feat: govern and harden service operations

[ty-everett]

Program and scope

• Tracker or issue: contributes to [Program] Complete TypeScript stack health, security, standardization, testing, docs, and performance #324 (Wave 25)
• Program gate(s) advanced: service operations governance; deployable service readiness; container and Kubernetes hardening; safe production-code Sonar closure; planning-document authority; source release candidates
• Why this change is needed: the seven deployable services need one enforceable operational contract, safe health semantics, reproducible deployment examples, explicit secret handling, current operator guidance, and a broad pass over low-risk production findings.
• Explicitly out of scope: PR fix(wallet-toolbox): derive ChainTracks from Arcade host, drop babbage defaults #306; npm publication; tags or releases; image publication; deployments; SonarCloud administration; CORS/CSP tightening; high-risk protocol/payment refactors; the deferred stack-wide fuzzing/manual/browser/performance/conformance/QA phase; BDK refactor(sdk): reduce cognitive complexity in Hash.ts (#44) #49 or vendored BDK artifacts.

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected services and intended patch versions (source candidates only; this PR does not publish):

• chaintracks-server 1.0.11
• message-box-server 1.1.15
• overlay-server 2.1.19
• uhrp-lite 0.1.9
• uhrp-storage-server 0.2.11
• wab-server 1.4.12
• wallet-infra 2.0.14

The next first-party dependency ranges are intentionally not installed yet because those versions are not published. Their release order and lock refresh remain a separately authorized publication-phase dependency.

What changes

• Introduces governance/service-operations.json as the exact seven-service operational contract and adds generated reference documentation plus CI-backed validation.
• Enforces non-root container users, real readiness-based Docker health checks, digest-pinned Kubernetes images, secret/config indirection, probes, resource bounds, restricted pod/container contexts, and disabled service-account token mounting.
• Repairs and hardens Overlay, WAB, and Wallet Kubernetes examples and documents migration, backup, rollback, and required secret inputs.
• Adds immediate liveness and bootstrap-aware readiness endpoints to both UHRP services with direct HTTP tests.
• Removes dynamic execution of Firebase credential files, validates credential shape without logging secrets, and makes safe complexity/modernization fixes in Message Box, Overlay, UHRP, and WAB.
• Marks historical and proposal plan documents unambiguously so they cannot be mistaken for current repository policy.
• Preserves the public-service model: Overlays, WAB, and Storage remain wildcard, credential-free CORS by default; an origin allowlist is an explicit operator opt-in rather than a new default.
• Applies repository formatting to touched legacy sources; the large textual diff includes that standardization, while substantive behavior remains limited to the items above.

Verification

• Local commands and results:
  • root pnpm health:check: 65/65 controls, zero documentation-policy findings, zero repository-health findings
  • root lint: all 36 workspace projects passed
  • root build and post-build typecheck: passed
  • root full test suite: passed, including SDK 5,747; conformance 6,650; wallet-toolbox 1,290
  • governance suite: passed; 559 required test files accounted for
  • service tests: UHRP Basic 26/26, UHRP Cloud 17/17, Message Box 17/17, WAB 86/86
  • all seven affected infrastructure builds and lints: passed
  • root audit and all seven service audits at high severity: zero known vulnerabilities
  • documentation build: 107 routes and 112 links passed
  • Kubernetes client dry-run validation: all Overlay, WAB, and Wallet manifests passed
  • git diff --check: passed
  • Verifast governance preserved all five pinned BDK artifacts byte-for-byte
• Hosted CI run: all 65 exact-head checks passed, including the full coverage and mutation matrix, both CodeQL languages, all seven service jobs, SonarCloud, Socket, dependency review, Codecov, documentation, conformance, code generation, platform checks, and the final merge gate
• Conformance evidence: full conformance suite passed; no protocol surface was intentionally changed
• Coverage delta: health and governance tests added; broader testing/QA hardening remains deliberately deferred by [Program] Complete TypeScript stack health, security, standardization, testing, docs, and performance #324
• Lint/typecheck delta: all workspace lint/build/typecheck checks passed
• Browser/mobile/packed-consumer evidence: no package or consumer behavior change; deferred QA phase remains preserved in [Program] Complete TypeScript stack health, security, standardization, testing, docs, and performance #324
• Performance or bundle-size delta: no public package bundle change; deferred final QA/performance phase remains preserved in [Program] Complete TypeScript stack health, security, standardization, testing, docs, and performance #324

Local pnpm codegen:check could not complete because this workstation lacks uv; generated specifications and artifacts are untouched, and the dedicated hosted gate installs the pinned toolchain.

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date, and removal condition
• Workflow permissions and lifecycle-script behavior remain least privilege

No dependency versions are changed in this wave; lockfiles change only with the seven candidate package versions. Credential parsing and deployment policy receive direct negative validation, while hosted CodeQL remains authoritative for the complete query set.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

No tag, release, image, deployment, or other publication action is authorized or performed here. Kubernetes examples continue to reference currently published exact image digests rather than unpublished source candidates.

Completion evidence

• The linked tracker is updated only for work fully proved by merged code, passing checks, resolved alerts, measurements, or an approved exception
• Review conversations are resolved
• One qualified maintainer approval is sufficient; no last-pusher restriction is assumed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[ty-everett]

Substantive maintainer review by ty-everett on exact head a048d6d against unchanged base b512122.

Reviewed the 70-file final diff and production impact. The service registry exactly covers the seven governed containers; the hosted operational check validates health/readiness contracts, non-root images, digest-pinned sample workloads, secret indirection, probes, resource limits, seccomp, dropped capabilities, read-only filesystems, and disabled service-account token mounting. The Overlay, WAB, Storage, and other public-service defaults remain wildcard credential-free CORS; allowlisting remains an explicit operator choice.

Security review confirms Firebase credentials are parsed as data rather than executed, secret-shaped deployment literals are rejected, and UHRP secret synchronization avoids ambient PATH lookup and shell execution while using a private 0600 temporary file with guaranteed cleanup. No new override, dismissal, suppression, skipped test, checked-in Secret, or mutable application image was introduced.

All 65 hosted checks pass on this exact head: both CodeQL analyses, SonarCloud with 0 new issues / 0 hotspots / 0.0% new duplication, dependency review, Socket, Codecov patch coverage, frozen build/lint/typecheck/policy, all seven affected service jobs, docs/codegen/conformance, browser/mobile, full coverage, every mutation shard and mutation-quality aggregate, and the final merge gate. Local repository health is 65/65 with zero contract findings, all seven service audits report zero high/critical vulnerabilities, and the two UHRP service suites pass 43 tests.

No npm package, tag, release, image, or deployment was published. Candidate service versions remain source-only; first-party dependency alignment waits for separately authorized coordinated publication. The deliberately deferred final QA/fuzz/manual/browser/performance program remains tracked rather than being smuggled into this operational wave.

GitHub does not permit an author to formally APPROVE their own pull request, so this COMMENT review records the maintainer acceptance evidence for an exact-SHA admin merge. No unresolved review threads or requested changes remain.