Wave 35: govern consumer contracts and CI performance

.github/workflows/ci-performance.yml

@@ -0,0 +1,43 @@
+name: CI performance trend
+
+on:
+  schedule:
+    - cron: '17 8 * * 1'
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  trend:
+    name: CI performance / 20-run trend and budget
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      actions: read
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.x
+
+      - name: Compare the latest representative runs with the governed baseline
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: >-
+          node scripts/ci-performance.mjs
+          --collect
+          --baseline governance/ci-performance-baseline.json
+          --output ci-performance-report.json
+
+      - name: Preserve the per-job and per-step trend evidence
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.0
+        with:
+          name: ci-performance-report
+          path: ci-performance-report.json
+          if-no-files-found: error
+          retention-days: 90

.github/workflows/ci.yml

@@ -136,7 +136,7 @@ jobs:
           if [ "${{ github.event_name }}" = "pull_request" ]; then
             BASE_SHA="${{ github.event.pull_request.base.sha }}"
             CHANGED=$(git diff --name-only "${BASE_SHA}"...HEAD)
-            if echo "$CHANGED" | grep -Eq '^(package.json|pnpm-lock.yaml|pnpm-workspace.yaml|tsconfig.base.json|codecov.yml|sonar-project.properties|\.sonarcloud\.properties|\.github/workflows/(ci|property-tests|mutation-tests|release)\.(yml|yaml)|governance/(npm-package-supply-chain\.json|repository-health|test-quality|mutation-testing)/|scripts/(check-browser-package|check-package-artifact|check-wallet-toolbox-platform|package-release-artifacts|repository-health|run-ci-tests|run-prebuilt-package-script|normalize-lcov-paths|run-governed-test|sonar-pr-gate|test-governance|mutation-testing|typescript-toolchain|sync-service-(rate-limit|edge)-policy|lib/workspace-packages)\.(mjs|test\.mjs)$)'; then
+            if echo "$CHANGED" | grep -Eq '^(package.json|pnpm-lock.yaml|pnpm-workspace.yaml|tsconfig.base.json|codecov.yml|sonar-project.properties|\.sonarcloud\.properties|\.github/workflows/(ci|ci-performance|property-tests|mutation-tests|release)\.(yml|yaml)|governance/(npm-package-supply-chain\.json|repository-health|test-quality|mutation-testing)/|scripts/(check-browser-package|check-package-artifact|check-wallet-toolbox-platform|ci-performance|package-release-artifacts|repository-health|run-ci-tests|run-prebuilt-package-script|normalize-lcov-paths|run-governed-test|sonar-pr-gate|test-governance|mutation-testing|typescript-toolchain|sync-service-(rate-limit|edge)-policy|lib/workspace-packages)\.(mjs|test\.mjs)$)'; then
               FILTER=""
             else
               FILTER="...[${BASE_SHA}]"

docs/packages/sdk/verifast.md

@@ -3,9 +3,9 @@ id: pkg-verifast
 title: '@bsv/verifast'
 kind: package
 domain: sdk
-version: '0.3.1'
-last_updated: '2026-07-28'
-last_verified: '2026-07-28'
+version: '0.3.2'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/verifast'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/verifast'
@@ -46,8 +46,11 @@ warms and routes eligible verification work to WASM afterward. Use explicit
 consensus or policy context when establishing transaction validity. Batch and
 worker APIs are bounded and can be preloaded for latency-sensitive workloads.
 
-Build and package checks exercise real WASM verification in Node, browser
-bundlers, workers, CommonJS, and the classic browser payload. See the
+Build and package checks install exact tarballs and exercise real WASM
+verification in Node, browser bundlers, workers, CommonJS, strict-CSP browser
+pages, streaming fallback, and the classic browser payload. Raw, gzip, and
+Brotli budgets guard both browser bundles and the complete UMD loaders-plus-WASM
+composition. See the
 [package README](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/verifast#readme)
 for routing, network, batch, resource, and UMD details.
 

docs/reference/ci-performance.md

@@ -0,0 +1,51 @@
+---
+id: ci-performance
+title: 'CI Performance Governance'
+kind: reference
+version: '1.0.0'
+last_updated: '2026-07-30'
+last_verified: '2026-07-30'
+review_cadence_days: 30
+status: stable
+tags: [reference, ci, performance, github-actions]
+---
+
+# CI Performance Governance
+
+The weekly `CI performance trend` workflow classifies successful pull-request
+CI runs as full-scope (at least 50 executed, non-skipped jobs) or targeted,
+retains the latest 20 of each class, and compares median and p95 end-to-end duration with
+`governance/ci-performance-baseline.json`. A material regression fails the
+workflow and requires timing evidence before its budget or baseline changes.
+
+The uploaded JSON report retains run, job, and step duration; queue time;
+prepare-job duration; artifact upload/download duration; and variance. This
+separates targeted feedback from the complete merge gate so a changing PR mix
+cannot make the trend appear faster or slower by accident.
+
+GitHub's Actions REST API does not expose hosted-runner CPU utilization, memory
+utilization, or action-internal cache-hit results. Those fields remain an
+explicit instrumentation gap in the baseline rather than being estimated from
+wall-clock time. Add deliberate in-run instrumentation before claiming those
+metrics.
+
+To refresh the evidence without changing the baseline:
+
+```bash
+GITHUB_TOKEN=... node scripts/ci-performance.mjs \
+  --collect \
+  --baseline governance/ci-performance-baseline.json \
+  --output ci-performance-report.json
+```
+
+Changing the committed baseline requires a reviewed PR:
+
+```bash
+GITHUB_TOKEN=... node scripts/ci-performance.mjs \
+  --collect \
+  --write-baseline governance/ci-performance-baseline.json
+```
+
+Review the 40 exact run links, classification threshold, sample summaries,
+workflow or runner changes, and the stated median/p95 budget. Never loosen a
+budget solely to make a red trend green.

docs/reference/package-api-migrations.md

@@ -48,7 +48,7 @@ and clean-consumer tests remain the executable type authority.
 | `@bsv/simple`                     | `0.4.1`      | `0.4.6`  | patch     | [API and usage](../packages/helpers/simple.md)                        | No consumer migration is required; the browser and server entry points remain compatible.                                                                                                                                        |
 | `@bsv/templates`                  | `1.9.1`      | `1.9.3`  | patch     | [API and usage](../packages/helpers/templates.md)                     | No consumer migration is required; template APIs, supported imports, and generated script semantics are unchanged.                                                                                                               |
 | `@bsv/teranode-listener`          | `1.1.1`      | `1.1.2`  | patch     | [API and usage](../packages/network/teranode-listener.md)             | No consumer migration is required; listener APIs, topics, and network configuration are unchanged.                                                                                                                               |
-| `@bsv/verifast`                   | `0.3.0`      | `0.3.1`  | patch     | [API and usage](../packages/sdk/verifast.md)                          | No consumer migration is required; valid verification results and worker protocols are unchanged.                                                                                                                                |
+| `@bsv/verifast`                   | `0.3.0`      | `0.3.2`  | patch     | [API and usage](../packages/sdk/verifast.md)                          | No consumer migration is required; exports, verification behavior, worker protocols, package paths, and runtime defaults are unchanged.                                                                                          |
 | `@bsv/wallet-helper`              | `0.1.1`      | `0.1.4`  | patch     | [API and usage](../packages/helpers/wallet-helper.md)                 | No consumer migration is required; fluent builder APIs and transaction semantics are unchanged.                                                                                                                                  |
 | `@bsv/wallet-relay`               | `0.2.2`      | `0.3.0`  | minor     | [API and usage](../packages/wallet/wallet-relay.md)                   | QRPairingCode now renders a native button and accepts button wrapper attributes. Existing className, style, data, and ARIA props continue to work; update div-specific wrapper selectors or explicitly typed div event handlers. |
 | `@bsv/wallet-toolbox`             | `2.4.4`      | `2.4.16` | patch     | [API and usage](../packages/wallet/wallet-toolbox.md)                 | No consumer migration is required; persisted schemas, provider behavior, transaction construction, monitor behavior, and the 2.x wallet and storage interfaces remain compatible.                                                |
@@ -399,8 +399,8 @@ CLI entry points: `{"fund-metanet":"./dist/index.mjs"}`.
 
 - Package documentation: [docs/packages/sdk/verifast.md](../packages/sdk/verifast.md)
 - Source: [packages/verifast](https://github.com/bsv-blockchain/ts-stack/tree/main/packages/verifast)
-- Release note: Uses precise worker result type errors and refreshes the compatible browser verification test client.
-- Migration: No consumer migration is required; valid verification results and worker protocols are unchanged.
+- Release note: Adds exact-tarball browser, WASM, worker, strict-CSP, streaming-fallback, UMD source-map, and raw/gzip/Brotli bundle contracts.
+- Migration: No consumer migration is required; exports, verification behavior, worker protocols, package paths, and runtime defaults are unchanged.
 
 | Public subpath             | Runtime target(s)                                                                           | Declaration target(s)                                                |
 | -------------------------- | ------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- |