From 4ec01aff15d8a36d0a0dfd1d31d13b0ac20a9a60 Mon Sep 17 00:00:00 2001 From: Ty J Everett Date: Wed, 26 Aug 2026 18:34:24 -0700 Subject: [PATCH 1/3] chore(governance): renew verification windows --- docs/about/versioning.md | 2 +- docs/architecture/beef.md | 2 +- docs/architecture/brc-100.md | 2 +- docs/architecture/conformance.md | 2 +- docs/architecture/identity.md | 2 +- docs/architecture/index.md | 2 +- docs/architecture/layers.md | 2 +- docs/conformance/contributing-vectors.md | 2 +- docs/conformance/index.md | 2 +- docs/conformance/runner-ts.md | 2 +- docs/conformance/vectors.md | 2 +- docs/get-started/choose-your-stack.md | 2 +- docs/get-started/concepts.md | 2 +- docs/get-started/index.md | 2 +- docs/get-started/install.md | 2 +- docs/guides/compiled-package-examples.md | 2 +- docs/guides/index.md | 2 +- docs/index.md | 2 +- docs/infrastructure/index.md | 2 +- docs/infrastructure/overlay-server.md | 2 +- docs/packages/index.md | 2 +- docs/packages/network/index.md | 2 +- docs/packages/overlays/btms-backend.md | 2 +- docs/packages/overlays/index.md | 2 +- docs/packages/sdk/index.md | 2 +- docs/packages/wallet/index.md | 2 +- .../wallet/wallet-toolbox-examples.md | 2 +- docs/reference/brc-index.md | 2 +- docs/reference/npm-package-supply-chain.md | 2 +- docs/reference/stack-facts.md | 4 +- docs/specs/index.md | 2 +- governance/repository-health/exceptions.json | 4 +- governance/test-quality/policy.json | 66 +++++++++---------- 33 files changed, 67 insertions(+), 67 deletions(-) diff --git a/docs/about/versioning.md b/docs/about/versioning.md index 772291f7a..7878f7b28 100644 --- a/docs/about/versioning.md +++ b/docs/about/versioning.md @@ -4,7 +4,7 @@ title: 'Versioning Policy' kind: meta version: '2.0.0' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [about, versioning, semver, releases] diff --git a/docs/architecture/beef.md b/docs/architecture/beef.md index e696f241e..97d69f967 100644 --- a/docs/architecture/beef.md +++ b/docs/architecture/beef.md @@ -4,7 +4,7 @@ title: BEEF — Background Evaluation Extended Format (BRC-62) kind: meta version: 'n/a' last_updated: '2026-04-29' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['architecture', 'BEEF', 'BRC-62', 'SPV'] diff --git a/docs/architecture/brc-100.md b/docs/architecture/brc-100.md index 4fb603ae0..bd32f0699 100644 --- a/docs/architecture/brc-100.md +++ b/docs/architecture/brc-100.md @@ -4,7 +4,7 @@ title: BRC-100 Wallet Interface kind: meta version: 'n/a' last_updated: '2026-04-30' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['architecture', 'BRC-100', 'wallet'] diff --git a/docs/architecture/conformance.md b/docs/architecture/conformance.md index ca989b37d..9dfefde4d 100644 --- a/docs/architecture/conformance.md +++ b/docs/architecture/conformance.md @@ -4,7 +4,7 @@ title: Conformance Pipeline kind: meta version: 'n/a' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['architecture', 'conformance', 'cross-language'] diff --git a/docs/architecture/identity.md b/docs/architecture/identity.md index da829a5ad..0e5f43105 100644 --- a/docs/architecture/identity.md +++ b/docs/architecture/identity.md @@ -4,7 +4,7 @@ title: Identity & Mutual Authentication kind: meta version: 'n/a' last_updated: '2026-04-29' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['architecture', 'identity', 'auth', 'BRC-31', 'BRC-103', 'BRC-104'] diff --git a/docs/architecture/index.md b/docs/architecture/index.md index a3a9316ce..b933d4d7a 100644 --- a/docs/architecture/index.md +++ b/docs/architecture/index.md @@ -4,7 +4,7 @@ title: Architecture kind: meta version: 'n/a' last_updated: '2026-04-29' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['architecture'] diff --git a/docs/architecture/layers.md b/docs/architecture/layers.md index da4b77277..abd6e26d4 100644 --- a/docs/architecture/layers.md +++ b/docs/architecture/layers.md @@ -4,7 +4,7 @@ title: Stack Layers kind: meta version: 'n/a' last_updated: '2026-05-01' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['architecture', 'layers'] diff --git a/docs/conformance/contributing-vectors.md b/docs/conformance/contributing-vectors.md index f1fd0463b..80cee3ae3 100644 --- a/docs/conformance/contributing-vectors.md +++ b/docs/conformance/contributing-vectors.md @@ -4,7 +4,7 @@ title: 'Contributing Vectors' kind: conformance version: '1.0.0' last_updated: '2026-05-14' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [conformance, contributing, vectors] diff --git a/docs/conformance/index.md b/docs/conformance/index.md index b4ec4ffc6..aed3fa26a 100644 --- a/docs/conformance/index.md +++ b/docs/conformance/index.md @@ -4,7 +4,7 @@ title: 'Conformance' kind: meta version: 'n/a' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [conformance, testing, cross-language, vectors] diff --git a/docs/conformance/runner-ts.md b/docs/conformance/runner-ts.md index 3ac44341a..dd329d368 100644 --- a/docs/conformance/runner-ts.md +++ b/docs/conformance/runner-ts.md @@ -4,7 +4,7 @@ title: 'TypeScript Runner' kind: conformance version: '1.0.0' last_updated: '2026-05-14' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [conformance, runner, typescript] diff --git a/docs/conformance/vectors.md b/docs/conformance/vectors.md index 1e26c9960..e40b2b643 100644 --- a/docs/conformance/vectors.md +++ b/docs/conformance/vectors.md @@ -4,7 +4,7 @@ title: 'Vector Catalog' kind: conformance version: '1.0.0' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [conformance, vectors, catalog] diff --git a/docs/get-started/choose-your-stack.md b/docs/get-started/choose-your-stack.md index 00666be26..746119ff9 100644 --- a/docs/get-started/choose-your-stack.md +++ b/docs/get-started/choose-your-stack.md @@ -4,7 +4,7 @@ title: Choose Your Stack kind: meta version: 'n/a' last_updated: '2026-04-30' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['decision-guide'] diff --git a/docs/get-started/concepts.md b/docs/get-started/concepts.md index 4b90d7050..14a92e790 100644 --- a/docs/get-started/concepts.md +++ b/docs/get-started/concepts.md @@ -4,7 +4,7 @@ title: Key Concepts kind: meta version: 'n/a' last_updated: '2026-04-30' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['concepts', 'protocol'] diff --git a/docs/get-started/index.md b/docs/get-started/index.md index ca8b6c902..8a9a940be 100644 --- a/docs/get-started/index.md +++ b/docs/get-started/index.md @@ -4,7 +4,7 @@ title: Get Started kind: meta version: 'n/a' last_updated: '2026-04-30' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['onboarding'] diff --git a/docs/get-started/install.md b/docs/get-started/install.md index ef362e21b..5df0e7ecf 100644 --- a/docs/get-started/install.md +++ b/docs/get-started/install.md @@ -4,7 +4,7 @@ title: Install kind: meta version: 'n/a' last_updated: '2026-04-29' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['installation', 'setup'] diff --git a/docs/guides/compiled-package-examples.md b/docs/guides/compiled-package-examples.md index 5a51057fb..b4cde9fd5 100644 --- a/docs/guides/compiled-package-examples.md +++ b/docs/guides/compiled-package-examples.md @@ -4,7 +4,7 @@ title: 'Compiled Package Boundary Examples' kind: guide version: '1.0.0' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [guide, typescript, packages, consumers, examples] diff --git a/docs/guides/index.md b/docs/guides/index.md index 2ecdf819b..f98e81ff6 100644 --- a/docs/guides/index.md +++ b/docs/guides/index.md @@ -4,7 +4,7 @@ title: 'Guides' kind: meta version: '1.0.0' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [guides, tutorials, how-to] diff --git a/docs/index.md b/docs/index.md index 28b5d43d0..55be67fc5 100644 --- a/docs/index.md +++ b/docs/index.md @@ -4,7 +4,7 @@ title: ts-stack kind: meta version: 'n/a' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [] diff --git a/docs/infrastructure/index.md b/docs/infrastructure/index.md index bb13bd1c7..e0eb2436e 100644 --- a/docs/infrastructure/index.md +++ b/docs/infrastructure/index.md @@ -4,7 +4,7 @@ title: 'Infrastructure' kind: meta version: '1.0.0' last_updated: '2026-04-30' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [infrastructure, deployment, reference-implementations, ts-stack] diff --git a/docs/infrastructure/overlay-server.md b/docs/infrastructure/overlay-server.md index 738bb76d2..a75cae7e5 100644 --- a/docs/infrastructure/overlay-server.md +++ b/docs/infrastructure/overlay-server.md @@ -4,7 +4,7 @@ title: 'Overlay Server' kind: infra version: '2.1.6' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [overlay, topic-manager, lookup-service, transaction-routing] diff --git a/docs/packages/index.md b/docs/packages/index.md index 73dba4c87..a126237e9 100644 --- a/docs/packages/index.md +++ b/docs/packages/index.md @@ -4,7 +4,7 @@ title: Packages kind: meta version: 'n/a' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['packages'] diff --git a/docs/packages/network/index.md b/docs/packages/network/index.md index eec6f33c3..7f34baa05 100644 --- a/docs/packages/network/index.md +++ b/docs/packages/network/index.md @@ -5,7 +5,7 @@ kind: meta domain: network version: 'n/a' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['domain', 'network'] diff --git a/docs/packages/overlays/btms-backend.md b/docs/packages/overlays/btms-backend.md index 774d3475a..332b55592 100644 --- a/docs/packages/overlays/btms-backend.md +++ b/docs/packages/overlays/btms-backend.md @@ -6,7 +6,7 @@ domain: overlays version: '0.1.1' source_repo: 'bsv-blockchain/ts-stack' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/overlays/btms-backend' status: experimental diff --git a/docs/packages/overlays/index.md b/docs/packages/overlays/index.md index 6c6036c24..060be9c15 100644 --- a/docs/packages/overlays/index.md +++ b/docs/packages/overlays/index.md @@ -5,7 +5,7 @@ kind: meta domain: overlays version: 'n/a' last_updated: '2026-04-28' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['domain', 'overlays'] diff --git a/docs/packages/sdk/index.md b/docs/packages/sdk/index.md index dd288d757..1bdaf56ae 100644 --- a/docs/packages/sdk/index.md +++ b/docs/packages/sdk/index.md @@ -5,7 +5,7 @@ kind: meta domain: sdk version: 'n/a' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['domain', 'sdk'] diff --git a/docs/packages/wallet/index.md b/docs/packages/wallet/index.md index 8626578b6..eff6e5283 100644 --- a/docs/packages/wallet/index.md +++ b/docs/packages/wallet/index.md @@ -5,7 +5,7 @@ kind: meta domain: wallet version: 'n/a' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['domain', 'wallet'] diff --git a/docs/packages/wallet/wallet-toolbox-examples.md b/docs/packages/wallet/wallet-toolbox-examples.md index c7eccd510..e6f133ac1 100644 --- a/docs/packages/wallet/wallet-toolbox-examples.md +++ b/docs/packages/wallet/wallet-toolbox-examples.md @@ -5,7 +5,7 @@ kind: package domain: wallet version: '1.1.157' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/wallet/wallet-toolbox-examples' status: stable diff --git a/docs/reference/brc-index.md b/docs/reference/brc-index.md index c1517a520..f7f51282d 100644 --- a/docs/reference/brc-index.md +++ b/docs/reference/brc-index.md @@ -4,7 +4,7 @@ title: 'BRC Standards Index' kind: reference version: 'n/a' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [reference, brc, standards] diff --git a/docs/reference/npm-package-supply-chain.md b/docs/reference/npm-package-supply-chain.md index 1f543919f..52f3543a2 100644 --- a/docs/reference/npm-package-supply-chain.md +++ b/docs/reference/npm-package-supply-chain.md @@ -4,7 +4,7 @@ title: 'npm Package Supply Chain' kind: reference version: '1.0.0' last_updated: '2026-07-27' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [reference, packages, npm, security, releases] diff --git a/docs/reference/stack-facts.md b/docs/reference/stack-facts.md index a37d5037c..9973b9b38 100644 --- a/docs/reference/stack-facts.md +++ b/docs/reference/stack-facts.md @@ -80,8 +80,8 @@ the separately released and verified image digest. | BSV Chaintracks Server | `chaintracks-server` | `1.1.15` | `>=24 <25` | node, linux/amd64 | ghcr-keyless | [infra/chaintracks-server](https://github.com/bsv-blockchain/ts-stack/tree/main/infra/chaintracks-server) | | BSV Message Box Server | `@bsv/messagebox-server` | `1.1.39` | `>=24 <25` | node, linux/amd64 | ghcr-keyless | [infra/message-box-server](https://github.com/bsv-blockchain/ts-stack/tree/main/infra/message-box-server) | | BSV Overlay Server | `@bsv/overlay-express-examples` | `2.1.34` | `>=24 <25` | node, linux/amd64 | ghcr-keyless | [infra/overlay-server](https://github.com/bsv-blockchain/ts-stack/tree/main/infra/overlay-server) | -| BSV UHRP Basic Server | `@bsv/uhrp-lite` | `0.1.33` | `>=24 <25` | node, linux/amd64 | ghcr-keyless | [infra/uhrp-server-basic](https://github.com/bsv-blockchain/ts-stack/tree/main/infra/uhrp-server-basic) | -| BSV UHRP Cloud Bucket Server | `@bsv/uhrp-storage-server` | `0.2.35` | `>=24 <25` | node, linux/amd64 | ghcr-keyless | [infra/uhrp-server-cloud-bucket](https://github.com/bsv-blockchain/ts-stack/tree/main/infra/uhrp-server-cloud-bucket) | +| BSV UHRP Basic Server | `@bsv/uhrp-lite` | `0.1.34` | `>=24 <25` | node, linux/amd64 | ghcr-keyless | [infra/uhrp-server-basic](https://github.com/bsv-blockchain/ts-stack/tree/main/infra/uhrp-server-basic) | +| BSV UHRP Cloud Bucket Server | `@bsv/uhrp-storage-server` | `0.2.36` | `>=24 <25` | node, linux/amd64 | ghcr-keyless | [infra/uhrp-server-cloud-bucket](https://github.com/bsv-blockchain/ts-stack/tree/main/infra/uhrp-server-cloud-bucket) | | Wallet Authentication Backend | `@bsv/wab-server` | `1.5.3` | `>=24 <25` | node, linux/amd64 | ghcr-and-aws-marketplace-keyless | [infra/wab](https://github.com/bsv-blockchain/ts-stack/tree/main/infra/wab) | | BSV Wallet Infrastructure | `@bsv/wallet-infra` | `2.0.37` | `>=24 <25` | node, linux/amd64 | ghcr-keyless | [infra/wallet-infra](https://github.com/bsv-blockchain/ts-stack/tree/main/infra/wallet-infra) | diff --git a/docs/specs/index.md b/docs/specs/index.md index 71292d14f..6ebcec806 100644 --- a/docs/specs/index.md +++ b/docs/specs/index.md @@ -4,7 +4,7 @@ title: Specifications kind: meta version: 'n/a' last_updated: '2026-04-28' -last_verified: '2026-07-27' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: ['specs'] diff --git a/governance/repository-health/exceptions.json b/governance/repository-health/exceptions.json index 7d3c10ef8..b5704f475 100644 --- a/governance/repository-health/exceptions.json +++ b/governance/repository-health/exceptions.json @@ -206,7 +206,7 @@ "https://github.com/bsv-blockchain/ts-stack/issues/324" ], "created": "2026-07-24", - "reviewBy": "2026-08-26", + "reviewBy": "2026-09-26", "removeWhen": "Every conformance skip is implemented or documented as deliberately unsupported with a permanent compatibility decision." }, { @@ -222,7 +222,7 @@ "https://github.com/bsv-blockchain/ts-stack/issues/324" ], "created": "2026-07-24", - "reviewBy": "2026-08-26", + "reviewBy": "2026-09-26", "removeWhen": "All six required-suite gaps are enabled, moved to a correctly governed non-PR suite, or removed with evidence that the scenario is obsolete." }, { diff --git a/governance/test-quality/policy.json b/governance/test-quality/policy.json index b2e47d478..7d1d37e8b 100644 --- a/governance/test-quality/policy.json +++ b/governance/test-quality/policy.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "lastReviewed": "2026-07-31", + "lastReviewed": "2026-08-26", "ownerDefinitions": ["ts-stack-maintainers"], "propertyTesting": { "library": "fast-check", @@ -11,7 +11,7 @@ "workflow": ".github/workflows/property-tests.yml", "replayEnvironment": ["FAST_CHECK_NUM_RUNS", "FAST_CHECK_SEED", "FAST_CHECK_PATH"], "owner": "ts-stack-maintainers", - "reviewBy": "2026-08-26", + "reviewBy": "2026-09-26", "manifests": [ "packages/sdk/package.json", "packages/wallet/wallet-toolbox/package.json", @@ -443,42 +443,42 @@ "kind": "adapter-or-composition", "rationale": "This package orchestrates wallet, PushDrop, DID, and overlay APIs; its independent codecs and advertisement boundaries are governed in @bsv/did and the overlay suites.", "owner": "ts-stack-maintainers", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "manifest": "packages/helpers/simple/package.json", "kind": "adapter-or-composition", "rationale": "This convenience facade composes wallet, DID, Message Box, overlay, and token clients without owning an independent wire codec or authorization parser.", "owner": "ts-stack-maintainers", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "manifest": "packages/messaging/ts-paymail/docs/examples/package.json", "kind": "example-or-platform", "rationale": "This private documentation example has no reusable runtime boundary; the Paymail address and protocol parser is governed in the parent package.", "owner": "ts-stack-maintainers", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "manifest": "packages/wallet/wallet-toolbox-examples/package.json", "kind": "example-or-platform", "rationale": "This private examples workspace demonstrates governed wallet-toolbox APIs and does not define an independent parser or security decision.", "owner": "ts-stack-maintainers", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "manifest": "packages/wallet/wallet-toolbox/client/package.json", "kind": "adapter-or-composition", "rationale": "This client surface exposes wallet-toolbox behavior whose authenticated binary framing and storage invariants are governed in the parent package.", "owner": "ts-stack-maintainers", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "manifest": "packages/wallet/wallet-toolbox/mobile/package.json", "kind": "example-or-platform", "rationale": "This React Native platform harness exercises the governed wallet and relay packages but does not own an independent arbitrary-input boundary.", "owner": "ts-stack-maintainers", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" } ] }, @@ -497,7 +497,7 @@ "cadence": "Run the relevant suite before a release that changes its boundary and during an operator investigation; do not batch-run all operator suites.", "invocation": "pnpm --filter @bsv/wallet-toolbox test:manual -- ", "lastRunEvidence": null, - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "id": "wallet-public-live", @@ -513,7 +513,7 @@ "cadence": "Weekly and before a release that changes the Go Chaintracks client.", "invocation": "pnpm --filter @bsv/wallet-toolbox test:live -- ", "lastRunEvidence": null, - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "id": "overlay-public-live", @@ -528,7 +528,7 @@ "cadence": "Weekly and before a release that changes Overlay provider integration.", "invocation": "pnpm --filter @bsv/overlay-express test:live", "lastRunEvidence": null, - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "id": "sdk-resource", @@ -543,7 +543,7 @@ "cadence": "Before an SDK release that changes AES-GCM length handling and on a monthly resource-test run.", "invocation": "pnpm --filter @bsv/sdk test:resource", "lastRunEvidence": null, - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" } ], "manualRules": [ @@ -580,7 +580,7 @@ "owner": "ts-stack-maintainers", "reason": "A valid case requires deterministic certificate and PushDrop signatures from subject and certifier wallets; the current helpers only construct invalid boundary fixtures.", "removeWhen": "Add deterministic certificate-construction helpers and assert admission plus decrypted public attributes.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "packages/wallet/wallet-toolbox/src/storage/__test/StorageIdb.test.ts", @@ -589,7 +589,7 @@ "owner": "ts-stack-maintainers", "reason": "The IndexedDB wallet scenario passes alone but leaves a handle open when run with the complete Jest suite.", "removeWhen": "Identify and close the leaked handle, give the scenario a behavioral name, and enable it in the required suite.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" } ], "conformanceSkipGroups": [ @@ -599,7 +599,7 @@ "expectedSkips": 4, "owner": "ts-stack-maintainers", "removeWhen": "Delete the four obsolete signature vectors after cross-language consumers confirm the replacement deterministic vectors.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/regressions/beef-v2-txid-panic.json", @@ -607,7 +607,7 @@ "expectedSkips": 1, "owner": "ts-stack-maintainers", "removeWhen": "The Go SDK handles empty BEEF consistently and the vector can become required.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/regressions/bip276-hex-decode.json", @@ -615,7 +615,7 @@ "expectedSkips": 3, "owner": "ts-stack-maintainers", "removeWhen": "The TypeScript stack exposes an equivalent BIP276 contract or the vectors are formally marked unsupported for TypeScript.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/regressions/privatekey-modular-reduction.json", @@ -623,7 +623,7 @@ "expectedSkips": 2, "owner": "ts-stack-maintainers", "removeWhen": "The Go SDK validates and reduces private-key scalars consistently with the TypeScript SDK.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/sdk/crypto/ecies.json", @@ -631,7 +631,7 @@ "expectedSkips": 1, "owner": "ts-stack-maintainers", "removeWhen": "The ECIES dispatcher validates the wrong-key error shape directly or the obsolete duplicate vector is removed.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/sdk/scripts/evaluation.json", @@ -639,7 +639,7 @@ "expectedSkips": 37, "owner": "ts-stack-maintainers", "removeWhen": "Each node-context, consensus, or flag-sensitive script case is implemented or formally classified as outside the standalone evaluator contract.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/sync/brc40-user-state.json", @@ -647,7 +647,7 @@ "expectedSkips": 24, "owner": "ts-stack-maintainers", "removeWhen": "A seeded producer/consumer sync harness validates BRC-40 state, merge, and offset behavior.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/abortaction.json", @@ -655,7 +655,7 @@ "expectedSkips": 6, "owner": "ts-stack-maintainers", "removeWhen": "The wallet harness creates deterministic in-flight actions before abort vectors execute.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/acquirecertificate.json", @@ -663,7 +663,7 @@ "expectedSkips": 5, "owner": "ts-stack-maintainers", "removeWhen": "Vectors use valid deterministic signatures and an ephemeral issuance endpoint.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/createaction.json", @@ -671,7 +671,7 @@ "expectedSkips": 90, "owner": "ts-stack-maintainers", "removeWhen": "A deterministic funded mock-chain wallet supplies change UTXOs for createAction vectors.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/discoverbyattributes.json", @@ -679,7 +679,7 @@ "expectedSkips": 1, "owner": "ts-stack-maintainers", "removeWhen": "A deterministic overlay lookup fixture returns matching certifier attributes.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/discoverbyidentitykey.json", @@ -687,7 +687,7 @@ "expectedSkips": 2, "owner": "ts-stack-maintainers", "removeWhen": "A deterministic overlay lookup fixture returns certifier identity records.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/internalizeaction.json", @@ -695,7 +695,7 @@ "expectedSkips": 8, "owner": "ts-stack-maintainers", "removeWhen": "Placeholder byte arrays are replaced with valid deterministic BEEF fixtures.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/listactions.json", @@ -703,7 +703,7 @@ "expectedSkips": 1, "owner": "ts-stack-maintainers", "removeWhen": "The wallet harness seeds the expected action before the list request.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/listcertificates.json", @@ -711,7 +711,7 @@ "expectedSkips": 1, "owner": "ts-stack-maintainers", "removeWhen": "The wallet harness seeds the expected certificate before the list request.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/provecertificate.json", @@ -719,7 +719,7 @@ "expectedSkips": 7, "owner": "ts-stack-maintainers", "removeWhen": "The wallet harness seeds deterministic certificates and proof keys.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/relinquishcertificate.json", @@ -727,7 +727,7 @@ "expectedSkips": 4, "owner": "ts-stack-maintainers", "removeWhen": "The wallet harness seeds deterministic certificates before relinquishment.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/relinquishoutput.json", @@ -735,7 +735,7 @@ "expectedSkips": 6, "owner": "ts-stack-maintainers", "removeWhen": "The wallet harness seeds deterministic outputs before relinquishment.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" }, { "path": "conformance/vectors/wallet/brc100/signaction.json", @@ -743,7 +743,7 @@ "expectedSkips": 8, "owner": "ts-stack-maintainers", "removeWhen": "The wallet harness creates and retains deterministic in-flight actions for signing.", - "reviewBy": "2026-08-26" + "reviewBy": "2026-09-26" } ] } From 417b0f9cd19f6252eef574e53feb8dfb6badc38a Mon Sep 17 00:00:00 2001 From: Ty J Everett Date: Wed, 26 Aug 2026 18:34:24 -0700 Subject: [PATCH 2/3] fix(infra): upgrade UHRP runtime OpenSSL --- docs/infrastructure/uhrp-server-basic.md | 10 +++++++--- docs/infrastructure/uhrp-server-cloud-bucket.md | 10 +++++++--- infra/uhrp-server-basic/Dockerfile | 5 +++++ infra/uhrp-server-basic/package-lock.json | 4 ++-- infra/uhrp-server-basic/package.json | 2 +- infra/uhrp-server-cloud-bucket/Dockerfile | 5 +++++ infra/uhrp-server-cloud-bucket/package-lock.json | 4 ++-- infra/uhrp-server-cloud-bucket/package.json | 2 +- 8 files changed, 30 insertions(+), 12 deletions(-) diff --git a/docs/infrastructure/uhrp-server-basic.md b/docs/infrastructure/uhrp-server-basic.md index 5e776a403..8213186c8 100644 --- a/docs/infrastructure/uhrp-server-basic.md +++ b/docs/infrastructure/uhrp-server-basic.md @@ -2,9 +2,9 @@ id: infra-uhrp-basic title: 'UHRP Server (Basic)' kind: infra -version: '0.1.33' -last_updated: '2026-08-25' -last_verified: '2026-08-25' +version: '0.1.34' +last_updated: '2026-08-26' +last_verified: '2026-08-26' review_cadence_days: 30 status: beta tags: [uhrp, storage, file-server, development, lightweight] @@ -14,6 +14,10 @@ tags: [uhrp, storage, file-server, development, lightweight] > A simple, file-system based UHRP (Universal Host Reference Protocol) host server. Stores files locally on disk and provides HTTP endpoints for UHRP data retrieval and storage. +The 0.1.34 image refreshes its Alpine OpenSSL runtime libraries to 3.5.8-r0 +to remediate CVE-2026-14456. Service APIs, storage formats, CHIRP behavior, and +deployment configuration are unchanged from 0.1.33. + ## What it does A lightweight Node.js server with Express that implements UHRP storage and diff --git a/docs/infrastructure/uhrp-server-cloud-bucket.md b/docs/infrastructure/uhrp-server-cloud-bucket.md index e199c0821..3a7b9fa22 100644 --- a/docs/infrastructure/uhrp-server-cloud-bucket.md +++ b/docs/infrastructure/uhrp-server-cloud-bucket.md @@ -2,9 +2,9 @@ id: infra-uhrp-cloud title: 'UHRP Server (Cloud Bucket)' kind: infra -version: '0.2.35' -last_updated: '2026-08-25' -last_verified: '2026-08-25' +version: '0.2.36' +last_updated: '2026-08-26' +last_verified: '2026-08-26' review_cadence_days: 30 status: stable tags: [uhrp, storage, cloud, google-cloud-run, production] @@ -14,6 +14,10 @@ tags: [uhrp, storage, cloud, google-cloud-run, production] > A production-grade UHRP host server backed by Google Cloud Storage. Stores large files in cloud buckets with optional billing/micropayments and includes advertising infrastructure for overlay network discovery. +The 0.2.36 image refreshes its Alpine OpenSSL runtime libraries to 3.5.8-r0 +to remediate CVE-2026-14456. Service APIs, bucket layouts, CHIRP behavior, and +deployment configuration are unchanged from 0.2.35. + ## What it does A TypeScript/Express server designed for Google Cloud Run that implements UHRP diff --git a/infra/uhrp-server-basic/Dockerfile b/infra/uhrp-server-basic/Dockerfile index 2837bb091..be4b491e0 100644 --- a/infra/uhrp-server-basic/Dockerfile +++ b/infra/uhrp-server-basic/Dockerfile @@ -16,6 +16,11 @@ RUN npm ci --omit=dev --ignore-scripts # ── Stage 2: production ──────────────────────────────────── FROM node@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd +# Alpine 3.24.1's pinned Node image contains OpenSSL 3.5.7-r0. Upgrade the +# runtime libraries to the fixed 3.5.8-r0 packages for CVE-2026-14456 before +# removing the package manager payload below. +RUN apk add --no-cache libcrypto3=3.5.8-r0 libssl3=3.5.8-r0 + # Strip npm from the runtime image: the app runs via `node` (see CMD) and # node:24-alpine's bundled npm ships its own HIGH-CVE deps (picomatch/undici) # that we don't need at runtime. diff --git a/infra/uhrp-server-basic/package-lock.json b/infra/uhrp-server-basic/package-lock.json index 6cc2f98a3..45ea9247a 100644 --- a/infra/uhrp-server-basic/package-lock.json +++ b/infra/uhrp-server-basic/package-lock.json @@ -1,12 +1,12 @@ { "name": "@bsv/uhrp-lite", - "version": "0.1.33", + "version": "0.1.34", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@bsv/uhrp-lite", - "version": "0.1.33", + "version": "0.1.34", "license": "SEE LICENSE IN LICENSE.txt", "dependencies": { "@bsv/auth-express-middleware": "^2.2.2", diff --git a/infra/uhrp-server-basic/package.json b/infra/uhrp-server-basic/package.json index fe3e57d20..bf09dbd16 100644 --- a/infra/uhrp-server-basic/package.json +++ b/infra/uhrp-server-basic/package.json @@ -1,6 +1,6 @@ { "name": "@bsv/uhrp-lite", - "version": "0.1.33", + "version": "0.1.34", "overrides": { "brace-expansion": "5.0.9", "gaxios": "7.3.0" diff --git a/infra/uhrp-server-cloud-bucket/Dockerfile b/infra/uhrp-server-cloud-bucket/Dockerfile index ad5f09cd8..1d46cf94a 100644 --- a/infra/uhrp-server-cloud-bucket/Dockerfile +++ b/infra/uhrp-server-cloud-bucket/Dockerfile @@ -23,6 +23,11 @@ RUN npm ci --omit=dev --ignore-scripts \ # ── Stage 2: production ──────────────────────────────────── FROM node@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd +# Alpine 3.24.1's pinned Node image contains OpenSSL 3.5.7-r0. Upgrade the +# runtime libraries to the fixed 3.5.8-r0 packages for CVE-2026-14456 before +# removing the package manager payload below. +RUN apk add --no-cache libcrypto3=3.5.8-r0 libssl3=3.5.8-r0 + # Strip npm from the runtime image: the app runs via `node` (see CMD) and # node:24-alpine's bundled npm ships its own HIGH-CVE deps (picomatch/undici) # that we don't need at runtime. diff --git a/infra/uhrp-server-cloud-bucket/package-lock.json b/infra/uhrp-server-cloud-bucket/package-lock.json index d9abea00d..6433fccdf 100644 --- a/infra/uhrp-server-cloud-bucket/package-lock.json +++ b/infra/uhrp-server-cloud-bucket/package-lock.json @@ -1,12 +1,12 @@ { "name": "@bsv/uhrp-storage-server", - "version": "0.2.35", + "version": "0.2.36", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@bsv/uhrp-storage-server", - "version": "0.2.35", + "version": "0.2.36", "license": "SEE LICENSE IN LICENSE.txt", "dependencies": { "@bsv/auth-express-middleware": "^2.2.2", diff --git a/infra/uhrp-server-cloud-bucket/package.json b/infra/uhrp-server-cloud-bucket/package.json index 8d4484b9b..92a703392 100644 --- a/infra/uhrp-server-cloud-bucket/package.json +++ b/infra/uhrp-server-cloud-bucket/package.json @@ -1,6 +1,6 @@ { "name": "@bsv/uhrp-storage-server", - "version": "0.2.35", + "version": "0.2.36", "overrides": { "brace-expansion": "5.0.9", "gaxios": "7.3.0", From 9712e7e9977e3f4b2ae8190b3ee5da662c5a2451 Mon Sep 17 00:00:00 2001 From: Ty J Everett Date: Wed, 26 Aug 2026 18:37:19 -0700 Subject: [PATCH 3/3] style(infra): consolidate runtime package layer --- infra/uhrp-server-basic/Dockerfile | 12 +++++------- infra/uhrp-server-cloud-bucket/Dockerfile | 12 +++++------- 2 files changed, 10 insertions(+), 14 deletions(-) diff --git a/infra/uhrp-server-basic/Dockerfile b/infra/uhrp-server-basic/Dockerfile index be4b491e0..19473ca9f 100644 --- a/infra/uhrp-server-basic/Dockerfile +++ b/infra/uhrp-server-basic/Dockerfile @@ -16,15 +16,13 @@ RUN npm ci --omit=dev --ignore-scripts # ── Stage 2: production ──────────────────────────────────── FROM node@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd -# Alpine 3.24.1's pinned Node image contains OpenSSL 3.5.7-r0. Upgrade the -# runtime libraries to the fixed 3.5.8-r0 packages for CVE-2026-14456 before -# removing the package manager payload below. -RUN apk add --no-cache libcrypto3=3.5.8-r0 libssl3=3.5.8-r0 - # Strip npm from the runtime image: the app runs via `node` (see CMD) and # node:24-alpine's bundled npm ships its own HIGH-CVE deps (picomatch/undici) -# that we don't need at runtime. -RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx +# that we don't need at runtime. Alpine 3.24.1's pinned Node image contains +# OpenSSL 3.5.7-r0, so install the fixed 3.5.8-r0 runtime packages for +# CVE-2026-14456 in the same layer. +RUN apk add --no-cache libcrypto3=3.5.8-r0 libssl3=3.5.8-r0 \ + && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx WORKDIR /app diff --git a/infra/uhrp-server-cloud-bucket/Dockerfile b/infra/uhrp-server-cloud-bucket/Dockerfile index 1d46cf94a..d14036c3d 100644 --- a/infra/uhrp-server-cloud-bucket/Dockerfile +++ b/infra/uhrp-server-cloud-bucket/Dockerfile @@ -23,15 +23,13 @@ RUN npm ci --omit=dev --ignore-scripts \ # ── Stage 2: production ──────────────────────────────────── FROM node@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd -# Alpine 3.24.1's pinned Node image contains OpenSSL 3.5.7-r0. Upgrade the -# runtime libraries to the fixed 3.5.8-r0 packages for CVE-2026-14456 before -# removing the package manager payload below. -RUN apk add --no-cache libcrypto3=3.5.8-r0 libssl3=3.5.8-r0 - # Strip npm from the runtime image: the app runs via `node` (see CMD) and # node:24-alpine's bundled npm ships its own HIGH-CVE deps (picomatch/undici) -# that we don't need at runtime. -RUN rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx +# that we don't need at runtime. Alpine 3.24.1's pinned Node image contains +# OpenSSL 3.5.7-r0, so install the fixed 3.5.8-r0 runtime packages for +# CVE-2026-14456 in the same layer. +RUN apk add --no-cache libcrypto3=3.5.8-r0 libssl3=3.5.8-r0 \ + && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx ARG APP_COMMIT ARG APP_VERSION