries.
Dependabot 6 open alerts: 4 medium, 2 low; repository security updates setting disabled Resolve or evidence-dismiss every alert and enable security updates.
Secret scanning Provider/non-provider/AI/validity/delegated/push protection enabled; 0 open alerts Preserve this state and validate in completion evidence.
SonarCloud 1,529 unresolved issues: 1,494 smells, 26 bugs, 9 vulnerabilities; reliability D, security C Fix repository findings now, eliminate generated-noise correctly, and later validate CI-based analysis with coverage.
Packaging Missing lint/test/coverage scripts and manifest/license fields across multiple packages; no repository-wide packed-consumer validation Define profile-specific package contracts and enforce them automatically.
Browser/performance VeriFast is the only package with a substantial consumer/bundle test matrix and a hard browser-size budget Establish Node, browser, bundler, React Native, CLI, and WASM profiles and budgets.
Containers/Kubernetes Non-root multi-stage images are a good base; release provenance, image scanning/SBOM, immutable bases/tags, workload hardening, probes, and manifest/runtime agreement are incomplete Harden release and deployment artifacts without changing examples into production secrets.
Documentation Package READMEs exist, but versions/prerequisites/metrics/policies are stale or inconsistent and examples are not compiled Create enforceable documentation contracts and generated/current facts.
Published package baseline (manifest = npm latest at audit time)
Package Version
@bsv/amountinator 2.1.1
@bsv/wallet-helper 0.1.1
create-bsv-app 1.0.2
@bsv/did 0.2.1
@bsv/did-client 1.2.1
@bsv/fund-wallet 1.4.1
@bsv/simple 0.4.1
@bsv/templates 1.9.1
@bsv/authsocket 2.1.1
@bsv/authsocket-client 2.1.1
@bsv/message-box-client 2.2.2
@bsv/paymail 2.4.2
@bsv/402-pay 0.2.1
@bsv/auth 0.1.1
@bsv/auth-express-middleware 2.1.2
@bsv/payment-express-middleware 2.1.1
@bsv/teranode-listener 1.1.1
@bsv/gasp 1.3.1
@bsv/overlay 2.2.1
@bsv/overlay-discovery-services 2.1.1
@bsv/overlay-express 2.4.2
@bsv/overlay-topics 1.6.1
@bsv/sdk 2.2.0
@bsv/verifast 0.3.0
@bsv/btms 1.1.1
@bsv/btms-permission-module 1.1.1
@bsv/wallet-relay 0.2.2
@bsv/wallet-toolbox-client 2.4.4
@bsv/wallet-toolbox-mobile 2.4.4
@bsv/wallet-toolbox 2.4.4

Program end state

The program is complete only when all of the following are true:

  • Zero open CodeQL, Dependabot, and secret-scanning alerts, except explicitly documented and unexpired evidence-based exceptions; zero high/critical exceptions.
  • CodeQL runs the security-extended suite and Dependabot security updates are enabled.
  • Zero known high/critical dependency or container vulnerabilities; lower-severity holds are owned, evidenced, and time-bounded.
  • Package and image releases are reproducible, provenance-bearing, SBOM-producing, scanned, immutable, and traceable to source. Source controls are complete through PRs ci(security): harden container supply chain #340–fix(deps): ignore placeholder container image #342 and Harden npm package release supply chain #372; keep this final gate open until a real npm release and the final image inventory retain production evidence.
  • Zero lint warnings and errors; lint is required and cannot continue-on-error.
  • All TypeScript projects use approved strict profile configs, with no unexplained local relaxation. Wave 36 governs 121 tsconfigs across approved runtime profiles and enforces the compatibility-safe strictness matrix in CI.
  • Every package conforms to its declared package profile for manifests, licensing, build, typecheck, lint, test, coverage, packed tarball, exports, and consumer validation.
  • Overall coverage is at least 80%; Tier 0/1 packages are at least 85% line and 80% branch coverage; the fail-closed repository-owned patch line/branch gate is restored at 90% and green; no critical source module remains at 0%. Aggregate/risk-tier coverage remains final-QA work.
  • No assertion-free tests, incomplete assertions, unexplained/expired skips, or accidental passWithNoTests remain.
  • Required conformance passes 100%; every intended skip has a reason, owner, and removal/unsupported decision.
  • Node ESM/CJS, browser bundlers, React Native/mobile, CLI, and WASM/worker artifact contracts are tested where applicable. Wave 38 completes deep exact-artifact validation for all 30 packages while retaining the separately open deeper CLI behavior matrix.
  • Public protocol services retain default arbitrary-origin interoperability, with governed regression coverage for wildcard/no-credentials, opaque Origin: null, preflight, exact allowlist, credentialed exact-origin, disabled-CORS, wildcard-plus-credentials rejection, and CSP-independence behavior. Wave 38 covers seven service contexts and eight integrations without changing defaults.
  • Bundle and benchmark baselines/budgets are enforced with noise-aware regression policy.
  • Documentation facts other than the intentionally deferred aggregate coverage facts are generated/current; examples compile/run, packages have complete usage/security/compatibility/migration guidance, and operational runbooks are accurate. Coverage facts remain owned by the final QA gate below.
  • Sonar reliability, security, and maintainability are A; exact main@c8261dfb0 has zero vulnerabilities, bugs, blockers, hotspots, critical, or untriaged production/QA issues. The 20 visible compatibility/consensus records are owned and review-dated rather than suppressed.
  • Sonar bulk: auto-fixable code style smells (~1,200 issues) #43, Sonar: 250+ functions exceed cognitive complexity threshold #44, Sonar: 138 issues around error handling, dead code, and TODOs #45, Sonar: duplication — 9,792 duplicated lines (4.8%) across 139 files in 439 blocks #46, and Sonar: long-tail TypeScript smells (~600 issues across 50+ rules) #48 are closed with exact-main evidence and all residual ownership centralized here.
  • The final package-version matrix and infrastructure release inventory are recorded here after the last release-sync PR lands.

Execution program

0. Establish the authoritative ledger and guardrails

  • Add a machine-readable repository health inventory covering each workspace’s owner/profile, publishability, runtime targets, build/test/lint/typecheck/coverage commands, release mechanism, and criticality tier.
  • Add a package-contract validator and a CI job that reports missing or divergent fields/scripts before enforcement begins.
  • Add the exception registry schema and validation: category, target, owner, reason, evidence, created date, review/expiry date, and removal condition.
  • Record current package versions, CI durations, coverage, lint, skipped tests, security alerts, Sonar counts, bundle sizes, and benchmark measurements as versioned baselines.
  • Define package criticality tiers and coverage/security/performance expectations. At minimum, SDK, wallet, auth/payment middleware, overlay/storage, credential, and network-edge code belong to Tier 0/1.
  • Add PR templates/checklists for dependency changes, security changes, package release impact, browser/runtime impact, documentation, and evidence links.
  • Confirm branch/ruleset behavior: required merge checks, resolved conversations, one maintainer approval, maintainer/admin bypass, no last-pusher restriction, and ty-everett able to approve/merge.
  • Preserve generated-file ownership/exclusion boundaries explicitly. Do not exclude all tests or broad source areas to make quality metrics pass.

Exit: every project and every exception is owned, machine-inventoried, and mapped to a program gate; future drift is visible in CI.

1. Eliminate immediate security alerts

1.1 CodeQL: resolve all 17 audited alerts

1.2 Dependabot and direct dependency remediation

Resolve all current alerts without broad permanent overrides:

  • Remove the vulnerable React Router 6/SSG path; migrate the docs application to React Router 8.3.0 with repository-owned static rendering, deterministic route generation, safe hydration fallback, navigation/deep-link/404 browser smoke tests, and built-link validation.
  • Remove vulnerable uuid@8.3.2 paths by deleting the unused message-box webpack-dev-server dependency, disabling implicit peer installation, and proving the installed graph contains no affected UUID copy.
  • Normalize the Express/body-parser dependency graph onto the supported patched body-parser@2.3.x path.
  • Remove the vulnerable tsup/esbuild path by replacing all three tsup builds with direct esbuild@0.28.1, preserving and testing CJS, ESM, declaration, source-map, and watch contracts as applicable.
  • Enable repository Dependabot security updates and verify the repository security-analysis setting reports enabled.
  • Re-run the frozen install, zero-finding pnpm audit, Dependabot/CodeQL/secret alert APIs, all package and coverage lanes, docs production/browser checks, all infrastructure image builds, and the complete merge gate.
  • Keep the existing first-party @bsv/* Dependabot ignore only because release-sync owns those updates; document that ownership in the config and health inventory.
  • Retain only the narrow brace-expansion@<=5.0.7 → 5.0.8 Jest security substitution; register its owner, GHSA evidence, 2026-08-25 review date, full-suite compatibility evidence, and removal condition (Jest adopting minimatch 10.2.5+).

Review other audited direct-major candidates deliberately; upgrade when compatible, or record an owned compatibility project with review date:

  • @clack/prompts 0.7.0 → 1.7.0
  • @testing-library/jest-dom 6.9.1 → 7.0.0 (with its explicit @testing-library/dom peer)
  • better-sqlite3 12.11.1 → 13.0.1; use pnpm—not npm—to rebuild its single physical native binding in isolated CI lanes.
  • Replace test-only CommonJS chalk@4.1.2 with current dual-module picocolors@1.1.1; Chalk 5 is ESM-only and broke the package’s CommonJS Jest contract.
  • jest-fetch-mock 3.2.0 → 4.2.0
  • puppeteer-core 24.43.1 → 25.3.0
  • Remove unused webpack-dev-server@5.2.6 instead of carrying or upgrading an unnecessary server and advisory tree.
  • Complete the TypeScript 7 migration (6.0.3 → 7.0.2). PR build: adopt TypeScript 7 with a supported tooling boundary #373 migrated all 43 governed manifests to the native 7.0.2 compiler plus the official TypeScript 6 compatibility API required by ts-jest@29.4.12, with no peer override; the complete declaration, build, consumer, conformance, browser/mobile, infrastructure, mutation, audit, and security matrices passed on the exact PR head and merged main.

1.3 Service-edge security review and shared controls

  • Inventory every HTTP endpoint’s authentication, authorization, rate limit, CORS, body/file-size limit, timeout, validation, error exposure, replay behavior, and resource quota.
  • Replace ad hoc rate limiting with shared, configurable policies for authentication, payment, quote, upload, storage, faucet, deletion/share, and general API traffic. Correctly handle reverse proxies and distributed deployments.
  • Replace extreme body limits unless proven necessary: UHRP basic raw body 2gb and JSON 1gb; UHRP cloud JSON 1gb; message-box JSON 1gb; overlay-express JSON/raw 1gb. Use streaming plus endpoint-specific quotas for large payloads.
  • Keep public protocol services—especially Overlay, WAB, UHRP/Storage, message-box, and chaintracks—browser-accessible by default with credential-free wildcard CORS (including opaque Origin: null callers such as mobile webviews). Provide configurable exact allowlists, credentialed exact-origin mode, or disabled CORS as operator opt-ins; never combine wildcard origin with credentials.
  • Add a shared security-header baseline (for example Helmet or equivalent explicit headers), with CSP decisions appropriate to APIs/docs/browser apps.
  • Standardize request/response timeouts, maximum concurrent work, upload quotas, abort handling, and safe backpressure.
  • Review filesystem, SQL/query, URL, header, template, command, archive, and redirect boundaries across services; add negative tests for traversal, injection, SSRF, prototype pollution, and resource exhaustion.
  • Review authentication/session/token/certificate/payment flows for replay, timing, key handling, default secrets, logging leakage, and authorization gaps.
  • Produce package/service threat models and security assumptions for every Tier 0/1 boundary.
  • Run a manual repository security review and document findings, dispositions, and retest evidence.
  • Commission an independent external review for cryptographic, wallet, payment, and public-network surfaces when scope/procurement are available; track this as defense-in-depth assurance rather than treating it as a substitute for repository controls.

Exit: no open CodeQL/Dependabot/secret alert, no high/critical vulnerable runtime path, and every exposed edge has a documented and tested policy.

2. Harden CI/CD and software supply chain

  • Change full-workspace install steps in CI/docs/codegen workflows to avoid unrestricted lifecycle scripts. Use --ignore-scripts by default plus an explicit, audited rebuild allowlist for packages that genuinely require native/generated artifacts.
  • Replace all three npx openapi-typescript@latest invocations with a lockfile-pinned workspace dependency and deterministic package script.
  • Pin datamodel-code-generator and transitive Python tooling; prefer an isolated locked environment and binary-only/hash verification where practical. Do not install an unpinned latest package in CI.
  • Preserve SHA-pinned GitHub Actions and add automated action-SHA update/review policy.
  • Add explicit least-privilege workflow permissions everywhere and separate read/test privileges from publish/deploy privileges.
  • Make infrastructure releases reproducible: PR ci(security): harden container supply chain #340 commits and validates the standalone infrastructure lockfiles, rejects lock drift, and builds from the frozen graph rather than resolving a fresh release graph.
  • Enable release provenance for infrastructure artifacts: PR ci(security): harden container supply chain #340 replaces the former provenance: false path with signed GitHub artifact attestations bound to the source commit, image digest, and workflow identity.
  • Generate CycloneDX or SPDX SBOMs for npm tarballs and container images; PR ci(security): harden container supply chain #340 covers every governed image and PR Harden npm package release supply chain #372 produces one CycloneDX SBOM per npm tarball plus a 330-component aggregate. PR fix: make coordinated release artifacts reproducible #378 additionally proves coordinated unpublished source candidates resolve their complete runtime/optional/peer closure only from exact staged tarballs, with portable and byte-reproducible source-only evidence and no registry fallback.
  • Scan dependencies, built tarballs, workflow configuration, secrets, licenses, and container images. CI/release now combine frozen audit, Dependency Review, CodeQL, secret scanning, Socket, complete license inventory, and blocking Trivy high/critical scans, with only governed time-bounded exceptions.
  • Pin container base images by digest and automate reviewed refreshes; PRs ci(security): harden container supply chain #340 and fix(deps): ignore placeholder container image #342 enforce governed digest refreshes without mutable placeholder drift.
  • Use immutable image tags/digests for deployments and release evidence; PR ci(security): harden container supply chain #340 deploys and records release-specific image digests and rejects mutable latest references at the release boundary.
  • Add OCI labels for repository, source commit, version, build date, licenses, and revision across every governed image; PRs fix(wab): bind verified identities to account operations #333 and ci(security): harden container supply chain #340 complete and enforce the label set.
  • Produce signed/attested provenance for images and packages and document verification instructions; PR ci(security): harden container supply chain #340 covers images and PR Harden npm package release supply chain #372 covers exact npm tarballs/SBOMs with repository, workflow, ref, and SHA verification.
  • Add OpenSSF Scorecard repository posture checks and triage findings through this program; PR fix(security): remediate Scorecard findings #341 made the check persistent and Wave 12 closed the fuzzing posture finding.
  • Resolve low-severity Scorecard CIIBestPracticesID alert fix(release): drop cross-ref/infra rewrites from #203, keep only version bumps #204 by registering the project for an OpenSSF Best Practices badge or recording an owned, evidence-based, time-bounded exception. This external posture item is not a current package/image integrity defect and does not by itself block publication.
  • Update SECURITY.md only after claimed controls exist and clearly distinguish completed from pending controls. PR Harden npm package release supply chain #372 now documents the implemented package-artifact SBOM, scan, license, OIDC/provenance, attestation-verification, integrity-reconciliation, retry, evidence-retention, and incident-response boundaries alongside the previously completed container and source controls.

Exit: a clean checkout can deterministically build, test, pack, attest, scan, and publish every artifact without mutable tool downloads or unrecorded dependency resolution.

3. Define and enforce the uniform package contract

Use profile-specific rules rather than pretending every package is identical. Profiles must cover: Node-only library/service, dual ESM/CJS library, browser-capable library, CLI/scaffolder, React Native/mobile, and WASM/worker.

3.1 Manifest and repository hygiene

  • Add a root license and settle the repository’s authoritative licensing model: Open BSV License Version 6, authorized by the repository administrator and pinned to the current BSV Association/Teranode text and SHA-256.
  • Ensure every public package’s license field, shipped license file, root license, source headers where required, and npm tarball agree. All 30 public dry-pack payloads are enforced in the release workflow.
  • Legally resolve every formerly missing or ambiguous package license—including amountinator, did, did-client, fund-wallet, auth, teranode-listener, overlay-topics, btms, btms-permission-module, wallet-relay, and Wallet Toolbox children—on the same exact Open BSV License Version 6 text.
  • Fix every missing or stale license manifest declaration/file/allowlist/lock root, remove legacy filenames and conflicting v4/v5/MIT/ISC package declarations, and enforce all 46 npm package projects plus seven OCI metadata records against drift.
  • Standardize all 30 public packages on the enforced engines.node: ">=22" consumer contract while retaining Node 24.11+ for contributors, CI, and releases.
  • Repair Amountinator’s real packed-consumer/export contract. PR fix(amountinator): enforce package artifact contract #347 now verifies its exact tarball with strict publint/type analysis plus clean ESM and CommonJS consumers; create-bsv-app retains its documented CLI exception, and wallet-toolbox preserves its published legacy SDK subpath.
  • Normalize declaration metadata for non-CLI packages and verify create-bsv-app’s CLI-only exception.
  • Declare and enforce the sideEffects contract across all 30 public packages; the repository audit found no package import-time CSS side effects requiring an exception.
  • Add files allowlists for overlay-topics, btms-permission-module, wallet-toolbox-client, and wallet-toolbox-mobile, and verify the changed tarballs do not include tests/specs.
  • Normalize and enforce publishConfig.access: "public" for all 30 public packages.
  • Add missing homepage/bugs metadata, including create-bsv-app and VeriFast where still absent.
  • Normalize repository, author/organization, keywords, funding/support, package manager, Node support, and provenance metadata.
  • Add automated exact-tarball validation plus publint and @arethetypeswrong checks for every publishable package. PRs fix(amountinator): enforce package artifact contract #347, chore(packages): enforce wallet helper and auth profiles #348, Harden Fund Wallet and 402 Pay package profiles #350–Harden and standardize BTMS packages #352, Modernize helper package distribution contracts #354, chore: enforce helper formatting and coverage gates #356–Harden and standardize the Message Box stack #359, and Harden and standardize Auth and Payment Express middleware #361–Harden Overlay package profiles and release contracts #363 establish the shared checker and complete all 30 strict public-package profiles, including exact local-tarball dependency installation for the final Overlay chain.

3.2 Required scripts and build/type profiles

  • Provide non-mutating lint, format:check, typecheck, test, coverage, build, and pack:check scripts wherever applicable; document profile-specific exceptions.
  • Add lint scripts to teranode-listener, verifast, btms-permission-module, and wallet-relay. The completed public-package profile waves enforce warning-free lint across all 30 packages.
  • Add tests to btms-permission-module. Wallet Toolbox Client/Mobile consumer, runtime, browser, mobile, and coverage targets are complete in PR Standardize wallet platform builds and Open BSV licensing #351; justified CLI/profile exceptions remain explicit.
  • Add coverage scripts to create-bsv-app, btms-permission-module, and wallet-relay. The completed profiles include create-bsv-app’s explicit generated-project/CLI coverage contract and enforce package-appropriate coverage behavior.
  • Add explicit typecheck coverage beyond the former VeriFast/wallet-relay-only scripts. All 30 public-package profiles now expose and enforce package-appropriate type checking, including declaration and packed-consumer resolution where applicable.
  • Replace the private wallet examples’ mutating Prettier-write “lint” behavior with non-mutating checks.
  • Remove or migrate the three stale ESLint config files after the shared Oxlint standard is enforced. PR refactor: resolve broad Sonar findings #382 added the governed root/environment Oxlint profiles first, then removed the orphan Message Box Server, Wallet Infra, and Overlay Express ESLint files.
  • Keep build implementations profile-appropriate (tsc, dual conversion, tsup, Rspack/UMD, WASM) while standardizing their external contract and validation. PR Wave 36: complete lint and TypeScript standardization #397 maps all 121 tracked configs to governed runtime profiles without replacing package-appropriate build systems; the full build, exact-tarball, declaration, browser/mobile, UMD, WASM/worker, conformance, and seven standalone service-context checks pass on exact head and main.
  • Remove unnecessary rebuilds from the 14 test scripts that currently rebuild packages when CI has already produced the same artifact; retain rebuilds only where they prove a distinct packed/consumer contract. PR Wave 34: standardize browser contracts and accelerate CI #394 reuses the one audited immutable workspace build in SDK, VeriFast, and general coverage/browser lanes. Its guarded helper removes only an exact leading pnpm build &&, pnpm run build &&, or npm run build && when PREBUILT_PACKAGE_OUTPUTS=1; otherwise the package script is unchanged. Control tests and the full 26-target mutation/coverage/platform matrix prove no test or distinct clean-consumer build was removed.

Exit: the package-contract validator is blocking and every package passes the rules for its declared profile.

4. Make linting and formatting uniform and blocking

Wave 36 re-audited the complete authored boundary after prior waves and found 683 remaining diagnostics in 140 files: 426 unused symbols, 173 unicorn/no-new-array, 54 useless escapes, 11 prefer-as-const, seven wrapper-object types, six useless spread fallbacks, two non-null optional-chain assertions, and four other findings. Exact main now scans 1,909 authored JavaScript/TypeScript files with 97 rules and reports zero warnings and zero errors.

  • Create shared root Oxlint rules and profile overrides for source, tests, benchmarks, generated code, browser, Node, and React Native. PR refactor: resolve broad Sonar findings #382 added the root profile plus Node, browser, React Native, test, config, infrastructure, generated, and vendored ownership overrides.
  • Establish a non-increasing warning baseline per package/rule immediately; CI fails if a PR adds warnings. PR Wave 36: complete lint and TypeScript standardization #397 replaces the transitional ratchet with the stronger repository-wide invariant: all authored code is scanned on every CI run and --deny-warnings rejects the first warning.
  • Remove warnings in controlled waves: correctness/security first, production unused/dead code next, then tests/benchmarks and style rules. PR Wave 36: complete lint and TypeScript standardization #397 completed the remaining 683-diagnostic production/test/benchmark inventory; exact head and main are zero-warning.
  • Investigate every unused symbol before deletion; distinguish dead exports from intentionally public API and generated/ambient declarations. PR Wave 36: complete lint and TypeScript standardization #397 reviewed all 426 records, preserved public/generated/ambient declarations, callback arity, destructuring, setup side effects, and intentional test bindings, and used explicit _ intent where execution must remain.
  • Replace unsupported/unnecessary new Array usage while preserving intentional sparse arrays and performance-sensitive cases with tests/benchmarks. PR Wave 36: complete lint and TypeScript standardization #397 reviewed all 173 records and uses equivalent Array.from({ length }) constructions while retaining length, hole/undefined, iteration, and allocation semantics; the full test, conformance, coverage, consumer, and mutation matrices pass.
  • Standardize formatting with a single root configuration and non-mutating format:check; exclude generated artifacts narrowly.
  • Remove continue-on-error: true from changed-package lint.
  • Add --deny-warnings (or equivalent) to package lint only after each package reaches zero; make the repository gate blocking.
  • Add editor/config documentation so contributors run exactly the CI rules locally.

Exit: zero warnings/errors, zero mutating lint commands, and lint/format are required merge checks.

5. Progressive TypeScript correctness modernization

Wave 36 expanded the effective-config audit to all 121 tracked tsconfigs. Exact main has nine approved runtime profiles, 43 native compiler profiles, one isolated codegen tooling-API profile, and seven governed self-contained deployable-service contexts. Every config enforces the six compatibility-safe strict flags; the documentation site exercises the strict-new indexed-access/optional-property profile; and Oxlint is the single zero-warning unused-symbol owner.

  • Define shared base profiles for Node library/service, dual ESM/CJS, browser, React Native/mobile, CLI, test, and WASM/worker. PR Wave 36: complete lint and TypeScript standardization #397 adds and governs strict base, Node library, Node service, dual-runtime, browser, React Native, CLI, test, WASM/worker, and strict-new specializations.
  • Align supported Node targets, lib declarations, module/moduleResolution, declaration/source-map settings, interop, and package engines with the tested runtime matrix. PR Wave 36: complete lint and TypeScript standardization #397 preserves each package/runtime build contract while centralizing the approved option sets; exact declaration, packed ESM/CJS, browser, mobile, CLI, UMD, WASM/worker, and service-context checks pass.
  • Enable and remediate strictNullChecks, noImplicitAny, useUnknownInCatchVariables, noImplicitOverride, and noFallthroughCasesInSwitch in staged package waves. PR Wave 36: complete lint and TypeScript standardization #397 also enforces strict itself and remediates 245 compiler diagnostics (SDK 156, Wallet 67, Paymail 17, VeriFast five) with zero remaining findings.
  • Then evaluate/enable noUncheckedIndexedAccess and exactOptionalPropertyTypes for new/critical code, expanding after migration evidence. PR Wave 36: complete lint and TypeScript standardization #397 enables both in the opt-in strict-new profile and applies it to the documentation site; compatibility-sensitive published packages retain the documented migration-safe setting until a future major boundary, avoiding declaration/API breakage.
  • Use lint for unused values unless TypeScript’s unused flags produce a demonstrably better uniform result; make one explicit repository decision. PR Wave 36: complete lint and TypeScript standardization #397 makes Oxlint the sole owner, scans tests/benchmarks/config/source uniformly, and keeps compiler unused flags disabled to prevent conflicting diagnostics.
  • Add local configs or explicit inherited-profile validation for wallet-toolbox-client and wallet-toolbox-mobile. PR Standardize wallet platform builds and Open BSV licensing #351 supplies explicit TypeScript build/test profiles and validates declarations from exact tarballs in ESM, CommonJS, browser, Metro, and Hermes consumers.
  • Forbid unexplained per-package relaxations; every temporary relaxation enters the exception registry with expiry. PR Wave 36: complete lint and TypeScript standardization #397 resolves JSONC extends chains, rejects missing/circular/out-of-repository profiles and weakened strict flags, and validates the seven unavoidable self-contained service configs against their exact governed profile values.
  • Run declaration, packed-consumer, ESM/CJS, browser, mobile, and conformance checks after each strictness wave. PR Wave 36: complete lint and TypeScript standardization #397 passed exact tarball checks for all 30 public packages, SDK/Wallet/VeriFast specialized consumers, all 6,650 conformance vectors, all coverage lanes, and all 25 affected mutation targets on exact head; the merged-main workflows independently passed.
  • Complete the Wave 16 TypeScript 7 compatibility migration. PR build: adopt TypeScript 7 with a supported tooling boundary #373 uses the supported native-compiler/official-compatibility-API split, keeps codegen isolated, uses no peer override or suppressed compiler regression, and passed the full profile matrix on exact head and main.

Exit: all projects inherit approved strict profiles and local differences are documented, tested, and minimal.

6. Correct and expand automated testing

6.1 Fix test-quality defects

  • Fix the four critical Sonar incompatible-equality assertions, including WAB shareService boolean-vs-number and message-box string-vs-number assertions; confirm whether the implementation or expectation is wrong before changing either. PR Make QA assertions explicit without API changes #391 completed all four after runtime characterization: SQLite-backed WAB booleans now use semantic truthiness assertions, Message Box Client explicitly preserves and tests its established numeric runtime acknowledgement, and the remaining incompatible assertions were corrected without production/type/API changes.
  • Replace incomplete expect statements and assertion-free tests with behavioral assertions, or explicitly reclassify non-test setup files. PR Make QA assertions explicit without API changes #391 resolved the automatic cases; PR Govern Wallet Toolbox manual suites and extract operator tooling #392 completed the manual/live/operator disposition without cosmetic assertions. Exact-main Sonar now reports S2699 59→0 and S2970 1→0, while the machine-enforced ledger retains 30 environment-backed Wallet Toolbox suites as tests and extracts operator/example workflows from the test runner.
  • Enforce assertion presence where appropriate (expect.hasAssertions/expect.assertions or framework/lint equivalent), especially for async/error paths. PRs Make QA assertions explicit without API changes #391 and Govern Wallet Toolbox manual suites and extract operator tooling #392 close the assertion-free and incomplete-assertion inventory at exact main; all retained manual/live tests now have real behavioral or diagnostic oracles, and operator commands have direct success/failure/safety coverage.
  • Audit required-suite direct skips. Wave 37 leaves exactly two governed skips, each with path/title, classification, owner, reason, removal condition, and 2026-08-26 review date; CI rejects new, stale, anonymous, or count-divergent skips. Enabling or otherwise retiring the two retained scenarios remains final QA.
  • Remove passWithNoTests from projects expected to have tests. PR Harden Fund Wallet and 402 Pay package profiles #350 removed the Paymail examples placeholder, and PR Standardize repository quality profiles #364 replaced the remaining empty-suite allowances—including both UHRP services—with real tests and drift-blocking repository-health controls. No active package script uses passWithNoTests.
  • Resolve the audited swallowed-exception finding category with explicit handling or assertions. Exact-main Sonar has zero S2486 record and the zero-new-finding gate prevents recurrence; broader branch-coverage expansion remains final QA.
  • Add deterministic clocks, randomness, network, database, and filesystem fixtures; quarantine genuine flaky tests with ownership and expiry rather than retrying indefinitely.

6.2 Risk-based coverage program

Audited approximate aggregate coverage is 66.97% (543 files; 46,259 lines; 30,981 hit; 11,619 missed; 3,659 partial). Low package aggregates include p2p ~6%, simple ~36%, message-box-client ~43%, overlay-topics ~44%, overlay ~45%, overlay-express ~49%, BTMS ~53%, payment middleware ~57%, VeriFast ~59%, templates ~60%, wallet-toolbox ~61%, discovery ~62%, auth-express ~63%, BTMS backend ~63%, DID ~77%; GASP and SDK are about 85%.

  • Publish a file/package coverage inventory with criticality, not merely a global percentage.
  • Add per-package Jest/provider thresholds and Codecov component flags. Wave 38 restored and tests the fail-closed repository-owned 90% changed-line and changed-branch gate, including failure when changed production files are absent from LCOV; aggregate/package threshold expansion remains final-QA work.
  • Raise overall coverage in staged ratchets to at least 80% without excluding difficult real source.
  • Reach at least 85% line / 80% branch for Tier 0/1 code, prioritizing auth, payment, credentials, wallet/storage, transaction/crypto, overlays, path/upload, and network boundaries.
  • Eliminate critical 0%-covered modules, especially p2p core and overlay topic lookup/storage implementations.
  • Add tests for did-client, which still lacks package test files; PR Harden Fund Wallet and 402 Pay package profiles #350 added 12 focused Fund Wallet tests with 92.23% line and 93.15% branch coverage. Add btms-permission-module and wallet client/mobile target coverage as above.
  • Add meaningful suites to infra chaintracks, overlay, wallet-infra, and UHRP basic, all audited at zero tests. Expand UHRP cloud, message-box, WAB, and notifier beyond their small current suites.
  • Add database-contract tests for supported SQLite/MySQL/Postgres/cloud adapters and migration/transaction/concurrency behavior.
  • Add end-to-end container/service tests for auth/payment/storage/upload/overlay/message flows with safe ephemeral dependencies.
  • Add browser tests for documentation routing/examples and public browser packages; add mobile/Metro smoke tests for React Native targets.
  • Add property-based tests for parsing, serialization, transactions, scripts, cryptographic encodings, Merkle/proof structures, path/URL validation, and protocol messages. Completed by PR Govern stack-wide property fuzzing and test quality #365 across 25 packages and 88 independent properties; all 33 package manifests are governed.
  • Run bounded generative property campaigns for untrusted binary/JSON/network inputs. PR suites enforce at least 300 fast-check cases/property; the weekly/manual workflow runs 5,000 cases/property with seed/path replay and retained failure logs (PR Govern stack-wide property fuzzing and test quality #365).
  • Add true coverage-guided fuzz targets with evolving corpora, deterministic regression replay, crash minimization/promotion, and longer scheduled discovery. Deferred final-QA WIP is preserved at codex/stack-wide-fuzzing@63485ce3c: 29 governed Jazzer.js targets cover all 29 implementation packages and all eight stack areas, but corpus replay currently stops at a known empty-input harness bug and the workflows/docs/full campaigns/PR/merge/exact-main gates remain open.
  • Run mutation testing across every governed property suite and use surviving mutants to identify superficial coverage. Completed by PR Validate stack fuzzing with mutation testing #369 across 25 packages/targets: 3,073 valid mutants, 2,662 detected, 411 survived, 86.63% aggregate, per-target 80.30–100%, and zero uncovered or invalid mutants; affected PR and scheduled full campaigns are enforced.

6.3 Manual/live test governance

  • Inventory and classify all 32 retained manual/live/resource files. PR Govern Wallet Toolbox manual suites and extract operator tooling #392 replaced the coarse Wave 12 inventory with 30 exact Wallet Toolbox suite dispositions plus the Overlay public-live and SDK resource-intensive ownership. Eight former Wallet Toolbox Jest/operator files were extracted into guarded commands/examples or replaced by ordinary automated tests only after purpose-by-purpose review; the permanent ledger records every disposition.
  • Convert deterministic manual tests to automated integration/contract tests. PR Govern Wallet Toolbox manual suites and extract operator tooling #392 moved deterministic operator/example logic out of Jest, added four ordinary example suites, replaced the monitor daemon manual placeholder with an automated lifecycle regression, and added 92 focused operator safety/behavior/execution tests. The 32 retained manual/live/resource files require a real environment, public network, or exceptional memory by policy.
  • Run environment/credential-dependent tests on an owned nightly/weekly/release schedule with secret-safe logging, alerting, and a documented operator response.
  • Give every retained manual test prerequisites, expected result, cleanup, cadence, owner, last-run evidence, and failure escalation. Governance now enforces prerequisites, expected result, cleanup, cadence, invocation, owner, and review date for every retained file; scheduled execution, retained last-run evidence, alerting, and escalation remain deliberately deferred to the final testing/QA phase.

Exit: thresholds are enforced; critical paths are deeply tested; empty, assertion-free, unexplained skipped, and silently flaky suites are gone.

7. Make conformance complete and truthful

  • Generate conformance counts from the governed baseline so they cannot drift. Current stack facts report 6,650 vectors, 6,439 structural passes, 211 governed skips, and 74 vector files; CI fails stale facts.
  • Separate conformance gaps in machine-readable metadata. All 19 skip groups / 211 cases are classified (superseded vector, upstream/language/runtime parity, runner/fixture gap, stateful/funded/overlay harness, or related owned category) with exact expected counts and review/removal conditions.
  • Inventory all 211 skipped cases across 19 exact vector files. CI reconciles every vector ID, rejects overlap between intended and explicit skip classifications, and fails any unregistered or count-divergent skip.
  • Give every intended skip a stable ID, capability, reason, owner, dependency, and removal/unsupported decision.
  • Remove or implement no-op/non-implemented runner paths across wallet, storage, broadcast, messaging, and overlay behavior.
  • Build funded-wallet, certificate, overlay, storage, and broadcast harnesses where the capability is supported; otherwise mark the capability formally unsupported with documented rationale.
  • Preserve 100% pass for required cases and fail CI on new unregistered skips, changed vector counts, missing ownership, or stale review metadata. Exact main passes 6,439 required cases with 211 registered skips.
  • Publish human-readable per-package conformance matrices and machine-readable results as CI artifacts.

Exit: conformance reports exactly what is supported, every non-run case is intentional and owned, and the published numbers match CI.

8. Browser, runtime, package-splitting, and bundle standardization

  • Assign every public package one or more consumer profiles: Node ESM, Node CJS, browser ESM, browser bundler, UMD/global, React Native/Metro, CLI, and WASM/worker. PR Wave 35: govern consumer contracts and CI performance #395 defines all eight canonical profiles, assigns one or more to every one of the 30 public packages, machine-validates known/unique/sorted assignments, required runtime targets and exact executable contract scripts, and exposes the matrix in generated stack facts. Repository health is 37 projects / 30 public packages / 0 contract findings / 0 control errors.
  • For every publishable package, install the packed tarball into clean consumer fixtures and test declared imports, declarations, all concrete conditional/wildcard subpaths, source maps, bins, side effects, optional/peer adapters, and advertised ESM/CJS/runtime behavior. Wave 38 completes all 30 and fixes SDK/Overlay subpath-pattern shadowing additively.
  • Test Node ESM and CJS wherever declared. PR Wave 35: govern consumer contracts and CI performance #395 binds every advertised Node profile to exact packed-artifact checks, parses and validates each package’s configured ESM/CJS modes, and classifies the intentional ESM-only and CJS-only packages instead of claiming unsupported formats. The full exact artifact matrix remains separately open above for types/subpaths/sourcemaps/runtime depth.
  • Add at least Vite and one independent bundler fixture for conventional browser-library packages; verify tree shaking, minification, dynamic imports, and no accidental Node builtin/polyfill leakage. PR Wave 34: standardize browser contracts and accelerate CI #394 completes exact-tarball Vite+esbuild validation for all 11 governed browser-library profiles: nine in the general lane plus dedicated SDK and Wallet Toolbox Client lanes; Wallet Relay is also covered. Existing SDK and Message Box UMD checks remain. Specialized VeriFast WASM/worker validation remains separately open under the WASM item rather than being misclassified as a conventional browser library.
  • Add React Native Metro/Hermes smoke builds for mobile targets. Wallet Toolbox Mobile is the only public package advertising a React Native target; PR Standardize wallet platform builds and Open BSV licensing #351 provides its exact packed Metro+Hermes contract and budgets, and PR Wave 35: govern consumer contracts and CI performance #395 assigns the canonical react-native-metro profile and enforces the exact checker so any future advertised mobile target cannot enter the inventory unverified.
  • Add a reusable public-service browser-policy contract matrix for Overlay/Overlay Express, WAB, UHRP/Storage, message-box, chaintracks, and future public APIs. Wave 38 governs seven contexts and tests eight integrations for arbitrary-origin and Origin: null access by default without credentials, preflight correctness, opt-in exact allowlists, opt-in credentialed exact-origin mode, opt-in disabled CORS, wildcard-plus-credentials rejection, and CSP independence.
  • Add CLI packed-install, --help, invalid-input, project-generation, generated-project install/build/test, and cross-platform path tests for create-bsv-app and other CLIs. PR Wave 35: govern consumer contracts and CI performance #395 now assigns the CLI profile and enforces exact packed bin execution for every advertised CLI, but the deeper invalid-input/generated-project/cross-platform matrix in this item remains open.
  • Add WASM/worker loading, CSP, streaming/fallback, browser/node, and package-path tests where applicable. VeriFast is the only public package assigned the WASM/worker profile. PR Wave 35: govern consumer contracts and CI performance #395 installs exact SDK/VeriFast tarballs and proves Node ESM/CJS/workers, real Chromium workers, UMD, strict same-origin CSP, correct streaming MIME, forced ArrayBuffer fallback, source maps, and installed package-path loading with positive/negative verification and bounded batch/benchmark sanity.
  • Review deep wildcard exports, conditional exports, types conditions, optional adapters, peer dependencies, and side-effect declarations for API stability and minimal bundles. Wave 38 validates every packed target and dependency/peer/optional/side-effect contract in clean consumers.
  • Define raw, minified, gzip, and Brotli budgets for SDK, simple, VeriFast, and other browser-facing entrypoints. PR Wave 34: standardize browser contracts and accelerate CI #394 enforces exact Vite+esbuild raw/gzip/Brotli budgets for every conventional browser-library profile plus Wallet Relay and retains UMD/mobile budgets. PR Wave 35: govern consumer contracts and CI performance #395 adds VeriFast Vite/esbuild budgets and sums the independently transferred UMD loader, WASM loader, and WASM binary for exact raw/gzip/Brotli composition limits. Current VeriFast measurements are Vite 767,637/305,216/130,685 bytes, esbuild 39,476/13,322/11,913, and UMD composition 298,753/116,488/91,815.
  • Produce bundle composition reports and fail on unexplained budget regression; require explicit approval and a versioned release-note/changelog change for intentional growth. Wave 38 covers all 13 browser targets with normalized chunk/module/package evidence retained for 30 days.
  • Standardize code-splitting/lazy-loading dispositions for large optional adapters and keep Node-only dependencies out of browser entrypoints. Wave 38 records an explicit disposition for all 13 targets and verifies the exact packed browser graph.

Exit: every advertised runtime/import format works from the published artifact and browser/mobile bundles have enforceable size/composition contracts.

9. Performance engineering and CI speed without lost coverage

9.1 CI critical path

  • Capture the Actions-supported per-job/per-step duration, queue time, artifact transfer, and variance evidence for at least 20 representative full and targeted runs. GitHub does not expose hosted CPU, memory, or action-internal cache-hit metrics; Wave 38 removes that unsupported instrumentation and requirement completely rather than spending CI resources on unreliable proxies. The retained baseline remains 527s minimum / 570s median / 892s p95 / 979s maximum for full scope and 177s / 425s / 557s / 561s for targeted runs.
  • Build a workspace dependency graph and run changed packages plus affected dependents in parallel for PR feedback, while retaining a complete push/merge/release path. Current CI uses pnpm transitive ...[base] selection, global-control full fan-out, affected package/mutation/browser/coverage matrices, and full push validation.
  • Split independent lint, typecheck, unit, integration, package-contract, docs, conformance, CodeQL, container, and consumer tests into parallel jobs/matrices. Historical timing-based shard balancing remains the distinct open item below.
  • Use historical timing to balance slow test shards rather than equal file counts.
  • Eliminate the 14 redundant package rebuilds from test scripts where CI already built identical outputs; share immutable build artifacts only when doing so preserves clean-consumer validation. PR Wave 34: standardize browser contracts and accelerate CI #394 restores the audited build artifact in every relevant lane and uses a narrowly tested opt-in helper to omit only exact redundant leading build commands. All coverage, exact-tarball browser/mobile, package, and 26 mutation targets passed; clean consumers still perform their own fixture bundling/install validation.
  • Cache or share only safe immutable inputs/outputs with lockfile/toolchain/config keys. The pnpm store and shared audited build were already present; Wave 38 adds one pinned cache for the immutable MongoDB test binary and keeps browser composition evidence, while avoiding mutable workspace/security-result caches. Re-evaluate other downloads only when measured reuse justifies invalidation risk.
  • Avoid repeated full pnpm install, Node setup, and archive upload/download where a safe reusable setup or job layout is faster. Wave 38 removes redundant worker esbuild rebuilds and retains affected-package selection/shared build output; repeated isolated installs remain open where job isolation currently protects correctness.
  • Optimize docs/conformance setup and run independent vector groups concurrently while preserving deterministic aggregate reporting.
  • Keep fail-fast behavior for quick deterministic gates, but always retain security/result aggregation needed to report the complete failure state.
  • Bound and decouple non-blocking external coverage publication from the merge-critical path while preserving every coverage test and the Codecov upload/report. Evidence: in CI 30175242619, all coverage shards finished in about 2m12s but Coverage / aggregate upload took 4m48s almost entirely inside the Codecov action.
  • Add a CI performance budget and trend report. PR Wave 35: govern consumer contracts and CI performance #395 adds a weekly/manual report over the latest 20 full-scope and 20 targeted successful PR runs, retains exact run/job/step evidence for 90 days, and fails on full-scope median >15% or p95 >20% and targeted median >20% or p95 >25% over the governed baseline. Baseline changes require reviewed evidence and the documentation forbids loosening a budget merely to make a red trend green.
  • Validate that optimized PR, merge, scheduled, and release workflows exercise the same required checks at the appropriate confidence level; no coverage disappears because a diff detector was wrong.

9.2 Runtime benchmarks

  • Expose and document SDK’s 11 benchmark files through package scripts and scheduled CI.
  • Standardize the wallet action-batch/ancestor, auth performance, VeriFast, and other benchmark harnesses with fixed datasets, warmup, iterations, environment metadata, and statistical comparison.
  • Establish stable nightly baselines; gate PRs only on high-signal size/algorithmic regressions with noise thresholds and rerun policy.
  • Add memory/allocation, startup, import, serialization, database, proof/crypto, and representative end-to-end latency measurements where they affect users.
  • Track benchmark artifacts historically and document how to reproduce locally.

Exit: CI is materially faster with unchanged required coverage, measured median/p95 budgets, and stable bundle/runtime regression detection.

10. Documentation and developer-experience overhaul

  • Define a README contract for each package: purpose/status, install, minimal typed example, API/import paths, runtime/browser compatibility, Node support, peer dependencies, security considerations, test/conformance status, migration/versioning, support, and license.
  • Compile/typecheck/run documentation examples against packed packages in CI; do not rely only on frontmatter/link/SSG checks.
  • Generate package/version/support/conformance/coverage facts from manifests and CI artifacts to prevent manual drift. PR chore: enforce stack documentation and package coherence #374 now generates package, version, support, runtime, and conformance facts; authoritative aggregate coverage facts remain part of the final QA phase.
  • Resolve runtime prerequisite contradictions: root README says Node 22+, root engine requires Node 24.11+, guides say Node 20+, and infra docs/images reference Node 20–24. Choose and test one support policy per profile.
  • Rewrite stale April 2026 reliability/spec material that still describes pre-consolidation repositories and obsolete versions (for example SDK 2.0.14, wallet 2.1.22, and message-box without CI).
  • Update the dependency policy so it matches reality and the intended gate: package lint must truly fail after the ratchet, first-party package ownership is clear, and security response/exception timelines are explicit. PR build: adopt TypeScript 7 with a supported tooling boundary #373 documented the compiler/API boundary and owned parent-scoped qs exception; PR chore: enforce stack documentation and package coherence #374 integrates those facts into the enforced contributor and operator path.
  • Update the security policy to reflect implemented controls, disclosure/triage expectations, supported versions, threat models, SBOM/provenance verification, and fuzz/security-test cadence.
  • Update conformance docs/counts and package capability matrices from generated results.
  • Add API/declaration documentation and migration guides for all public packages, especially breaking dependency/runtime/exports changes. PR Wave 26: package release and service operations hardening #384 inventories all 30 public packages and generates the authoritative API/declaration, current-versus-published version, release type, change summary, and migration contract; repository health fails on missing or stale ownership.
  • Document browser/Node/mobile/CLI/WASM profiles, bundle budgets, supported import forms, tree-shaking expectations, and troubleshooting.
  • Document release workflow, affected-package versioning, OIDC/provenance, release-sync PRs, infra images, rollback, and verification. PR Harden npm package release supply chain #372 completed the npm artifact, OIDC, attestation, integrity, retry, and recovery reference; PR chore: enforce stack documentation and package coherence #374 integrates affected-package versioning, release-sync operations, image rollout, verification, and end-to-end rollback into one operator path.
  • Complete service operation docs: configuration and secret names (never values), metrics/logs/traces, SLOs, alerts, dashboards, deploy validation, rollback, incident response, and disaster recovery. PR Wave 26: package release and service operations hardening #384 upgrades all seven governed service manifests to schema v2 and generates their public-edge, dependency, configuration, observability, SLO/error-budget, alert/dashboard, incident, state/migration/backup/restore, lifecycle/disruption/topology/scaling, and critical-journey contracts; installed validation checks the owned YAML/container/security/probe surfaces.
  • Archive or clearly supersede stale one-time plans under plans/; retain decision history without presenting completed/obsolete plans as current policy. PR feat: govern and harden service operations #383 adds the plans authority index and marks every retained plan historical/resolved/unapproved as appropriate.
  • Enforce documentation freshness (last_verified or generated equivalent), ownership, broken internal/external links, snippets, frontmatter, navigation, and 90-day review for high-risk docs.
  • Complete changelogs/release notes for the 18 public packages without changelogs, or adopt a uniform generated changeset/release-note mechanism. PR Wave 26: package release and service operations hardening #384 adopts one governed generated mechanism for all 30 packages, records the published baseline and release type for every package, and provides explicit summaries/migration notes for all 18 unpublished patch candidates.

Exit: a new contributor or consumer can install, build, test, publish, operate, migrate, and troubleshoot from current verified documentation alone.

11. Infrastructure, container, and operational uniformity

  • Add container health checks where meaningful and Kubernetes readiness, liveness, and startup probes tied to real service readiness. PR feat: govern and harden service operations #383 gives all seven governed Docker images real HTTP health checks and enforces application-workload probes; UHRP /ready now remains unavailable until bootstrap completes.
  • Finish pod/container security contexts. PR feat: govern and harden service operations #383 enforces the complete application-workload security context; PR Wave 26: package release and service operations hardening #384 explicitly classifies checked-in MySQL/Mongo manifests as non-production examples and documents the operator-owned managed production state boundary, encryption/access/backup/restore requirements, and prohibition on treating sample databases as production defaults.
  • Complete graceful shutdown/preStop/termination handling, disruption/topology policy, and autoscaling guidance. PR Wave 37: close non-QA quality, release, and runtime gaps #398 completed published-surface-compatible Message Box/Overlay shutdown adapters and exact Linux lifecycle validation without requiring unpublished dependency behavior; all seven services now have governed lifecycle, disruption, topology, and scaling contracts.
  • Replace mutable image references with release version plus digest. PR feat: govern and harden service operations #383 makes every checked-in workload/example image immutable and adds repository enforcement; sample application versions remain deliberately tied to currently published digests, not unpublished source candidates.
  • Remove hard-coded example database credentials from deployable manifests; clearly separate non-production examples and document secret injection/rotation. PR feat: govern and harden service operations #383 replaces literal credentials with ConfigMap/Secret references, documents injection, and rejects Secret manifests or secret-like literals across all governed YAML roots.
  • Verify every Dockerfile/manifest command against the final image contents. PR feat: govern and harden service operations #383 repairs the Overlay command and port mismatch, validates manifests with the Kubernetes client dry-run, and builds/tests/scans all affected Linux images in hosted CI.
  • Keep images non-root and multi-stage; validate runtime filesystem ownership and avoid copying build/dev dependencies. PR feat: govern and harden service operations #383 enforces non-root execution for all seven governed service Dockerfiles; existing locked multi-stage production-image construction and hosted builds remain green.
  • Consolidate the duplicated telemetry implementations across six services into a tested shared package/configuration where deployed compatibility is proved, or document intentional deviations. PR Wave 26: package release and service operations hardening #384 reviewed initialization order, exporter/config behavior, failure isolation, package/runtime coupling, and deployment compatibility; it removes unused direct instrumentation dependencies and standardizes preload/env contracts, while deliberately retaining service-local initialization as a documented compatibility boundary instead of forcing an unsafe abstraction.
  • Standardize structured logging, correlation/request IDs, metrics, traces, health schemas, redaction, sampling, and error classification. PR Wave 26: package release and service operations hardening #384 records and validates the common fields, correlation propagation, telemetry resource attributes/exporters, health/readiness semantics, redaction rules, sampling controls, and error classes for every governed service.
  • Define SLOs, alerts, dashboards, operator runbooks, release validation, and rollback evidence for each deployable service. PR Wave 26: package release and service operations hardening #384 gives every governed service availability/latency/error-budget objectives, critical journeys, burn-rate/saturation/failure alerts, dashboard ownership, incident/escalation data, deploy validation, rollback triggers, state recovery, and restore/RPO/RTO contracts.
  • Test container startup, probes, migrations, configuration failure, graceful shutdown, and a minimal service transaction in CI. PR Wave 37: close non-QA quality, release, and runtime gaps #398 adds a no-push hosted Linux/amd64 contract for all seven governed images covering non-root/health metadata, closed invalid configuration, startup, liveness, post-migration readiness, credential-free wildcard CORS, a minimal public transaction, and clean SIGTERM shutdown with disposable real dependencies where required.
  • Validate SBOM, image scan, provenance, signature, base digest, and source/version OCI labels before release. PRs ci(security): harden container supply chain #340–fix(deps): ignore placeholder container image #342 and Harden npm package release supply chain #372 implement the blocking source/release gates; PR feat: govern and harden service operations #383 reruns every affected Linux image build and high/critical Trivy gate. The first authorized live release evidence remains the separate final release gate and was not manufactured during the publication hold.

Exit: every deployable artifact is secure by default, observable, reproducible, immutable, probeable, rollback-ready, and consistent with its manifests/docs.

12. SonarCloud remediation and quality-debt program

Initial audited public API state was 1,529 unresolved issues (1,494 code smells, 26 bugs, 9 vulnerabilities). Exact main@c8261dfb0, analyzed 2026-07-30, has 20 open/confirmed records, all code smells: 0 bugs, 0 vulnerabilities, 0 blockers, 0 critical, two major, and 18 minor. All 20 are visible registered compatibility/consensus boundaries: 17 public WERR_* protocol identifiers, two Curve singleton-constructor records, and one exhaustive opcode dispatch. Current aggregate measures are cognitive complexity 26,063, total complexity 37,977, 9,646 duplicated lines / 1.5%, 390,922 NCLOC, and 125 minutes of debt. Reliability, security, and maintainability are A; the hosted aggregate gate is OK; security hotspots are zero. PR acceptance remains stricter than the Sonar badge: the repository-owned exact-head gate rejects every new issue state and unreviewed hotspot. Automatic analysis still lacks authoritative main-branch coverage, while Codecov and the restored repository patch gate remain the coverage authorities, so the Sonar administration switch is deferred and is not a release blocker unless later validation proves it adds a required capability.

12.1 Fix repository findings now

  • Resolve all 9 workflow/codegen vulnerabilities by completing the lifecycle-script and pinned-codegen work above.
  • Resolve the 4 critical incompatible test assertions above. PR Make QA assertions explicit without API changes #391 resolved all four with runtime characterization and exact-main Sonar now reports zero bugs; production behavior and public types remain unchanged.
  • Exclude the generated wallet OpenRPC HTML artifact from source analysis by precise generated-file ownership; do not manually “fix” its 22 generated CSS/font bugs.
  • Make the repository’s active .sonarcloud.properties exclusions consistent with real generated/third-party ownership. The current automatic analysis reads this file, not the better-configured sonar-project.properties.
  • Triage the then-remaining 89 blocker and 18 critical issues first. PRs Make QA assertions explicit without API changes #391 and Govern Wallet Toolbox manual suites and extract operator tooling #392 resolved all four bugs and all 89 blocker records without suppression; PR Wave 34: standardize browser contracts and accelerate CI #394 removed 1,064 generated AsyncAPI HTML records through precise generated ownership; subsequent waves resolved the remaining critical QA smells. Exact main now has zero bugs, vulnerabilities, blockers, critical records, or hotspots.
  • Resolve every non-QA/actionable exact-main rule group. Wave 38 also safely resolves the final two QA records with parameterized fee-model cases and an explicit no-send state, introduces no suppression or accepted/false-positive disposition, and preserves public behavior. The remaining 20 records are governed compatibility/consensus boundaries.
  • Resolve the two formerly classified test/test-helper findings as real code-quality work. Wave 38 parameterizes the SDK S5976 fee-model cases and replaces the Wallet Toolbox S1854 useless assignment with an explicit isNoSend state while preserving behavior; focused and full suites pass.
  • Finish the exact-main Sonar QA debt. Exact main@c8261dfb0 has no QA issue record; the 20 compatibility records / 125 minutes remain visible and governed across protocol WERR_* names, Curve singleton construction, and exhaustive opcode dispatch.
  • Refactor the 40 actionable non-exception production cognitive-complexity findings and the two formerly suppressed Spend/Wallet Wire S3776 boundaries with characterization tests first. PR Close remaining production quality findings without API changes #390 completed the Message Box, SDK, Overlay, Wallet Toolbox, wire, cryptographic, transaction, remittance, storage, persistence, action-batch, proof, provider, monitor, and propagation pass; removed both obsolete S3776 suppressions and the Wallet Wire exception; passed the exact-head strict gate; and preserved public API, wire/storage/error/serialization/order/default behavior. Exact-main Sonar confirms all 42 findings are gone. The remaining 20 compatibility records are governed separately and remain intentionally visible.
  • Consolidate verified actionable duplication without inappropriate abstractions. PR Wave 37: close non-QA quality, release, and runtime gaps #398 records the 10 retained cryptographic fixture, public/private package, service-build-context, provider, setup, storage, protocol-vector, and persistence boundaries in governance/duplication-policy.json with owner, rationale, review date, and equivalence/removal conditions; CI rejects ungoverned drift. Exact main is 9,646 duplicated lines / 1.5%, and issue Sonar: duplication — 9,792 duplicated lines (4.8%) across 139 files in 439 blocks #46 is closed with disposition evidence rather than a false zero-duplication claim.
  • Resolve all production TODO/dead-code findings by implementation, governed disposition, linked ownership, or deletion. Exact main contains no authored TS/JS TODO/FIXME/HACK marker and the former test-helper S1854 assignment is resolved.
  • Re-run Sonar after the completed finding-remediation program and record the result. Exact main@c8261dfb0 is 20 smells / 0 bugs / 0 vulnerabilities / 0 blockers / 0 critical / 0 hotspots, two major / 18 minor, 125 debt minutes, 9,646 duplicated lines / 1.5%, cognitive complexity 26,063, total complexity 37,977, and 390,922 NCLOC with A/A/A ratings and quality OK.

12.2 Deferred Sonar administration switch

This step is deferred because project administration cannot change now. It becomes necessary if automatic analysis still cannot ingest authoritative aggregate coverage or provide reliable required PR status.

  • Prepare a CI Sonar scan using the existing aggregate LCOV/report paths and correct source/test/generated exclusions.
  • When administration is available, disable Automatic Analysis, enable SONAR_CI_ENABLED, and run analysis from the controlled CI workflow.
  • Validate main and PR coverage ingestion, new-code definition, changed-line issue attribution, monorepo path mapping, fork behavior, token/permission safety, and required check name.
  • Add the validated Sonar check to the repository ruleset only after it is stable and non-duplicative.
  • If automatic analysis gains equivalent authoritative coverage/check behavior before then, document evidence and explicitly close this deferred task as unnecessary.

Exit: reliability/security A, authoritative coverage visible, zero vulnerability/bug/blocker/critical/untriaged issues, generated noise correctly excluded, and #43–#48 closed.

13. Dependency and release governance that persists

  • Keep routine third-party updates consolidated monthly, with high/critical security fixes handled immediately. Wave 37 encodes and validates the cadence in the multi-ecosystem Dependabot group and governance policy.
  • Keep Dependabot’s routine PR concurrency at one for coherent review while security updates remain grouped by ecosystem, immediate, and independent of the routine limit.
  • Require dependency PR evidence: release notes/necessity, runtime/build/peer compatibility, deduplicated lockfile, audit/CodeQL, package/consumer tests, bundle/performance impact, and affected public versions are machine-checked against the PR template.
  • Forbid new overrides/resolutions unless the exception registry proves why no supported upstream path exists. Wave 37 removed five unnecessary service overrides; Wave 38 re-rehearsed all 19 remaining exact substitutions and confirmed each still prevents a reproduced vulnerable graph or preserves deterministic codegen. All remain owned, review-dated, and removal-tested.
  • Re-run a registry-time-aware direct/latest inventory monthly and after release waves. Wave 38 enforces a 24-hour release-age floor and reports 631 current declarations, 114 first-party release holds, 18 release-age holds, 13 coordinated-major holds, 43 compiler-bridge holds, three supported-peer ranges, one forward-vendor build, and zero unexplained mature compatible updates.
  • Preserve first-party release-sync ownership and require every changed public package to reconcile source candidate, protected OIDC publication, npm latest, tarball integrity, signatures/provenance, and generated version facts. Source implementation waves may close under an explicit publication hold; the release event itself remains a final gate.
  • Require final npm versions and infrastructure image versions/digests to be recorded after every release wave. The mechanism is implemented; this program’s real release inventory remains open because nothing has yet been published.
  • Add scheduled and reusable verification that source manifests reconcile with npm latest, published tarballs clean-install, registry signatures/provenance verify, deployment images pull by immutable digest, and generated documentation/version facts match. Evidence is retained for 90 days.

Exit: dependency/release maintenance is routine, visible, reviewable, and cannot recreate the current backlog.

Recommended PR / release sequence

Keep these as separate thematic waves unless a very small adjacent fix is safer together. Security waves may run in parallel only when their touched files and release dependencies do not overlap.

Wave PR focus Required release/evidence
1 CodeQL helper/SDK fixes: VC context, prototype pollution, TLS bypass, BigNumber bounds, workflow permissions Targeted adversarial tests, CodeQL rerun, affected package patch releases
2 Service-edge path/resource/error hardening Negative/integration tests, affected infra/package releases
3 Shared rate limiting, CORS, headers, size/time/quota policies Service contract tests and live-like container smoke tests
4 React Router migration and current Dependabot fixes Docs browser smoke, full audit, all alerts closed, affected packages/docs published
5 Pinned codegen and lifecycle-script allowlist Reproducible generation diff, no unpinned network install
6 Container provenance, SBOM, scanning, base digests, reproducible infra locks Signed/attested scan-clean images by immutable digest
7 Root/package licensing and manifest/package-contract normalization publint, types, tarball and clean-install matrix; public package patch releases
8 Shared Oxlint/format config and warning ratchet Non-increasing baseline, then package-by-package zero-warning PRs
9 Test correctness: incompatible assertions, incomplete/no assertions, skips, empty suites Targeted tests and updated skip registry
10 Coverage expansion by Tier 0/1 risk Per-package/component thresholds and measured gains
11 Complete in Wave 16 / PR #373: TypeScript 7 native compiler with the official TypeScript 6 compatibility API for ts-jest Exact-head and exact-main declaration/build/consumer/conformance/browser/mobile/infrastructure/mutation/security matrices; enforced decision record
12 Artifact/browser portion complete through Wave 38 / PR #399: all 30 deep exact artifacts, all 13 browser composition/splitting contracts, mobile, CLI-bin, WASM/worker, exports, and bundle budgets; deeper CLI behavior remains final QA Exact package/platform/browser evidence is green; public package releases remain separately authorized
13 Generated documentation facts, README/API/migration/reliability/security/runbook rewrite Compiled examples, freshness/link checks, final versions
14 Complexity, duplication, dead-code, and long-tail Sonar waves Characterization tests and per-wave Sonar deltas
15 Sonar CI analysis/admin switch, if validation says necessary and access is available Authoritative LCOV, stable required PR check, no duplicate analysis
16 Final audit, release train, and closure All gates below, final npm/image inventory, close #43–#48

Dependencies between waves

  1. Ledger/profile/exception rules precede broad enforcement.
  2. Immediate CodeQL/Dependabot and supply-chain fixes precede quality-only modernization.
  3. Characterization tests precede high-complexity and duplication refactors.
  4. Package contracts and strictness should be introduced with a ratchet so unrelated packages are not forced into one unreviewable PR.
  5. Consumer/profile tests precede export, side-effect, splitting, and bundle changes.
  6. Documentation follows settled runtime/package/security decisions but generated-fact plumbing should be built early.
  7. Sonar administrator changes wait for access; repository-side fixes do not.
  8. Each wave completes affected package/image releases before dependent waves assume the new behavior.
  9. By operator direction on 2026-07-27, complete all remaining non-QA work before resuming the retained testing/QA-hardening gates as the final program phase; rebase the preserved fuzzing branch on the then-current main rather than merging its WIP state.

Completion gates and final evidence

Before closing this program, attach a final audit report containing:

  • main commit and all linked merged child issues/PRs.
  • Final green required-check run with per-job timing and comparison to the ~4m55s audited merge-gate baseline.
  • Final package inventory: all public names and newly published versions; manifest = npm latest; provenance and clean packed-consumer verification.
  • Final infrastructure inventory: image version/digest/source commit, SBOM, signature/attestation, scan result, deployment smoke evidence, and rollback reference.
  • Zero-open screenshots/API summaries for CodeQL, Dependabot, secret scanning, and container/dependency scanners, or the complete unexpired exception register.
  • CodeQL security-extended configuration and Dependabot security-updates enabled evidence: PRs #338–#339, advanced run 30180480265, and repository security settings verified 2026-07-26.
  • Zero-warning lint and blocking configuration evidence: Wave 36 scans 1,909 authored files with 97 Oxlint rules and --deny-warnings, enforces root formatting, and exact main passes the build/lint/policy job.
  • TypeScript profile matrix with strictness results and approved permanent profile differences: 121 governed tsconfigs, 43 native compiler profiles, and enforced runtime-profile compatibility settings.
  • Coverage report proving overall ≥80%, Tier 0/1 ≥85% line/80% branch, and no critical 0%-covered modules. The repository-owned fail-closed patch line/branch gate is restored and green at 90%; aggregate/risk-tier targets remain final QA.
  • Test report proving no assertion-free/incomplete tests, empty expected suites, anonymous/expired skips, or unowned manual/live tests.
  • Conformance report proving 100% required pass and owned intended skips, with counts matching generated docs.
  • Node/browser/bundler/mobile/CLI/WASM packed-consumer matrix and bundle-size results.
  • Runtime benchmark and CI median/p95 trend reports.
  • Sonar report proving A reliability/security, authoritative coverage, zero vulnerabilities/bugs/blocker/critical/untriaged issues, measured complexity/duplication/debt improvement, and durable evidence that the exact-head repository gate requires every required check and rejects every new issue record in OPEN, CONFIRMED, ACCEPTED, or FALSE_POSITIVE state plus every unreviewed hotspot—even when Sonar’s aggregate badge is green.
  • Documentation verification report for all non-QA facts: compiled examples, current prerequisites/versions, links, freshness, API/migration/security/release/operations coverage. Aggregate coverage facts remain attached to the deferred final QA report.
  • Closure evidence for Sonar bulk: auto-fixable code style smells (~1,200 issues) #43, Sonar: 250+ functions exceed cognitive complexity threshold #44, Sonar: 138 issues around error handling, dead code, and TODOs #45, Sonar: duplication — 9,792 duplicated lines (4.8%) across 139 files in 439 blocks #46, and Sonar: long-tail TypeScript smells (~600 issues across 50+ rules) #48: all five issues were closed as completed on 2026-07-30 with exact-main evidence and residual QA/compatibility ownership linked here.
  • A remaining-recommendations section. It should be empty for required work; optional future enhancements must have an owner and rationale and must not conceal incomplete program gates.

Ongoing maintenance after closure

  • High/critical security alerts: triage immediately; remediation target measured in days, not the monthly dependency cycle.
  • Routine dependency consolidation: monthly, with a direct/latest and override/exception review.
  • CodeQL/secret/dependency/container scans: on PR/release as applicable plus scheduled full scans at least weekly.
  • Longer fuzz, live integration, conformance, and runtime benchmark suites: scheduled nightly/weekly according to cost and required environment.
  • Documentation and support-matrix freshness: generated continuously; human review at least every 90 days for critical material.
  • Exception review: at least monthly; security exceptions no longer than 30 days without explicit renewed evidence, other temporary exceptions no longer than 90 days.
  • CI and performance trend review: monthly and after material toolchain/runtime changes.
  • Package/image provenance and published-version reconciliation: after every release and scheduled monthly.

Closing this issue means the stack is not merely green at one point in time: the controls above are enforced so it stays healthy.

Metadata

Metadata

Assignees

Labels

dependenciesPull requests that update a dependency filedocumentationImprovements or additions to documentationhardeningReliability, governance, and release hardeninginfrareleaseCoordinated package publication and release readinesssecuritySecurity vulnerability, hardening, or supply-chain work

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions