Wave 37: close non-QA quality, release, and runtime gaps

.github/pull_request_template.md

@@ -41,6 +41,20 @@ through the release workflow after approval):
       and removal condition
 - [ ] Workflow permissions and lifecycle-script behavior remain least privilege
 
+## Dependency evidence
+
+Complete every field when a dependency manifest, lockfile, container base, code
+generator dependency, Dependabot configuration, or pinned workflow action
+changes. Use “Not applicable — <reason>” only when the reason is concrete.
+
+- Release notes and necessity:
+- Runtime, build, and peer compatibility:
+- Deduplicated lockfile:
+- Audit and CodeQL:
+- Package and consumer tests:
+- Bundle and performance impact:
+- Affected public package versions:
+
 ## Release and operations
 
 - [ ] No npm publication was performed from a workstation or from this PR

.github/workflows/ci.yml

@@ -20,6 +20,9 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
 
       - name: Use Node.js 24.x
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -32,6 +35,20 @@ jobs:
       - name: Enforce the TypeScript compiler and tooling-API boundary
         run: node scripts/typescript-toolchain.mjs
 
+      - name: Enforce persistent dependency and release governance
+        run: node scripts/dependency-release-governance.mjs check
+
+      - name: Require complete dependency review evidence
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+        run: >-
+          node scripts/dependency-release-governance.mjs pr-evidence
+          --base "$BASE_SHA"
+          --head "$HEAD_SHA"
+
       - name: Enforce test, manual-suite, and conformance skip governance
         run: node scripts/test-governance.mjs
 

.github/workflows/container-runtime-contract.yml

@@ -0,0 +1,165 @@
+name: Container runtime contracts
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - '.github/workflows/container-runtime-contract.yml'
+      - 'governance/container-images.json'
+      - 'governance/service-operations.json'
+      - 'infra/**'
+      - 'packages/wallet/wallet-toolbox/**'
+      - 'scripts/container-runtime-contract.mjs'
+      - 'scripts/container-runtime-contract.test.mjs'
+      - 'scripts/service-operations.mjs'
+  push:
+    branches: [main]
+    paths:
+      - '.github/workflows/container-runtime-contract.yml'
+      - 'governance/container-images.json'
+      - 'governance/service-operations.json'
+      - 'infra/**'
+      - 'packages/wallet/wallet-toolbox/**'
+      - 'scripts/container-runtime-contract.mjs'
+      - 'scripts/container-runtime-contract.test.mjs'
+      - 'scripts/service-operations.mjs'
+
+permissions: {}
+
+concurrency:
+  group: container-runtime-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  runtime:
+    name: Runtime / ${{ matrix.component.name }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      max-parallel: 7
+      matrix:
+        component:
+          - name: chaintracks-server
+            path: infra/chaintracks-server
+            wallet: false
+          - name: message-box-server
+            path: infra/message-box-server
+            wallet: true
+          - name: overlay-server
+            path: infra/overlay-server
+            wallet: true
+          - name: uhrp-server-basic
+            path: infra/uhrp-server-basic
+            wallet: true
+          - name: uhrp-server-cloud-bucket
+            path: infra/uhrp-server-cloud-bucket
+            wallet: true
+          - name: wab
+            path: infra/wab
+            wallet: false
+          - name: wallet-infra
+            path: infra/wallet-infra
+            wallet: false
+    services:
+      mysql:
+        image: mysql@sha256:b3b90af2a6552ae30c266fdb7d5dd55f3afb72404bb78d37fe8a23eb857fd3fb
+        env:
+          MYSQL_DATABASE: container_contract
+          MYSQL_ROOT_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
+        ports:
+          - 3306:3306
+        options: >-
+          --health-cmd "mysqladmin ping --host 127.0.0.1 --password=$MYSQL_ROOT_PASSWORD"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 30
+      mongo:
+        image: mongo@sha256:5351bff2b5d1563e3fa603a74b9be85ef9323e10aeb0b45cea933a93876e77fd
+        ports:
+          - 27017:27017
+        options: >-
+          --health-cmd "mongosh --quiet --eval 'quit(db.runCommand({ping:1}).ok ? 0 : 2)'"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.0
+
+      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+
+      - name: Build the exact component image
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: ${{ matrix.component.path }}
+          file: ${{ matrix.component.path }}/Dockerfile
+          platforms: linux/amd64
+          load: true
+          push: false
+          provenance: false
+          sbom: false
+          tags: ts-stack-${{ matrix.component.name }}:contract
+          cache-from: type=gha,scope=runtime-${{ matrix.component.name }}
+          cache-to: type=gha,mode=max,scope=runtime-${{ matrix.component.name }}
+
+      - name: Build Wallet Infrastructure dependency from the same source
+        if: matrix.component.wallet
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        with:
+          context: infra/wallet-infra
+          file: infra/wallet-infra/Dockerfile
+          platforms: linux/amd64
+          load: true
+          push: false
+          provenance: false
+          sbom: false
+          tags: ts-stack-wallet-infra:contract-dependency
+          cache-from: type=gha,scope=runtime-wallet-infra
+
+      - name: Isolate service migration schemas
+        env:
+          CONTRACT_DB_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
+        run: |
+          docker run --rm --network host \
+            --env MYSQL_PWD="$CONTRACT_DB_PASSWORD" \
+            mysql@sha256:b3b90af2a6552ae30c266fdb7d5dd55f3afb72404bb78d37fe8a23eb857fd3fb \
+            mysql --host 127.0.0.1 --user root --execute \
+            "CREATE DATABASE IF NOT EXISTS container_contract_message;
+            CREATE DATABASE IF NOT EXISTS container_contract_overlay;
+            CREATE DATABASE IF NOT EXISTS container_contract_wab;
+            CREATE DATABASE IF NOT EXISTS container_contract_wallet;"
+
+      - name: Exercise the complete runtime contract
+        env:
+          CONTRACT_DB_PASSWORD: ${{ github.run_id }}-${{ github.run_attempt }}
+        run: >-
+          node scripts/container-runtime-contract.mjs
+          --component "${{ matrix.component.name }}"
+          --image "ts-stack-${{ matrix.component.name }}:contract"
+          ${{ matrix.component.wallet && '--wallet-image ts-stack-wallet-infra:contract-dependency' || '' }}
+
+      - name: Preserve container logs on failure
+        if: failure()
+        run: |
+          mkdir -p container-contract-logs
+          for container in $(docker ps --all --format '{{.Names}}' --filter name=contract-); do
+            docker logs "$container" > "container-contract-logs/$container.log" 2>&1 || true
+            docker inspect "$container" > "container-contract-logs/$container.inspect.json" || true
+          done
+
+      - name: Upload failed runtime evidence
+        if: failure()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: container-runtime-${{ matrix.component.name }}-${{ github.run_attempt }}
+          path: container-contract-logs
+          if-no-files-found: ignore
+          retention-days: 30

.github/workflows/dependency-release-verification.yml

@@ -0,0 +1,85 @@
+name: Dependency and release verification
+
+on:
+  schedule:
+    - cron: '17 14 1 * *'
+  workflow_dispatch:
+  workflow_call:
+
+permissions: {}
+
+concurrency:
+  group: dependency-release-verification
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 60
+    permissions:
+      contents: read
+      packages: read
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: main
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.0
+          registry-url: https://registry.npmjs.org
+
+      - name: Enforce dependency and release governance
+        run: node scripts/dependency-release-governance.mjs check
+
+      - name: Generate direct/latest dependency inventory
+        run: >-
+          node scripts/dependency-release-governance.mjs inventory
+          --output dependency-release-inventory.json
+
+      - name: Reconcile source candidates and published npm packages
+        run: >-
+          node scripts/dependency-release-governance.mjs verify-published
+          --output published-package-verification.json
+
+      - name: Prepare the locked published-package install
+        run: >-
+          node scripts/dependency-release-governance.mjs prepare-published-install
+          --report published-package-verification.json
+          --directory published-install
+
+      - name: Install every published package tarball without lifecycle scripts
+        working-directory: published-install
+        run: npm ci --ignore-scripts --no-audit --no-fund
+
+      - name: Verify registry signatures and npm provenance
+        working-directory: published-install
+        run: npm audit signatures
+
+      - name: Verify immutable deployment images can be pulled by digest
+        run: |
+          node scripts/dependency-release-governance.mjs image-refs \
+            --output immutable-deployment-images.json
+          jq -r '.images[]' immutable-deployment-images.json |
+            while IFS= read -r image; do
+              docker pull --quiet "$image"
+            done
+
+      - name: Verify generated package, support, conformance, and version facts
+        run: pnpm docs:facts:check
+
+      - name: Record reconciliation evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: dependency-release-verification-${{ github.run_id }}-${{ github.run_attempt }}
+          path: |
+            dependency-release-inventory.json
+            published-package-verification.json
+            immutable-deployment-images.json
+            published-install/package-lock.json
+          if-no-files-found: error
+          retention-days: 90

.github/workflows/infra-release.yaml

@@ -310,3 +310,10 @@ jobs:
             echo "- SLSA provenance and SBOM attestations published to GitHub and GHCR"
             echo "- Image digest keylessly signed with GitHub OIDC via Cosign"
           } >> "$GITHUB_STEP_SUMMARY"
+
+  post-release-verification:
+    needs: release
+    permissions:
+      contents: read
+      packages: read
+    uses: ./.github/workflows/dependency-release-verification.yml

.github/workflows/release.yaml

@@ -365,3 +365,11 @@ jobs:
               --title "chore: sync published workspace versions" \
               --body "$body"
           fi
+
+  post-release-verification:
+    if: needs.publish.result == 'success'
+    needs: publish
+    permissions:
+      contents: read
+      packages: read
+    uses: ./.github/workflows/dependency-release-verification.yml