[ty-everett]

Established application-wallet contracts must remain interoperable across independently deployed applications and wallets. This makes backward compatibility a permanent project-wide invariant: major versions, maintainer approval, migration notes and coordinated first-party upgrades cannot waive it. The root agent/contributor policies, versioning policy, PR evidence template and dedicated compatibility contract require published-client integration evidence in both old/new directions.

The policy PR was blocked by newly reported high dependency advisories. This also repairs that frozen graph while retaining the audit, lifecycle and provenance controls.

Dependency evidence

• Release notes and necessity: Express 5.3.0/body-parser 2.4.0 fix GHSA-27r3-jxmh-p828. Zod 4.6.7 fixes GHSA-mrhx-c7xc-m3w5; upstream bounded-container repair.
• Runtime, build, and peer compatibility: all public manifests/ranges remain unchanged. Express/body-parser stay within the committed ranges. Stryker's protocol accepts the patched Zod 4 API. VeriFast's private Chrome test harness retains its existing Chrome/CDP default and unchanged harness; the exact Puppeteer 25.11.0 unused Chromium-BiDi dependency is removed, eliminating its Zod 3 closure. Available upstream Puppeteer upgrades fail the existing adapter provenance policy; no provenance exception is introduced.
• Deduplicated lockfile: only the reviewed HTTP patch/minor closure, patched Zod 4 and unused adapter removal change. Unrelated Babel/Inquirer/Node-type refreshes were discarded. Two temporary overrides are registered with maintainer owners, upstream evidence, November 6 review dates and explicit retirement tests.
• Audit and CodeQL: full unexcluded audit now has zero high/critical findings; six moderate and one low remain. Initial failing audit/CI is retained. Exact-head hosted CodeQL and zero-new-Sonar gates remain required.
• Package and consumer tests: local health:check, lint, format:check, workspace build and recursive typecheck pass. Full unchanged VeriFast browser/WASM/worker/CSP/streaming-fallback suite passes with the adapter absent. HTTP integration passes six signed request method/body cases, signed response headers, 402 payment handoff, attachment disposition and Content-Type parameters. A compressed-frame/trailing-bytes regression proves process survival, request completion and preservation of a second raw-body hash consumer. The patched Zod bounded-container probe passes. The complete workspace unit run passes (26,411 reported passing tests across 34 package-runner summaries; existing governed skips/todo retained).
• Bundle and performance impact: no public runtime source or packed package inputs change. The unused development adapter closure is removed. No performance claim is made from incidental browser benchmark output.
• Affected public package versions: none; no public package manifest, runtime source or packed artifact is changed by this dependency/tooling repair.

Verification

The existing governed amount-format mutation target passes on the repaired Stryker/Zod graph: 213 mutants, 89.20% score (189 killed, 1 timeout, 23 survived), with its normal policy and assertions unchanged. The documentation build and link checker pass for 139 pages.

Self-review covers the complete final diff, public API/transport compatibility, dependency closure, private harness scope, ownership/removal conditions and security controls. No audit exclusion, threshold reduction, trust-policy bypass, disabled assertion, skipped test or deployment is introduced.

Hold merge until exact-head qualification finishes. David's implementation #1366 and companion BRCs #351 remain held for author coordination; this PR does not alter or approve those proposals. No npm/image publication or service rollout is performed.

The initial repaired head 9893f9a93 passed all behavior suites but failed patch coverage because the redundant explicit CDP setting changed the standalone browser harness, which has no LCOV entry. That unnecessary edit was removed; the harness is byte-identical to main and its complete browser suite passes again. No coverage rule or threshold changed. The committed final diff passes the local patch-coverage gate with no changed production files. The original failure is retained.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​body-parser@​2.4.0
	npm/​express@​5.3.0

View full report

[ty-everett]

Local pre-merge validation for exact head 9893f9a93a33f8a7ef099edf395df60b28fd8faf:

• pnpm install --frozen-lockfile --ignore-scripts, audited esbuild rebuild, pnpm health:check (395/395 script tests), pnpm lint, pnpm format:check, pnpm build, recursive pnpm typecheck, and documentation build/link verification pass (139 pages).
• pnpm audit:security passes the full unexcluded audit: zero high/critical, six moderate and one low. The earlier failed audit remains preserved.
• The unchanged complete pnpm --filter @bsv/verifast test:browser suite passes with the unused BiDi adapter absent: real headless Chrome over explicit CDP, packed consumers, WASM, workers, CSP and streaming fallback. No assertions were removed or skipped.
• A real loopback SDK/auth/payment HTTP integration passes six signed method/body cases, response header handling, signed 402 challenge/payment handoff, Content-Disposition and Content-Type parameters on the repaired workspace graph.
• The security probe covers deflate/gzip trailing bytes, unsupported compressed-body charset, request completion and preservation of an independent raw-body hash consumer. Negative control using retained body-parser 2.3.0 reproduces an uncaught Gunzip Z_DATA_ERROR and process exit 1. The same probe with 2.4.0 exits 0. An earlier deflate-only control passed on both versions; it was retained, then the probe was expanded to cover the actual gzip failure. No product behavior or test gate was weakened.
• The patched Zod rejects an oversized bounded collection before per-element validation, with one size issue.
• pnpm test:mutation --target amount-format passes the unchanged governed target: 213 mutants, 89.20% score, 189 killed / 1 timeout / 23 survived; 52 initial tests. This exercises the repaired Stryker/Zod execution path with its normal thresholds and fixed property settings.
• Additional workspace unit suites are still finishing locally; SDK already passes 219 suites / 7,801 tests, and Overlay passes 40 suites / 828 tests with its one pre-existing governed skip. Final totals and exact-head hosted checks will be recorded before merge.

The two scoped temporary overrides have maintainer owners, upstream evidence, 2026-11-06 review dates and concrete retirement checks. Public manifests/ranges and packed runtime source remain unchanged. Provenance no-downgrade, denied lifecycle scripts, audit thresholds, coverage and quality gates remain in force. David's #1366 and BRCs #351 remain held for coordination; no publication or rollout is part of this merge.

[ty-everett]

Final local validation is complete; current head is 087692cb23064a14d052c71d40d09d2d5b4f1b59.

The complete workspace unit command exits 0: pnpm -r --workspace-concurrency=2 --filter '!@bsv/ts-stack' run test. Package runners report 26,411 passing tests in 34 summaries, including SDK 7,801, Wallet Toolbox 3,420, Overlay 828 and Topics 1,475. Existing governed skips/todo remain unchanged. These runtime/test inputs are unchanged from the first repaired head; the final browser-harness configuration and governance/documentation checks were qualified again separately.

The first repaired head failed the unchanged patch-coverage gate because the redundant protocol: 'cdp' setting changed the standalone browser harness, which has no LCOV entry. Removed that unnecessary setting: the harness is byte-identical to main and pinned Puppeteer's existing Chrome/CDP default is retained. Repeated the complete unchanged browser suite successfully. No assertion, test, coverage selector, rule or threshold changed. The committed final diff passes local patch coverage: 100%, 0/0 changed production points, no missing production file.

Final health:check (395 tests), documentation build/link check (139 pages), and relevant formatting/governance checks pass. The full build, typecheck, unit, security-probe, signed HTTP integration, unexcluded audit and Stryker mutation results in the prior comment remain applicable to the unchanged inputs. The prior high-advisory failure, observer correction, negative controls and coverage failure are retained as separate evidence.

Final exact-head runs: CI 40041245034, CodeQL 40041245128, Conformance 40041245011. Merge remains held until these and all applicable external checks pass on this exact head. David's implementation/spec reviews remain held independently.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Maintainer review complete for exact head 087692c. The permanent compatibility invariant is coherent across the canonical contributor/agent/versioning policies and PR evidence template. Reviewed the complete dependency diff: the HTTP closure remains within manifest ranges, Zod 4 stays within its upstream API range, and the unused exact-parent BiDi removal preserves the unchanged Chrome/CDP test harness and public package contracts. Owners, upstream evidence and retirement tests cover both temporary overrides.

All 50 current-head checks are terminal with no failure or pending result; selected CI, final merge gate, CodeQL, conformance, strict zero-new-Sonar and external coverage reporting pass. CodeQL analyses have zero results on merge candidate e68e971, whose parents are reviewed base de02e95 and this exact head. No unresolved review thread exists. Local unit/build/type/browser/security/HTTP/mutation evidence and retained failures are recorded above.

The operator explicitly requested this policy/advisory repair be merged after green CI. For this author-owned PR, use the repository's documented maintainer/admin facilitation; this comment records the maintainer review and does not represent a GitHub formal self-approval. No automated check, review finding or quality threshold is waived. David's implementation and spec PRs remain held independently; no package/image publication or application-service rollout is authorized by this merge.