fix(harness): enforce real verifier gates

.github/actions/setup-harness/action.yml

@@ -81,8 +81,8 @@ runs:
           args=()
           IFS=',' read -ra parts <<< "$bins"
           for b in "${parts[@]}"; do args+=(--bin "$b"); done
-          echo "cargo build -p $pkg ${args[*]}"
-          cargo build -p "$pkg" "${args[@]}"
+          echo "cargo build --locked -p $pkg ${args[*]}"
+          cargo build --locked -p "$pkg" "${args[@]}"
         done
 
     - name: Install harness

.github/delivery/README.md

@@ -0,0 +1,13 @@
+# Delivery ledgers
+
+Delivery ledgers inventory source work without treating file presence as proof of
+semantic delivery. `pr216-ledger.json` is pinned to the authoritative
+`49dc797..45ad8c9` commit and path sets. Validate it with:
+
+```sh
+node scripts/validate-pr216-ledger.mjs
+node scripts/validate-pr216-ledger_test.mjs
+```
+
+Only use `integrated` with independently checkable evidence. Keep unresolved
+work as `open_pr` or `missing` with an owner and concrete follow-up.

.github/workflows/harness.yml

@@ -142,8 +142,8 @@ jobs:
       - name: Checkout payment channels program
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
-          repository: Moonsong-Labs/solana-payment-channels
-          ref: d1dee6b34d45d4e4a1ed3174ef421ca2e801aaea
+          repository: solana-foundation/payment-channels
+          ref: 0c07d5751c8972abf6a219570a3f39a72f46f879
           path: _payment-channels
           fetch-depth: 1
       # Pinned Agave release, fetched as a tarball and checksum-verified.
@@ -235,10 +235,14 @@ jobs:
           fi
           pnpm exec vitest run test/e2e.test.ts --testTimeout 180000 --reporter=default --reporter=json --outputFile=vitest-report.json
           node scripts/assert-run-count.mjs --report vitest-report.json --exact 1
-      - name: Focused Python session missing-ATA rejection
+      - name: Focused Python session missing-ATA settlement invariant (deliver-or-reject)
         working-directory: harness
-        # This regression is blocking: a successful response must never hide a
-        # settlement that delivered no funds because the recipient ATA was absent.
+        # Blocking (no continue-on-error): a settle reported successful
+        # (200 + settledSignature) MUST deliver the payout to the recipient ATA,
+        # creating it idempotently when absent. A clean rejection (>= 400, no
+        # receipt surfaced, no delivery) is equally acceptable. The only failure
+        # is the false-paid condition — a confirmed receipt with no on-chain
+        # delivery — which #216 fixed and this leg keeps release-blocking.
         env:
           MPP_HARNESS_INTENTS: session
           MPP_HARNESS_SCENARIOS: session-basic

.github/workflows/lua.yml

@@ -12,6 +12,7 @@ jobs:
   test-lua:
     name: Lua tests
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 

.github/workflows/pr-routing.yml

@@ -24,6 +24,7 @@ jobs:
       swift: ${{ steps.select.outputs.swift }}
       kotlin: ${{ steps.select.outputs.kotlin }}
       harness: ${{ steps.select.outputs.harness }}
+      docs_only: ${{ steps.select.outputs.docs_only }}
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
@@ -40,7 +41,9 @@ jobs:
           node-version: 22
           package-manager-cache: false
       - name: Test path classifier
-        run: node scripts/select-pr-workflows_test.mjs
+        run: |
+          node scripts/select-pr-workflows_test.mjs
+          node scripts/verify-routed-sdk-gate_test.mjs
       - id: select
         name: Select SDK workflows
         run: |
@@ -49,7 +52,7 @@ jobs:
             echo "::error::PR verification router requires a synthetic merge commit with a base parent"
             exit 1
           fi
-          git diff --name-only HEAD^1 HEAD | \
+          git diff --no-renames --name-only HEAD^1 HEAD | \
             node scripts/select-pr-workflows.mjs --github-output "$GITHUB_OUTPUT"
 
   go:
@@ -122,37 +125,8 @@ jobs:
     needs: [classify, core, go, go_consumer, python, ruby, lua, php, swift, kotlin, harness]
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Require every selected workflow to pass
         env:
           NEEDS: ${{ toJSON(needs) }}
-        run: |
-          node <<'NODE'
-          const needs = JSON.parse(process.env.NEEDS);
-          if (needs.classify.result !== "success") {
-            throw new Error(`classifier did not pass: ${needs.classify.result}`);
-          }
-
-          const selected = needs.classify.outputs;
-          const required = {
-            typescript: ["core"],
-            rust: ["core"],
-            go: ["go", "go_consumer"],
-            python: ["python"],
-            ruby: ["ruby"],
-            lua: ["lua"],
-            php: ["php"],
-            swift: ["swift"],
-            kotlin: ["kotlin"],
-            harness: ["core", "harness"],
-          };
-
-          for (const [surface, jobs] of Object.entries(required)) {
-            if (selected[surface] !== "true") continue;
-            for (const job of jobs) {
-              if (needs[job].result !== "success") {
-                throw new Error(`${surface} selected ${job}, which finished ${needs[job].result}`);
-              }
-            }
-          }
-          console.log("all selected SDK workflows passed");
-          NODE
+        run: node scripts/verify-routed-sdk-gate.mjs

.github/workflows/python.yml

@@ -91,7 +91,7 @@ jobs:
       - name: Checkout payment channels program
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
-          repository: Moonsong-Labs/solana-payment-channels
+          repository: solana-foundation/payment-channels
           ref: 0c07d5751c8972abf6a219570a3f39a72f46f879
           path: _payment-channels
           fetch-depth: 1

.github/workflows/release-gate.yml

@@ -62,10 +62,14 @@ jobs:
     uses: ./.github/workflows/kotlin.yml
     secrets: inherit
 
+  semgrep:
+    name: Semgrep
+    uses: ./.github/workflows/semgrep.yml
+
   gate:
     name: All release gates green
     runs-on: ubuntu-latest
-    needs: [ci, harness, go, go-consumer, python, ruby, lua, php, swift, kotlin]
+    needs: [ci, harness, go, go-consumer, python, ruby, lua, php, swift, kotlin, semgrep]
     steps:
       - name: Confirm
         run: echo "core CI, harness, on-chain legs, and every SDK matrix passed"

.github/workflows/semgrep.yml

@@ -8,10 +8,8 @@ name: Semgrep (radar L7)
 #   - self-test: every *.bad.* fixture MUST fire, every *.good.* MUST stay clean
 #   - scan:      run the ruleset over the real source tree (typescript/, go/, python/)
 #
-# The scan step is advisory (does not fail the build) so a newly surfaced,
-# to-be-triaged finding doesn't block unrelated PRs. The self-test step IS
-# blocking: it guarantees the rules keep catching their known-bad and stay quiet
-# on their known-good. Flip `continue-on-error` off once the tree is clean.
+# Every source scan is blocking. A security-rule finding is either a real
+# regression or a rule-quality defect that must be resolved before merge.
 
 on:
   push:
@@ -29,16 +27,8 @@ jobs:
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - uses: actions/setup-python@v5
-        with:
-          python-version: '3.12'
-
-      - name: Install semgrep
-        run: pip install semgrep==1.168.0
-
       - name: Self-test rules against fixtures (blocking)
-        run: bash harness/semgrep/run.sh --test
+        run: docker run --rm -v "$PWD:/src" -w /src semgrep/semgrep@sha256:59fbed6127ea7c5dde3ba6a85142733bb20ea9aaa36120c953904f1539aaf66e bash harness/semgrep/run.sh --test
 
-      - name: Scan real source (advisory)
-        continue-on-error: true
-        run: bash harness/semgrep/run.sh typescript go python
+      - name: Scan real source (blocking)
+        run: docker run --rm -e SEMGREP_ERROR_ON_FINDINGS=1 -v "$PWD:/src" -w /src semgrep/semgrep@sha256:59fbed6127ea7c5dde3ba6a85142733bb20ea9aaa36120c953904f1539aaf66e bash harness/semgrep/run.sh typescript go python

CONTRIBUTING.md

@@ -0,0 +1,24 @@
+# Contributing
+
+## Pull request scope
+
+Keep changes reviewable and independently green. Use one pull request per language when a coherent SDK feature or refactor is language-owned. Use one pull request per protocol flaw when the same invariant must change in multiple SDKs, for example `fix(upto): bind settlement amounts in Ruby and TypeScript`.
+
+Stacked pull requests must name their base and merge order. Do not mix unrelated language cleanup, protocol security changes, generated artifacts, and CI infrastructure solely to reduce the number of pull requests.
+
+## Verification
+
+Run the focused SDK tests, lint, typecheck, format, coverage, and owned harness legs before requesting review. Changes to shared vectors, schemas, routing, or harness infrastructure must run the full matrix; unknown paths deliberately fall back to full verification.
+
+Security guards need an adversarial reject case that executes the real verifier, plus a valid accept case proving the guard is not over-broad. A declared verifier mode without both outcomes is treated as untested.
+
+## Large pull requests and Greptile
+
+Greptile may skip diffs above its 100-file review ceiling. Prefer splitting those changes by language or protocol. When a large mechanical migration cannot be split safely:
+
+1. Separate and document the mechanical and semantic portions of the diff.
+2. Keep the exact head green and resolve human review findings first.
+3. Post `@greptile-apps please review` once on the meaningful final head.
+4. Record the reviewed head commit in the pull request description; request another review only after a semantic change.
+
+This bypass is review friction, not a substitute for focused tests, the full integration matrix, or maintainer approval.

harness/package.json

@@ -25,6 +25,7 @@
     "express": "^4.21.0",
     "tsx": "^4.19.2",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.0"
+    "vitest": "^4.1.0",
+    "yaml": "^2.8.3"
   }
 }

harness/runners/go.json

@@ -2,5 +2,10 @@
   "language": "go",
   "command": ["go", "run", "./cmd/conformance"],
   "cwd": "go",
-  "intents": ["charge", "x402-exact", "session"]
+  "intents": ["charge", "x402-exact", "session"],
+  "modesByIntent": {
+    "charge": ["canonical-bytes"],
+    "session": ["canonical-bytes"],
+    "x402-exact": ["verify-x402-transaction"]
+  }
 }

harness/runners/kotlin.json

@@ -2,5 +2,9 @@
   "language": "kotlin",
   "command": ["sh", "-c", "exec build/install/mpp-kotlin-conformance/bin/mpp-kotlin-conformance"],
   "cwd": "harness/kotlin-conformance",
-  "intents": ["session"]
+  "intents": ["charge", "session"],
+  "modesByIntent": {
+    "charge": ["canonical-bytes"],
+    "session": ["canonical-bytes"]
+  }
 }

harness/runners/lua.json

@@ -1,5 +1,10 @@
 {
   "language": "lua",
   "command": ["luajit", "cmd/conformance/main.lua"],
-  "cwd": "lua"
+  "cwd": "lua",
+  "intents": ["charge", "x402-exact"],
+  "modesByIntent": {
+    "charge": ["canonical-bytes"],
+    "x402-exact": ["verify-x402-transaction"]
+  }
 }

harness/runners/php.json

@@ -1,5 +1,10 @@
 {
   "language": "php",
   "command": ["php", "conformance/runner.php"],
-  "cwd": "php"
+  "cwd": "php",
+  "intents": ["charge", "x402-exact"],
+  "modesByIntent": {
+    "charge": ["canonical-bytes"],
+    "x402-exact": ["verify-x402-transaction"]
+  }
 }

harness/runners/python.json

@@ -2,5 +2,10 @@
   "language": "python",
   "command": ["uv", "run", "python", "conformance_runner.py"],
   "cwd": "python",
-  "intents": ["charge", "x402-exact", "session"]
+  "intents": ["charge", "x402-exact", "session"],
+  "modesByIntent": {
+    "charge": ["canonical-bytes"],
+    "x402-exact": ["verify-x402-transaction"],
+    "session": ["canonical-bytes"]
+  }
 }

harness/runners/ruby.json

@@ -1,5 +1,10 @@
 {
   "language": "ruby",
   "command": ["bundle", "exec", "ruby", "exe/conformance"],
-  "cwd": "ruby"
+  "cwd": "ruby",
+  "intents": ["charge", "x402-exact"],
+  "modesByIntent": {
+    "charge": ["canonical-bytes"],
+    "x402-exact": ["verify-x402-transaction"]
+  }
 }

harness/runners/rust.json

@@ -2,5 +2,12 @@
   "language": "rust",
   "command": ["bash", "-lc", "if [ -x target/debug/examples/conformance_runner ]; then exec target/debug/examples/conformance_runner; fi; exec cargo run -q -p solana-pay-kit --example conformance_runner --features x402,client"],
   "cwd": "rust",
-  "intents": ["x402-exact"]
+  "intents": ["charge", "x402-exact"],
+  "modesByIntent": {
+    "charge": ["canonical-bytes"],
+    "x402-exact": ["build-transaction", "verify-transaction", "verify-x402-transaction"]
+  },
+  "strictModesByIntent": {
+    "x402-exact": ["verify-transaction", "verify-x402-transaction"]
+  }
 }

harness/runners/swift.json

@@ -2,5 +2,10 @@
   "language": "swift",
   "command": ["swift", "run", "-c", "release", "mpp-conformance"],
   "cwd": "swift",
-  "intents": ["charge", "x402-exact", "session"]
+  "intents": ["charge", "x402-exact", "session"],
+  "modesByIntent": {
+    "charge": ["canonical-bytes"],
+    "x402-exact": ["verify-x402-transaction"],
+    "session": ["canonical-bytes"]
+  }
 }

harness/runners/typescript.json

@@ -1,5 +1,10 @@
 {
   "language": "typescript",
   "command": ["pnpm", "exec", "node", "--import", "tsx", "src/conformance/ts-runner.ts"],
-  "cwd": "harness"
+  "cwd": "harness",
+  "intents": ["charge", "x402-exact"],
+  "modesByIntent": {
+    "charge": ["canonical-bytes"],
+    "x402-exact": ["verify-x402-transaction"]
+  }
 }