Wave 39: centralize contributor and agent governance

[ty-everett]

Local and hosted validation are complete on the exact head. Every applicable check is terminal and successful; there are no unresolved findings or review threads.

Program and scope

• Tracker or issue: [RETIRED] TypeScript stack health, security, standardization, testing, docs, and performance #324 (final modernization closeout); residual work is preserved in [QA] Complete deferred coverage, fuzzing, conformance, and runtime validation #400, [Release] Execute the authorized package and image release train with external assurance #401, and [Maintenance] Validate Sonar administration and continue CI efficiency review #402
• Program gate(s) advanced: durable contributor/agent governance; root-owned GitHub policy; tracker retirement readiness
• Why this change is needed: prevent package-local contribution, agent, CI, release, documentation, dependency, and quality rules from drifting or silently regressing after the modernization program
• Explicitly out of scope: deferred QA/fuzzing in [QA] Complete deferred coverage, fuzzing, conformance, and runtime validation #400; package/image publication and external assurance in [Release] Execute the authorized package and image release train with external assurance #401; optional Sonar administration and further CI-efficiency analysis in [Maintenance] Validate Sonar administration and continue CI efficiency review #402; any deployment; draft PR fix(wallet-toolbox): derive ChainTracks from Arcade host, drop babbage defaults #306
• Exact head SHA reviewed: fcda716e370b0e3ab4b870ec2be93d5a2b38a771

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected package candidates (not published here): @bsv/sdk 2.2.15, @bsv/templates 1.9.6, and lockstep @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile 2.4.20. Changes are README/contribution-policy alignment only; runtime behavior is unchanged.

Verification

• Local commands and results: pnpm health:check (113/113 governance tests; 0 findings/control errors), pnpm lint (0 warnings), pnpm format:check, pnpm typecheck, pnpm build, pnpm test, pnpm audit:security (0 vulnerabilities), pnpm check-versions, pnpm docs:facts:check, pnpm docs:build, contributor-policy tests (5/5), issue-form YAML parse, and affected artifact checks all passed
• Hosted CI run: CI 30568657089 completed successfully with 59 jobs; all exact-head PR checks are terminal and green
• Conformance evidence: parity generator verifies 74 files / 6,650 vectors; hosted conformance passed; no protocol behavior changed
• Coverage delta: Codecov patch passed and reports every modified coverable line covered; aggregate SDK, VeriFast, DID, Wallet Toolbox, and other affected-package coverage passed
• Lint/typecheck delta: zero warnings; all governed TypeScript profiles pass
• Browser/mobile/packed-consumer evidence: exact tarball contracts and hosted browser/mobile/platform jobs pass for all affected package candidates; behavior is unchanged
• Performance or bundle-size delta: no runtime source or dependency change; measured impact is zero
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; the empty non-coverage package partition was an expected scope skip validated by merge-gate

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed; the only Dependabot edit clarifies existing major-migration governance
• CodeQL/negative-test evidence is not applicable because no trust boundary or runtime behavior changed; exact-head CodeQL still passed
• The exact-head CodeQL analysis has no new alert
• The exact-head repository quality gate reports zero new Sonar findings (including accepted or false-positive issue states) and zero unreviewed hotspots; both the repository gate and Sonar report passed
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date, and removal condition; none is introduced here
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

• Release notes and necessity: no dependency release; a comment now requires dedicated review for database majors
• Runtime, build, and peer compatibility: no dependency graph or runtime change
• Deduplicated lockfile: unchanged; frozen install passed
• Audit and CodeQL: local security audit is clean; exact-head Actions and JavaScript/TypeScript CodeQL passed
• Package and consumer tests: full workspace tests/build, five exact-package artifact checks, browser/mobile platform jobs, coverage, and mutation quality passed
• Bundle and performance impact: No runtime source, dependency, bundle, or performance path changed; measured impact is zero.
• Affected public package versions: SDK 2.2.15; templates 1.9.6; Wallet Toolbox family 2.4.20

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included
• Image/SBOM/provenance/deployment/rollback impact is documented: no image or deployment change; root protected release controls remain authoritative
• Documentation, changelog, migration, and operational guidance are current

Completion evidence

• Tracker follow-up work is preserved in [QA] Complete deferred coverage, fuzzing, conformance, and runtime validation #400, [Release] Execute the authorized package and image release train with external assurance #401, and [Maintenance] Validate Sonar administration and continue CI efficiency review #402; [RETIRED] TypeScript stack health, security, standardization, testing, docs, and performance #324 will be updated and retired only after this exact head is merged and main is verified
• Review conversations are resolved; the thread-aware audit found zero review threads and zero requested changes
• Documentation, changelog, migration notes, release notes, and operator guidance are current or concretely not applicable
• No pending, failed, stale, cancelled, or unexpectedly skipped check is being handed to another contributor as complete
• One qualified maintainer approval is sufficient; no last-pusher restriction is assumed

Consolidation inventory

• 43 governed package/service scopes now contain generated root-policy pointers
• 31 legacy agent guides were deliberately consolidated, with stale duplicated technical inventories retired in favor of current READMEs/docs/specs/operator authorities
• 49 historical nested .github files have explicit root replacement or retirement dispositions
• 8 package-local contribution/code-of-conduct files were consolidated
• CI now rejects missing/drifting pointers, nested GitHub ownership, or new package-local contributor policies

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Exact-head maintainer self-review completed as ty-everett at fcda716e370b0e3ab4b870ec2be93d5a2b38a771. GitHub does not permit an author to submit an APPROVE review on their own PR, so this anchored review records the required assessment without waiting for another maintainer. The complete diff preserves public API/runtime behavior, centralizes contributor and agent authority, records every historical disposition, and is supported by terminal-successful repository health, lint, formatting, build, typecheck, tests, artifacts, docs, conformance, coverage, patch coverage, mutation, CodeQL, Sonar zero-finding, Socket, container, browser/mobile, and merge-gate evidence. No review threads or requested changes remain.