@@ -2,6 +2,20 @@
 
 ## Unreleased
 
+- Complete the Registry's generalized artifact and chain-evidence path. Rust,
+  C, JavaScript, and other CKB artifacts now keep explicit source, build,
+  deployment, TCB, and copy-only identities instead of being presented as
+  CellScript dependencies. Reproducible profiles require two to sixteen
+  distinct builder reports bound to the signed environment, source, recipe,
+  executable, build log, and predecessor evidence before verification becomes
+  `verified`; deployment is rejected until that evidence exists. Add
+  `cellc artifact reproduction-evidence`, wallet-ready mainnet commitment
+  transaction intents, fixed Registry Type/attestor Lock configuration,
+  Type-Script-indexed `CSREGv1` scans, and scheduled lifecycle reconciliation
+  that demotes spent attestations or stale deployment Cells without deleting
+  historical evidence. The chain path is implemented but remains
+  operationally disabled until the canonical mainnet Registry Type Script,
+  CellDep, and attestor Lock are deployed and configured.
 - Harden the unified artifact Registry boundary: default discovery now hides
   pending/rejected releases and paginates by package coordinate; deployment
   records and admin recovery must match the immutable CKB `hash_type` and
@@ -45,7 +59,11 @@
   now uses the corresponding official Nervos wallet-directory SVG rather than
   an autogenerated letter mark or a runtime favicon. The chooser header no
   longer reserves space for a hidden back control, so its title, explanatory
-  text, and wallet list share one left alignment edge.
+  text, and wallet list share one left alignment edge. Submit now asks for the
+  artifact kind and source language independently, and Manage groups publish,
+  inspection, reproduction, deployment, commitment, and availability as
+  isolated task flows; hidden task fields can no longer leak into the selected
+  workflow.
 - Deploy the public Registry production slice at
   `api.registry.cellscript.dev` and `registry.cellscript.dev`: Postgres 17 is
   the authoritative write store, the Node 22 adapter persists source snapshots
 
@@ -4,6 +4,13 @@
 admission, verification, discovery, deployment-evidence, CLI, and website
 surfaces described here are checked in on the current release line.
 
+The source-package production slice is deployed. Generic artifact,
+reproduction, deployment, and chain-index code is implemented, but a public
+`on_chain_attested` claim additionally requires operators to deploy and pin the
+canonical mainnet Registry Type Script, its CellDep, and the attestor Lock.
+Until all three identities are configured, commitment construction fails
+closed and scheduled chain reconciliation remains disabled.
+
 The Registry indexes CKB ecosystem artifacts. A coordinate is
 `namespace/name`; a release adds an immutable version. The coordinate does not
 imply that the object is a CellScript dependency, executable, deployed Script,
@@ -60,6 +67,10 @@ binary may be verified but have no deployment concept. A CKB executable may be
 verified and still undeployed. A previously chain-verified release may later be
 deprecated without rewriting its evidence.
 
+`on_chain_attested` is a current-state claim, not a permanent badge. Scheduled
+maintenance returns a spent commitment to `deployed` and a stale deployment to
+`verified_build`, while retaining every accepted evidence record for audit.
+
 ## Artifact Identity
 
 The Registry separates four questions:
@@ -209,6 +220,40 @@ reproducible build is marked `evidence_required` until
 appropriate build evidence exists; merely uploading output bytes does not prove
 reproducibility.
 
+## Accepting Reproduction Evidence
+
+The Registry never executes an arbitrary publisher build recipe in its API
+process. Independent builders execute the signed recipe in the declared
+environment and emit bounded reports:
+
+```json
+{
+  "schema": "cellscript-reproduction-report-v1",
+  "builder_id": "builder-a",
+  "environment": "<exact signed environment>",
+  "source_hash": "<CKB Blake2b-256>",
+  "build_recipe_hash": "<CKB Blake2b-256>",
+  "artifact_hash": "<CKB Blake2b-256>",
+  "build_log_hash": "<CKB Blake2b-256>",
+  "generated_at": "2026-08-02T00:00:00Z"
+}
+```
+
+Create the operator promotion payload locally:
+
+```bash
+cellc artifact reproduction-evidence acme/vault-lock@1.0.0 \
+  --report reports/builder-a.json \
+  --report reports/builder-b.json \
+  --output reproduced-build-promotion.json
+```
+
+The CLI and API require two to sixteen distinct builder IDs and exact matches
+for the signed environment, source, recipe, and executable. The promotion also
+references the accepted `verified_build` evidence. A reproducible artifact
+stays `evidence_required`, and deployment admission fails, until
+`reproduced_build` evidence is accepted.
+
 ## Consuming Other Artifacts
 
 Generic artifacts never pass through `cellc install`. Use the explicit
@@ -219,6 +264,7 @@ cellc artifact fetch acme/vault-lock@1.0.0 --output vault-lock.bundle.json
 cellc artifact verify --bundle vault-lock.bundle.json --receipt vault-lock.bundle.json.receipt.json
 cellc artifact pin acme/vault-lock@1.0.0 --output Artifacts.lock --accept-hash-bound
 cellc artifact copy acme/starter@1.0.0 --destination ./new-project --accept-hash-bound
+cellc artifact reproduction-evidence acme/vault-lock@1.0.0 --report builder-a.json --report builder-b.json --output reproduced-build-promotion.json
 cellc artifact record-deployment acme/vault-lock@1.0.0 --code-hash <hash> --hash-type data1 --dep-type code --tx-hash <tx_hash> --index 0 --capability-key-id <key_id>
 cellc artifact cell-dep acme/vault-lock@1.0.0 --output CellDep.json --accept-hash-bound --rpc-url https://mainnet.ckb.dev/rpc
 cellc artifact set-availability acme/vault-lock@1.0.0 --status yanked --reason "security advisory" --capability-key-id <key_id>
@@ -246,11 +292,22 @@ It signs a short-lived, nonce-protected capability payload; publishers may set
 `active`, `deprecated`, or `yanked`, while administrative quarantine remains a
 separate privileged action.
 
-`commitment` produces the canonical `cellscript-registry-commitment-v1`
-payload, CKB Blake2b commitment, and compact `CSREGv1 || hash` Cell data. The
-Registry accepts an on-chain attestation only after reading that live mainnet
-Cell and matching its exact data, attestor Lock hash, and Registry Type Script
-hash used for chain indexing.
+`commitment` verifies the Registry response against the locally fetched signed
+release, then writes the canonical `cellscript-registry-commitment-v1` payload,
+CKB Blake2b commitment, compact `CSREGv1 || hash` Cell data, fixed Registry
+Type/Lock hashes, and a wallet-ready mainnet transaction intent. The wallet,
+not the Registry or CLI, completes capacity, inputs, change, fee, witnesses,
+signatures, and broadcast.
+
+The Registry accepts an on-chain attestation only after reading the live
+mainnet Cell and matching its exact data, configured attestor Lock, and
+configured Registry Type Script. Scheduled maintenance uses an exact Type
+Script indexer query plus the `CSREGv1` prefix to discover commitments and
+reconcile their live lifecycle.
+
+This contract indexes code/artifact evidence; it does not take ownership of
+application business Cells. Business state remains governed by the
+application's own Lock/Type Scripts, schemas, and replacement transactions.
 
 ## Publisher Authorisation
 
@@ -311,6 +368,8 @@ that every artifact is installable.
   only between characters.
 - A source dependency resolver rejects every non-CellScript profile.
 - A CKB deployment requires prior verified-build evidence.
+- A reproducible CKB deployment additionally requires accepted
+  `reproduced_build` evidence.
 - Deployment evidence must match the published executable hash and a live
   mainnet Cell.
 - Quarantined releases are not returned by public detail or evidence routes.
@@ -319,6 +378,8 @@ that every artifact is installable.
   other mirror failures are audited and retried by verification sync, so an
   uncommitted release or deployment is never advertised as current.
 - State transitions append evidence; they do not mutate hash identity.
+- An unconfigured or partially configured Registry Type/Lock Script set cannot
+  produce a wallet transaction intent or current attestation.
 
 ## Validation
 
 
@@ -3,7 +3,7 @@
 **Status**: Development release notes for `nightly-0.23`; not a stable release
 certificate.
 
-**Updated**: 2026-08-01.
+**Updated**: 2026-08-02.
 
 CellScript 0.23 makes its source semantics and compatibility axes explicit.
 Edition 2026 is the first and only CellScript source-semantics epoch. The
@@ -13,8 +13,10 @@ canonical location:
 
 This document records completed 0.23 work. The public Registry infrastructure,
 read/write domains, website, CLI read authority, and automatic compiler-backed
-evidence chain are deployed; the first publisher-owned JoyID publication and
-clean-machine install remain the final Registry adoption checkpoint. Broader
+source-package evidence chain are deployed. General artifact, reproduction,
+deployment, and commitment support is implemented in-tree, while canonical
+Registry Script deployment, the first real non-CellScript mainnet attestation,
+and publisher-owned clean-machine adoption remain checkpoints. Broader
 RGB++/Fiber evidence and the Off-Chain Session Runtime profile remain roadmap
 work.
 
@@ -30,6 +32,9 @@ work.
 | Registry operations | `api.registry.cellscript.dev` and `registry.cellscript.dev` run as an isolated self-hosted Postgres/Node/object-volume/read-only-nginx stack behind trusted TLS. |
 | Registry retry safety | Pre-admission failures release only the failed request's nonce and retry reservation; accepted metadata commits transactionally, and readiness covers the actual managed object prefixes. |
 | Registry verification | Publish transactionally queues a leased, bounded real-compiler verification job; verified evidence/status commit atomically before crash-safe static-index convergence, and default search stays hidden until the baseline passes. |
+| Registry artifact profiles | CellScript dependencies, CKB executables, runtime verifiers, reproducible binaries, and copy-only templates share discovery but retain different resolver, TCB, deployment, and copy contracts. |
+| Registry reproducibility | Reproducible profiles stay `evidence_required` until independent builder reports bind the signed environment, source, recipe, executable, and build logs. |
+| Registry chain evidence | Mainnet deployment records are RPC-checked; configured Registry Type/Lock Scripts produce wallet transaction intents and a bounded Type-Script indexer reconciles live commitments without erasing history. |
 | Production HTTP boundary | API/static JSON responses use HSTS, deny-all content policy, anti-framing, no-sniff, and restrictive browser permissions; the website ships a reproducible read-only nginx deployment with health checks and bounded logs/temp storage. |
 | Registry install policy | Explicit unverified/quarantined install acknowledgements persist per dependency, so lock refresh and subsequent builds retain the same auditable risk choice. |
 | Tooling | CLI, LSP, WASM, website bindings, examples, and package tooling use the same edition contract. |
@@ -163,6 +168,41 @@ This removes the previous cross-process nondeterminism caused by serializing
 `HashMap` fields directly and gives the publisher and isolated verifier one
 stable identity.
 
+## General Artifact And Chain Evidence Closure
+
+The public model no longer equates Registry discovery with `cellc install`.
+Each release declares an artifact kind, profile, source language, and
+consumption mode. Only `cellscript_source` plus `dependency` enters the package
+resolver. A CKB executable is consumed through explicit artifact verification,
+pinning, deployment, and CellDep commands; a runtime verifier is a declared TCB
+input; and a template is copied without becoming an implicit dependency.
+
+Reproducibility is now an evidence transition rather than a manifest adjective.
+`cellc artifact reproduction-evidence` verifies two to sixteen reports from
+distinct builder IDs. Every report must use
+`cellscript-reproduction-report-v1` and match the signed environment, source
+hash, build-recipe hash, executable hash, build-log hash, and timestamp. The
+Registry binds the promotion to the accepted `verified_build` evidence. Until
+that promotion succeeds, a reproducible executable remains
+`evidence_required` and cannot acquire deployment evidence.
+
+For an RPC-verified mainnet deployment, the commitment endpoint computes the
+canonical `cellscript-registry-commitment-v1` payload and compact
+`CSREGv1 || commitment_hash` Cell data. When operators configure the canonical
+Registry Type Script, its CellDep, and the attestor Lock, the endpoint also
+returns a mainnet-only wallet transaction intent. A compatible wallet supplies
+capacity, inputs, change, fee, witnesses, signatures, and broadcast. Scheduled
+maintenance scans exact Type Script matches through the CKB indexer and
+reconciles current state: a matching live Cell promotes the release to
+`on_chain_attested`; a spent attestation falls back to `deployed`; and a stale
+deployment falls back to `verified_build`. Evidence remains append-only.
+
+This is an implementation boundary, not a claim that the canonical mainnet
+Registry Script has already been deployed. Production chain attestation stays
+disabled until those three Script identities are deployed and configured, and
+the first real non-CellScript mainnet artifact is still an adoption/evidence
+checkpoint.
+
 ## CLI, LSP, WASM, And Website
 
 - Package commands read Edition 2026 from `Cell.toml`.
@@ -176,6 +216,10 @@ stable identity.
   compatibility-profile hash, and use the checked-in fixture only as an
   explicitly labelled read-only mirror during API failure. The Coming Soon
   surface is removed.
+- Submit separates artifact kind from source language instead of hard-coding
+  Rust. Manage exposes isolated reproduction, mainnet deployment, and
+  commitment command builders alongside publish, inspect, and availability;
+  task-specific fields disappear when the task changes.
 - `cellc auth namespace claim` and the submit page's **Claim namespace** action
   expose the namespace-ownership admission step required before a package's
   first public publish. Capability registration no longer appears to imply a
 
@@ -333,26 +333,24 @@ model:
 - deployment identity answers which CKB Cell, CellDep, or runtime artifact is
   being used.
 
-Registry discovery can be broad. It may index CellScript source packages,
+Registry discovery is broad. It indexes CellScript source packages,
 runtime verifiers, deployed CKB artifacts, reproducible artifacts, and even
 external CKB tooling artifacts such as bootstrapper outputs. Resolver profiles
 must stay narrower: an object can be discovered without being installable by
 `cellc add`.
 
-That means registry resolution is stricter than discovery. Current `cellc`
-registry dependencies are CellScript source-package dependencies. Future
-profile-aware resolver paths should accept only objects that can be checked
-fail-closed:
+That means registry resolution is stricter than discovery. `cellc add` and
+`cellc install` accept only the `cellscript_source` + `dependency` contract.
+Other profiles use explicit `cellc artifact` commands and fail closed on
+unknown fields, identities, roles, or lifecycle state:
 
-| Kind | Current `cellc add` | Future profile boundary |
+| Kind | `cellc add` | Current explicit boundary |
 | --- | --- | --- |
-| `source_package` / library | yes | Source and API identity must be pinned and reproducible. |
-| `runtime_verifier` / `spawn-verifier` | no, unless wrapped as a CellScript package today | TCB object; requires verifier ID, ABI, artifact identity, build profile, security status, and production deployment pins when used in production. |
-| `deployable_contract` | no, unless it is a CellScript source package today | Must expose build/audit/deployment identity, not just source text. |
-| `deployed_artifact_record` | no | Must bind network, OutPoint, dep type, code/data hash, and status. |
-| `reproducible_artifact` | no | Must bind source hash, build profile hash, artifact hash, and compatibility profile. |
-| `protocol_profile_library` | only if it is a real CellScript package today | Must be a real package with checkable source/schema/API semantics. |
-| `template`, `cookbook`, `protocol_skeleton`, scaffold | no | Copy-only starting material; after copying, it becomes local project code. |
+| `source_library` / `profile_library` | yes | Compiler-backed source and API identity are pinned in `Cell.lock`. |
+| `runtime_verifier` | no | `artifact fetch`, `verify`, and `pin`; verifier ID, IPC ABI, artifact, build, security, and production CellDep remain explicit TCB facts. |
+| `deployable_contract` | no | `artifact fetch`, `verify`, `pin`, `record-deployment`, and `cell-dep` bind build and live mainnet deployment identity. |
+| `reproducible_binary` | no | `artifact reproduction-evidence` binds independent builders to source, recipe, environment, executable, and logs before verified use. |
+| `template` | no | `artifact copy` authenticates a bounded file map, rejects traversal and overwrite, and then leaves local project source. |
 
 The rule is intentionally blunt:
 
@@ -373,9 +371,8 @@ hashes, build profile, TCB/security status, and any production CellDep pins.
 A NovaSeal starter project, by contrast, is not dependency-safe merely because
 it contains useful `.cell` code. If users are expected to copy it and edit terms,
 authorities, manifests, or deployment pins, it belongs in a cookbook or template
-flow, not in dependency resolution. The current `cellc` CLI does not ship a
-template or cookbook-copy command; copy starter material with repository tooling
-or a future scaffold command, then treat the result as local project source.
+flow, not in dependency resolution. Use `cellc artifact copy`, then treat the
+authenticated result as local project source.
 
 It should not be installed with:
 
@@ -403,20 +400,26 @@ cellc info --json
 Use `info` when you want a quick view of the package boundary before building or
 debugging dependency resolution.
 
-## Experimental Commands
+## Registry Commands
 
 Registry source-package installation and registry-backed `update` are supported
-for the CellScript source-package profile. The public registry policy is:
-`cellc auth capability create --principal-id <principal_id> --scope
-publish:namespace/package --expires 90d` authorises a JoyID-rooted publisher
-capability, then `cellc publish` writes a real registry entry. The
-`principal_id` is derived from the connected JoyID signer, not from a display
-address. The same metadata can still be
+for the CellScript source-package profile. `cellc auth capability create
+--principal-type <joyid_ckb|ckb_secp256k1> --principal-id <principal_id> --scope
+publish:namespace/package --expires 90d` creates the wallet payload for a
+scoped publisher capability, then `cellc publish` writes a real Registry entry.
+The `principal_id` is cryptographically derived from the signer, not from a
+display label. The same metadata can still be
 mirrored with `cellc publish --offline` to `registry.json` and Git tags for
 audit, local fixtures, and offline fallback. `cellc registry add` manages discovery/claim metadata rather than
-ordinary version publication. `run`, `repl`, cryptographic audit-signature
-verification, and non-CellScript artifact profiles remain future-facing or
-fail-closed.
+ordinary version publication.
+
+Non-CellScript profiles publish with `Artifact.toml` and
+`cellc publish --artifact-manifest Artifact.toml`. Consumers use the explicit
+`cellc artifact fetch`, `verify`, `pin`, `copy`, `reproduction-evidence`,
+`record-deployment`, `cell-dep`, `commitment`, and `set-availability` commands;
+none silently turns an executable, TCB object, or template into a source
+dependency. `run`, `repl`, and cryptographic audit-signature verification
+retain their separate documented assurance boundaries.
 
 ## Next