feat: implement durable output knowledge and overlay architecture

[ty-everett]

Implementation and review scope

This PR implements progressive ingestion and resumable live lookup together, durable UTXO-derived application state, protected operations, private lookup context and acquisition, STEAK/POTATOES delivery, independently authenticated SHIP/SLAP root suppression, and SDK/tooling/Overlay Express adapters and reference compositions. Discovery, Bitcoin facts, domain eligibility, private delivery and root coordination remain distinct responsibilities. BRC-197 is one optional transaction-domain exemplar; generic acquisition does not require it. Application migrations remain Checkpoint 3 work.

The specification target is BRC PR295 at 1b9a75e497b5856675af1ce01fd86843c37d07f9. The published implementation head is 096ef8c5e6cae1435d67281d236ffedf6145f848, with main f77d672263a2d5218c787fe64c085a75aa08af78. Checkpoint 2 remains incomplete; this PR remains draft.

Compatibility and current implementation

Existing finite lookup, STEAK, GASP, wallet actions and ordinary LCH paths remain available. New capability/profile selections, journals, real-time adapters and private acquisition are opt-in. Original declarations, native method bodies, protocol bytes, custody formats, authorization/currentness checks and resource bounds remain compatible. BRC-197 historical helpers are kept separately from the generic current acquisition contract.

Portable WithInlineStrings packet parsing retains its established text/byte path. Seven additive WithOwnedRecords parsers allow native server bindings to construct fresh independent records during complete lexical validation. Object inputs retain fresh ownership. The additive canonicalOutputJSONWithDirectRecords emits canonical text directly from freshly checked records and arrays; seventeen native serializer import aliases select it. Existing serializers and portable browser/wallet selections retain their behavior. It checks the complete input on every call, with identical canonical bytes, descriptor ordering, safe integers, Unicode, prototype/symbol/cycle refusals and resource fences. No input, normalized graph, shape, encoding, secret, authorization or currentness verdict is cached. Representation validation supplies no schema, signature or authority decision.

Two appended SDK tests exercise generated nested JCS values, exact UTF-8 byte fences, refusal order, cross-realm records, sparse/decorated arrays, hidden/accessor/symbol fields, cycles and fresh observations. All original test bodies remain. SDK/output-knowledge READMEs, SDK release notes, implementation guidance and the source-generated migration ledger describe the explicit selection. Official public ECR mirror routes retain the existing immutable Node, Postgres, MySQL and Mongo image identities and service settings.

Review the spec alignment, implementation and validation record, reference application, workbench guide, acquisition recovery guide, and root coordination guide.

Validation and remaining qualification

Commit 096ef8c selects the existing direct-record serializers in private identity, purchase-contract and acquisition-payload framing, and the existing native Base64 round-trip in protected payload framing. Four imports and appended neutral implementation guidance change; all other 5,339 tracked files remain exact. Every supplied representation, custody key, HMAC commitment, HKDF/GCM authentication and authorization/currentness fence remains freshly checked. No runtime cache is added. This is a performance hypothesis pending hosted validation.

All nine local source checks pass, including pure engine/coverage controls, policy, lint, formatting, build, types, audit, documentation and compiled examples. Six-context compiler comparison preserves declarations and introduces no new diagnostics. The precommit full source inventory retains 151 targets, 398 nonempty disjoint execution rows and 64,165 canonical mutants (wallet 944; protected ledger 1,023). The exact staged tree and all 5,344 tracked index blobs were verified before commit/push; local, remote and PR heads match. These checks do not qualify runtime or mutations.

The independently reconciled wallet diagnostic38040022870 passes on b520: 847 killed, 12 timeout and 85 survived mutants, giving 90.9957627118644% over all 944 canonical mutants against the unchanged 90% minimum. Uncovered, invalid, ignored and unexecuted counts are zero. All eleven source bodies, canonical configuration, exact source/run/attempt/runtime identity, 300 runs, seed3242026, empty replay and raw receipt/report digests were independently verified. Artifact SHA256: 871f47017a39a239c09cd956f2468b92554b05de548d852995598d68d16abf97. This is older-head diagnostic evidence, not final-source campaign qualification. Earlier81.05%/60NoCoverage and failed initial runs remain historical; their failures are not waived.

The preceding f389 CI38043247221 failed disclosure240/300 and coordinator214/300 after fresh serial isolation, plus the consequent merge gate. Neither property reported a counterexample. Other applicable CI jobs passed, including wallet coverage, SDK, platform, package and documentation consumers. Conformance, container, codegen and both actual CodeQL categories passed. Independently verified Sonar has zero issues, including accepted/false-positive status, and zero TO_REVIEW hotspots; CodeQL has zero open PR-reference alerts with both analyzed merge parents/tree checked. All23 review threads were resolved. Those results are historical for this successor.

Current CI38047210101 is terminal:39successful jobs,3failed jobs and4skipped jobs. Only native coordinator246/300 (job114199624010), disclosure195/300 (job114199624013) and consequent merge-gate114203464485 fail. Both properties hit the original150-second interruption without a reported counterexample. The last application shard passes63suites/998tests, with no interruption. SDK, wallet, platforms and package/documentation consumers pass; container38047209864, conformance38047209946, codegen38047209932 and CodeQL38047209924 pass. Fresh independently verified actual Sonar has zero issues including accepted/false-positive status and zero TO_REVIEW hotspots; CodeQL has zero open PR-reference alerts on the verified analyzed merge parents/tree. All23 review threads remain resolved at final recheck. The four-import change has not resolved the qualification gap, and no speedup is claimed.

The complete151-target/398-row campaign has not been dispatched on this revision. A formatted six-file harness-only proposal changes just these two properties to300-second interruption/360-second Jest case, with matching390-second diagnostic guard/source controls, the two exact policy timing descriptions and appended implementation guidance. Every original property body is independently byte-equal after reverting the proposed time parameters; every other production/test/seed/worker/threshold/151398 control remains. The peer956 author-verified ACK permits only those two policy descriptions, preserving every other policy byte and peer569 ownership. This proposal is private, NOT adopted and awaits separate human approval because the preceding outer-allowance decision explicitly retained the inner limits. All required assertions and complete exact-head qualification must still pass after any authorized change. Checkpoint2 remains incomplete and this PR remains draft.

The unadopted allowance candidate also passes all26 existing pure diagnostic control tests with0fail/skip. A restricted Node import guard verifies that only the diagnostic test, diagnostic metadata helper and monotonic helper execute; four application/workflow files are source text only, with no application/native runtime imports. Full5,344tracked source plus actual helper/input/tool closure remains unchanged, all deadline/fault/output/case guards remain false and the process group is independently absent. This is candidate-control validation, not application/property/CI/mutation qualification. The first three guard attempts refused its own preload re-import before controls ran; those failures are preserved, and the corrected exact-module guard passes without changing test assertions. Human approval and source adoption remain pending.

Earlier independently valid diagnostics identify JSON ownership/validation and Base64 costs. All51 invalid CPU profiles remain excluded whole: current artifact11668092737 (SHA256 05e63cfb3d4b1832ecd0d210709211e1691bc15cc0af93ecf7eb0648f2cef240) adds three invalid sampling reports, with1/1/2 negative deltas and2/2/4 reordered samples. Its source/actual execution merge, producer114199623883 terminal success, runtimev24.18, property controls, raw digests and separate monotonic clocks were independently checked. Diagnostic properties interrupt at186/300 and206/300; four original native HTTP assertions pass. These diagnostic results do not qualify complete functionality or mutations; independent native clocks are never summed as exclusive CPU totals. The coverage controller preserves exact original shard discovery, every raw batch result/full source map and independent complete-union reconciliation before the original global threshold. It has not alone resolved the property interruptions. Original test bodies, both Jest configurations, native engines, all20 original engine goldens and29 explicit additive framing sites remain intact.

Checkpoint2 requires terminal successful exact-head CI/platform/packed/conformance, fresh analyzer/review reconciliation and all151targets/398rows successfully reconciled from raw mutation receipts. Approved outer allowances are13 initial suites15minutes, buyer30minutes and three whole qualification jobs180minutes. Preserve300cases, seed3242026, empty replay, per-case deadlines, workers, thresholds and browser budgets. Diagnostic or older-head receipts cannot qualify a successor. No SDK/application/native/Go/property/mutation targets execute on macOS.

No merge, package publication, deployment, funding or broadcast has occurred. Application migrations remain Checkpoint3.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​express-rate-limit@​8.6.1

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
2.3% Duplication on New Code

See analysis details on SonarQube Cloud