[fraware]

Summary

• Box channel send errors in the sidecar signing and batch-verification paths so those futures stay usable under the current Rust toolchain.
• Resolve the TypeScript protobuf plugin from the SDK-local install, then the hoisted workspace root, so proto generation does not depend on a single node_modules layout.

Test plan

• Confirm runtime/sidecar-watcher still type-checks with the boxed SendError return types.
• Run the proto TypeScript generation target with ts-proto installed either under core/sdk/typescript or hoisted to the repository root.

[github-actions]

Thanks for the PR! CI will run CERT validation and replay checks. Results will appear in workflow badges and artifacts.

[github-actions]

SBOM Security Report

Total Packages: 3275

Language Distribution:

• go: 323
• javascript: 1987
• rust: 654
• python: 4

License Distribution:

• MIT: 1374
• Apache-2.0: 44
• BSD-3-Clause: 45
• CC0-1.0: 43
• ISC: 85
• BSD-2-Clause: 40
• Python-2.0: 1
• MPL-2.0: 1
• Unlicense: 3
• CC-BY-4.0: 1
• (Apache-2.0 OR MPL-1.1): 1
• BlueOak-1.0.0: 3
• (AFL-2.1 OR BSD-3-Clause): 1
• (BSD-3-Clause OR GPL-2.0): 1
• (MIT AND Zlib): 1
• (MIT AND BSD-3-Clause): 1
• 0BSD: 4
• (MIT OR CC0-1.0): 3
• MIT AND ISC: 1

✅ SBOM generated successfully
✅ No GPL licenses detected
✅ No high/critical vulnerabilities found

[github-actions]

Policy Coverage Report

Tools Coverage: 100%
Events Coverage: 100%
Egress Labeled: 100%
Replay Determinism: 100%

All policy gates passed successfully!