Release v0.21.0

.github/workflows/ci.yml

@@ -21,6 +21,8 @@ jobs:
   ci:
     uses: XChain-Platform/.github/.github/workflows/ci-reusable.yml@6f4d39ae85787fc31e90a31588d87610a2c33103 # pin: XChain-Platform/.github @ master 2026-08-14; bump deliberately
     with:
+      # The fleet's consensus runtime; a floating "22" now resolves 22.23.3, which the VM runtime gate refuses.
+      node-version: "22.22.3"
       # On a release or hotfix PR, check the siblings out at the PR's own
       # branch so a release-branch-only change to a file a cross-repo guard
       # reads is tested against the train, not against develop. The shared
@@ -66,7 +68,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@v4
         with:
-          node-version: "22"
+          node-version: "22.22.3"
 
       - name: Install dependencies
         working-directory: xchain-encoder
@@ -140,7 +142,7 @@ jobs:
       - name: Use Node.js 22
         uses: actions/setup-node@v4
         with:
-          node-version: "22"
+          node-version: "22.22.3"
           cache: npm
 
       - name: Install dependencies

.github/workflows/mutation.yml

@@ -0,0 +1,54 @@
+# Scheduled Stryker mutation-testing run. Mutant runs are too slow for the
+# push gate, so this rides its own cadence against test/mutation/stryker.conf.json
+# (the XChainEncoder facade plus its post-split src/XChainEncoder/** modules)
+# and archives the report as a build artifact.
+name: mutation
+
+# Least privilege for the default GITHUB_TOKEN: every job here only reads the repo.
+permissions:
+  contents: read
+
+on:
+  schedule:
+    # Sundays 09:00 UTC, off audit.yml's Monday slot so the two scheduled
+    # workflows do not contend for the same runner minute.
+    - cron: "0 9 * * 0"
+  # Re-run on demand.
+  workflow_dispatch:
+
+jobs:
+  mutate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js 22
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+          cache: npm
+
+      - name: Install dependencies
+        run: if [ -f package-lock.json ]; then npm ci; else npm install; fi
+
+      - name: Run Stryker mutation testing
+        run: npm run mutate
+
+      - name: Fail if the mutation report is empty
+        run: |
+          test -s reports/mutation/report.json || {
+            echo "reports/mutation/report.json is missing or empty" >&2
+            exit 1
+          }
+
+      # Runs even if the score gate above failed, so a red run still leaves
+      # the report behind to triage.
+      - name: Archive mutation report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: mutation-report
+          path: reports/mutation/
+          retention-days: 30
+          if-no-files-found: error

CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.21.0] - 2026-09-29
+
+### Added
+- Exposed transaction block lookups through the tracker-backed RPC interface.
+
+### Fixed
+- Rejected constructed transaction fees below the node relay floor.
+
 ## [0.20.1] - 2026-09-23
 
 ### Fixed

CONTRIBUTING.md

@@ -21,7 +21,6 @@ If you're reporting a security issue, **stop here** and read [`SECURITY.md`](./S
 xchain-encoder/
 ├── src/                  encoder core: XChainEncoder, validator, PSBT construction, API, formats
 ├── test/                 layered suites (unit, integration, fuzz, boundary, chaos, regression, security, smoke, performance)
-├── dist/                 browser bundle output (xchain_encoder.min.js)
 ├── CHANGELOG.md          authoritative version history
 ├── SECURITY.md           private vulnerability disclosure
 └── package.json          scripts + dependencies
@@ -52,7 +51,6 @@ Create a `.env` (see [`README.md`](./README.md) for the full key list). **Never
 
 ```bash
 npm run api        # start the JSON-RPC API server
-npm run build      # production browser bundle -> dist/xchain_encoder.min.js
 ```
 
 ---

README.md

@@ -4,7 +4,7 @@
 # XChain Platform Encoder
 
 <p align="center">
-  <img src="https://img.shields.io/badge/version-0.20.1-blue" alt="Version">
+  <img src="https://img.shields.io/badge/version-0.21.0-blue" alt="Version">
   <img src="https://img.shields.io/badge/tests-1%2C787%2B%20passing-brightgreen" alt="Tests">
   <img src="https://img.shields.io/badge/node-%3E%3D22-green" alt="Node">
   <img src="https://img.shields.io/badge/license-AGPL--3.0--or--later-blue" alt="License">
@@ -30,7 +30,6 @@ PSBT encoding service for the XChain Platform. Takes an ACTION string, a set of
 - **Custom outputs**: arbitrary address/value outputs (e.g., COINPay native coin payments)
 - **Token-gated content support**: encodes [FILE v1](https://github.com/XChain-Platform/xchain-documentation/blob/master/protocol/actions/file.md) gated files and `BATCH(FILE, MESSAGE)` issuer-publish flows; ciphertext travels as `rawData` via P2WSH alongside the action string
 - **JSON-RPC API**: Express server with Helmet security headers, optional API key auth, configurable rate limiting, CORS
-- **Browser bundle**: Browserify build for client-side PSBT generation without a server
 - **Single-instance guard**: refuses to boot when `ENCODER_REPLICAS` declares more than one replica, and takes an exclusive PID lockfile against a second local process; the UTXO reservation guard, the recent-build duplicate refusal, the envelope-cancel owner set, the `release_inputs` reservation tickets, the rate limiter and the concurrency-gate counters are in-process only until a shared store exists
 - **1330+ tests**: unit, integration, e2e, boundary, security, fuzz, chaos, mutation, regression, performance, smoke
 
@@ -163,8 +162,6 @@ neither source sets one, so these defaults hold on an unconfigured box:
 | Command | Description |
 |---|---|
 | `npm run api` | Start the JSON-RPC API server |
-| `npm run build` | Production browser bundle (minified) -> `dist/xchain_encoder.min.js` |
-| `npm run build:dev` | Development browser bundle (unminified) |
 | `npm run smoke-test` | Smoke tests (~52 tests, <1s) |
 | `npm run test:unit` | Unit tests (910 tests) |
 | `npm run test:integration` | Integration tests (115 tests) |

SECURITY.md

@@ -52,7 +52,6 @@ If we cannot meet a timeline, we will tell you why and propose a new one. We wil
 - PSBT construction: inputs, outputs, amounts, and change address handling; any path where the wrong inputs are selected or the wrong value reaches an output.
 - Fee calculation and the fee-rate cap logic (`MAX_FEE_RATE_MULTIPLIER`, `MAX_FEE_RATE_KB`): a bypass could drain inputs into miner fee.
 - The encoder HTTP JSON-RPC API (`npm run api`): injection, auth bypass, rate-limit bypass, or denial-of-service via crafted requests.
-- The browser bundle (`dist/xchain_encoder.min.js`) produced by `npm run build`, including supply-chain integrity of that artifact.
 - Any path where a malformed or adversarial input yields a valid-looking but wrong transaction (wrong recipient, wrong amount, wrong action).
 
 ### Out of scope

bin/ci-full.sh

@@ -77,17 +77,20 @@ ci_tier_deferred() {
   return 1
 }
 # <<< ci-tier <<<
+# >>> ci-tier timer (generated block; re-run the tier wirer to update) >>>
 run_tier() {
   ci_tier_deferred "$1" && return 0  # ci-tier guard (generated)
   local name="$1"; shift
+  local __ci_tier_t0=$SECONDS
   echo; echo "ci:full ===== $name ====="
   if "$@"; then
-    echo "ci:full ----- $name PASS"
+    echo "ci:full ----- $name PASS ($(( SECONDS - __ci_tier_t0 ))s)"
   else
     FAILED="$FAILED [$name]"
-    echo "ci:full ----- $name FAIL"
+    echo "ci:full ----- $name FAIL ($(( SECONDS - __ci_tier_t0 ))s)"
   fi
 }
+# <<< ci-tier timer <<<
 need_sib() {
   local s
   for s in "$@"; do
@@ -103,6 +106,10 @@ need_sib() {
 
 need_sib xchain-hub xchain-documentation xchain-decoder xchain-sdk
 
+# Hold every tier below to the same guarantee need_sib just confirmed: an
+# unusable sibling must fail the tier that needs it, not skip it quietly.
+export XCHAIN_REQUIRE_SIBLINGS=1
+
 # --- job: ci (XChain-Platform/.github ci-reusable.yml -> npm run ci) -------
 run_tier "ci" npm run ci
 

bin/coverage-thresholds.json

@@ -1,7 +1,7 @@
 {
-  "comment": "Coverage floors for the CI coverage job (regression floors, ~1-1.5 points below measured, not tier targets; raise as coverage climbs). Mirrored into the coverage:check npm script in package.json and guarded by test/unit/repo/coverage_thresholds_sync.test.js. Re-measured 2026-08-14 WITH the declared siblings checked out, which is what the coverage job now does: 87.77 lines/statements, 86.67 branches, 67.48 functions over 587 unit tests; the functions floor stays at its existing 66, already inside the band, and remains a holding line rather than a target.",
-  "lines": 86.2,
-  "statements": 86.2,
-  "branches": 85.1,
-  "functions": 66
+  "comment": "Coverage floors for the CI coverage job (regression floors, ~1-1.5 points below measured, not tier targets; raise as coverage climbs). Mirrored into the coverage:check npm script in package.json and guarded by test/unit/repo/coverage_thresholds_sync.test.js. Re-measured 2026-09-24 with --all and the declared siblings checked out: 96.45 lines/statements, 88.50 branches, 95.48 functions over 925 passing and 4 pending unit tests. No source files are excluded: all files under src, including process entry points and locally owned vendored code, remain in the measurement.",
+  "lines": 95.1,
+  "statements": 95.1,
+  "branches": 87.1,
+  "functions": 94.1
 }