Wave 35: govern consumer contracts and CI performance

[ty-everett]

Summary

Wave 35 directly advances the remaining production-readiness program in tracker #324 by replacing inferred package support with machine-governed consumer contracts, completing the outstanding VeriFast browser/WASM distribution proof, and adding an evidence-backed CI performance trend gate.

What changed

• Assigns one or more canonical consumer profiles to all 30 public packages and validates their runtime targets and executable contract scripts.
• Governs Node ESM/CommonJS, browser bundler/ESM, CLI, UMD global, React Native Metro/Hermes, and WASM/worker consumption without changing public APIs.
• Extends generated stack facts so every public package's supported consumer modes are visible and reviewable.
• Upgrades the source candidate for @bsv/verifast to 0.3.2 and tests exact packed tarballs through Node ESM/CommonJS, Vite, esbuild, real Chromium, workers, UMD, strict CSP, normal streaming WASM, and the ArrayBuffer MIME fallback.
• Adds source-map validation and raw/gzip/Brotli budgets for VeriFast's Vite, esbuild, and complete independently transferred UMD loader-plus-WASM payload.
• Adds a governed 40-run CI baseline: 20 full-scope and 20 targeted successful PR runs, exact run links/SHAs, per-job/per-step timing, queue/prepare/artifact timing, and variance.
• Adds a weekly median/p95 regression gate with explicit budgets and documents the Actions API's CPU, memory, and action-internal cache-hit instrumentation gaps.

Tracker #324 disposition

This PR is intended to complete the applicable all-package consumer matrix, all-package profile assignment, declared Node ESM/CommonJS verification, Metro/Hermes profile coverage, VeriFast WASM/worker/CSP/fallback verification, compressed browser payload budgets, and CI trend-budget control. It materially advances—but does not overclaim completion of—the broader exact-tarball/sourcemap/runtime matrix and resource telemetry items. The deferred testing/QA-hardening phase remains deferred.

Compatibility and impact

• No public exports, package paths, runtime behavior, protocol behavior, storage behavior, error behavior, defaults, CORS/CSP service policy, or consumer-facing APIs are changed.
• @bsv/verifast@0.3.2 is a source candidate only. This PR does not publish packages, create tags/releases, or deploy anything.
• Draft PR fix(wallet-toolbox): derive ChainTracks from Arcade host, drop babbage defaults #306 is not incorporated or modified.

Validation

Validated on Node 24.18.0 and pnpm 10.33.2:

• full workspace build, lint, typecheck, test, and format checks
• repository health: 90 tests; 37 projects; 30 public packages; 0 contract findings; 0 control errors
• pnpm audit:security: no known vulnerabilities
• package version consistency and generated documentation checks
• VeriFast unit suite: 8 suites / 75 tests
• VeriFast coverage, exact packed artifact, Node ESM/CommonJS/worker, Rspack, Vite/esbuild budget, strict-CSP Chromium, WASM streaming/fallback, and UMD checks
• workflow YAML parsing and staged diff whitespace validation

CI, CodeQL, Sonar zero-new-findings, Codecov, and the remaining merge gates must pass on the exact PR head before merge.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Administrative exact-head review by ty-everett for 5ec9965.

Reviewed the complete Wave 35 diff and the follow-up static-analysis refactor. The changes establish machine-enforced consumer profiles for all 30 public packages, add evidence-backed CI performance governance, and harden the exact packed VeriFast browser/WASM/worker/UMD contracts. Public exports, package paths, runtime and protocol behavior, storage and error behavior, defaults, and service CORS/CSP policy remain unchanged. No package publication, tag, release, or deployment is included.

Exact-head evidence: 66 checks passed, zero failed or pending; merge-gate passed; Sonar has 0 new issues, 0 accepted issues, and 0 hotspots; CodeQL actions and JavaScript/TypeScript passed; Socket and dependency review passed; Codecov covers all modified coverable lines; full coverage, mutation, platform, infrastructure, conformance, docs, build, lint, type, policy, and package contract lanes passed. No unresolved review threads or actionable comments remain.

GitHub does not permit an author to submit APPROVE on the authors own pull request, so this COMMENT records the requested substantive ty-everett administrative review without waiting for an unrelated reviewer. The exact head is suitable for the authorized admin squash merge.