[Program] Complete TypeScript stack health, security, standardization, testing, docs, and performance

[ty-everett]

Purpose

This is the authoritative execution tracker for bringing the consolidated TypeScript stack to a fully healthy, current, secure, uniform, documented, tested, publishable, browser-aware, and operationally maintainable end state.

It captures the full-repository audit as of 2026-07-24 and converts every material finding into explicit work, ordering, evidence requirements, and completion gates. Child issues and PRs should link here, and this issue should be updated as facts change so no work remains implicit or gets lost between PRs.

Scope, assumptions, and explicit exclusions

• Baseline: main@f9137ff.
• Treat PRs feat(wallet-toolbox): plan noSend batches locally and commit atomically #289 and Make VeriFast production-ready and accelerate WASM verification #290, and all other non-draft consolidation/dependency work preceding this baseline, as merged.
• Operator hold (2026-07-27): do not modify, rebase, comment on, review, close, merge, or otherwise act on draft PR fix(wallet-toolbox): derive ChainTracks from Arcade host, drop babbage defaults #306. It is not a dependency or source of truth for this work.
• Publication hold (2026-07-27): do not publish npm packages and do not create releases or tags. Source candidate versions may advance so artifacts remain version-correct, but registry publication is a separately authorized final action.
• BDK issue refactor(sdk): reduce cognitive complexity in Hash.ts (#44) #49 is out of scope.
• SonarCloud organization/project administration cannot be changed immediately. Repository-side remediation proceeds now; the automatic-analysis-to-CI switch is a separately gated later step only if the validation in this issue confirms it remains necessary.
• CI speed improvements must preserve the coverage and quality of checks. No check may be dropped merely to make the pipeline faster.
• Execution sequencing update (2026-07-27): retain every remaining testing and QA-hardening gate, but execute that work as the final program phase after the non-QA backlog. The deferred final phase includes coverage-guided fuzzing, coverage closure, manual/live test review, conformance completion, cross-runtime/browser/mobile/package QA, bundle and runtime benchmarks, CI-performance validation, and the corresponding final evidence. The next active work resumes with the earliest incomplete non-QA gate; no deferred checkbox is waived or treated as complete.
• Public protocol interoperability is a permanent compatibility invariant: Overlay/Overlay Express, WAB, UHRP/Storage, message-box, chaintracks, and comparable public APIs must remain usable from arbitrary deployed web origins, WUI, mobile/webviews, native shells, and unknown future callers. Their default browser policy is credential-free wildcard CORS, including compatible handling of opaque Origin: null; exact-origin allowlists, credentialed exact-origin mode, or disabled CORS are operator opt-ins, and wildcard origin must never be combined with credentials. CSP is a separate, configurable document/UI boundary policy—not API access control—and must not be used to silently restrict these public service contracts.
• Repository administration must remain practical: one qualified maintainer approval is sufficient; no independent-last-pusher restriction is required; maintainers/admins, including ty-everett, may approve and merge when authorized. Required checks and resolved review conversations still apply.

How to run this program

• Keep this issue’s baseline, status table, linked child issues/PRs, exceptions, and measured outcomes current.
• Create thematic, reviewable child issues/PRs for the waves below; do not accumulate a single repository-wide mega-PR.
• Link every child issue and PR back to this tracker and name the program gate(s) it advances.
• Mark a checkbox complete only with evidence: merged PR, passing run, published version, resolved alert, measurement, or documented/time-bounded exception.
• Rebase each wave on current main, run the relevant changed-package checks plus the full merge gate, and re-measure affected baselines after merge.
• Resolve review conversations before merge. Dependabot-generated code receives human review for changelog/runtime impact, peer compatibility, audit output, and full CI; it is not blindly auto-merged.
• Use one maintainer approval. Permit administrator/maintainer facilitation and ty-everett approval/merge where needed; do not restore a two-reviewer or non-last-pusher requirement.
• For every source or manifest change affecting a public package, patch-bump every affected package and record the source candidate version. While the publication hold is active, stop before npm publication, release/tag creation, release-sync, or infrastructure rollout. When separately authorized later, use only the existing protected OIDC/provenance workflow; never publish locally.
• Maintain an exception register for every temporary advisory dismissal, dependency hold, override, skipped test, coverage exclusion, or quality-rule suppression. Every exception needs owner, rationale, evidence, expiry/review date, and removal condition.
• Cross-link and update Sonar bulk: auto-fixable code style smells (~1,200 issues) #43, Sonar: 250+ functions exceed cognitive complexity threshold #44, Sonar: 138 issues around error handling, dead code, and TODOs #45, Sonar: duplication — 9,792 duplicated lines (4.8%) across 139 files in 439 blocks #46, and Sonar: long-tail TypeScript smells (~600 issues across 50+ rules) #48 as their findings are retired. Close them only when their underlying categories are actually complete.

Execution status

Current program tip: main@f1a8f8271.

Active execution: Wave 26 — broad documentation, release-readiness, observability, and remaining operations closure. Wave 25 is complete in PR #383, with exact-main evidence recorded below. Keep the broad-wave model: in one reviewable non-QA pass, inventory all 30 public-package API/declaration and migration surfaces; adopt uniform generated changelog/release-note ownership for the 18 gaps; complete service configuration/secret-name, structured logging/correlation, metrics/traces/health-schema, redaction/sampling/error-classification, SLO/alert/dashboard, backup/migration/disaster-recovery, incident, graceful-shutdown, disruption/topology, and autoscaling guidance; consolidate duplicated telemetry only where deployed compatibility is proved, otherwise document intentional deviations; close the next coherent production/config/docs Sonar set; and refresh the source-candidate/dependency publication-order matrix. Repository-owned source/config/docs may change, but there must be no deployment, npm publication, release, tag, release-sync, image publication, secret rotation, or DNS change. Public Overlay/WAB/Storage/message-box/chaintracks interoperability remains invariant: arbitrary-origin credential-free wildcard CORS (including compatible Origin: null) stays the default, exact allowlists or credentialed exact-origin behavior remain opt-in, and CSP remains separate from API access policy. Test-only assertions, fuzzing, manual/live coverage, conformance expansion, browser/performance QA, benchmark hardening, container transaction tests, and the 43 coverage-safe Wave 24 deferrals remain in the final QA phase. SonarCloud administration remains deferred. External CII Best Practices registration #204 is the sole open code-scanning posture item. After all non-QA waves close, rebase codex/stack-wide-fuzzing@63485ce3c and execute the final QA program.

Wave	Status	Evidence / next gate
0 — authoritative ledger and guardrails	Complete	PR #325 merged 2026-07-25. CI 30149013720 passed all 25 jobs in 4m13s; CodeQL 30149012950 and Conformance 30149013718 passed; Sonar PR analysis had 0 open/confirmed issues and an OK quality gate.
1 — CodeQL helper/SDK fixes	Complete	PR #326 merged at main@172f37a1. CI 30149650621, Conformance 30149650627, and CodeQL 30149649850 passed; CodeQL PR results, Sonar issues/hotspots, and coverage misses were all zero.
2 — service-edge path/resource/error hardening	Complete	PR #327 merged at main@7278be16. CI 30150486667, Conformance 30150486666, and CodeQL 30150486611 passed on main; alerts #90, #91, #92, and #112 are fixed. PR analysis had zero CodeQL alerts, zero Sonar issues/hotspots, and 100% Codecov patch coverage. Repository-health findings decreased from 243 to 242.
3 — shared service rate limiting and edge policy	Complete	PR #328 and PR #329 merged at main@6826bc6f. Rate limits, endpoint inventories, public/configurable CORS, headers, body/file quotas, timeouts/backpressure, boundary review, threat models, and manual security evidence are complete. CI 30172472690, Conformance 30172472698, CodeQL 30172472476, and docs deploy 30172472706 passed on main; CodeQL and secret scanning report zero open alerts.
4 — current dependency advisories and direct-major review	Complete	PR #330 merged at main@51c96923. React Router 8, direct esbuild builds, all compatible direct majors, a normalized frozen graph, explicit peers, and one tracked Jest security substitution leave pnpm audit and all GitHub alert APIs at zero. CI 30174141425, Conformance 30174141433, CodeQL 30174141220, and docs deploy 30174141434 passed on main; Dependabot security updates are enabled.
5 — deterministic codegen and lifecycle controls	Complete	PR #331 merged at main@f7fca9c0. OpenAPI TypeScript/Go/Python generation is read-only, deterministic, and fully locked; workspace lifecycle scripts are disabled by default with an explicit esbuild rebuild; action SHAs, first-party release-sync ownership, and generated-artifact ownership are enforced. The newly disclosed critical kin-openapi advisory was fixed with v0.145.0 before merge. CI 30175242619, Codegen 30175242630, Conformance 30175242611, and CodeQL 30175241209 passed; Dependency Review, Socket, and pnpm audit were clean, and Sonar reported zero open/confirmed PR issues.
1b — security-extended and manual review follow-up	Complete	PRs #333–#339 are merged at main@9496f8c0. Corrected advanced CodeQL run 30180480265 passed authored Actions and JavaScript/TypeScript with security-extended; default setup is off, the advanced workflow is active, and its gate is enabled. CodeQL, Dependabot, and secret scanning each report zero open alerts. Generated OpenRPC alerts #168/#169/#183 closed as fixed at the owned generated boundary; public BRC-104 handshake alert #165 closed after exact-path/signed-dispatch evidence with no dismissal. CI 30180313340, Conformance 30180313327, and docs deploy 30180313331 passed on main.
1c — current CodeQL follow-up	Complete	PR #353 merged by ty-everett at main@6ebeb710. Five wallet-wire remote-property-injection sinks were replaced by safe entry construction with trust-boundary key validation, and two deterministic Base58 remainder operations were rewritten without cryptographic-random modulo semantics. Alerts #205–#211 are fixed on main with no dismissal or suppression. PR evidence: all 31 checks green, CodeQL/Sonar APIs at zero PR issues/hotspots, and 100% coverage of modified coverable lines. Exact-main CI 30192558880, CodeQL 30192558878, Conformance 30192558874, and Scorecard 30192558876 passed; Dependabot and secret scanning remain at zero, and only the two owned Scorecard posture gaps remain open. No artifact was published.
6 — container and artifact supply chain	Complete — implementation and dry-run evidence; first live npm release evidence remains a final release gate	PR #340 completed reproducible locked infrastructure builds, digest-pinned bases, immutable image references, complete OCI labels, blocking Trivy scans, CycloneDX SBOMs, and signed/attested container provenance; PR #341 completed the Scorecard control and evidence-backed exception register; PR #342 repaired image-refresh automation. PR #372 then admin squash-merged the npm artifact boundary at main@59d0234a4: uncredentialed preparation and protected OIDC publication are separated; 30 exact tarballs are built once and carried immutably through per-package/aggregate CycloneDX SBOMs, complete license inventory, Trivy scanning, GitHub attestations, provenance verification, exact-tarball npm publish, registry SHA-512 reconciliation, retained evidence, and a separately privileged release-sync job. Candidate naming makes failed-job retries reuse the original bytes. Exact-head passed 65/65 checks with CodeQL, Sonar (0 issues/hotspots), Codecov, Dependency Review, Socket, full package/platform/infrastructure/mutation/coverage matrices, and a local 30-tarball/30-SBOM/330-component/0-license-finding/0-high-or-critical dry run. Exact-main CI 30292915701, CodeQL 30292915285, Conformance 30292916017, Scorecard 30292915833, codegen, and docs validation are the final merged-tree evidence. All 30 current exact package versions were already present on npm, so no version, tag, package, image, or other artifact was published. The first future release must retain the production attestation/SBOM/integrity evidence and final version inventory before the program closes. GitHub forbids author self-approval; ty-everett therefore performed the requested exact-head admin merge after review without adding a two-reviewer or independent-last-pusher requirement.
7 — package contracts	Complete	PR #344 standardized all 30 public manifests on Node.js 22 consumer support, explicit public access, side-effect metadata, export maps/files allowlists, and private-workspace documentation. The wallet-toolbox export map preserves its published SDK subpath for ESM/CJS consumers. Repository-health debt fell from 241 to 148 with 0 control errors. Exact-main dc8071a0 CI, CodeQL, Conformance, Scorecard, and docs deploy all passed. Open BSV License Version 6 was completed in Wave 9. All 30 modern strict public-package profiles are complete through PR #363. No artifact was published.
8 — dependency automation consolidation	Complete	PR #345 merged at main@d215223a. All compatible Action updates are current and immutable; TypeScript 7 was completed as the owned Wave 16 migration, while Node 26, MySQL 9, and MongoDB 8 remain explicit owned migrations instead of unsafe bot merges. Every PR build, test, coverage, CodeQL, dependency-review, Socket, infra, docs, repository-health, and Sonar check passed; Sonar reported zero new issues and zero hotspots. Exact-main CI 30183507155 passed on retry after a documented Docker Hub timeout; CodeQL, Conformance, Scorecard, codegen, and docs deploy also passed.
9 — uniform licensing	Complete	PR #346 merged at main@979f4a63. All 46 npm manifests, exact package-local files, standalone lock roots, and seven OCI metadata records use Open BSV License Version 6. CI enforces canonical SHA-256 bac995a0c84dd533f7d5335b6d870aae9fee7d28d189b8aa78b103e0c9932bc0, manifest/filename/allowlist/lock consistency, and a parallel 30-public-package dry-pack release gate. PR #351 removed the final WAB marketplace Version 4 hardcoding, derives the governed image license dynamically from the canonical record, and made contribution/licensing guidance explicit. All owned package and image license surfaces are now uniform and drift-blocking. No artifact was published.
10 — package quality and artifact contracts	Complete — 30 of 30	PRs #347, #348, #350–#352, #354, #356–#359, #361–#363 completed the modern strict profile for every public package. PR #363 delivered the final dependency-coherent Overlay pass for @bsv/overlay@2.2.1, @bsv/overlay-discovery-services@2.1.1, @bsv/overlay-topics@1.6.1, and @bsv/overlay-express@2.4.2: warning-free non-mutating format/lint, strict typecheck, build/test/coverage, exact tarballs, conditional ESM/CommonJS declarations, publint, strict type-resolution, clean consumers, and exact local-tarball dependency verification. It repaired Overlay’s ./storage contract, guarded malformed/missing topic data and unknown errors, added 24 boundary regressions, removed source/dist coverage double counting, and preserved public-by-default cross-domain deployment assumptions. The four packages run 740 tests with four pre-existing skips; honest source coverage is Overlay 34.17% line / 27.64% branch, Discovery 50.09% / 32.57%, Topics 55.79% / 47.53%, and Express 66.32% / 58.14%, so Tier 0/1 coverage remains an explicit later gate rather than being hidden. Repository health is now 12 findings, 11 active exceptions, and 0 control errors, down from 24 findings. Exact head ce814152 passed all 31 PR checks. The first external reports correctly blocked the PR at 3.6% Sonar new-code duplication, two Sonar findings, and 44.83% Codecov patch coverage; source refactors and targeted tests—not exclusions or bypasses—produced the final OK Sonar gate with A reliability/security/maintainability, 0 open/confirmed issues, 0 hotspots, 0.7% new duplication, and 100% Codecov patch coverage (30 hits, 0 misses, 0 partials). Sonar still cannot ingest authoritative aggregate coverage under automatic analysis, which remains the separately deferred administration item. ty-everett recorded a substantive exact-head review and admin squash-merged the identical tree at main@996aa6f699. Exact-main CI 30226677156 (29 successful jobs), CodeQL 30226677167, Conformance 30226677150, and Scorecard 30226677160 passed. CodeQL has zero owned open findings, Dependabot and secret scanning are zero, and only owned Scorecard posture findings #202 and #204 remain. Licensing and package versions were unchanged, and no artifact was published.
10a — compact action-batch transport	Complete	PR #360 was exact-head reviewed, security-hardened, and admin squash-merged at main@96ad2b2e1; the reviewed and merged trees are identical. Compact authenticated action-batch transport reduces the benchmark from 501 to 2 RPCs for 250 actions and from 1,085 ms to 150 ms for a 4 MiB payload. Storage upload is fail-closed to prepared/requested digests, untrusted Express bodies are runtime type-checked before binary parsing, and six critical CodeQL type-confusion findings (#213–#218) were fixed in code with no dismissal. PR CI, Sonar (OK / 0 open or confirmed issues / 0 hotspots), and exact-main CI 30224483443, CodeQL 30224483426, Conformance 30224483452, and Scorecard 30224483418 passed. No version, publication, or licensing change.
11 — repository quality and metadata contract	Complete	PR #364 ratcheted all 37 projects and 30 public packages to 0 repository-health findings with 10 governed exceptions and 0 errors; completed canonical public metadata; made root/workspace lint warning-free and blocking; enforced read-only formatting; added real docs, conformance, UHRP, and Wallet Toolbox example quality gates; and resolved all 14 Sonar findings raised during the PR. Exact reviewed head 1fb5ead3e passed all 39 PR checks, 100% Codecov patch coverage, and 0 Sonar issues/hotspots; its tree is identical to main@ac8128dba. Exact-main CI 30229090424 (29 successful jobs), CodeQL 30229090438, Conformance 30229090456, Codegen 30229090465, Scorecard 30229090598, and Docs 30229090439 passed. The next broad pass was completed in PR #365 and TypeScript 7 in PR #373; remaining documentation/runtime/operations, coverage/performance, Sonar administration, and release-governance gates remain explicit below.
12 — test governance and property-based testing	Complete	PR #365 established a machine-enforced test-quality contract: 550 required test files, only 6 governed direct skips, 40 classified manual/live/resource files, and 211 owned conformance gaps across 19 vector files. All 33 package manifests are now classified: 25 packages own meaningful fast-check suites with 88 independent properties, while 8 adapter/composition/example/platform packages have dated, owned exclusions instead of cosmetic tests. PR tests run at least 300 cases/property; the weekly/manual campaign runs 5,000 with seed/path replay and retained failure logs. Final local exact-tree validation exercised at least 88,000 generated cases; exact head a59cdc604b87a367ef170c5c6c4793ffa2f49e30 passed CI 30235006722, CodeQL 30235006706, Conformance 30235006695, Dependency Review, Socket, Codecov patch, browser/mobile, package, infrastructure, docs, and codegen gates. Sonar was used as a blocking semantic review despite its nominal gate: two findings were fixed, then the exact head reported quality gate OK, 0 open/confirmed issues, and 0 hotspots. Generated property testing found and drove fixes for malformed/canonical encodings, unsafe integer/varint boundaries, GASP timestamp/limit/response validation, Message Box destination grammar, BTMS amount parsing and per-origin authorization, relay/pairing origins and expiry, reorg/event JSON, script framing, and related trust boundaries. ty-everett recorded the exact-head maintainer attestation and admin squash-merged as main@27986ed7f. Exact-main CI 30235327776, CodeQL 30235327817, Conformance 30235327764, Scorecard 30235327746, codegen, and docs deploy all passed. The merged-main tree is identical to the reviewed head; Scorecard fuzzing finding #202 is closed, Dependabot and secret scanning remain at zero, and CII Best Practices registration #204 is the only open code-scanning posture item. No package version changed and nothing was published.
13 — workspace typecheck and dual-package boundary	Complete	PR #367 makes root pnpm typecheck a governed post-build contract in PR and release CI, and fixes Fund Wallet’s real SDK ESM/Wallet Toolbox CommonJS nominal-identity split by aligning its runtime and declaration resolution to the CommonJS SDK condition without weakening the SDK’s valid dual exports. Exact head b33aa1f3a passed all 39 PR checks, including full build/typecheck/lint/test/coverage, packed consumers, browser/mobile, infrastructure, CodeQL, Codecov patch, Dependency Review, Socket, and Sonar (OK, 0 open/confirmed issues, 0 hotspots). ty-everett recorded exact-head review and admin squash-merged the identical tree (c7eefe3b5e2ebd15a7befbd13cf055e0065465cf) at main@6c3559764b. Exact-main CI 30236754069, CodeQL 30236754039, Conformance 30236754044, Codegen 30236754036, Scorecard 30236754027, and Docs 30236754060 passed. No version changed and nothing was published; mutation quality is complete in Wave 14, while Tier 0/1 coverage remains retained for the final QA phase.
14 — stack-wide mutation-quality validation	Complete	PR #369 mapped all 25 governed property suites across 25 packages to exact Stryker 9.6.1 mutation targets, with per-target score ratchets, zero allowed no-coverage/invalid mutants, fixed fast-check seed 3242026, 300 generated cases/property, affected-target PR selection, global-control fan-out, a six-way parallel weekly/manual full campaign, shared build artifacts, and retained machine-readable reports. The exact campaign exercised 3,073 valid mutants: 2,662 detected, 411 survived, 86.63% aggregate; every target passed between 80.30% and 100%, with 0 uncovered and 0 invalid. Surviving-mutant review strengthened tests and removed or corrected superficial/dead behavior across SDK codecs, wallet action/script/pairing, Overlay linkage/advertisement/integrity/reorg, Paymail, DID, Mandala, P2P, auth/payment/replay, GASP, BTMS, Message Box, Amountinator, Fund Wallet, Create BSV App, and VeriFast. Exact-head CI 30241380054, CodeQL 30241380149, Conformance, Socket, Dependency Review, Codecov, and Sonar passed; Sonar had 0 open/confirmed issues and 0 hotspots after both findings were fixed. ty-everett admin squash-merged as main@8edb09665; exact-main CI 30241920702, CodeQL 30241920773, Conformance 30241920683, Scorecard 30241920714, codegen, and docs passed. A newly disclosed development-only qs advisory in Stryker’s typed-rest-client chain was initially fixed by PR #370, moving the sole lock resolution from 6.15.1 to 6.15.3; all 25 mutation targets passed again and ty-everett admin squash-merged as main@8e1c5af92. Exact-final-main CI 30243173940, CodeQL 30243173941, Conformance 30243173955, and Scorecard 30243173987 passed. The TypeScript 7 lock refresh later proved that lock-only selection was not durable, so PR #373 added the narrow parent-scoped typed-rest-client@2.3.1>qs override to 6.15.3, registered with owner, evidence, a 2026-08-27 review date, and removal when upstream adopts a fixed dependency. Root and infrastructure audits and all 25 mutation targets remained green. Dependabot and secret scanning are zero; CII registration #204 is the sole open code-scanning posture item. No package version changed and nothing was published.
15 — coverage-guided stack fuzzing	Deferred to final QA phase — WIP preserved, unmerged	The exact work-in-progress is preserved on codex/stack-wide-fuzzing@63485ce3c, based on exact main@8e1c5af92. It expands the governed property/mutation layer from 25 suites/targets across 25 packages to 30 suites/targets across all 29 implementation packages, eliminating four inaccurate exclusions and adding DID-client instructions, Simple DID key validation, AuthSocket server/client differential event codecs, and Wallet Toolbox header guards. The coverage-guided draft now defines 29 Jazzer.js 4.0.0 targets across all 29 implementation packages and all eight stack areas, with semantic oracles, dictionaries, two committed seeds per target, built-in command-injection/path-traversal/prototype-pollution detectors, a governed runner, and affected-target selection. Static governance (4/4 tests and 29-target validation) and the full workspace property build pass; five new mutation targets passed at 92.31%, 96.15%, 100%, 100%, and 95.12%, with zero no-coverage or invalid mutants. Corpus replay passed the first 13 targets and then correctly exposed an empty-input bug in the unfinished fund-wallet-cli harness; later targets, CI/scheduled workflows, documentation, complete discovery campaigns, hosted checks, review, merge, and exact-main validation remain deliberately unfinished. There is no PR and this branch must be rebased and completed only in the final QA phase. No package version changed and nothing was published.
16 — coordinated TypeScript 7 migration	Complete	PR #373 established the supported side-by-side compiler boundary in all 43 governed TypeScript manifests: native @typescript/native 7.0.2 performs compiler builds/typechecks, while the official @typescript/typescript6 compatibility package supplies the stable TypeScript API required by ts-jest@29.4.12; there is no peer override. The independently locked deterministic codegen toolchain remains on TypeScript 5.9.3. A filesystem-scanning toolchain contract, tests, CI gate, Dependabot major holds, documentation, dependency policy, and health exceptions now block drift across the root and all seven standalone infrastructure roots. The migration removed obsolete TypeScript 7 options, repaired Auth resolution, made the development-only qs advisory durable with the narrow owned parent override recorded in Wave 14, and removed the TypeScript native binary and all other dev dependencies from the WAB runtime image through a production prune. The final exact head 4a2450553 passed 65/65 PR checks, including build/typecheck, 53 script tests, every package test/property/coverage/consumer/browser/mobile/CLI/WASM profile, all 25 mutation targets, all seven infrastructure roots and Linux images, zero root/infra audit findings, CodeQL, Dependency Review, Socket, Codecov, and Sonar (OK, A ratings, 0 open/confirmed issues, 0 hotspots). ty-everett recorded a substantive exact-head maintainer review and admin squash-merged the identical tree as main@de8df4d1c. Exact-main CI 30296126490 passed 55 jobs with one intentional skip; CodeQL 30296126586, Conformance 30296124736, Scorecard 30296124700, Codegen 30296125121, and Docs 30296126588 also passed. No package version, tag, image, or artifact was published.
17 — authentication correctness and documentation/operations coherence	Complete	PR #368 completed the justified authentication session-binding fix at main@4ea4a530f. PR #374 then admin squash-merged exact reviewed head 443011429507eb4d2306f210963f42d7dcb4b9c1 (tree 540edf37564ef5e0320c2ee4abfd49a15af4d4b4) as the identical tree at main@5f1f5d533. It generates source-derived facts for 37 projects, 30 public packages, seven infrastructure roots, and 74 conformance files / 6,650 vectors; enforces 30 README contracts, exactly 40 package pages, 87 freshness records, consolidated source links, and eight compiled clean-consumer examples over 21 exact tarballs; publishes required Express declaration dependencies for six public packages; aligns Window CWI declarations with canonical wallet types without implementation or wire changes; and validates transitive workspace runtime closures in exact artifact checks. Current Node/toolchain, dependency, security, reliability, conformance, release, release-sync, image rollout, rollback, incident, and public-service guidance is now enforceable. Public CORS/CSP behavior, routes, persistence, manifests, and network behavior are unchanged; Overlay, Wallet Storage, WAB, Message Box, and Wallet Relay remain public/configurable by default. Nine Sonar findings raised during iteration were fixed, not dismissed; the exact head had zero issues/hotspots and 100% Codecov patch coverage (21/21 lines, zero misses/partials), with all 64 reported checks green. GitHub forbade formal author self-approval, so ty-everett recorded the exact-head admin attestation and merged the pinned SHA. Exact-main CI 30306158123 passed 55 jobs with one intentional skip; CodeQL 30306158089, Conformance 30306158042, Codegen 30306158038, Scorecard 30306157998, and Docs 30306158025 passed. Source version candidates are SDK 2.2.1, Paymail 2.4.3, Auth Express 2.1.3, Payment Express 2.1.2, Overlay Express 2.4.3, Wallet Relay 0.2.3, and Wallet Toolbox core/client/mobile 2.4.5. The docs site was updated by the normal main workflow; no npm package, tag, service image, application deployment, DNS, or secret changed. Deferred QA remains preserved and unmerged on codex/stack-wide-fuzzing.
18 — critical production Sonar correctness cleanup	Complete	PR #375 resolved the three non-complexity critical production findings without protocol, storage-ordering, notification, public API, CORS/CSP, or deployment changes. Exact reviewed head bdf5a226b passed all 57 PR checks, CodeQL, Sonar (0 new issues / 0 hotspots / 0.0% new duplication), and 100% coverage of modified coverable lines; its tree is identical to admin squash merge main@088b44928. Exact-main CI 30309578296 passed 55 jobs with one intentional push-only skip; CodeQL 30309578371, Conformance 30309578255, Scorecard 30309578290, and Docs 30309578274 passed. Exact-main Sonar decreased from 1,179 to 1,176 open issues: critical 173→170, debt 8,786→8,741 minutes, and cognitive complexity 26,731→26,723; vulnerabilities remain 0, security/maintainability remain A, and all 89 blockers plus all 4 bugs are test-only work retained for the final QA phase. Source candidates are @bsv/sdk@2.2.2 and @bsv/overlay@2.2.2; npm remains at 2.2.0 and 2.2.1 respectively. No package, release, tag, image, service, DNS, or secret was published or changed.
19 — bounded cross-package production complexity remediation	Complete	PR #376 used characterization-backed refactors across SDK, Amountinator, Simple, Overlay Topics, and Wallet Toolbox without dependency, public protocol/API, CORS/CSP, persistence, deployment, or service behavior changes. Exact reviewed head 588861bf5 passed all 57 checks, including CodeQL, Dependency Review, Socket, every build/type/lint/test/coverage/platform/mutation lane, Sonar (0 new issues / 0 hotspots / 0.0% new duplication), Codecov patch (96.24%, five partial branch lines, required check green), and merge-gate. GitHub forbade author self-approval, so ty-everett used the authorized exact-head admin squash merge; merged main@226c1241a has the identical reviewed tree 31ce6b615888d05fca7ec5a19e58d38e32ec0995. Exact-main CI 30311958678 passed 55 jobs with the expected push-only Dependency Review skip; CodeQL 30311958671, Conformance 30311958672, Scorecard 30311958687, and Docs 30311958679 passed. Exact-main Sonar removed seven critical production S3776 findings: 1,176→1,169 open issues, critical 170→163, cognitive complexity 26,723→26,684, and debt 8,741→8,689 minutes; 0 vulnerabilities and 0 unreviewed hotspots remain. The separate BigNumber.toBaseString finding remains at 16 versus 15 and is explicitly carried into Wave 20. Source candidates are @bsv/sdk@2.2.3, @bsv/amountinator@2.1.2, @bsv/simple@0.4.2, @bsv/overlay-topics@1.6.2, and Wallet Toolbox core/client/mobile 2.4.6; npm remains at 2.2.0, 2.1.1, 0.4.1, 1.6.1, and 2.4.4 respectively. No package, release, tag, image, service, DNS, or secret was published or changed.
20 — continued bounded production complexity remediation	Complete	PR #377 used behavior-preserving helper extraction across SDK BigNumber formatting, downloader fallback/stream validation, and HTTP wallet errors/browser detection; Simple output construction; Message Box PeerPay parsing/proof/cancellation/classification/acknowledgement; Wallet Helper OP_RETURN validation; Overlay Discovery URI classification; Overlay Topics supply-chain validation; Wallet Toolbox sync summaries; and docs-manifest frontmatter parsing. No public protocol/API, CORS/CSP, origin policy, persistence schema, fallback/validation ordering, deployment, or service behavior changed. The first Sonar pass exposed two issues despite a nominally green gate; both were fixed, and exact reviewed head 7109c7cea then passed all 57 checks with final Sonar 0 open/confirmed issues and 0 hotspots, CodeQL, Dependency Review, Socket, Codecov patch 94.69%, every coverage/platform/mutation lane, mutation quality, and merge-gate. There were no review threads or change requests. GitHub forbade author self-approval, so ty-everett recorded a substantive COMMENT review on the exact head and used the authorized SHA-pinned admin squash merge. Merged main@f104ed9a9 has the identical tree a24f76328f53a440224d818cb366b7cf8b4b4681. Exact-main CI 30314808921 passed 55 jobs with the expected push-only Dependency Review skip; CodeQL 30314808915, Conformance 30314808922, Scorecard 30314808920, and Docs 30314808916 passed. Exact-main Sonar removed 11 issues and 10 critical findings: 1,169→1,158 open, critical 163→153, cognitive complexity 26,684→26,618, and debt 8,689→8,594 minutes; vulnerabilities and unreviewed hotspots remain 0. Source candidates are @bsv/sdk@2.2.4, @bsv/simple@0.4.3, @bsv/message-box-client@2.2.3, @bsv/wallet-helper@0.1.2, @bsv/overlay-discovery-services@2.1.2, @bsv/overlay-topics@1.6.3, and Wallet Toolbox core/client/mobile 2.4.7; npm remains at 2.2.0, 0.4.1, 2.2.2, 0.1.1, 2.1.1, 1.6.1, and 2.4.4 respectively. A source-only staging dry run found that SBOM temporary installs rewrite dependencies/optionalDependencies but not peerDependencies, allowing unpublished peers to fall through to npm; this is an explicit Wave 21 tooling defect, not a reason to publish. No package, release, tag, image, service, DNS, or secret was published or changed.
21 — reproducible coordinated source-only release closure	Complete	PR #378 closes the unpublished first-party runtime/optional/peer dependency graph entirely over staged local tarballs, rejects missing/version-mismatched/registry-fallback lockfile resolution, removes resolver-only root relationships and local filesystem references from final CycloneDX output, and canonicalizes final isolated package snapshots without reordering conditional exports. The exact governed build runtime is Node 24.18.0, pnpm 10.33.2, and npm >=11.5.1, checked before output creation. Focused tests are 12/12; the final full source-only stage produced 16 artifacts, 197 aggregate components, zero license findings, no file: references, and passed verification. Two independently generated full evidence trees were byte-identical. The first Sonar pass found one new complexity issue despite a green quality gate; it was refactored and final exact head 8ecaae9b5 passed 33/33 checks, Codecov coverage of every modified coverable line, Sonar 0 open/confirmed issues and 0 hotspots, CodeQL, Dependency Review, Socket, conformance, all coverage shards, browser/mobile, and merge-gate. No review thread or change request remained. GitHub rejected author self-approval, so ty-everett recorded the substantive exact-head COMMENT review and used the authorized SHA-pinned admin squash merge. Merged main@082a4bee5 has the identical reviewed tree bda2af230b3f286eccb4bfad006dc796f97bfcbc. Exact-main CI 30317519416, CodeQL 30317519378, Conformance 30317519402, Scorecard 30317519336, and Docs 30317519327 passed. Exact-main Sonar remains 1,158 open issues (89 blocker, 153 critical, 4 bugs, 1,154 code smells), 8,594 minutes debt, 0 vulnerabilities, and 0 unreviewed hotspots; aggregate cognitive complexity is 26,649 after adding the governed release logic, with no new threshold violation. Dependabot and secret scanning remain zero; Scorecard CII registration #204 remains the sole open low-severity posture item. No package version, npm package, release, tag, image, service, DNS, or secret was published or changed.
22 — broad production complexity remediation	Complete	PR #379 closed 23 targeted production S3776 findings across SDK, Overlay, Overlay Express, BTMS, Wallet Toolbox, and Wallet Helper using behavior-preserving helper extraction and 21 direct characterization tests. Exact reviewed head a25b633c6 passed all 57 hosted checks: every CI/build/type/lint/test/coverage/platform/mutation lane, CodeQL, Dependency Review, Socket, 6,650-vector conformance, Sonar with 0 new issues / 0 hotspots / 0.0% new duplication, Codecov patch 90.43% at the unchanged 90% threshold, and merge-gate. The initial exact head failed only Codecov at 83.13%; the gate was not bypassed, and additional behavior-level ordinal and ARC callback tests raised the patch result above threshold. Repository aggregate Codecov improved 70.74%→70.98%. There were no inline review comments, review threads, or change requests. GitHub rejected author self-approval, so ty-everett recorded substantive exact-head COMMENT review 4793012842 and used an authorized SHA-pinned admin squash merge. Merged main@c9f5d1d5d has the identical reviewed tree 5112d53caf4358fe28fec510e9447e0793989a24. Exact-main CI 30321348394 passed 55 jobs with one expected push-only Dependency Review skip; CodeQL 30321348396, Conformance 30321348404, Scorecard 30321348412, and Docs 30321348393 passed. Exact-main Sonar is 1,132 open issues (−26), 89 blocker (unchanged and test-QA-deferred), 130 critical (−23), 4 bugs, 1,128 code smells (−26), 8,404 minutes debt (−190), and cognitive complexity 26,472 (−177), with maintainability A, security A, 0 vulnerabilities, and 0 unreviewed hotspots. Dependabot and secret scanning remain zero; Scorecard CII registration #204 remains the sole open low-severity posture item. Source candidates are @bsv/sdk@2.2.5, @bsv/overlay@2.2.3, @bsv/overlay-express@2.4.4, @bsv/btms@1.1.2, Wallet Toolbox core/client/mobile 2.4.8, and @bsv/wallet-helper@0.1.3; generated docs and health baselines are synchronized. Public CORS/CSP/origin behavior is unchanged. No package, release, tag, image, service, DNS, or secret was published or changed.
23 — broad production-runtime complexity and maintainability remediation	Complete	PR #380 closed 25 production S3776 findings across SDK, Overlay Topics, Overlay Discovery, and Wallet Toolbox; consolidated shared registry/discovery validation; hardened BTMS untrusted-key accounting with Map; and added focused malformed-token/envelope/script/input coverage. Exact reviewed head 593d7059b passed every hosted build/type/lint/policy/test/coverage/platform/mutation/security/docs/conformance/merge check. Codecov patch passed at 91.20198% (736 hits, 23 misses, 48 partials) with the 90% threshold unchanged; Sonar had 0 new issues, 0 hotspots, and 0.7% new duplication. There were no unresolved review threads; ty-everett recorded substantive exact-head COMMENT review 4793376417 and used the authorized SHA-pinned admin squash merge. Merged main@bb7d3f298 has the identical reviewed tree af558c0d6dbae5ccb0201937966f19dce4d0af7f. Exact-main CI 30325477190 passed 53 jobs with one expected push-only Dependency Review skip; CodeQL 30325477204, Conformance 30325477206, Scorecard 30325477218, and Docs 30325477188 passed. Exact-main Sonar moved 1,132→1,105 open issues, 130→105 critical, 1,128→1,101 code smells, 8,404→7,936 minutes debt, cognitive complexity 26,472→26,129, and duplication density 1.7%→1.6%, with 0 vulnerabilities and 0 hotspots. Aggregate Codecov moved 70.98%→71.48%. Source candidates are @bsv/sdk@2.2.6, @bsv/overlay-topics@1.6.4, @bsv/overlay-discovery-services@2.1.3, and Wallet Toolbox core/client/mobile 2.4.9; npm remains at 2.2.0, 1.6.1, 2.1.1, and 2.4.4 respectively. Public CORS/CSP/origin behavior is unchanged. No package, release, tag, image, service, DNS, or secret was published or changed.
24 — broad non-complexity source modernization and lint-policy uniformity	Complete	PR #382 resolved 167 of its 210 selected findings across SDK, Wallet Toolbox, Overlay Express, Overlay Topics, Message Box Client, Simple, WAB, infrastructure, config, scripts, and docs; 43 style-only/test-coverage or SDK benchmark findings remain explicitly final-QA owned rather than weakening the 90% patch gate. It added the shared root Oxlint profile and environment overrides, removed the three orphan ESLint files, hardened safe stringification/WAB response parsing/SDK mutation-range governance, synchronized generated facts and docs, and patch-bumped affected source candidates. Final exact head de8c1576d passed CI 30329465728, CodeQL 30329465741, Conformance 30329465797, Codegen 30329465734, Dependency Review, Socket, all platform/infrastructure/coverage/mutation gates, Codecov 100% patch coverage (76 hits, 0 misses, 0 partials), and Sonar with 0 new issues, 0 hotspots, and 1.7% new duplication. There were no unresolved review threads or change requests. ty-everett recorded substantive exact-head COMMENT review 4793821231 and used the authorized SHA-pinned admin squash merge. Merged main@b51212277 has the identical reviewed tree d9c2b27f457c80f54ff2f17e6c0fb6ac23ca185a. Exact-main CI 30329963645 passed 53 jobs with the expected push-only Dependency Review skip; CodeQL 30329963621, Conformance 30329963683, Scorecard 30329963634, Docs 30329963665, and Codegen 30329963729 passed. Exact-main Sonar moved 1,105→935 open issues (−170), 1,101→931 smells, 196→138 major, 705→603 minor, 10→0 info, and 7,936→7,132 debt minutes; blocker 89, critical 105, and bugs 4 are unchanged because they are complexity/test-QA work. Cognitive complexity moved 26,129→26,103, code complexity 35,444→35,426, and duplicated lines 9,622→9,620 at 1.6%, with 0 vulnerabilities and 0 hotspots. Source candidates are @bsv/sdk@2.2.7, Wallet Toolbox core/client/mobile 2.4.10, @bsv/overlay-topics@1.6.5, @bsv/message-box-client@2.2.4, @bsv/overlay-express@2.4.5, and @bsv/simple@0.4.4. Lockfiles and vendored BDK artifacts are byte-unchanged; public CORS/CSP/origin behavior is unchanged. No package, release, tag, image, service, DNS, or secret was published or changed.
25 — broad documentation, operational uniformity, and safe production-quality closure	Complete	PR #383 established a machine-readable seven-service operations contract and generated reference; enforced real Docker health checks, non-root images, digest-pinned manifests, secret-free/config-driven YAML, disabled service-account tokens, and hardened application workload probes/resources/security contexts; repaired the Overlay runtime command/port contract; hardened Overlay/WAB/Wallet samples; added true post-bootstrap UHRP readiness; removed dynamic Firebase credential execution/logging from Message Box; made UHRP secret synchronization shell-free with private temporary files and guaranteed cleanup; validated Overlay environment boundaries; and made every retained plan explicitly authoritative, historical, resolved, or unapproved. Exact reviewed head a048d6d4a passed all 65 PR checks: both CodeQL languages, Sonar with 0 new issues/hotspots and 0.0% new duplication, Codecov with every modified coverable line covered, Dependency Review, Socket, seven service builds/tests/Linux images/Trivy scans, full package/platform/coverage/mutation matrices, docs, codegen, conformance, and merge gate. There were no review threads or change requests; ty-everett recorded substantive exact-head COMMENT review 4794201091 and used the authorized SHA-pinned admin squash merge. Merged main@f1a8f8271 has the identical reviewed tree 2e49f439c571e69956e76a3eb35d0f9cf55b757e. Exact-main CI 30332970100 passed 55 jobs with the expected push-only Dependency Review skip; CodeQL 30332970029, Conformance 30332970105, Codegen 30332970041, Scorecard 30332970122, and Docs 30332970043 passed. Exact-main Sonar moved 935→916 open issues, 931→912 smells, 105→101 critical, 138→133 major, 603→593 minor, and 7,132→7,042 debt minutes; vulnerabilities and hotspots remain 0, duplication remains 9,620 lines / 1.6%, and the quality gate is green. Dependabot and secret scanning remain zero; Scorecard CII registration #204 is the sole open code-scanning posture item. Source service candidates are chaintracks-server@1.0.11, @bsv/messagebox-server@1.1.15, @bsv/overlay-express-examples@2.1.19, @bsv/uhrp-lite@0.1.9, @bsv/uhrp-storage-server@0.2.11, @bsv/wab-server@1.4.12, and @bsv/wallet-infra@2.0.14; first-party dependency ranges remain on current installable releases until a separately authorized coordinated publication order exists. Public CORS/CSP/origin behavior and vendored BDK artifacts are unchanged. No package, release, tag, image, service, DNS, or secret was published or changed.
26 — broad documentation, release-readiness, observability, and remaining operations closure	Next	Complete the broad non-QA scope described above across all public packages and seven governed services. Required closure: uniform package API/migration/changelog ownership; per-service operator and observability contracts; justified telemetry consolidation or documented variance; remaining graceful-shutdown/disruption/topology/autoscaling guidance; safe production/config/docs Sonar remediation; exact source-candidate/dependency ordering without publication; generated/current docs facts; zero new Sonar issues/hotspots; patch coverage ≥90%; affected/root build/type/lint/format/test/audit/license/health/docs/codegen/conformance checks; CodeQL/Dependency Review/Socket/service image/platform/mutation/merge gates; resolved review threads; exact-SHA maintainer review/admin merge; exact-main remeasurement; tracker update; and no publication/deployment.

Audited baseline

Area	Current state	Program implication
Repository	37 workspace projects: 33 package-area projects, 30 public packages, 3 private package projects, plus root/docs/conformance	A uniform contract must cover all relevant profiles without forcing unlike packages into one build model.
Current releases	All 30 public package manifests match npm latest at audit time	The baseline is published, but every program source/manifest change must create and publish new patch versions.
CI	Latest audited CI run green; merge gate about 4m55s	Preserve coverage while optimizing the critical path, caching, fan-out, and redundant builds.
Conformance	Latest audited conformance run: 6,439 passed, 211 skipped, 6,650 total; 74 vector files	Required tests pass, but skips and documentation require ownership and correction.
Lint	846 warnings, 0 errors in audited non-mutating package run; changed-package lint is allowed to fail	Establish shared rules, a measured ratchet, then reach zero warnings and make lint blocking.
TypeScript	Root strictness disabled; 31 effective configs vary substantially	Adopt profile-based configs and progressively enable strict correctness options.
Coverage	Codecov about 66.97% overall; current project threshold applies only to SDK source; patch threshold 90%	Add tiered repository/package thresholds and close critical untested paths.
CodeQL	17 open alerts: 14 high, 3 medium	Triage and resolve every alert, then run security-extended queries.
Dependabot	6 open alerts: 4 medium, 2 low; repository security updates setting disabled	Resolve or evidence-dismiss every alert and enable security updates.
Secret scanning	Provider/non-provider/AI/validity/delegated/push protection enabled; 0 open alerts	Preserve this state and validate in completion evidence.
SonarCloud	1,529 unresolved issues: 1,494 smells, 26 bugs, 9 vulnerabilities; reliability D, security C	Fix repository findings now, eliminate generated-noise correctly, and later validate CI-based analysis with coverage.
Packaging	Missing lint/test/coverage scripts and manifest/license fields across multiple packages; no repository-wide packed-consumer validation	Define profile-specific package contracts and enforce them automatically.
Browser/performance	VeriFast is the only package with a substantial consumer/bundle test matrix and a hard browser-size budget	Establish Node, browser, bundler, React Native, CLI, and WASM profiles and budgets.
Containers/Kubernetes	Non-root multi-stage images are a good base; release provenance, image scanning/SBOM, immutable bases/tags, workload hardening, probes, and manifest/runtime agreement are incomplete	Harden release and deployment artifacts without changing examples into production secrets.
Documentation	Package READMEs exist, but versions/prerequisites/metrics/policies are stale or inconsistent and examples are not compiled	Create enforceable documentation contracts and generated/current facts.

Published package baseline (manifest = npm latest at audit time)

Package	Version
@bsv/amountinator	2.1.1
@bsv/wallet-helper	0.1.1
create-bsv-app	1.0.2
@bsv/did	0.2.1
@bsv/did-client	1.2.1
@bsv/fund-wallet	1.4.1
@bsv/simple	0.4.1
@bsv/templates	1.9.1
@bsv/authsocket	2.1.1
@bsv/authsocket-client	2.1.1
@bsv/message-box-client	2.2.2
@bsv/paymail	2.4.2
@bsv/402-pay	0.2.1
@bsv/auth	0.1.1
@bsv/auth-express-middleware	2.1.2
@bsv/payment-express-middleware	2.1.1
@bsv/teranode-listener	1.1.1
@bsv/gasp	1.3.1
@bsv/overlay	2.2.1
@bsv/overlay-discovery-services	2.1.1
@bsv/overlay-express	2.4.2
@bsv/overlay-topics	1.6.1
@bsv/sdk	2.2.0
@bsv/verifast	0.3.0
@bsv/btms	1.1.1
@bsv/btms-permission-module	1.1.1
@bsv/wallet-relay	0.2.2
@bsv/wallet-toolbox-client	2.4.4
@bsv/wallet-toolbox-mobile	2.4.4
@bsv/wallet-toolbox	2.4.4

Program end state

The program is complete only when all of the following are true:

• Zero open CodeQL, Dependabot, and secret-scanning alerts, except explicitly documented and unexpired evidence-based exceptions; zero high/critical exceptions.
• CodeQL runs the security-extended suite and Dependabot security updates are enabled.
• Zero known high/critical dependency or container vulnerabilities; lower-severity holds are owned, evidenced, and time-bounded.
• Package and image releases are reproducible, provenance-bearing, SBOM-producing, scanned, immutable, and traceable to source. Source controls are complete through PRs ci(security): harden container supply chain #340–fix(deps): ignore placeholder container image #342 and Harden npm package release supply chain #372; keep this final gate open until a real npm release and the final image inventory retain production evidence.
• Zero lint warnings and errors; lint is required and cannot continue-on-error.
• All TypeScript projects use approved strict profile configs, with no unexplained local relaxation.
• Every package conforms to its declared package profile for manifests, licensing, build, typecheck, lint, test, coverage, packed tarball, exports, and consumer validation.
• Overall coverage is at least 80%; Tier 0/1 packages are at least 85% line and 80% branch coverage; patch coverage remains at least 90%; no critical source module remains at 0%.
• No assertion-free tests, incomplete assertions, unexplained/expired skips, or accidental passWithNoTests remain.
• Required conformance passes 100%; every intended skip has a reason, owner, and removal/unsupported decision.
• Node ESM/CJS, browser bundlers, React Native/mobile, CLI, and WASM/worker contracts are tested where applicable.
• Public protocol services retain default arbitrary-origin interoperability, with regression coverage for wildcard/no-credentials, opaque Origin: null, preflight, exact allowlist, credentialed exact-origin, disabled-CORS, and CSP-independence behavior.
• Bundle and benchmark baselines/budgets are enforced with noise-aware regression policy.
• Documentation facts are generated/current, examples compile/run, packages have complete usage/security/compatibility/migration guidance, and operational runbooks are accurate.
• Sonar reliability and security ratings are A; zero open vulnerability, bug, blocker, critical, or untriaged issue remains. Generated artifacts are excluded by ownership, not by hiding real source/test findings.
• Sonar bulk: auto-fixable code style smells (~1,200 issues) #43, Sonar: 250+ functions exceed cognitive complexity threshold #44, Sonar: 138 issues around error handling, dead code, and TODOs #45, Sonar: duplication — 9,792 duplicated lines (4.8%) across 139 files in 439 blocks #46, and Sonar: long-tail TypeScript smells (~600 issues across 50+ rules) #48 are closed with evidence.
• The final package-version matrix and infrastructure release inventory are recorded here after the last release-sync PR lands.

---

Execution program

0. Establish the authoritative ledger and guardrails

• Add a machine-readable repository health inventory covering each workspace’s owner/profile, publishability, runtime targets, build/test/lint/typecheck/coverage commands, release mechanism, and criticality tier.
• Add a package-contract validator and a CI job that reports missing or divergent fields/scripts before enforcement begins.
• Add the exception registry schema and validation: category, target, owner, reason, evidence, created date, review/expiry date, and removal condition.
• Record current package versions, CI durations, coverage, lint, skipped tests, security alerts, Sonar counts, bundle sizes, and benchmark measurements as versioned baselines.
• Define package criticality tiers and coverage/security/performance expectations. At minimum, SDK, wallet, auth/payment middleware, overlay/storage, credential, and network-edge code belong to Tier 0/1.
• Add PR templates/checklists for dependency changes, security changes, package release impact, browser/runtime impact, documentation, and evidence links.
• Confirm branch/ruleset behavior: required merge checks, resolved conversations, one maintainer approval, maintainer/admin bypass, no last-pusher restriction, and ty-everett able to approve/merge.
• Preserve generated-file ownership/exclusion boundaries explicitly. Do not exclude all tests or broad source areas to make quality metrics pass.

Exit: every project and every exception is owned, machine-inventoried, and mapped to a program gate; future drift is visible in CI.

1. Eliminate immediate security alerts

1.1 CodeQL: resolve all 17 audited alerts

• Fix CodeQL chore(deps): bump actions/upload-artifact from 4 to 7 #14: validate the VC context in packages/helpers/simple/src/modules/credentials.ts using exact parsed URL/origin/allowed-value semantics instead of substring .includes(VC_CONTEXT) matching.
• Fix Sonar follow-up: add unit tests for entityValidationHelpers + StorageClientBase (covers gate) #61: replace the attacker-controlled plain-object key map in packages/sdk/src/transaction/BeefParty.ts with Map, Set, or a null-prototype structure and add prototype-pollution regression tests.
• Fix test(wallet-toolbox): unit tests for entityValidationHelpers (#61) #62: remove the global NODE_TLS_REJECT_UNAUTHORIZED=0 behavior from packages/helpers/fund-wallet/index.ts; use trusted TLS by default and an explicit, tightly scoped development-only trust mechanism if genuinely required.
• Fix feat(conformance): full-coverage dispatcher refactor #73: bound and validate nominal word-array length/allocation in packages/sdk/src/primitives/BigNumber.ts; add adversarial resource-exhaustion tests.
• Fix refactor(wallet-toolbox): reduce cognitive complexity in WalletPermissionsManager #86: add least-privilege top-level/job-level permissions to .github/workflows/conformance.yml.
• Fix chore(sonar): address S2486 swallowed exceptions in sdk (kvstore/identity/http/primitives) #90: bound and validate recipient count and total work in infra/message-box-server/src/routes/permissions/getQuote.ts; add rejection and resource-limit tests.
• Fix chore(sonar): address S2486 swallowed exceptions in helpers #91 and chore(sonar): address S2486 swallowed exceptions in wallet-toolbox (privileged/CWI/knex/chaintracks) #92: validate/canonicalize objectID, prevent traversal and path escape, and prove the final path stays beneath the intended root in infra/uhrp-server-basic/src/routes/put.ts; test encoded, absolute, separator, symlink, and traversal variants.
• Fix refactor(wt+sdk): S3776 long-tail in manager + bignumber + contacts #100, refactor(wallet-toolbox): S3776 long-tail in storage #101, and refactor(wallet-toolbox): S3776 long-tail in services + chaintracks #102: apply a shared rate-limit policy to exposed WAB authentication/user routes, with trusted-proxy behavior and tests.
• Fix fix(sdk): NOSONAR comment for intentional Peer.ready listener registration #107 and chore(sonar): wave 7 sweep — helpers/middleware/btms/etc #108: apply the same policy to UHRP basic/cloud auth/payment middleware.
• Fix [codex] Rewrite @bsv/did as SD-JWT VC compatibility layer #112: prevent stack-trace/internal-error exposure in create-bsv-app UI while retaining safe diagnostics and server-side observability.
• Fix [ FEATURE ] utxo selection algo in ts wallet-toolbox #116 and [codex] Add BRC-38/39 wallet portability #117: rate-limit message-box payment/auth endpoints.
• Re-triage ci(release): scope build to tagged package and its workspace deps #120 against current wallet StorageServer code: PR fix(security): harden service request boundaries #327 and main-branch CodeQL confirmed that the post-authenticated limiter does not bound authentication middleware work, so the alert is genuine rather than fixed/stale.
• Fix ci(release): scope build to tagged package and its workspace deps #120 in Wave 3 with the shared pre-auth IP and post-auth identity rate-limit policy, including trusted-proxy and targeted coverage tests.
• Re-run CodeQL after each completed security wave and link the closed alerts to the fixing PR. Wave 3a evidence: main CodeQL 30152113925 closed the final eight audited alerts; the repository reported zero open alerts after analysis.
• Switch CodeQL to the GitHub-supported extended query suite and baseline the resulting findings without reducing query coverage. First extended run: 30174600730.
• Complete the WAB manual-review subwave in PR #333: bind verified identities to all target accounts, remove the OTP bypass, prevent live identity transfer, replace deletion prefixes with hashed/expiring/single-use sessions, validate public inputs, preserve public-by-default CORS, and close every PR Sonar/CodeQL result with evidence.
• Resolve or individually evidence-dispose the remaining extended findings: PRs fix(security): eliminate dynamic property injection #335–fix(security): eliminate file-system races #337 fixed all owned source findings with adversarial coverage; PRs ci(security): govern CodeQL source boundaries #338–Make advanced CodeQL scan authored languages only #339 established the exact generated boundary and advanced analysis. Generated alerts [DISCUSSION] createNonce / verifyNonce are misleading for auth — and redundant with signatures #168/New auth-proof package, simple authentication flow #169/build(deps): bump the bsv-workspace group across 1 directory with 39 updates #183 closed as fixed, BRC-104 handshake build(deps): bump actions/checkout from 4.3.1 to 6.0.2 #165 closed after exact-path/signed-dispatch evidence, and advanced run 30180480265 left zero open alerts without dismissals.

1.2 Dependabot and direct dependency remediation

Resolve all current alerts without broad permanent overrides:

• Remove the vulnerable React Router 6/SSG path; migrate the docs application to React Router 8.3.0 with repository-owned static rendering, deterministic route generation, safe hydration fallback, navigation/deep-link/404 browser smoke tests, and built-link validation.
• Remove vulnerable uuid@8.3.2 paths by deleting the unused message-box webpack-dev-server dependency, disabling implicit peer installation, and proving the installed graph contains no affected UUID copy.
• Normalize the Express/body-parser dependency graph onto the supported patched body-parser@2.3.x path.
• Remove the vulnerable tsup/esbuild path by replacing all three tsup builds with direct esbuild@0.28.1, preserving and testing CJS, ESM, declaration, source-map, and watch contracts as applicable.
• Enable repository Dependabot security updates and verify the repository security-analysis setting reports enabled.
• Re-run the frozen install, zero-finding pnpm audit, Dependabot/CodeQL/secret alert APIs, all package and coverage lanes, docs production/browser checks, all infrastructure image builds, and the complete merge gate.
• Keep the existing first-party @bsv/* Dependabot ignore only because release-sync owns those updates; document that ownership in the config and health inventory.
• Retain only the narrow brace-expansion@<=5.0.7 → 5.0.8 Jest security substitution; register its owner, GHSA evidence, 2026-08-25 review date, full-suite compatibility evidence, and removal condition (Jest adopting minimatch 10.2.5+).

Review other audited direct-major candidates deliberately; upgrade when compatible, or record an owned compatibility project with review date:

• @clack/prompts 0.7.0 → 1.7.0
• @testing-library/jest-dom 6.9.1 → 7.0.0 (with its explicit @testing-library/dom peer)
• better-sqlite3 12.11.1 → 13.0.1; use pnpm—not npm—to rebuild its single physical native binding in isolated CI lanes.
• Replace test-only CommonJS chalk@4.1.2 with current dual-module picocolors@1.1.1; Chalk 5 is ESM-only and broke the package’s CommonJS Jest contract.
• jest-fetch-mock 3.2.0 → 4.2.0
• puppeteer-core 24.43.1 → 25.3.0
• Remove unused webpack-dev-server@5.2.6 instead of carrying or upgrading an unnecessary server and advisory tree.
• Complete the TypeScript 7 migration (6.0.3 → 7.0.2). PR build: adopt TypeScript 7 with a supported tooling boundary #373 migrated all 43 governed manifests to the native 7.0.2 compiler plus the official TypeScript 6 compatibility API required by ts-jest@29.4.12, with no peer override; the complete declaration, build, consumer, conformance, browser/mobile, infrastructure, mutation, audit, and security matrices passed on the exact PR head and merged main.

1.3 Service-edge security review and shared controls

• Inventory every HTTP endpoint’s authentication, authorization, rate limit, CORS, body/file-size limit, timeout, validation, error exposure, replay behavior, and resource quota.
• Replace ad hoc rate limiting with shared, configurable policies for authentication, payment, quote, upload, storage, faucet, deletion/share, and general API traffic. Correctly handle reverse proxies and distributed deployments.
• Replace extreme body limits unless proven necessary: UHRP basic raw body 2gb and JSON 1gb; UHRP cloud JSON 1gb; message-box JSON 1gb; overlay-express JSON/raw 1gb. Use streaming plus endpoint-specific quotas for large payloads.
• Keep public protocol services—especially Overlay, WAB, UHRP/Storage, message-box, and chaintracks—browser-accessible by default with credential-free wildcard CORS (including opaque Origin: null callers such as mobile webviews). Provide configurable exact allowlists, credentialed exact-origin mode, or disabled CORS as operator opt-ins; never combine wildcard origin with credentials.
• Add a shared security-header baseline (for example Helmet or equivalent explicit headers), with CSP decisions appropriate to APIs/docs/browser apps.
• Standardize request/response timeouts, maximum concurrent work, upload quotas, abort handling, and safe backpressure.
• Review filesystem, SQL/query, URL, header, template, command, archive, and redirect boundaries across services; add negative tests for traversal, injection, SSRF, prototype pollution, and resource exhaustion.
• Review authentication/session/token/certificate/payment flows for replay, timing, key handling, default secrets, logging leakage, and authorization gaps.
• Produce package/service threat models and security assumptions for every Tier 0/1 boundary.
• Run a manual repository security review and document findings, dispositions, and retest evidence.
• Commission an independent external review for cryptographic, wallet, payment, and public-network surfaces when scope/procurement are available; track this as defense-in-depth assurance rather than treating it as a substitute for repository controls.

Exit: no open CodeQL/Dependabot/secret alert, no high/critical vulnerable runtime path, and every exposed edge has a documented and tested policy.

2. Harden CI/CD and software supply chain

• Change full-workspace install steps in CI/docs/codegen workflows to avoid unrestricted lifecycle scripts. Use --ignore-scripts by default plus an explicit, audited rebuild allowlist for packages that genuinely require native/generated artifacts.
• Replace all three npx openapi-typescript@latest invocations with a lockfile-pinned workspace dependency and deterministic package script.
• Pin datamodel-code-generator and transitive Python tooling; prefer an isolated locked environment and binary-only/hash verification where practical. Do not install an unpinned latest package in CI.
• Preserve SHA-pinned GitHub Actions and add automated action-SHA update/review policy.
• Add explicit least-privilege workflow permissions everywhere and separate read/test privileges from publish/deploy privileges.
• Make infrastructure releases reproducible: PR ci(security): harden container supply chain #340 commits and validates the standalone infrastructure lockfiles, rejects lock drift, and builds from the frozen graph rather than resolving a fresh release graph.
• Enable release provenance for infrastructure artifacts: PR ci(security): harden container supply chain #340 replaces the former provenance: false path with signed GitHub artifact attestations bound to the source commit, image digest, and workflow identity.
• Generate CycloneDX or SPDX SBOMs for npm tarballs and container images; PR ci(security): harden container supply chain #340 covers every governed image and PR Harden npm package release supply chain #372 produces one CycloneDX SBOM per npm tarball plus a 330-component aggregate. PR fix: make coordinated release artifacts reproducible #378 additionally proves coordinated unpublished source candidates resolve their complete runtime/optional/peer closure only from exact staged tarballs, with portable and byte-reproducible source-only evidence and no registry fallback.
• Scan dependencies, built tarballs, workflow configuration, secrets, licenses, and container images. CI/release now combine frozen audit, Dependency Review, CodeQL, secret scanning, Socket, complete license inventory, and blocking Trivy high/critical scans, with only governed time-bounded exceptions.
• Pin container base images by digest and automate reviewed refreshes; PRs ci(security): harden container supply chain #340 and fix(deps): ignore placeholder container image #342 enforce governed digest refreshes without mutable placeholder drift.
• Use immutable image tags/digests for deployments and release evidence; PR ci(security): harden container supply chain #340 deploys and records release-specific image digests and rejects mutable latest references at the release boundary.
• Add OCI labels for repository, source commit, version, build date, licenses, and revision across every governed image; PRs fix(wab): bind verified identities to account operations #333 and ci(security): harden container supply chain #340 complete and enforce the label set.
• Produce signed/attested provenance for images and packages and document verification instructions; PR ci(security): harden container supply chain #340 covers images and PR Harden npm package release supply chain #372 covers exact npm tarballs/SBOMs with repository, workflow, ref, and SHA verification.
• Add OpenSSF Scorecard repository posture checks and triage findings through this program; PR fix(security): remediate Scorecard findings #341 made the check persistent and Wave 12 closed the fuzzing posture finding. OpenSSF/CII registration remains the separately tracked external posture gap.
• Update SECURITY.md only after claimed controls exist and clearly distinguish completed from pending controls. PR Harden npm package release supply chain #372 now documents the implemented package-artifact SBOM, scan, license, OIDC/provenance, attestation-verification, integrity-reconciliation, retry, evidence-retention, and incident-response boundaries alongside the previously completed container and source controls.

Exit: a clean checkout can deterministically build, test, pack, attest, scan, and publish every artifact without mutable tool downloads or unrecorded dependency resolution.

3. Define and enforce the uniform package contract

Use profile-specific rules rather than pretending every package is identical. Profiles must cover: Node-only library/service, dual ESM/CJS library, browser-capable library, CLI/scaffolder, React Native/mobile, and WASM/worker.

3.1 Manifest and repository hygiene

• Add a root license and settle the repository’s authoritative licensing model: Open BSV License Version 6, authorized by the repository administrator and pinned to the current BSV Association/Teranode text and SHA-256.
• Ensure every public package’s license field, shipped license file, root license, source headers where required, and npm tarball agree. All 30 public dry-pack payloads are enforced in the release workflow.
• Legally resolve every formerly missing or ambiguous package license—including amountinator, did, did-client, fund-wallet, auth, teranode-listener, overlay-topics, btms, btms-permission-module, wallet-relay, and Wallet Toolbox children—on the same exact Open BSV License Version 6 text.
• Fix every missing or stale license manifest declaration/file/allowlist/lock root, remove legacy filenames and conflicting v4/v5/MIT/ISC package declarations, and enforce all 46 npm package projects plus seven OCI metadata records against drift.
• Standardize all 30 public packages on the enforced engines.node: ">=22" consumer contract while retaining Node 24.11+ for contributors, CI, and releases.
• Repair Amountinator’s real packed-consumer/export contract. PR fix(amountinator): enforce package artifact contract #347 now verifies its exact tarball with strict publint/type analysis plus clean ESM and CommonJS consumers; create-bsv-app retains its documented CLI exception, and wallet-toolbox preserves its published legacy SDK subpath.
• Normalize declaration metadata for non-CLI packages and verify create-bsv-app’s CLI-only exception.
• Declare and enforce the sideEffects contract across all 30 public packages; the repository audit found no package import-time CSS side effects requiring an exception.
• Add files allowlists for overlay-topics, btms-permission-module, wallet-toolbox-client, and wallet-toolbox-mobile, and verify the changed tarballs do not include tests/specs.
• Normalize and enforce publishConfig.access: "public" for all 30 public packages.
• Add missing homepage/bugs metadata, including create-bsv-app and VeriFast where still absent.
• Normalize repository, author/organization, keywords, funding/support, package manager, Node support, and provenance metadata.
• Add automated exact-tarball validation plus publint and @arethetypeswrong checks for every publishable package. PRs fix(amountinator): enforce package artifact contract #347, chore(packages): enforce wallet helper and auth profiles #348, Harden Fund Wallet and 402 Pay package profiles #350–Harden and standardize BTMS packages #352, Modernize helper package distribution contracts #354, chore: enforce helper formatting and coverage gates #356–Harden and standardize the Message Box stack #359, and Harden and standardize Auth and Payment Express middleware #361–Harden Overlay package profiles and release contracts #363 establish the shared checker and complete all 30 strict public-package profiles, including exact local-tarball dependency installation for the final Overlay chain.

3.2 Required scripts and build/type profiles

• Provide non-mutating lint, format:check, typecheck, test, coverage, build, and pack:check scripts wherever applicable; document profile-specific exceptions.
• Add lint scripts to teranode-listener, verifast, btms-permission-module, and wallet-relay. The completed public-package profile waves enforce warning-free lint across all 30 packages.
• Add tests to btms-permission-module. Wallet Toolbox Client/Mobile consumer, runtime, browser, mobile, and coverage targets are complete in PR Standardize wallet platform builds and Open BSV licensing #351; justified CLI/profile exceptions remain explicit.
• Add coverage scripts to create-bsv-app, btms-permission-module, and wallet-relay. The completed profiles include create-bsv-app’s explicit generated-project/CLI coverage contract and enforce package-appropriate coverage behavior.
• Add explicit typecheck coverage beyond the former VeriFast/wallet-relay-only scripts. All 30 public-package profiles now expose and enforce package-appropriate type checking, including declaration and packed-consumer resolution where applicable.
• Replace the private wallet examples’ mutating Prettier-write “lint” behavior with non-mutating checks.
• Remove or migrate the three stale ESLint config files after the shared Oxlint standard is enforced. PR refactor: resolve broad Sonar findings #382 added the governed root/environment Oxlint profiles first, then removed the orphan Message Box Server, Wallet Infra, and Overlay Express ESLint files.
• Keep build implementations profile-appropriate (tsc, dual conversion, tsup, Rspack/UMD, WASM) while standardizing their external contract and validation.
• Remove unnecessary rebuilds from the 14 test scripts that currently rebuild packages when CI has already produced the same artifact; retain rebuilds only where they prove a distinct packed/consumer contract.

Exit: the package-contract validator is blocking and every package passes the rules for its declared profile.

4. Make linting and formatting uniform and blocking

Audited lint warning distribution: 846 total; 516 no-unused-vars, 282 unicorn/no-new-array, with approximately 544 in tests/benchmarks and 302 in production. SDK accounts for about 362 and wallet-toolbox 295.

• Create shared root Oxlint rules and profile overrides for source, tests, benchmarks, generated code, browser, Node, and React Native. PR refactor: resolve broad Sonar findings #382 added the root profile plus Node, browser, React Native, test, config, infrastructure, generated, and vendored ownership overrides.
• Establish a non-increasing warning baseline per package/rule immediately; CI fails if a PR adds warnings.
• Remove warnings in controlled waves: correctness/security first, production unused/dead code next, then tests/benchmarks and style rules.
• Investigate every unused symbol before deletion; distinguish dead exports from intentionally public API and generated/ambient declarations.
• Replace unsupported/unnecessary new Array usage while preserving intentional sparse arrays and performance-sensitive cases with tests/benchmarks.
• Standardize formatting with a single root configuration and non-mutating format:check; exclude generated artifacts narrowly.
• Remove continue-on-error: true from changed-package lint.
• Add --deny-warnings (or equivalent) to package lint only after each package reaches zero; make the repository gate blocking.
• Add editor/config documentation so contributors run exactly the CI rules locally.

Exit: zero warnings/errors, zero mutating lint commands, and lint/format are required merge checks.

5. Progressive TypeScript correctness modernization

Audited effective-config state across 31 configs: strict 11, strictNullChecks 16, noImplicitAny 9, useUnknownInCatchVariables 11, noImplicitOverride 2, noFallthroughCasesInSwitch 1, and zero use of noUncheckedIndexedAccess, exactOptionalPropertyTypes, noUnusedLocals, or noUnusedParameters. Targets/modules/resolution are mixed; wallet client/mobile have no independent local tsconfig.

• Define shared base profiles for Node library/service, dual ESM/CJS, browser, React Native/mobile, CLI, test, and WASM/worker.
• Align supported Node targets, lib declarations, module/moduleResolution, declaration/source-map settings, interop, and package engines with the tested runtime matrix.
• Enable and remediate strictNullChecks, noImplicitAny, useUnknownInCatchVariables, noImplicitOverride, and noFallthroughCasesInSwitch in staged package waves.
• Then evaluate/enable noUncheckedIndexedAccess and exactOptionalPropertyTypes for new/critical code, expanding after migration evidence.
• Use lint for unused values unless TypeScript’s unused flags produce a demonstrably better uniform result; make one explicit repository decision.
• Add local configs or explicit inherited-profile validation for wallet-toolbox-client and wallet-toolbox-mobile. PR Standardize wallet platform builds and Open BSV licensing #351 supplies explicit TypeScript build/test profiles and validates declarations from exact tarballs in ESM, CommonJS, browser, Metro, and Hermes consumers.
• Forbid unexplained per-package relaxations; every temporary relaxation enters the exception registry with expiry.
• Run declaration, packed-consumer, ESM/CJS, browser, mobile, and conformance checks after each strictness wave.
• Complete the Wave 16 TypeScript 7 compatibility migration. PR build: adopt TypeScript 7 with a supported tooling boundary #373 uses the supported native-compiler/official-compatibility-API split, keeps codegen isolated, uses no peer override or suppressed compiler regression, and passed the full profile matrix on exact head and main.

Exit: all projects inherit approved strict profiles and local differences are documented, tested, and minimal.

6. Correct and expand automated testing

6.1 Fix test-quality defects

• Fix the four critical Sonar incompatible-equality assertions, including WAB shareService boolean-vs-number and message-box string-vs-number assertions; confirm whether the implementation or expectation is wrong before changing either.
• Replace incomplete expect statements and assertion-free tests with behavioral assertions, or explicitly reclassify non-test setup files.
• Enforce assertion presence where appropriate (expect.hasAssertions/expect.assertions or framework/lint equivalent), especially for async/error paths.
• Audit the remaining 120 skipped cases (126 audited baseline minus six Wallet Helper cases reactivated in PR chore(packages): enforce wallet helper and auth profiles #348). Every retained skip must state reason, owner/upstream dependency, and removal condition/date; CI rejects new anonymous skips.
• Remove passWithNoTests from projects expected to have tests. PR Harden Fund Wallet and 402 Pay package profiles #350 removed the Paymail examples placeholder, and PR Standardize repository quality profiles #364 replaced the remaining empty-suite allowances—including both UHRP services—with real tests and drift-blocking repository-health controls. No active package script uses passWithNoTests.
• Test error and rejection branches currently hidden by swallowed exceptions; eliminate the 50 audited swallowed-exception findings with explicit handling/assertions.
• Add deterministic clocks, randomness, network, database, and filesystem fixtures; quarantine genuine flaky tests with ownership and expiry rather than retrying indefinitely.

6.2 Risk-based coverage program

Audited approximate aggregate coverage is 66.97% (543 files; 46,259 lines; 30,981 hit; 11,619 missed; 3,659 partial). Low package aggregates include p2p ~6%, simple ~36%, message-box-client ~43%, overlay-topics ~44%, overlay ~45%, overlay-express ~49%, BTMS ~53%, payment middleware ~57%, VeriFast ~59%, templates ~60%, wallet-toolbox ~61%, discovery ~62%, auth-express ~63%, BTMS backend ~63%, DID ~77%; GASP and SDK are about 85%.

• Publish a file/package coverage inventory with criticality, not merely a global percentage.
• Add per-package Jest/provider thresholds and Codecov component flags; keep patch coverage at 90%.
• Raise overall coverage in staged ratchets to at least 80% without excluding difficult real source.
• Reach at least 85% line / 80% branch for Tier 0/1 code, prioritizing auth, payment, credentials, wallet/storage, transaction/crypto, overlays, path/upload, and network boundaries.
• Eliminate critical 0%-covered modules, especially p2p core and overlay topic lookup/storage implementations.
• Add tests for did-client, which still lacks package test files; PR Harden Fund Wallet and 402 Pay package profiles #350 added 12 focused Fund Wallet tests with 92.23% line and 93.15% branch coverage. Add btms-permission-module and wallet client/mobile target coverage as above.
• Add meaningful suites to infra chaintracks, overlay, wallet-infra, and UHRP basic, all audited at zero tests. Expand UHRP cloud, message-box, WAB, and notifier beyond their small current suites.
• Add database-contract tests for supported SQLite/MySQL/Postgres/cloud adapters and migration/transaction/concurrency behavior.
• Add end-to-end container/service tests for auth/payment/storage/upload/overlay/message flows with safe ephemeral dependencies.
• Add browser tests for documentation routing/examples and public browser packages; add mobile/Metro smoke tests for React Native targets.
• Add property-based tests for parsing, serialization, transactions, scripts, cryptographic encodings, Merkle/proof structures, path/URL validation, and protocol messages. Completed by PR Govern stack-wide property fuzzing and test quality #365 across 25 packages and 88 independent properties; all 33 package manifests are governed.
• Run bounded generative property campaigns for untrusted binary/JSON/network inputs. PR suites enforce at least 300 fast-check cases/property; the weekly/manual workflow runs 5,000 cases/property with seed/path replay and retained failure logs (PR Govern stack-wide property fuzzing and test quality #365).
• Add true coverage-guided fuzz targets with evolving corpora, deterministic regression replay, crash minimization/promotion, and longer scheduled discovery. Deferred final-QA WIP is preserved at codex/stack-wide-fuzzing@63485ce3c: 29 governed Jazzer.js targets cover all 29 implementation packages and all eight stack areas, but corpus replay currently stops at a known empty-input harness bug and the workflows/docs/full campaigns/PR/merge/exact-main gates remain open.
• Run mutation testing across every governed property suite and use surviving mutants to identify superficial coverage. Completed by PR Validate stack fuzzing with mutation testing #369 across 25 packages/targets: 3,073 valid mutants, 2,662 detected, 411 survived, 86.63% aggregate, per-target 80.30–100%, and zero uncovered or invalid mutants; affected PR and scheduled full campaigns are enforced.

6.3 Manual/live test governance

• Inventory and classify all 40 manual/live/resource files. PR Govern stack-wide property fuzzing and test quality #365 governs 37 Wallet Toolbox operator-only files, two public-network scheduled-live files, and one SDK resource-intensive file with exact filename rules, ownership, prerequisites, expected results, cleanup, cadence, invocation, and review dates.
• Convert deterministic manual tests to automated integration/contract tests.
• Run environment/credential-dependent tests on an owned nightly/weekly/release schedule with secret-safe logging, alerting, and a documented operator response.
• Give every retained manual test prerequisites, expected result, cleanup, cadence, owner, last-run evidence, and failure escalation.

Exit: thresholds are enforced; critical paths are deeply tested; empty, assertion-free, unexplained skipped, and silently flaky suites are gone.

7. Make conformance complete and truthful

• Correct documentation to the audited 6,650 tests / 74 vectors, or preferably generate counts from the runner so they cannot drift.
• Separate required, optional, environment-dependent, unsupported, and not-yet-implemented capabilities in machine-readable metadata.
• Inventory all 211 skipped cases. Reconcile the current intended-skip set (audited as roughly 204 plus 8 explicit skip entries with overlap) and eliminate accidental/duplicate classification.
• Give every intended skip a stable ID, capability, reason, owner, dependency, and removal/unsupported decision.
• Remove or implement no-op/non-implemented runner paths across wallet, storage, broadcast, messaging, and overlay behavior.
• Build funded-wallet, certificate, overlay, storage, and broadcast harnesses where the capability is supported; otherwise mark the capability formally unsupported with documented rationale.
• Preserve 100% pass for required cases and fail CI on new unregistered skips, changed vector counts, or missing capability ownership.
• Publish human-readable per-package conformance matrices and machine-readable results as CI artifacts.

Exit: conformance reports exactly what is supported, every non-run case is intentional and owned, and the published numbers match CI.

8. Browser, runtime, package-splitting, and bundle standardization

• Assign every public package one or more consumer profiles: Node ESM, Node CJS, browser ESM, browser bundler, UMD/global, React Native/Metro, CLI, and WASM/worker.
• For every publishable package, install the packed tarball into clean consumer fixtures; test declared imports, types, subpath exports, sourcemaps, and runtime behavior rather than importing workspace source.
• Test Node ESM and CJS wherever declared. Remove formats that are not actually supported instead of shipping unverified metadata.
• Add at least Vite and one independent bundler fixture for browser-capable packages; verify tree shaking, minification, dynamic imports, worker loading, and no accidental Node builtin/polyfill leakage. PR Standardize wallet platform builds and Open BSV licensing #351 completes the Vite+esbuild packed-consumer boundary for Wallet Toolbox Client, and PR Harden and standardize the Message Box stack #359 adds Vite, esbuild, and UMD packed-browser validation plus bundle budgets for Message Box Client; remaining browser-capable packages stay open.
• Add React Native Metro/Hermes smoke builds for mobile targets. PR Standardize wallet platform builds and Open BSV licensing #351 completes the packed Metro+Hermes contract and budgets for Wallet Toolbox Mobile; apply the same profile to any additional package that advertises mobile support.
• Add a reusable public-service browser-policy contract matrix for Overlay/Overlay Express, WAB, UHRP/Storage, message-box, chaintracks, and future public APIs: arbitrary-origin and Origin: null access by default without credentials; preflight correctness; opt-in exact allowlists; opt-in credentialed exact-origin mode; opt-in disabled CORS; rejection of wildcard-plus-credentials; and proof that CSP configuration remains independent from API CORS behavior.
• Add CLI packed-install, --help, invalid-input, project-generation, generated-project install/build/test, and cross-platform path tests for create-bsv-app and other CLIs.
• Add WASM/worker loading, CSP, streaming/fallback, browser/node, and package-path tests where applicable.
• Review deep wildcard exports, conditional exports, types conditions, optional adapters, peer dependencies, and side-effect declarations for API stability and minimal bundles.
• Define raw, minified, gzip, and Brotli budgets for SDK, simple, VeriFast, and other browser-facing entrypoints. PR Standardize wallet platform builds and Open BSV licensing #351 establishes enforced Wallet Toolbox browser/mobile raw+gzip+Brotli budgets; VeriFast retains its existing 300 KB model.
• Produce bundle composition reports and fail on unexplained budget regression; require explicit approval and changelog entry for intentional growth.
• Standardize code splitting/lazy loading for large optional adapters and keep Node-only dependencies out of browser entrypoints.

Exit: every advertised runtime/import format works from the published artifact and browser/mobile bundles have enforceable size/composition contracts.

9. Performance engineering and CI speed without lost coverage

9.1 CI critical path

• Capture per-job and per-step timing, cache hit rate, queue time, CPU/memory utilization, artifact transfer, and variance for at least 20 representative runs.
• Build a workspace dependency graph and run changed packages plus affected dependents in parallel for PR feedback, while retaining a complete merge/nightly/release validation path.
• Split independent lint, typecheck, unit, integration, package-contract, docs, conformance, CodeQL, container, and consumer tests into balanced parallel shards.
• Use historical timing to balance slow test shards rather than equal file counts.
• Eliminate the 14 redundant package rebuilds from test scripts where CI already built identical outputs; share immutable build artifacts only when doing so preserves clean-consumer validation.
• Cache the pnpm store, tool downloads, browser binaries, generated code, and deterministic build outputs with lockfile/toolchain/config keys. Do not cache mutable workspaces or security-sensitive results incorrectly.
• Avoid repeated full pnpm install, Node setup, and archive upload/download across jobs where a safe reusable setup/composite action or job layout is faster.
• Optimize docs/conformance setup and run independent vector groups concurrently while preserving deterministic aggregate reporting.
• Keep fail-fast behavior for quick deterministic gates, but always retain security/result aggregation needed to report the complete failure state.
• Bound and decouple non-blocking external coverage publication from the merge-critical path while preserving every coverage test and the Codecov upload/report. Evidence: in CI 30175242619, all coverage shards finished in about 2m12s but Coverage / aggregate upload took 4m48s almost entirely inside the Codecov action.
• Add a CI performance budget and trend report. Require evidence before accepting a material regression in median/p95 duration.
• Validate that optimized PR, merge, scheduled, and release workflows exercise the same required checks at the appropriate confidence level; no coverage disappears because a diff detector was wrong.

9.2 Runtime benchmarks

• Expose and document SDK’s 11 benchmark files through package scripts and scheduled CI.
• Standardize the wallet action-batch/ancestor, auth performance, VeriFast, and other benchmark harnesses with fixed datasets, warmup, iterations, environment metadata, and statistical comparison.
• Establish stable nightly baselines; gate PRs only on high-signal size/algorithmic regressions with noise thresholds and rerun policy.
• Add memory/allocation, startup, import, serialization, database, proof/crypto, and representative end-to-end latency measurements where they affect users.
• Track benchmark artifacts historically and document how to reproduce locally.

Exit: CI is materially faster with unchanged required coverage, measured median/p95 budgets, and stable bundle/runtime regression detection.

10. Documentation and developer-experience overhaul

• Define a README contract for each package: purpose/status, install, minimal typed example, API/import paths, runtime/browser compatibility, Node support, peer dependencies, security considerations, test/conformance status, migration/versioning, support, and license.
• Compile/typecheck/run documentation examples against packed packages in CI; do not rely only on frontmatter/link/SSG checks.
• Generate package/version/support/conformance/coverage facts from manifests and CI artifacts to prevent manual drift. PR chore: enforce stack documentation and package coherence #374 now generates package, version, support, runtime, and conformance facts; authoritative aggregate coverage facts remain part of the final QA phase.
• Resolve runtime prerequisite contradictions: root README says Node 22+, root engine requires Node 24.11+, guides say Node 20+, and infra docs/images reference Node 20–24. Choose and test one support policy per profile.
• Rewrite stale April 2026 reliability/spec material that still describes pre-consolidation repositories and obsolete versions (for example SDK 2.0.14, wallet 2.1.22, and message-box without CI).
• Update the dependency policy so it matches reality and the intended gate: package lint must truly fail after the ratchet, first-party package ownership is clear, and security response/exception timelines are explicit. PR build: adopt TypeScript 7 with a supported tooling boundary #373 documented the compiler/API boundary and owned parent-scoped qs exception; PR chore: enforce stack documentation and package coherence #374 integrates those facts into the enforced contributor and operator path.
• Update the security policy to reflect implemented controls, disclosure/triage expectations, supported versions, threat models, SBOM/provenance verification, and fuzz/security-test cadence.
• Update conformance docs/counts and package capability matrices from generated results.
• Add API/declaration documentation and migration guides for all public packages, especially breaking dependency/runtime/exports changes. Wave 26 performs the full 30-package inventory and closes the coherent gaps.
• Document browser/Node/mobile/CLI/WASM profiles, bundle budgets, supported import forms, tree-shaking expectations, and troubleshooting.
• Document release workflow, affected-package versioning, OIDC/provenance, release-sync PRs, infra images, rollback, and verification. PR Harden npm package release supply chain #372 completed the npm artifact, OIDC, attestation, integrity, retry, and recovery reference; PR chore: enforce stack documentation and package coherence #374 integrates affected-package versioning, release-sync operations, image rollout, verification, and end-to-end rollback into one operator path.
• Complete service operation docs: configuration and secret names (never values), metrics/logs/traces, SLOs, alerts, dashboards, deploy validation, rollback, incident response, and disaster recovery. PR chore: enforce stack documentation and package coherence #374 supplies the common release/rollback/incident baseline; PR feat: govern and harden service operations #383 now generates the exact seven-service port, liveness/readiness, state, migration, backup, and operator-guide contract and adds Overlay/WAB/Wallet sample-deployment guides. Wave 26 owns the remaining per-service configuration, observability, SLO/alert/dashboard, incident, and disaster-recovery detail.
• Archive or clearly supersede stale one-time plans under plans/; retain decision history without presenting completed/obsolete plans as current policy. PR feat: govern and harden service operations #383 adds the plans authority index and marks every retained plan historical/resolved/unapproved as appropriate.
• Enforce documentation freshness (last_verified or generated equivalent), ownership, broken internal/external links, snippets, frontmatter, navigation, and 90-day review for high-risk docs.
• Complete changelogs/release notes for the 18 public packages without changelogs, or adopt a uniform generated changeset/release-note mechanism. Wave 26 owns one repository-wide solution and its CI/release-workflow enforcement.

Exit: a new contributor or consumer can install, build, test, publish, operate, migrate, and troubleshoot from current verified documentation alone.

11. Infrastructure, container, and operational uniformity

• Add container health checks where meaningful and Kubernetes readiness, liveness, and startup probes tied to real service readiness. PR feat: govern and harden service operations #383 gives all seven governed Docker images real HTTP health checks and enforces application-workload probes; UHRP /ready now remains unavailable until bootstrap completes.
• Finish pod/container security contexts. PR feat: govern and harden service operations #383 enforces runAsNonRoot, read-only root filesystem, allowPrivilegeEscalation: false, dropped capabilities, seccomp, writable ephemeral mounts, and disabled service-account tokens for every checked-in application workload, plus full hardening for the Overlay janitor. Wave 26 must either harden the MySQL/Mongo sample templates consistently or explicitly classify/document their operator-owned stateful-security boundary.
• Complete graceful shutdown/preStop/termination handling, disruption/topology policy, and autoscaling guidance. PR feat: govern and harden service operations #383 adds enforceable requests/limits to all checked-in application workloads and database samples; lifecycle and availability-policy completion remains Wave 26 work.
• Replace mutable image references with release version plus digest. PR feat: govern and harden service operations #383 makes every checked-in workload/example image immutable and adds repository enforcement; sample application versions remain deliberately tied to currently published digests, not unpublished source candidates.
• Remove hard-coded example database credentials from deployable manifests; clearly separate non-production examples and document secret injection/rotation. PR feat: govern and harden service operations #383 replaces literal credentials with ConfigMap/Secret references, documents injection, and rejects Secret manifests or secret-like literals across all governed YAML roots.
• Verify every Dockerfile/manifest command against the final image contents. PR feat: govern and harden service operations #383 repairs the Overlay command and port mismatch, validates manifests with the Kubernetes client dry-run, and builds/tests/scans all affected Linux images in hosted CI.
• Keep images non-root and multi-stage; validate runtime filesystem ownership and avoid copying build/dev dependencies. PR feat: govern and harden service operations #383 enforces non-root execution for all seven governed service Dockerfiles; existing locked multi-stage production-image construction and hosted builds remain green.
• Consolidate the duplicated telemetry implementations across six services into a tested shared package/configuration where deployed compatibility is proved, or document intentional deviations. Wave 26 must review initialization order, exporter/config compatibility, failure behavior, and package/runtime coupling before accepting an abstraction.
• Standardize structured logging, correlation/request IDs, metrics, traces, health schemas, redaction, sampling, and error classification.
• Define SLOs, alerts, dashboards, operator runbooks, release validation, and rollback evidence for each deployable service.
• Test container startup, probes, migrations, configuration failure, graceful shutdown, and a minimal service transaction in CI. Docker build, lint, unit-test, vulnerability-scan, command/probe policy, and manifest dry-run coverage are complete; runtime transaction/failure/shutdown testing remains intentionally in the final QA phase.
• Validate SBOM, image scan, provenance, signature, base digest, and source/version OCI labels before release. PRs ci(security): harden container supply chain #340–fix(deps): ignore placeholder container image #342 and Harden npm package release supply chain #372 implement the blocking source/release gates; PR feat: govern and harden service operations #383 reruns every affected Linux image build and high/critical Trivy gate. The first authorized live release evidence remains the separate final release gate and was not manufactured during the publication hold.

Exit: every deployable artifact is secure by default, observable, reproducible, immutable, probeable, rollback-ready, and consistent with its manifests/docs.

12. SonarCloud remediation and quality-debt program

Initial audited public API state was 1,529 unresolved issues (1,494 code smells, 26 bugs, 9 vulnerabilities). Exact main@f1a8f8271, analyzed 2026-07-28, now has 916 open/confirmed issues: 912 code smells, 4 bugs, 0 vulnerabilities; 89 blocker, 101 critical, 133 major, 593 minor, 0 info. This is a 613-issue reduction from the initial baseline and a 19-issue reduction from the pre-Wave-25 state. Current measures are cognitive complexity 26,159, code complexity 35,535, 9,620 duplicated lines / 1.6% density, 375,804 NCLOC, reliability D, security A, maintainability A, and 7,042 minutes of debt. There are 0 current security hotspots. The exact-main new-code quality gate is green (A reliability/security/maintainability, 0.9% new duplication, 100% hotspot review). Sonar automatic analysis still has no authoritative main-branch coverage measure, while Codecov remains the enforced aggregate/patch authority, so the administration decision remains deferred.

12.1 Fix repository findings now

• Resolve all 9 workflow/codegen vulnerabilities by completing the lifecycle-script and pinned-codegen work above.
• Resolve the 4 critical incompatible test assertions above.
• Exclude the generated wallet OpenRPC HTML artifact from source analysis by precise generated-file ownership; do not manually “fix” its 22 generated CSS/font bugs.
• Make the repository’s active .sonarcloud.properties exclusions consistent with real generated/third-party ownership. The current automatic analysis reads this file, not the better-configured sonar-project.properties.
• Triage the remaining 89 blocker and 101 critical issues first. All 89 blockers and all 4 bugs currently occur in test files and remain retained for the final QA phase. The 101 critical findings are 97 S3776 complexity findings (86 TypeScript plus 11 JavaScript) plus the 4 test assertion bugs; the production/config/docs complexity set remains the immediate non-QA target while test/benchmark complexity remains final-QA owned. No issue may be bulk-dismissed without per-rule evidence.
• Fix the largest current actionable rule groups from exact main: 419 toHaveLength findings, 86 TypeScript plus 11 JavaScript cognitive-complexity findings, 83 tests without assertions, 23 redundant await findings (test/benchmark and final-QA deferred), 21 array-constructor findings, 21 naming and 21 parameter-count findings, 17 nullish-coalescing findings, 10 optional-chaining findings, 9 S7785 plus 5 S6551 stringification/coercion findings, and the remaining long tail. Wave 25 reduced the main backlog by 19, including 4 TypeScript complexity findings, without suppression or quality-gate weakening. Wave 24's 43 selected deferrals remain explicitly final-QA owned (17 nullish, 9 optional-chain, 5 S6551, 2 nested-conditional, 9 benchmark top-level-await, and 1 benchmark stringification). Refresh this inventory after every wave.
• Treat test/benchmark findings as real quality work (audited about 723) while prioritizing the roughly 750 production/config/docs findings; exclude only generated artifacts (about 56 audited findings).
• Work package-by-package from the largest debt: wallet-toolbox (~704), SDK (~333), conformance (~61), overlay-topics (~42), scripts (~38), docs-site (~34), UHRP basic (~29), UHRP cloud (~25), WAB (~24), GASP (~24), message-box (~19), then the long tail.
• Refactor top cognitive-complexity hotspots with characterization tests first: wallet actionBatchValidation (~63), conformance payments (~63), simple DID resolver (~60), wallet listOutputsIdb (~57), SDK Script (~56), wallet Bitails (~52), StorageServer/internalizeAction (~50), RemittanceManager/SLAP lookup (~48), SDK Point (~45), overlay Engine (~44), BTMS topics (~42), and subsequent ranked functions.
• Consolidate verified duplication without inappropriate abstractions: SDK Curve (~772 duplicated lines/62.5%); OverlayExpress (~286); BTMS topic managers (~278/96.9%) and lookup managers (~206/91.2%); UHRP basic/cloud renew (~206/83%), quote (~107/96%), upload (~88/72%); wallet bulk header validation (~210), ARC (~188), Arcade (~175), Setup/SetupClient (~151 each); conformance wallet-storage (~191); simple tokens (~187); and six telemetry implementations (~102 lines each/65–69%).
• Resolve all TODO/dead-code findings by implementation, linked issue with owner/date, or deletion; do not leave ambiguous comments.
• Re-run Sonar after every remediation wave and record issue count, ratings, duplication, complexity, and debt delta here.

12.2 Deferred Sonar administration switch

This step is deferred because project administration cannot change now. It becomes necessary if automatic analysis still cannot ingest authoritative aggregate coverage or provide reliable required PR status.

• Prepare a CI Sonar scan using the existing aggregate LCOV/report paths and correct source/test/generated exclusions.
• When administration is available, disable Automatic Analysis, enable SONAR_CI_ENABLED, and run analysis from the controlled CI workflow.
• Validate main and PR coverage ingestion, new-code definition, changed-line issue attribution, monorepo path mapping, fork behavior, token/permission safety, and required check name.
• Add the validated Sonar check to the repository ruleset only after it is stable and non-duplicative.
• If automatic analysis gains equivalent authoritative coverage/check behavior before then, document evidence and explicitly close this deferred task as unnecessary.

Exit: reliability/security A, authoritative coverage visible, zero vulnerability/bug/blocker/critical/untriaged issues, generated noise correctly excluded, and #43–#48 closed.

13. Dependency and release governance that persists

• Keep routine third-party updates consolidated monthly, with high/critical security fixes handled immediately.
• Keep Dependabot’s PR concurrency intentionally low enough for coherent review, but do not let a single stale PR block urgent security remediation.
• Require dependency PR evidence: release notes, runtime/build/peer compatibility, deduplicated lockfile, audit/CodeQL result, package and consumer tests, bundle/performance impact, and affected public package versions.
• Forbid new overrides/resolutions unless the exception registry proves why no supported upstream path exists. Every override must have an upstream link, owner, expiry, and removal test. PR build: adopt TypeScript 7 with a supported tooling boundary #373’s narrow typed-rest-client@2.3.1>qs exception is the current model: parent-scoped, security-evidenced, owned, reviewed by 2026-08-27, and removable when upstream updates.
• Re-run a direct/latest inventory monthly and after release waves; distinguish security urgency from major-version migration projects.
• Preserve first-party release-sync ownership and verify every changed public package is published and available before closing its implementation PR wave.
• Record final npm versions and infrastructure image versions/digests in this issue after every release wave.
• Add scheduled verification that manifests equal published latest, package tarballs install, provenance verifies, images pull by digest, and docs/version tables match.

Exit: dependency/release maintenance is routine, visible, reviewable, and cannot recreate the current backlog.

---

Recommended PR / release sequence

Keep these as separate thematic waves unless a very small adjacent fix is safer together. Security waves may run in parallel only when their touched files and release dependencies do not overlap.

Wave	PR focus	Required release/evidence
1	CodeQL helper/SDK fixes: VC context, prototype pollution, TLS bypass, BigNumber bounds, workflow permissions	Targeted adversarial tests, CodeQL rerun, affected package patch releases
2	Service-edge path/resource/error hardening	Negative/integration tests, affected infra/package releases
3	Shared rate limiting, CORS, headers, size/time/quota policies	Service contract tests and live-like container smoke tests
4	React Router migration and current Dependabot fixes	Docs browser smoke, full audit, all alerts closed, affected packages/docs published
5	Pinned codegen and lifecycle-script allowlist	Reproducible generation diff, no unpinned network install
6	Container provenance, SBOM, scanning, base digests, reproducible infra locks	Signed/attested scan-clean images by immutable digest
7	Root/package licensing and manifest/package-contract normalization	publint, types, tarball and clean-install matrix; public package patch releases
8	Shared Oxlint/format config and warning ratchet	Non-increasing baseline, then package-by-package zero-warning PRs
9	Test correctness: incompatible assertions, incomplete/no assertions, skips, empty suites	Targeted tests and updated skip registry
10	Coverage expansion by Tier 0/1 risk	Per-package/component thresholds and measured gains
11	Complete in Wave 16 / PR #373: TypeScript 7 native compiler with the official TypeScript 6 compatibility API for ts-jest	Exact-head and exact-main declaration/build/consumer/conformance/browser/mobile/infrastructure/mutation/security matrices; enforced decision record
12	Packed consumer, browser, mobile, CLI, WASM, exports, bundle budgets	Cross-runtime fixtures and size reports
13	Generated documentation facts, README/API/migration/reliability/security/runbook rewrite	Compiled examples, freshness/link checks, final versions
14	Complexity, duplication, dead-code, and long-tail Sonar waves	Characterization tests and per-wave Sonar deltas
15	Sonar CI analysis/admin switch, if validation says necessary and access is available	Authoritative LCOV, stable required PR check, no duplicate analysis
16	Final audit, release train, and closure	All gates below, final npm/image inventory, close #43–#48

Dependencies between waves

1. Ledger/profile/exception rules precede broad enforcement.
2. Immediate CodeQL/Dependabot and supply-chain fixes precede quality-only modernization.
3. Characterization tests precede high-complexity and duplication refactors.
4. Package contracts and strictness should be introduced with a ratchet so unrelated packages are not forced into one unreviewable PR.
5. Consumer/profile tests precede export, side-effect, splitting, and bundle changes.
6. Documentation follows settled runtime/package/security decisions but generated-fact plumbing should be built early.
7. Sonar administrator changes wait for access; repository-side fixes do not.
8. Each wave completes affected package/image releases before dependent waves assume the new behavior.
9. By operator direction on 2026-07-27, complete all remaining non-QA work before resuming the retained testing/QA-hardening gates as the final program phase; rebase the preserved fuzzing branch on the then-current main rather than merging its WIP state.

Completion gates and final evidence

Before closing this program, attach a final audit report containing:

• main commit and all linked merged child issues/PRs.
• Final green required-check run with per-job timing and comparison to the ~4m55s audited merge-gate baseline.
• Final package inventory: all public names and newly published versions; manifest = npm latest; provenance and clean packed-consumer verification.
• Final infrastructure inventory: image version/digest/source commit, SBOM, signature/attestation, scan result, deployment smoke evidence, and rollback reference.
• Zero-open screenshots/API summaries for CodeQL, Dependabot, secret scanning, and container/dependency scanners, or the complete unexpired exception register.
• CodeQL security-extended configuration and Dependabot security-updates enabled evidence: PRs #338–#339, advanced run 30180480265, and repository security settings verified 2026-07-26.
• Zero-warning lint and blocking configuration evidence.
• TypeScript profile matrix with strictness results and any approved permanent profile differences.
• Coverage report proving overall ≥80%, Tier 0/1 ≥85% line/80% branch, patch ≥90%, and no critical 0%-covered modules.
• Test report proving no assertion-free/incomplete tests, empty expected suites, anonymous/expired skips, or unowned manual/live tests.
• Conformance report proving 100% required pass and owned intended skips, with counts matching generated docs.
• Node/browser/bundler/mobile/CLI/WASM packed-consumer matrix and bundle-size results.
• Runtime benchmark and CI median/p95 trend reports.
• Sonar report proving A reliability/security, authoritative coverage, zero vulnerabilities/bugs/blocker/critical/untriaged issues, and measured complexity/duplication/debt improvement.
• Documentation verification report: compiled examples, current prerequisites/versions, links, freshness, API/migration/security/release/operations coverage.
• Closure evidence for Sonar bulk: auto-fixable code style smells (~1,200 issues) #43, Sonar: 250+ functions exceed cognitive complexity threshold #44, Sonar: 138 issues around error handling, dead code, and TODOs #45, Sonar: duplication — 9,792 duplicated lines (4.8%) across 139 files in 439 blocks #46, and Sonar: long-tail TypeScript smells (~600 issues across 50+ rules) #48.
• A remaining-recommendations section. It should be empty for required work; optional future enhancements must have an owner and rationale and must not conceal incomplete program gates.

Ongoing maintenance after closure

• High/critical security alerts: triage immediately; remediation target measured in days, not the monthly dependency cycle.
• Routine dependency consolidation: monthly, with a direct/latest and override/exception review.
• CodeQL/secret/dependency/container scans: on PR/release as applicable plus scheduled full scans at least weekly.
• Longer fuzz, live integration, conformance, and runtime benchmark suites: scheduled nightly/weekly according to cost and required environment.
• Documentation and support-matrix freshness: generated continuously; human review at least every 90 days for critical material.
• Exception review: at least monthly; security exceptions no longer than 30 days without explicit renewed evidence, other temporary exceptions no longer than 90 days.
• CI and performance trend review: monthly and after material toolchain/runtime changes.
• Package/image provenance and published-version reconciliation: after every release and scheduled monthly.

Closing this issue means the stack is not merely green at one point in time: the controls above are enforced so it stays healthy.

[ty-everett]

Wave 0 is complete via #325, squash-merged to main as a6ca4713a3c30d1cb12c9ded2dd1d0648b53c166.

Evidence:

• repository health controls cover 37 projects / 30 public packages, expose 243 ratcheted contract findings, and validate 5 owned, expiring exceptions with 0 control errors;
• CI 30149013720 passed all 25 jobs in 4m13s, including all coverage shards and merge-gate;
• CodeQL 30149012950 passed with 0 PR alerts after its ReDoS finding was fixed; the bot thread resolved automatically;
• Conformance 30149013718, Socket, Codecov patch, and Sonar passed;
• final Sonar PR analysis reported 0 open/confirmed issues, 0 hotspots, A new-code ratings, and an OK quality gate;
• the flaky live WhatsOnChain Chaintracks test is now hermetic, expanded to 12 contract tests, and preserves identical aggregate covered-line count while increasing covered functions;
• ruleset verification confirms one approval, no last-pusher restriction, resolved-thread enforcement, required technical checks, and maintainer/admin bypass. GitHub rejected ty-everett self-approval with 422 because the same account authored the PR, so the fully green PR used the documented administrator merge path.

No npm package or infrastructure image was published. Wave 1 now proceeds from this exact main commit with CodeQL #14, #61, #62, #73, and #86.

[ty-everett]

Wave 1 complete — immediate helper/SDK CodeQL fixes

PR #326 merged via the authorized admin path at main@172f37a1.

Completed and checked in the tracker only after verification:

• CodeQL chore(deps): bump actions/upload-artifact from 4 to 7 #14: exact VC-context membership plus deceptive/malformed-context tests
• Sonar follow-up: add unit tests for entityValidationHelpers + StorageClientBase (covers gate) #61: null-prototype BeefParty registries plus prototype-name regression tests
• test(wallet-toolbox): unit tests for entityValidationHelpers (#61) #62: removed the process-wide TLS verification bypass; trusted TLS is now the default and private CAs are documented via NODE_EXTRA_CA_CERTS
• feat(conformance): full-coverage dispatcher refactor #73: bounded BigNumber nominal word allocations at 1,048,576 words with both boundary and allocation-backstop tests
• refactor(wallet-toolbox): reduce cognitive complexity in WalletPermissionsManager #86: Conformance workflow token reduced to contents: read

Merge evidence:

• CI 30149650621: every build, policy, test, coverage, packed-consumer, and merge-gate job passed in about 4m30s
• Conformance 30149650627: passed
• CodeQL 30149649850: Actions and JavaScript/TypeScript passed; PR alert API returned [] and both analyses reported 0 results
• SonarCloud PR 326: quality gate OK; 0 open/confirmed issues; 0 hotspots; A ratings for new reliability, security, and maintainability; 0.0% new duplication
• Codecov: 100% patch coverage, 14/14 coverable changed lines, 0 misses, 0 partials
• review sweep: 0 unresolved threads, 0 requested changes; automatic CODEOWNERS requests were removed before merge
• post-merge package publications: intentionally deferred; accumulated release candidates are @bsv/sdk 2.2.1, @bsv/simple 0.4.2, and @bsv/fund-wallet 1.4.2

Wave 2 is now in progress for alerts #90, #91, #92, and #112. Alert #120 remains unchecked until its current middleware behavior is proven by targeted tests and a fresh CodeQL run.

[ty-everett]

Wave 2 complete — service-edge path/resource/error hardening

PR #327 was admin-squash-merged at main@7278be16 after all required and advisory checks passed.

Verified security outcomes

• CodeQL alerts chore(sonar): address S2486 swallowed exceptions in sdk (kvstore/identity/http/primitives) #90, chore(sonar): address S2486 swallowed exceptions in helpers #91, chore(sonar): address S2486 swallowed exceptions in wallet-toolbox (privileged/CWI/knex/chaintracks) #92, and [codex] Rewrite @bsv/did as SD-JWT VC compatibility layer #112 are now fixed on main.
• The current open CodeQL set is exactly eight high-severity rate-limiting findings: refactor(wt+sdk): S3776 long-tail in manager + bignumber + contacts #100, refactor(wallet-toolbox): S3776 long-tail in storage #101, refactor(wallet-toolbox): S3776 long-tail in services + chaintracks #102, fix(sdk): NOSONAR comment for intentional Peer.ready listener registration #107, chore(sonar): wave 7 sweep — helpers/middleware/btms/etc #108, [ FEATURE ] utxo selection algo in ts wallet-toolbox #116, [codex] Add BRC-38/39 wallet portability #117, and ci(release): scope build to tagged package and its workspace deps #120.
• ci(release): scope build to tagged package and its workspace deps #120 was re-triaged and is genuinely open: the existing wallet StorageServer limiter protects PUT/POST only after authentication, leaving authentication middleware work unbounded. It moves into Wave 3 with the shared pre-auth IP plus post-auth identity design.
• PR CodeQL returned zero alerts.
• Sonar PR analysis passed with A reliability/security/maintainability ratings, zero open/confirmed issues, zero hotspots, and zero duplication.
• Codecov reported 100% patch coverage (10 hits, 0 misses, 0 partials).

Implemented controls and evidence

• Message quote fan-out is capped at 100 before public-key validation or database work; its OpenAPI schema carries the same limit.
• UHRP upload IDs are bounded canonical Base58, resolved beneath the served CDN root, and stored with exclusive wx creation. Traversal, encoded/separator/absolute/NUL inputs, symlink targets, and overwrites are covered.
• create-bsv-app no longer returns caught internal/parser/command details; expected and unexpected paths use stable public messages while unexpected errors remain server-side.
• create-bsv-app now emits LCOV in CI. Its full suite is 237/237 tests with 95.52% line and 92.5% statement coverage.
• Message-box passed 36/36 tests; UHRP Lite passed 20/20 tests.
• CI 30150486667, Conformance 30150486666, and CodeQL 30150486611 all passed on the merged commit, including Linux builds for every infrastructure image.
• Repository-health remains clean and the ratcheted backlog decreased from 243 to 242 findings.

Pre-publication ledger

No npm package or infrastructure release was published in this session. Accumulate these Wave 2 candidates for the final release train:

• create-bsv-app: 1.0.2 → candidate 1.0.3
• @bsv/uhrp-lite: 0.1.8 → candidate 0.1.9
• private @bsv/messagebox-server: 1.1.14 → candidate 1.1.15 plus the next traceable infrastructure image

Previously accumulated Wave 1 candidates remain unchanged: @bsv/sdk@2.2.1, @bsv/simple@0.4.2, and @bsv/fund-wallet@1.4.2.