Skip to content

Verify overlay identity evidence and share transaction jobs - #517

Draft
sirdeggen wants to merge 20 commits into
mainfrom
codex/overlay-evidence-c02
Draft

Verify overlay identity evidence and share transaction jobs#517
sirdeggen wants to merge 20 commits into
mainfrom
codex/overlay-evidence-c02

Conversation

@sirdeggen

@sirdeggen sirdeggen commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

Overlay reliability program

This change is one slice of Make Overlays Great Again.

Do not merge until the stacked TypeScript and Go overlay branches have been proven together locally. Isolated CI green is not integration acceptance. Keep this PR draft. No npm publication, live database migration, or Mongo/BASM default activation.

C05 (verified progressive API) is parked. C02 (ts-stack#517) and C04 (ts-stack#518) both edit LookupResolver.ts and must not merge independently.

Keep this pull request in draft until local validation is complete. After
every push, wait for all applicable checks on the exact head to finish and
fix every failure before requesting review or calling the work complete.

Program and scope

  • Tracker or issue: Overlay reliability plan packages C01 (already in history) + C02/C03
  • Program gate(s) advanced: G1 trust boundary (local source/test)
  • Why this change is needed: Overlay identity results must bind txid to bytes, share verification by txid, recover from a bad first proof, and invalidate cache on reorg/policy change.
  • Explicitly out of scope: C05 verified progressive API (parked), C04 host scheduler (separate PR; both edit LookupResolver.ts), publication, default activation
  • Exact head SHA reviewed: b012b33a6b1891d8635b16bf48c3c83ae441a7fe

Impact

  • Public package source or manifest changed; affected packages are listed below
  • Public API, exports, types, runtime targets, or browser/mobile behavior changed
  • Security-sensitive boundary changed
  • Documentation or examples changed

Affected packages: @bsv/sdk, @bsv/wallet-toolbox (intended patch/minor at release workflow; not published from this PR)

Verification

  • Local commands and results: focused SDK coordinator/evidence suites and wallet identity/chaintracker/BHS tests reported passing in the SDD task reports; BHServiceClient reread tests added
  • Hosted CI run: not yet (draft)
  • I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
  • All applicable checks are terminal and successful on the exact head

Security and dependencies

  • No dependency or lockfile change
  • The exact-head CodeQL analysis has no new alert
  • The exact-head repository quality gate reports zero new Sonar findings

Release and operations

  • No npm publication was performed from a workstation or from this PR
  • Required npm patch bumps are included or intentionally deferred by the controlling program

Notes for reviewers

C04 is a sibling PR that also touches LookupResolver.ts. Do not merge both without a follow-up merge. C05 remains parked.

Preserve per-entry script results so a rejected sibling cannot poison a
shared ancestor. LocalChainTracker tokens use participating sources only
and fail closed on missing identity. Reset ownership is rechecked after
dispose before destructive hooks. Built-in remote ChainTracks clients
advertise reorg-event capability explicitly. Services.getChainTracker
publishes one coalesced wrapper before yielding.
BHServiceClient no longer caches the queried merkle root. Validity is
decided from a freshly read header, so a false result cannot invert on
retry and a reorg cannot reuse a stale positive.
Drop redundant optional-undefined on lookup evidence limits, extract
parseEvidence and Chaintracks header-retry helpers below S3776, and
rename coordinator catch params to error_.
…e-c02

# Conflicts:
#	docs/reference/package-api-migrations.md
#	governance/package-release-notes.json
discoverOverlayCertificates called getServices(), which throws on wallets
constructed without services and broke BRC-100 discoverBy* conformance.
Missing chain context now yields no identities instead of throwing.
Jest's istanbul graph still resolved 3.15.1, which fails pnpm audit --audit-level=high.
Health requires overrideRemovalReview.retainedCount to match the live registry.
LookupResolver and evidence helpers pushed the UMD/Vite/Metro payloads
over the previous raw-size gates.
Message-box UMD, wallet Vite gzip, and Hermes bytecode now cover the
evidence/discovery helper payload growth.
…ervices

Contact discovery still works without services. forceRefresh bypasses
contacts and still requires a chain tracker, matching the existing test.
S3776: discoverOverlayCertificates was 17 after the forceRefresh services
check. The missing-services path is now requireOverlayChainTracker.
@sonarqubecloud

sonarqubecloud Bot commented Sep 9, 2026

Copy link
Copy Markdown

@sirdeggen sirdeggen added the overlay-reliability Part of org overlay reliability program (project 19) label Sep 9, 2026
@sirdeggen

Copy link
Copy Markdown
Contributor Author

Linked to org project Make Overlays Great Again and tracker https://github.com/bsv-blockchain/make-overlays-great-again/issues/1.

This PR stays draft until the overlay stack is proven locally across ts-stack, go-overlay-services, and go-sdk. Do not merge to main/master to make progress.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

overlay-reliability Part of org overlay reliability program (project 19)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant