@@ -315,8 +315,11 @@ Existing command families to be aware of:
 - `proposals/novaseal` is a submodule (`NovaSeal.git`, branch `main`). Same
   for `proposals/evolving-dob/evolving-dob-profile-v1`.
 - `tools/ckb-tx-measure` depends on `../ckb/util/jsonrpc-types` and
-  `../ckb/util/types`; the gate builds the helper with CellScript's pinned
-  Rust 1.97.1 toolchain so its declared `rust-version` remains enforceable.
+  `../ckb/util/types`; when release validation receives `--ckb-repo`, the gate
+  stages the helper's tracked workspace under `target/` so those same relative
+  paths resolve to the explicit checkout. The gate builds the helper with
+  CellScript's pinned Rust 1.97.1 toolchain so its declared `rust-version`
+  remains enforceable.
 - `--primitive-strict 0.16` is the current production assurance gate; the
   README mentions it and the policy lives in `docs/`.
 
 
@@ -1,6 +1,16 @@
 # Changelog
 
-## Unreleased
+## 0.24.0 - 2026-08-17
+
+- Close the 0.24 audit blockers: reject transitive executable resolvers and
+  unsafe Git refs, bound and origin-bind Registry downloads, preserve exact
+  LS-IDL Type-script identity, and stop exposing unexpected service errors.
+  Restore a deliberate Clippy boundary for legacy explicit-context helpers,
+  align package identities with 0.24, and carry the closed 0.23 release and
+  NovaSeal evidence forward.
+- Isolate every CKB-dependent gate check. The backend stateful wrapper accepts
+  `CELLSCRIPT_CKB_REPO`, and release modes propagate `--ckb-repo` to the staged
+  `ckb-tx-measure` workspace instead of silently using another sibling checkout.
 
 - Remove the unreachable external RISC-V toolchain fallback and make the
   audited internal assembler the sole ELF-emission path. Reassign `E2400` to
 
@@ -21,7 +21,7 @@ resolver = "3"
 
 [package]
 name = "cellscript"
-version = "0.22.0"
+version = "0.24.0"
 edition = "2024"
 rust-version = "1.97.1"
 autobins = false
@@ -82,7 +82,7 @@ blake2b_simd = "1.0"
 toml = "0.8"
 hex = "0.4"
 semver = "1.0"
-cellscript-artifact-checker = { version = "=0.22.0", path = "crates/cellscript-artifact-checker" }
+cellscript-artifact-checker = { version = "=0.24.0", path = "crates/cellscript-artifact-checker" }
 
 indexmap = "=2.2.6"
 
 
@@ -4,7 +4,7 @@
 </p>
 
 [![CellScript CI](https://github.com/CellScript-Labs/CellScript/actions/workflows/ci.yml/badge.svg)](https://github.com/CellScript-Labs/CellScript/actions/workflows/ci.yml)
-[![Release: v0.22.0](https://img.shields.io/badge/release-v0.22.0-2f6f4e.svg)](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.22.0)
+[![Release: v0.23.0](https://img.shields.io/badge/release-v0.23.0-2f6f4e.svg)](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.23.0)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE-MIT)
 [![Rust 1.97.1](https://img.shields.io/badge/rust-1.97.1-orange.svg)](Cargo.toml)
 [![Targets: CKB](https://img.shields.io/badge/targets-CKB-2f6f4e.svg)](#target-profiles)
@@ -20,8 +20,8 @@ artifacts, together with typed metadata for auditing, policy checks, schema
 binding, and scheduler-aware execution.
 
 The current stable release is
-[CellScript v0.22.0](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.22.0).
-See the [0.22 release notes](docs/releases/CELLSCRIPT_0_22_RELEASE_NOTES.md)
+[CellScript v0.23.0](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.23.0).
+See the [0.23 release notes](docs/releases/CELLSCRIPT_0_23_RELEASE_NOTES.md)
 for its shipped surface, evidence boundaries, and migration checklist.
 The completed 0.23 implementation scope is tracked in the
 [0.23 release notes](docs/releases/CELLSCRIPT_0_23_RELEASE_NOTES.md); those
@@ -122,15 +122,15 @@ curl -fsSL https://raw.githubusercontent.com/CellScript-Labs/CellScript/main/scr
 Or pin a specific version:
 
 ```bash
-CELLSCRIPT_VERSION=0.22.0 curl -fsSL https://raw.githubusercontent.com/CellScript-Labs/CellScript/main/scripts/install.sh | sh
+CELLSCRIPT_VERSION=0.23.0 curl -fsSL https://raw.githubusercontent.com/CellScript-Labs/CellScript/main/scripts/install.sh | sh
 ```
 
 The release page publishes `SHA256SUMS` alongside all four platform archives.
 
 Build the exact published source instead:
 
 ```bash
-git clone --branch v0.22.0 --depth 1 https://github.com/CellScript-Labs/CellScript.git
+git clone --branch v0.23.0 --depth 1 https://github.com/CellScript-Labs/CellScript.git
 cd CellScript
 cargo install --locked --path .
 ```
@@ -732,7 +732,7 @@ policy defaults:
 [package]
 edition = "2026"
 name = "token"
-version = "0.22.0"
+version = "0.24.0"
 entry = "src/main.cell"
 source_roots = ["src"]
 
@@ -916,9 +916,11 @@ the manual, CI, recovery, and external-wallet path.
 - The default source-package authority is
   `https://api.registry.cellscript.dev`; only publicly accepted statuses enter
   ordinary version selection. `CELLSCRIPT_REGISTRY_API_URL` changes that API
-  origin, while `CELLSCRIPT_REGISTRY_URL` explicitly selects the legacy
-  Git/offline discovery authority. An unavailable production API does not
-  silently downgrade to Git discovery.
+  origin, and `CELLSCRIPT_REGISTRY_STATIC_ORIGIN` explicitly trusts a separate
+  immutable-object origin for a private Registry. Snapshot downloads are
+  origin-bound; a lockfile cannot redirect the client to an unrelated host.
+  `CELLSCRIPT_REGISTRY_URL` selects the legacy Git/offline discovery authority.
+  An unavailable production API does not silently downgrade to Git discovery.
 - Registry discovery may grow to include CellScript packages, verifier
   artifacts, deployed artifact records, reproducible artifacts, and external
   CKB tooling artifacts. Dependency resolution stays narrower than discovery.
 
@@ -1,6 +1,6 @@
 [package]
 name = "cellscript-registry-type-script"
-version = "0.22.0"
+version = "0.24.0"
 edition = "2024"
 rust-version = "1.97.1"
 publish = false
 
@@ -43,7 +43,8 @@ Reproduce the canonical Linux artifact with the pinned container digest:
 contracts/registry-type-script/build_canonical_container.sh
 ```
 
-The deployable artifact is tracked under `artifacts/v0.22.0` and was produced
+The current deployable artifact is tracked under `artifacts/v0.24.0`; the
+identical historical release bytes remain under their versioned directories. It was produced
 for the `x86_64-unknown-linux-gnu` host with the builder image digest recorded
 in `release-manifest.json`. Rust/LLVM may order identical RISC-V functions
 differently on another build host, so the script claims a byte-for-byte