fix(auth): contain untrusted transport failures

.github/workflows/codegen.yml

@@ -31,6 +31,7 @@ jobs:
   verify:
     name: Verify committed generated types
     runs-on: ubuntu-latest
+    timeout-minutes: 20
     permissions:
       contents: read
     steps:

.github/workflows/conformance.yml

@@ -3,8 +3,18 @@ name: Conformance
 on:
   push:
     branches: [main, phase2/boundary-specs]
+    paths:
+      - '.github/workflows/conformance.yml'
+      - 'conformance/**'
+      - 'specs/**'
+      - 'scripts/generate-openapi-types.mjs'
   pull_request:
     branches: [main]
+    paths:
+      - '.github/workflows/conformance.yml'
+      - 'conformance/**'
+      - 'specs/**'
+      - 'scripts/generate-openapi-types.mjs'
 
 concurrency:
   group: conformance-${{ github.event.pull_request.number || github.ref }}
@@ -16,6 +26,7 @@ permissions:
 jobs:
   ts-runner:
     runs-on: ubuntu-latest
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

.github/workflows/container-runtime-contract.yml

@@ -8,9 +8,10 @@ on:
       - 'governance/container-images.json'
       - 'governance/service-operations.json'
       - 'infra/**'
-      - 'packages/wallet/wallet-toolbox/**'
       - 'scripts/container-runtime-contract.mjs'
       - 'scripts/container-runtime-contract.test.mjs'
+      - 'scripts/ci-affected-scope.mjs'
+      - 'scripts/ci-affected-scope.test.mjs'
       - 'scripts/service-operations.mjs'
   push:
     branches: [main]
@@ -19,9 +20,10 @@ on:
       - 'governance/container-images.json'
       - 'governance/service-operations.json'
       - 'infra/**'
-      - 'packages/wallet/wallet-toolbox/**'
       - 'scripts/container-runtime-contract.mjs'
       - 'scripts/container-runtime-contract.test.mjs'
+      - 'scripts/ci-affected-scope.mjs'
+      - 'scripts/ci-affected-scope.test.mjs'
       - 'scripts/service-operations.mjs'
 
 permissions: {}
@@ -31,38 +33,58 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  scope:
+    name: Select affected runtime images
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    outputs:
+      matrix: ${{ steps.scope.outputs.matrix }}
+      has-runtime: ${{ steps.scope.outputs.has-runtime }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24.18.0
+
+      - name: Resolve runtime contexts from the changed-file graph
+        id: scope
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PUSH_BASE_SHA: ${{ github.event.before }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
+        run: |
+          BASE_SHA="$PR_BASE_SHA"
+          if [ -z "$BASE_SHA" ]; then BASE_SHA="$PUSH_BASE_SHA"; fi
+          if [ -z "$BASE_SHA" ] ||
+             [ "$BASE_SHA" = "0000000000000000000000000000000000000000" ] ||
+             ! git cat-file -e "$BASE_SHA^{commit}" 2>/dev/null; then
+            SCOPE=$(node scripts/ci-affected-scope.mjs --all)
+          else
+            SCOPE=$(node scripts/ci-affected-scope.mjs --base "$BASE_SHA" --head "$HEAD_SHA")
+          fi
+          MATRIX=$(jq -c '.runtimeMatrix' <<<"$SCOPE")
+          echo "matrix=$MATRIX" >> "$GITHUB_OUTPUT"
+          echo "has-runtime=$(jq -r '.include | length > 0' <<<"$MATRIX")" >> "$GITHUB_OUTPUT"
+          echo "Runtime images: $(jq -c '[.include[].component.name]' <<<"$MATRIX")" >> "$GITHUB_STEP_SUMMARY"
+
   runtime:
     name: Runtime / ${{ matrix.component.name }}
+    if: needs.scope.outputs.has-runtime == 'true'
+    needs: scope
     runs-on: ubuntu-24.04
     timeout-minutes: 35
     permissions:
       contents: read
     strategy:
-      fail-fast: false
+      fail-fast: true
       max-parallel: 7
-      matrix:
-        component:
-          - name: chaintracks-server
-            path: infra/chaintracks-server
-            wallet: false
-          - name: message-box-server
-            path: infra/message-box-server
-            wallet: true
-          - name: overlay-server
-            path: infra/overlay-server
-            wallet: true
-          - name: uhrp-server-basic
-            path: infra/uhrp-server-basic
-            wallet: true
-          - name: uhrp-server-cloud-bucket
-            path: infra/uhrp-server-cloud-bucket
-            wallet: true
-          - name: wab
-            path: infra/wab
-            wallet: false
-          - name: wallet-infra
-            path: infra/wallet-infra
-            wallet: false
+      matrix: ${{ fromJSON(needs.scope.outputs.matrix) }}
     services:
       mysql:
         image: mysql@sha256:b3b90af2a6552ae30c266fdb7d5dd55f3afb72404bb78d37fe8a23eb857fd3fb

docs/packages/messaging/authsocket-client.md

@@ -3,10 +3,10 @@ id: pkg-authsocket-client
 title: '@bsv/authsocket-client'
 kind: package
 domain: messaging
-version: '2.1.3'
+version: '2.1.4'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-30'
-last_verified: '2026-07-30'
+last_updated: '2026-07-31'
+last_verified: '2026-07-31'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/authsocket-client'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/messaging/authsocket-client'
@@ -58,6 +58,8 @@ socket.on('disconnect', () => {
 - **Transparent proxying** — User code sees normal Socket.IO API; BRC-103 hidden
 - **Certificate exchange** — Supports verifiable certificates during handshake (optional)
 - **Standard Socket.IO interface** — `.on()`, `.emit()`, `.id`, `.connect()`, `.disconnect()`
+- **Failure isolation** — Authentication and callback failures disconnect the affected connection
+- **Bounded ingress** — Authentication concurrency defaults to 32 and is configurable
 
 ## Common patterns
 
@@ -96,6 +98,23 @@ const socket = AuthSocketClient('http://localhost:3000', {
 })
 ```
 
+### Failure reporting and authentication bounds
+
+```typescript
+const socket = AuthSocketClient('http://localhost:3000', {
+  wallet,
+  maxPendingAuthMessages: 32,
+  onError: (error, context) => {
+    console.error(context.phase, context.eventName, error)
+  }
+})
+```
+
+Malformed server authentication traffic and application callback failures are
+contained before they can become unhandled rejections. The error context does
+not include remote payloads or wallet material, and an `onError` handler that
+throws or rejects is also contained.
+
 ## Key concepts
 
 - **BRC-103 mutual authentication** — Nonce-based challenge-response protocol

docs/packages/messaging/authsocket.md

@@ -3,10 +3,10 @@ id: pkg-authsocket
 title: '@bsv/authsocket'
 kind: package
 domain: messaging
-version: '2.1.4'
+version: '2.1.5'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-30'
-last_verified: '2026-07-30'
+last_updated: '2026-07-31'
+last_verified: '2026-07-31'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/authsocket'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/messaging/authsocket'
@@ -60,6 +60,8 @@ server.listen(3000)
 - **Message signing** — Every message auto-signed with server wallet; every inbound message verified
 - **Automatic re-dispatch** — Special `'authMessage'` channel for BRC-103 frames; user code sees normal Socket.IO events
 - **Graceful lifecycle** — Idempotent `close()` disconnects clients and closes the attached HTTP server
+- **Failure isolation** — Authentication and callback failures disconnect only the offending socket
+- **Bounded ingress** — Per-socket authentication concurrency defaults to 32 and is configurable
 
 ## Common patterns
 
@@ -100,6 +102,23 @@ process.once('SIGTERM', () => {
 `close()` is idempotent. Socket.IO disconnects active clients before closing
 the HTTP server supplied to `AuthSocketServer`.
 
+### Failure reporting and authentication bounds
+
+```typescript
+const io = new AuthSocketServer(server, {
+  wallet,
+  maxPendingAuthMessages: 32,
+  onError: (error, context) => {
+    console.error(context.phase, context.socketId, error)
+  }
+})
+```
+
+Authentication, connection, and application callback failures are contained
+and disconnect only the affected socket. The error context identifies the
+phase and socket without including remote payloads or wallet material. An
+`onError` handler that throws or rejects is also contained.
+
 ### Receiving authenticated messages
 
 ```typescript

docs/packages/middleware/auth-express-middleware.md

@@ -3,10 +3,10 @@ id: pkg-auth-express-middleware
 title: '@bsv/auth-express-middleware'
 kind: package
 domain: middleware
-version: '2.1.5'
+version: '2.1.6'
 source_repo: 'bsv-blockchain/ts-stack'
-last_updated: '2026-07-30'
-last_verified: '2026-07-30'
+last_updated: '2026-07-31'
+last_verified: '2026-07-31'
 review_cadence_days: 30
 npm: 'https://www.npmjs.com/package/@bsv/auth-express-middleware'
 repo: 'https://github.com/bsv-blockchain/ts-stack/tree/main/packages/middleware/auth-express-middleware'

docs/packages/sdk/bsv-sdk.md

@@ -3,10 +3,10 @@ id: bsv-sdk
 title: '@bsv/sdk'
 kind: package
 domain: sdk
-version: '2.2.15'
+version: '2.2.16'
 npm: '@bsv/sdk'
-last_updated: '2026-07-30'
-last_verified: '2026-07-30'
+last_updated: '2026-07-31'
+last_verified: '2026-07-31'
 review_cadence_days: 30
 status: stable
 tags: ['sdk', 'crypto', 'transactions']

docs/reference/ci-performance.md

@@ -2,9 +2,9 @@
 id: ci-performance
 title: 'CI Performance Governance'
 kind: reference
-version: '1.0.0'
-last_updated: '2026-07-30'
-last_verified: '2026-07-30'
+version: '1.1.0'
+last_updated: '2026-07-31'
+last_verified: '2026-07-31'
 review_cadence_days: 30
 status: stable
 tags: [reference, ci, performance, github-actions]
@@ -23,13 +23,33 @@ prepare-job duration; artifact upload/download duration; and variance. This
 separates targeted feedback from the complete merge gate so a changing PR mix
 cannot make the trend appear faster or slower by accident.
 
-The main CI workflow builds the workspace once and shares immutable outputs
-with isolated test lanes, skips empty affected-package lanes, installs through
-the setup-node pnpm cache, caches the immutable MongoDB test binary, and
-rebuilds native/build tools only in jobs that execute them. Browser lanes
-retain exact package-composition reports without rebuilding the workspace.
-These optimizations reduce repeated CPU, network, and setup work without
-removing coverage, mutation, platform, security, or package-consumer checks.
+The zero-install scope job resolves three distinct package sets from the
+workspace dependency graph. Directly changed package importers own coverage
+suites; their reverse-dependency closure owns non-instrumented regression,
+compatibility, and browser checks; and the forward closure supplies every build
+prerequisite. This preserves behavioral coverage of possible consumers without
+paying to regenerate unchanged packages' coverage reports.
+A lockfile-only change selects the importers whose lock snapshots actually
+changed instead of treating the root lockfile as a global invalidation. Root
+compiler and workspace controls still select the complete graph deliberately.
+
+Mutation selection follows each target's exact implementation, property,
+regression, configuration, and policy inputs. Package-wide mutation suites
+expand only where their configuration really covers the whole package. Image
+jobs follow changed build contexts: a CI-workflow-only change selects no
+application image, while shared image/runtime contract inputs deliberately fan
+out to the registered consumers.
+
+The main CI workflow builds the selected graph once and shares immutable
+outputs with isolated test lanes, skips empty lanes, installs through the
+setup-node pnpm cache, caches the immutable MongoDB test binary, and rebuilds
+native/build tools only in jobs that execute them. Browser lanes retain exact
+package-composition reports without rebuilding the workspace. The cheap
+repository-health, scope, Sonar, and dependency-review gates complete before
+dependency installation, and all expensive matrices cancel unfinished siblings
+after the first failure.
+These controls reduce repeated CPU, network, and setup work without weakening
+the tests selected by the dependency or registered trust-boundary graph.
 
 To refresh the evidence without changing the baseline:
 

docs/reference/container-supply-chain.md

@@ -59,12 +59,14 @@ dependency graph.
 
 ## Pull request gates
 
-The infrastructure CI matrix builds all registered images on GitHub's
-Linux/amd64 runners and scans each resulting image with Trivy. Any high or
-critical OS or library vulnerability, including one without an upstream fix,
-blocks the merge. A finding must be fixed or entered in the repository's
-time-bounded exception registry with an owner, evidence, review date, and
-objective removal condition.
+The infrastructure CI matrix builds and scans only images whose build contexts
+changed. Shared image-governance or runtime-contract changes expand to every
+registered consumer, while application packages and CI orchestration alone do
+not build unrelated images. GitHub's Linux/amd64 runners scan every selected
+image with Trivy. Any high or critical OS or library vulnerability, including
+one without an upstream fix, blocks the merge. A finding must be fixed or
+entered in the repository's time-bounded exception registry with an owner,
+evidence, review date, and objective removal condition.
 
 All base-image and deployment references use a readable version tag plus a
 content digest. Dependabot proposes reviewed Docker refreshes alongside the