* Add term weight

* Fix wrong pre-commmit

* Remove binary of consensus precompiled, add version check

…c struct scenario. (#941)

* <fix>(build): update dependencies version, add UT with AI.

* Add unit tests to increase JaCoCo coverage from 30.1% to 30.7% (#1)

* Initial plan

* Initial setup: Upgrade Gradle to 7.6.4 for Java 17 compatibility and fix duplicate resources handling

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add unit tests for model classes and exceptions to improve coverage

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add more unit tests for model and enum classes to increase coverage

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add unit tests for crypto exception classes to increase coverage

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Downgrade Gradle version to 6.3

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add unit tests for SDK v3 client and transaction packages (#2)

* Initial plan

* Add unit tests for client and transaction packages - part 1

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add more unit tests for client protocol response and transaction dto classes

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add unit tests for LogFilterRequest, model BO classes and CommonConstant

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Fix ResultCodeEnumTest to avoid mutating enum state in tests

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* <fix>(test): fixed tests path.

* Add comprehensive test coverage for uncovered utility, protocol, and codec classes (#4)

* Initial plan

* Add comprehensive tests for ByteUtils, ThreadPoolService, SystemInformation, SecureRandomUtils, and LinuxSecureRandom

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add comprehensive tests for JsonRpcRequest and TopicTools

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Address code review feedback - fix resource cleanup and remove redundant tests

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* <fix>(CI): fix windows ci version to 2025.

* <fix>(build): update publish url to central.sonatype.

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>

* <fix>(sdk): fix logic and security bugs found via codebase scan

- codec/scale ScaleCodecReader: fix 32-bit int overflow in decodeInteger
  (1<<(bytesSize*8) overflowed to 1 for bytesSize>=4, corrupting unsigned
  SCALE values >= uint32); add a bounds/negative guard in readByteArray
  so a forged compact length cannot over-read or OOM.
- client ClientImpl.getTransactionAsync: send the withProof flag the async
  path was dropping (matching the synchronous getTransaction).
- eventsub EventSubscribeImp.subscribeEvent: use the topic-position index
  for addTopic (was wrongly using the contract-address loop index); guard
  negative index in EventSubParams.addTopic.
- filter Publisher: use CopyOnWriteArrayList to avoid
  ConcurrentModificationException between subscribe/unsubscribe and publish.
- precompiled BalanceService: stop mutating the shared
  PrecompiledRetCode.CODE_SUCCESS singleton (concurrency race + per-call
  receipt leak into global state); return a fresh copy instead.
- crypto P12KeyStore: fix inverted self-signed cert validity (notBefore was
  advanced +100y instead of notAfter, making every cert never-valid) and a
  FileOutputStream leak on the keystore write path.

* <test>(sdk): add unit + integration tests raising coverage to ~80%

Add ~1500 new unit and integration tests across codec (ABI/SCALE, datatypes,
generated types, ContractCodec), crypto, config, client RPC + response POJOs,
transaction managers, precompiled services, auth governance, filter/eventsub.

Merged JaCoCo coverage (unit + integration against local standard and
auth-mode chains): ~80% instruction / ~81% line / ~86% method, up from ~30%.

Also add CLAUDE.md / AGENTS.md contributor/build guide.

* <test>(sdk): address Codacy static-analysis findings in the new tests

- Move field/constant declarations to the top of the class
  (FieldDeclarationsShouldBeAtStartOfClass) across the codec unit tests.
- Replace `x.equals(null)` assertions with `assertNotEquals(null, x)` (EqualsNull).
- Throw IllegalStateException instead of a raw RuntimeException (AvoidThrowingRawExceptionTypes).
- Remove the reflection/`setAccessible` test of the private ContractCodec.buildType
  (AvoidAccessibilityAlteration); cover the equivalent type-dispatch via the public
  encode/decode API instead (new ContractCodecBuildTypePublicTest).
- Split the over-complex auth integration test methods into smaller ones (NPathComplexity),
  preserving the exact production calls/coverage.
- Remove unused locals/params, document empty callback bodies, and delete the dead
  always-skipped EIP-1559 placeholder test (UnconditionalIfStatement / UnusedLocalVariable
  / UnusedFormalParameter / UncommentedEmptyMethodBody).

Merged JaCoCo coverage remains >= 80% (unit + integration).

* <test>(sdk): make integration tests skip (not fail) when chain unreachable

The new coverage integration tests built one BcosSDK/Client in @BeforeClass
without try/catch, so a transient peer-connection refusal marked the whole
class as classMethod FAILED (red CI) even though sibling classes connected
fine. Wrap each setUp in try/catch and add a @before guard that uses
Assume.assumeTrue(client != null) so an unreachable/flaky chain skips the
class instead of failing it. Also loosen a node-version-sensitive keyColumn
assertion in PrecompiledWrapperDecodeIntegrationTest (it threw AssertionError,
which the existing catch(Exception) did not catch).

Codecov coverage reports stopped appearing on PRs after the build-centos
job (which carried the only coverage upload step) was removed in 9837e92.
Add a dedicated 'coverage' job that runs the unit tests, generates the
JaCoCo XML report (jacocoTestReport, xml.enabled=true) and uploads it to
Codecov using the existing CODECOV_TOKEN secret. Unit-test scope matches
.codecov.yml, which already ignores src/integration-test and
src/integration-wasm-test. The job is continue-on-error so it never blocks
a PR.

…u runner (#960)

* <CI>(workflow): upload Codecov BASE report on push to main branches

Codecov could not show a coverage delta on PRs because the base branch never
had a coverage report: the workflow only ran on pull_request/release, so merges
(which are pushes) never uploaded coverage for the base commit (hence the
'missing base commit' warning and the empty +/- column).

Add a push trigger for master and release-* and gate the heavy integration
'build' job to non-push events, so a push to a main branch runs only the
lightweight 'coverage' job and uploads a BASE report. PR/release behavior is
unchanged. After this lands, future PRs show a proper coverage delta.

* <CI>(workflow): fix macOS openssl dep and bump Ubuntu runner to latest

The macOS build hard-failed at the dependency step: Homebrew removed the
openssl@1.1 formula ('No available formula with the name openssl@1.1'), so
'brew install openssl@1.1' exits 1. Switch to openssl@3 — the SDK native runs
fine against OpenSSL 3.x (the Ubuntu job already executes the full integration
suite with libssl 3.x). Also bump the Ubuntu runner from ubuntu-22.04 to
ubuntu-latest (build matrix + coverage job).

Note: the remaining Ubuntu integration failures are pre-existing flaky tests
(node/chain state, e.g. -4008 / 'Call address error'), unrelated to the runner
version; the build job is continue-on-error so it does not block merge.

)

* <CI>(check): simplify node matrix to 3 concurrent cert-free chains

Rework .ci/ci_check.sh from 5 sequential build-test-teardown rounds
(v3.2.6 auth / v3.7.3 wasm / v3.7.3 ecdsa / v3.7.3 sm / v3.11.0) to 3
chains started once, concurrently, on disjoint ports:

  - v3.7.3 ecdsa            (p2p 30300, rpc 20200)  pinned compatibility
  - latest release ecdsa    (p2p 30310, rpc 20210)
  - latest release sm       (p2p 30320, rpc 20220)

The latest tag is auto-resolved from the GitHub releases/latest redirect
(guaranteeing binary assets exist; the newest git tag may have no release),
with a gitee fallback; build_chain.sh falls back to the source tree for
releases that no longer attach it as an asset. WASM testing is dropped and
SM is only tested on the latest version.

All chains disable SSL on the RPC endpoint (';disable_ssl=true' ->
'disable_ssl=true' on <=3.7.x, 'enable_ssl=true' -> 'enable_ssl=false' on
newer templates; the [p2p] enable_ssl_verify key is unaffected), so the SDK
connects certificate-free: the rendered config.toml sets enableSsl=false
and no node certs are copied into conf/. integrationTest then runs three
times, once per chain (useSMCrypto toggled for the SM round).

Verified locally (macOS, both binaries via Rosetta): all three chains
healthy with plain-HTTP JSON-RPC responding, and a real SDK integration
test class ran against each chain (36/36 executed, 0 failures, 0 skips)
with no certificates configured.

* <CI>(check): validate latest-tag resolution, probe rpc with real JSON-RPC

Address review feedback: fail fast with a clear message if the latest
release tag cannot be resolved (instead of confusing download errors), and
make wait_rpc_ready send an actual getBlockNumber JSON-RPC request and
require a jsonrpc response body (a bare HTTP probe could report ready on
any HTTP responder). Probe verified against a live local chain.

* <CI>(check): stop each chain after its round, run all rounds to completion

The macOS run showed the v3.16.3 round failing 6 PrecompiledTest cases with
receipt status -4008 (node-side execution timeout): the chain processed
transactions fine for ~16 minutes and then stalled permanently. Root cause is
runner resource exhaustion — macos-latest (7GB, arm64) cannot sustain 12
x86_64 nodes under Rosetta plus the Gradle JVM for the whole job. The same
tests pass locally against an idle v3.16.3 chain.

Keep the start-everything-upfront design but stop each chain as soon as its
round finishes, so round 2 runs with 8 nodes and round 3 with 4. Also make
rounds non-fatal individually: every round always runs, failures are
aggregated in FAILED_ROUNDS and reported at the end (a flaky early round no
longer hides the later rounds' results), with chain health reported before
and after each round.

* <test>(sdk): stop SystemServicesExhaustive test poisoning the chain gas price

Root cause of the CI integration flakiness (and of the long-standing 6
PrecompiledTest failures on newer node versions upstream):
SystemServicesExhaustiveIntegrationTest.testSystemConfigManyKeys set
tx_gas_price=1 on the live chain. On any node version that supports the key
(>= ~3.6), every later transaction from the zero-balance test accounts can no
longer be sealed (the SDK times out after 10s and surfaces a synthetic -4008
receipt), and the price cannot be restored because the restoring transaction
itself would need gas. Whether a run passed depended purely on Gradle's test
class execution order: classes running before the poisoning passed, classes
after it failed - which is why identical scripts alternated between green and
red, on both ubuntu and macOS at the same wall-clock offset.

Set the value to 0 instead: it exercises exactly the same
Numeric.toHexString conversion branch in SystemConfigService.setValueByKey
with no side effect. Same guard for the tx_gas_price governance proposal in
AuthGovernanceExhaustiveIntegrationTest (currently inert because the test
account is not a governor, but poisonous the day it is one).

Verified locally against a fresh v3.16.3 chain in the poisoning order
(SystemServicesExhaustive first, then PrecompiledTest): both pass, and the
chain reports tx_gas_price=0x0 set at block 24.

* <test>(sdk): stop consensus-membership churn poisoning the shared chain

Second chain-poisoner found behind the v3.16.x-only round failures (the first
was the tx_gas_price one):

- WrapperTxContractDeepIntegrationTest.testConsensusServiceAddRemoveAgainstRealNode
  did setWeight(2) + setTermWeight(1) + addObserver on a REAL sealer and never
  restored it. On nodes >= 3.12 the setTermWeight version gate passes, so the
  final addObserver executes and permanently demotes a sealer of the shared
  4-node chain; on <= 3.11 setTermWeight throws into the catch block first,
  which is exactly why only the latest-version rounds died. Bisect on a live
  v3.16.3 chain confirmed: sealers 4 -> 3 after the class ran, then the chain
  stalls under load and every later transaction times out with -4008.
- SystemServicesExhaustiveIntegrationTest.testConsensusFullLifecycleWithRealNode
  demoted a sealer and re-added it, but membership changes only take effect on
  a block boundary: on newer nodes the immediate addSealer returned receipt
  status 0 without taking effect, silently leaving 3 sealers.
- SystemServicesExhaustiveIntegrationTest.testConsensusSetTermWeight left a
  real sealer with termWeight=1.

Fixes keep the codec/version-gate/receipt-parsing coverage without mutating
live consensus state: setWeight now re-sets the genesis weight (success
receipt, zero net change), setTermWeight targets a bogus node id (error
receipt), and the demote/promote lifecycle poll-verifies the node is actually
back in the sealer list, retrying the addSealer until it takes effect.

* <test>(sdk): async consensus test was removing a live sealer despite 'bogus' comment

Third and final chain-poisoner behind the -4008 cascades:
testConsensusAsyncCallbackVariants declared 'String bogus' with a comment
claiming a bogus node id, but actually assigned realSealerNodeId(). The async
consensus.remove(bogus, cb) therefore REMOVED a live sealer from the shared
4-node chain. Unlike setTermWeight there is no version gate on remove, which
is why after the first two poisoners were fixed the v3.7.3 round started
failing as well - whether a round survived depended only on whether Gradle
happened to schedule this class before or after the strict assertion classes.

Use a genuinely bogus 64-hex node id: the async submission paths, callbacks
and decoders are still exercised via the error receipt, with zero live
consensus mutation (same pattern as testConsensusRemoveInputOutputDecode).

* <test>(sdk): consensus decode tests were demoting a live sealer too

Fourth chain-poisoner: PrecompiledWrapperDecodeIntegrationTest's consensus
input/output-decode tests shared pickNodeId(), which returned a REAL sealer id
(getSealerList().get(0)). The addObserver decode test assumed the tx 'may be
rejected by the chain', but demoting an existing sealer to observer succeeds -
so the class silently dropped the shared 4-node chain to 3 sealers before the
other consensus tests even ran (visible in CI as sealerList=3 at the start of
SystemServicesExhaustive's lifecycle test), the chain stalled under load and
later strict test classes failed with -4008.

pickNodeId() now returns a well-formed bogus node id: all four decode tests
assert only on transaction INPUT decoding, which behaves identically on the
error receipt a bogus id produces (same pattern the remove decode test in the
same class already used).

* <test>(sdk): wait for demotion to apply before restore; avoid phantom consensus entries

Two refinements after the previous run (v3.7.3 round green, v3.16.x rounds
still dying 25s after the consensus lifecycle test):

1. The lifecycle restore was a false positive on newer nodes: membership
   changes apply on a block boundary, so right after addObserver the node is
   STILL in the sealer list - the immediate addSealer-back gets rejected with
   ALREADY_EXISTS, the membership poll passes on the stale list ('sealer
   restored: true' 2s after the demote), and the demotion lands afterwards,
   leaving 3 sealers. Now the test first waits until the demotion has actually
   been applied (node absent from the list, up to 10s) and only then re-adds
   and verifies, retrying until the change takes effect.

2. Newer nodes ACCEPT addSealer/addObserver/setTermWeight for a bogus node id
   with receipt status 0 (older nodes reject with -51100), creating a phantom
   consensus-table entry. The addSealer decode test now targets a REAL sealer
   (ALREADY_EXISTS rejection - guaranteed non-mutating), the setWeight decode
   test re-sets a real sealer's genesis weight (success, zero net change), and
   an @afterclass hook best-effort removes the phantom entry the remaining
   bogus-id decode tests may leave in the table.

* <test>(sdk): stop demoting live sealers entirely - rejection paths only

Even with the demotion verified as applied and the sealer list verified as
restored ('demotion applied: true' / 'sealer restored: true' in the previous
run), the v3.16.x chains still stalled ~25s after the lifecycle test: on newer
nodes the demoted-then-restored node's consensus engine does not re-engage
cleanly even though the sealer list shows it back, and the chain dies under
load. Live consensus-membership mutation is fundamentally unsafe on a
suite-shared chain.

The lifecycle test now exercises only guaranteed-non-mutating real-node
branches: addSealer on an existing sealer (ALREADY_EXISTS rejection) and
setWeight with the genesis weight (success receipt, zero net change). The
demote/restore success path is left to dedicated chain-per-test environments.

* <test>(sdk): sysconfig tests re-set current values instead of mutating live consensus params

With every consensus-membership mutation eliminated, the v3.16.x rounds still
stalled ~25-30s after SystemServicesExhaustive's sysconfig writes (v3.7.3
immune, same tests). The remaining live mutations were consensus_leader_period
(current+1) - a PBFT reconfiguration that applies at the next epoch - and
enabling the bugfix_revert feature switch mid-run.

All sysconfig coverage tests now RE-SET the current value (full setValueByKey
pipeline: validation predicates, tx_gas_price hex branch, submission, receipt
parsing - zero behavior change), and the feature-switch write only happens if
the feature is already enabled. Same treatment for the consensus_leader_period
test in PrecompiledExpandedIntegrationTest.

* <CI>(check): connect the SDK to two peers for RPC failover

Aligned three consecutive macOS runs: the v3.16.3 round dies ~7.5 minutes in,
between two vanilla CRUD transactions, regardless of which test is running -
after every test-side state mutation had been eliminated. The same signature
was reproduced locally: node0's RPC endpoint wedges (every request times out)
while node1 keeps answering on the same healthy chain. The rendered SDK config
pointed at a SINGLE node's RPC, so a one-node RPC wedge killed the entire
round.

Render peers=[node0, node1] like the historical CI config did, so the SDK
fails over instead of the round dying with cascading -4008 timeouts.

* <CI>(check): dump per-node diagnostics on round failure, clean up phantom consensus entries

* <fix>(test): stop passing a BFS path as solidity deploy path, it poisons 3.16.x chains

* <CI>(check): revert to single peer, poison-tx fix makes failover unneeded and it flakes testClient

* Remove outdated fisco-bcos.org URL from Maven POM metadata (#946)

* Initial plan

* Remove fisco-bcos.org URL, replace with GitHub repo URL in build.gradle

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Initial plan

* Fix idempotent SDK and eventsub shutdown

* Apply remaining changes

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

… 69.9% (#959)

Adds offline (no live node) JUnit4 unit tests that drive the generated
precompiled and auth contract wrappers, their high-level Service classes, and
several pure-Java codec/model/util classes. The wrappers are exercised via a
mocked Client (Mockito) plus ABI round-trips (encode known args with the SDK's
own FunctionEncoder, feed to the getXxxInput/getXxxOutput decoders) and stubbed
client.call(...) outputs, so no chain or JNI transaction signing is required.

Unit-only JaCoCo (verifiable in CI/Codecov, which ignores integration-test
dirs): instruction 54.57% -> 69.87%, line 56.24% -> 68.22%, branch -> 67.79%,
method -> 76.07%. Notable package gains: contract/auth/contracts 6.7% -> 88.2%,
precompiled/crud 6.8% -> 67%, consensus 12.5% -> 66%, balance 20% -> 72%,
bfs 36% -> 74%, transaction/tools 36% -> 89%.

Test-only change; no production code modified.

#953)

* Remove outdated fisco-bcos.org URL from Maven POM metadata (#946)

* Initial plan

* Remove fisco-bcos.org URL, replace with GitHub repo URL in build.gradle

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Initial plan

* Fix ProposalInfo default constructor

* fix(auth): delegate ProposalInfo() to 7-arg ctor; update obsolete characterization test

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Remove outdated fisco-bcos.org URL from Maven POM metadata (#946)

* Initial plan

* Remove fisco-bcos.org URL, replace with GitHub repo URL in build.gradle

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Initial plan

* Fix indexed event value decoding

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Remove outdated fisco-bcos.org URL from Maven POM metadata (#946)

* Initial plan

* Remove fisco-bcos.org URL, replace with GitHub repo URL in build.gradle

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Initial plan

* fix: decode constructor params without stripping selector

* <test>(codec): add constructor decode edge-case coverage

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add unit tests to increase JaCoCo coverage from 30.1% to 30.7% (#1)

* Initial plan

* Initial setup: Upgrade Gradle to 7.6.4 for Java 17 compatibility and fix duplicate resources handling

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add unit tests for model classes and exceptions to improve coverage

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add more unit tests for model and enum classes to increase coverage

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add unit tests for crypto exception classes to increase coverage

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Downgrade Gradle version to 6.3

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add comprehensive test coverage for uncovered utility, protocol, and codec classes (#4)

* Initial plan

* Add comprehensive tests for ByteUtils, ThreadPoolService, SystemInformation, SecureRandomUtils, and LinuxSecureRandom

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Add comprehensive tests for JsonRpcRequest and TopicTools

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* Address code review feedback - fix resource cleanup and remove redundant tests

Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: kyonRay <32325790+kyonRay@users.noreply.github.com>

* <CI>(check): run each integration round as a parallel matrix job

Parameterize ci_check.sh with a round id (pinned-ecdsa | latest-ecdsa |
latest-sm); each id builds just that round's single 4-node cert-free chain
and runs one integrationTest pass. No-arg/all keeps the sequential
all-three-chains path for local runs.

workflow.yml: split the old build job into a Windows-only build job plus an
integration matrix {ubuntu,macos} x {3 rounds}, so the three chains run on
independent runners (one 4-node chain each) instead of one runner carrying
twelve nodes through three sequential rounds. Same tests, same serial
per-round execution; wall-clock per platform drops from ~22min to ~9-10min.

* <CI>(check): run all 3 rounds on ubuntu, only latest-ecdsa on macOS

macOS GitHub-hosted runner slots are a scarce org-wide resource (cap ~5,
shared across the whole org), so three parallel macOS legs just queue and
buy no wall-clock. Make the integration matrix asymmetric: ubuntu runs all
three rounds in parallel, macOS runs only the latest-ecdsa smoke round.

---------

Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>