fix: enforce auth policy, quiet telemetry and preserve payment ordering

[ty-everett]

Summary

Enforce locally requested certificate policy on standalone SDK certificate responses, correct the conformance documentation to the SDK's existing BRC-103/104 wire messages, and make service telemetry quiet when no collector is configured. Payment processing now requires affirmative wallet acceptance before deleting the original notification; refundable PeerPay payments are internalized, refunded, then acknowledged.

• SDK 2.7.0 snapshots handshake and outstanding dynamic policies in local session state, preserving the v0.1 wire format. Serialized updates retain policy state with asynchronous session stores. Certificate listeners remain observers; documentation and tests explicitly cover committed validation and released message waiters before callbacks.
• Conformance fixtures are checked against a real SDK handshake captured with an injected fetch implementation. Historical vector identifiers stay stable; BRC-31 Authrite remains separate from BRC-103/104. Corrected specs describe unsigned initial requests, nonce fields, and the actual response shape.
• All seven service bootstraps are byte-for-byte synchronized from one canonical source using the existing runtime-copy policy; only the six synchronized copies are omitted from duplication scoring while code analysis and behavior tests remain active. They start no SDK, instrumentation, exporters, timers or log bridge by default. OTEL_CONSOLE_EXPORTERS=true explicitly enables local console telemetry; an OTLP collector takes precedence. Application logs remain active. Environment examples, Compose wiring and the operations reference document the migration.
• Message Box Client 2.5.1 and SDK BRC-29 processing check accepted === true. Initial ordering fixes for message-box-client: payment-bearing paths acknowledge (delete) the relay message before the payment is durably stored #503 preserve existing public result and wire shapes. Envelope/outcome redesign, mixed basket handling and durable refund/exactly-once semantics remain outside this PR; message-box-client: payment-bearing paths acknowledge (delete) the relay message before the payment is durably stored #503 stays open.

Addresses #491, #492, #493 and #505. Partially addresses #503.

Validation

• SDK: 159 suites / 5,967 tests pass; Message Box: 9 suites / 224 tests pass.
• Conformance: 6,485 passing cases, 211 existing skips, including two new real-emission/metadata tests; no new skips.
• SDK auth property tests and governed mutation target pass (85.47%).
• SDK and Message Box packed ESM/CJS/type consumers and browser contracts pass.
• All seven infrastructure packages compile and lint locally; dependency-free bootstrap tests cover default, explicit console and OTLP precedence plus application shutdown ownership.
• Repository format/typecheck, health/lint, eight compiled documentation examples, docs build (127 checked HTML pages), and security audit pass. Patch coverage is 96.64%. The isolated codegen toolchain now pins patched js-yaml 4.3.2, audits cleanly, and reproduces all nine generated files with its pinned Go/Node/Python tools. Hosted checks are required before merge.

Reviewed browser composition

The versioned local-policy bookkeeping and payment guards add runtime code, without a new dependency. SDK exact-tarball Vite/esbuild/UMD raw sizes are 744,420 / 562,342 / 557,389 bytes (gzip 180,827 / 163,879 / 159,942). Raise only their raw ceilings to 745,000 / 563,000 / 558,000; compressed SDK limits stay unchanged. Vite and UMD each retain 128 modules, and Vite contains only the SDK.

Message Box exact-tarball Vite/esbuild/UMD raw sizes are 662,502 / 515,149 / 512,607 bytes. Only UMD crosses its old limits (gzip 147,030); its reviewed caps become 513,000 raw / 147,500 gzip. Vite/esbuild and Brotli limits stay unchanged. Composition retains the SDK, AuthSocket/Message Box and existing Socket.IO packages (130 Vite/UMD modules).

The downstream Wallet Toolbox 2.13.1 candidates also incorporate this SDK code. Browser Vite/esbuild measure 1,718,279 / 1,340,483 raw bytes and 317,088 / 296,227 Brotli bytes; only those four ceilings change to 1,719,000 / 1,341,000 raw and 317,500 / 296,500 Brotli. The Vite gzip cap stays unchanged; official Node/Linux measures esbuild gzip at 369,775 bytes, so its cap becomes 370,000. Composition remains SDK, Wallet Toolbox, noble/hashes, hash-wasm and idb (106 Vite / 173 esbuild modules). Mobile Metro/Hermes measure 1,769,497 / 3,594,063 raw bytes; only raw ceilings change to 1,770,000 / 3,595,000. Metro compressed ceilings remain unchanged. Official Node/Linux measures Hermes gzip at 1,462,502 bytes; official Node on macOS measures Hermes Brotli at 1,135,493 bytes. Their caps become 1,463,000 / 1,136,000. The initial Homebrew Node measurement used a different zlib implementation; final compressed bounds are validated with the official Node toolchain used by CI. These are reviewed source-growth adjustments, with no new runtime dependency.

Deployment and compatibility

Existing valid authentication wire messages and fields are unchanged; responses outside the receiver's local policy are rejected. Custom asynchronous session stores must retain the added optional session metadata and coordinate writes between Peer instances as documented. No live services are deployed by this PR.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

❌ Patch coverage is 94.79167% with 5 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
.../messaging/message-box-client/src/PeerPayClient.ts	85.71%	2 Missing and 1 partial ⚠️
packages/sdk/src/auth/Peer.ts	96.96%	0 Missing and 2 partials ⚠️

📢 Thoughts on this report? Let us know!