fix(registry): close 0.23 audit findings

Author: a19q3

.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: cargo
+    directory: /services/registry-verifier
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: npm
+    directory: /services/registry-api
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: gitsubmodule
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -42,7 +42,7 @@ jobs:
       REGISTRY_TEST_DATABASE_URL: postgresql://cellscript_test:cellscript_test_password@127.0.0.1:5432/cellscript_registry_test
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
 
@@ -73,7 +73,7 @@ jobs:
           git config --global user.email "ci@cellscript.dev"
 
       - name: Cache Cargo dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/git
@@ -90,23 +90,23 @@ jobs:
 
       - name: Upload backend shape report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: cellscript-backend-shape-report
           if-no-files-found: error
           path: /tmp/cellscript-backend-shape/
 
       - name: Upload syntax combination audit report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: cellscript-syntax-combo-audit
           if-no-files-found: ignore
           path: target/syntax-combo-audit/
 
       - name: Upload strict backend audit report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: cellscript-strict-backend-audit
           if-no-files-found: ignore

.github/workflows/release.yml

@@ -26,13 +26,13 @@ jobs:
     timeout-minutes: 180
     steps:
       - name: Check out tagged source
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
           submodules: recursive
 
       - name: Install Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
           cache: npm
@@ -41,7 +41,7 @@ jobs:
             editors/vscode-cellscript/package-lock.json
 
       - name: Install Rust release toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.97.1"
           components: rustfmt, clippy, llvm-tools-preview
@@ -99,7 +99,7 @@ jobs:
 
       - name: Upload release evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: cellscript-release-gate-evidence
           if-no-files-found: warn
@@ -126,7 +126,7 @@ jobs:
             os: ubuntu-latest
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
           submodules: recursive
@@ -139,7 +139,7 @@ jobs:
           git -C "$GITHUB_WORKSPACE/../ckb-sdk-rust" rev-parse --short HEAD
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
         with:
           toolchain: "1.97.1"
           targets: ${{ matrix.target }}
@@ -179,7 +179,7 @@ jobs:
           sha256sum "${{ steps.package.outputs.archive }}" > SHA256SUMS.${{ matrix.target }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: cellscript-${{ matrix.target }}
           path: |
@@ -194,12 +194,12 @@ jobs:
       contents: write
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
 
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           path: artifacts
           merge-multiple: false
@@ -220,7 +220,7 @@ jobs:
           printf 'version=%s\n' "$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           tag_name: v${{ steps.version.outputs.version }}
           name: CellScript ${{ steps.version.outputs.version }}

.github/workflows/website-build.yml

@@ -13,12 +13,12 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "22"
           cache: "npm"
@@ -46,7 +46,7 @@ jobs:
           npm exec -- astro build
 
       - name: Upload website dist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: cellscript-website-dist
           path: website/dist/

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## Unreleased
 
+- Close the 0.23 Registry audit findings across admission, verification, and
+  delivery. Publisher-controlled repository and homepage fields now require
+  credential-free HTTPS URLs, malformed base64 is a stable client error, and
+  unexpected server failures no longer disclose internal messages. Source
+  hashing confines manifest entry/source-root paths to the package, the
+  isolated verifier rejects path/Git dependencies, and signed dependency
+  metadata must exactly match the materialized `Cell.toml`. The Node adapter
+  derives quota identity only across an explicitly configured trusted-proxy
+  boundary. Fix Registry CI under a shared `CARGO_TARGET_DIR` and additive
+  migrations, pin GitHub Actions by commit, add Dependabot coverage, and
+  update vulnerable Registry/website build dependencies. The website filters
+  Registry navigation URLs and adds a defense-in-depth CSP.
 - Make Registry chain confirmation compatible with the standard CKB v0.207.0
   RPC schema by resolving a live Cell's committed block through
   `get_transaction.tx_status` instead of depending on a proxy-specific

docs/releases/CELLSCRIPT_0_23_RELEASE_NOTES.md

@@ -3,7 +3,7 @@
 **Status**: Development release notes for `nightly-0.23`; not a stable release
 certificate.
 
-**Updated**: 2026-08-02.
+**Updated**: 2026-08-08.
 
 CellScript 0.23 makes its source semantics and compatibility axes explicit.
 Edition 2026 is the first and only CellScript source-semantics epoch. The
@@ -30,12 +30,14 @@ work.
 | Build identity | The resolved profile independently combines edition, target, primitive assurance, metadata schemas, and entry/witness ABIs, then binds them into metadata, registry, lock, deployment, receipt, and builder records. |
 | Registry contract | The deployed publish contract requires Edition 2026 plus its compatibility-profile hash from CLI signature through API, Postgres, version-addressed JSON, and website; assurance states require ordered evidence. |
 | Registry operations | `api.registry.cellscript.dev` and `registry.cellscript.dev` run as an isolated self-hosted Postgres/Node/object-volume/read-only-nginx stack behind trusted TLS. |
+| Registry testnet | Pudge runs as a separate short-lived testnet sandbox with distinct API, object, database, wallet-session, RPC, and website state; it is not a mode of the production Registry. |
 | Registry retry safety | Pre-admission failures release only the failed request's nonce and retry reservation; accepted metadata commits transactionally, and readiness covers the actual managed object prefixes. |
 | Registry verification | Publish transactionally queues a leased, bounded real-compiler verification job; verified evidence/status commit atomically before crash-safe static-index convergence, and default search stays hidden until the baseline passes. |
 | Registry artifact profiles | CellScript dependencies, CKB executables, runtime verifiers, reproducible binaries, and copy-only templates share discovery but retain different resolver, TCB, deployment, and copy contracts. |
 | Registry reproducibility | Reproducible profiles stay `evidence_required` until independent builder reports bind the signed environment, source, recipe, executable, and build logs. |
 | Registry chain evidence | Mainnet deployment records are RPC-checked; configured Registry Type/Lock Scripts produce wallet transaction intents and a bounded Type-Script indexer reconciles live commitments without erasing history. |
 | Production HTTP boundary | API/static JSON responses use HSTS, deny-all content policy, anti-framing, no-sniff, and restrictive browser permissions; the website ships a reproducible read-only nginx deployment with health checks and bounded logs/temp storage. |
+| Audit closure | Registry links are HTTPS-only, source paths and dependency sources are verifier-confined, signed dependencies are manifest-bound, proxy identity is explicit, and CI/supply-chain dependencies are deterministic and monitored. |
 | Registry install policy | Explicit unverified/quarantined install acknowledgements persist per dependency, so lock refresh and subsequent builds retain the same auditable risk choice. |
 | Tooling | CLI, LSP, WASM, website bindings, examples, and package tooling use the same edition contract. |
 | Syntax audit | Canonical type fields use trailing commas, checked examples use named `u64` boundaries, and compatibility plus CKB-VM regressions cover both source and witness placement. |

roadmap/CELLSCRIPT_0_23_ROADMAP.md

@@ -144,7 +144,7 @@ Source documents:
 
 ## Pillar 1: Public Registry Production Deployment
 
-**Status (2026-08-02): production infrastructure, public reads, website, CLI
+**Status (2026-08-08): production infrastructure, public reads, website, CLI
 resolution, evidence promotion, and the bounded automatic source/build
 verification pipeline are implemented and deployed. The generalized artifact,
 independent reproduction, mainnet deployment, and configured chain-commitment
@@ -320,7 +320,9 @@ runtime or the optional Cloudflare/R2/Hyperdrive/Neon adapter.
   remain under their own Lock/Type Scripts and transaction protocols.
 - No bond or refundable deposit mechanism; the schema leaves `policy_hooks`
   and `bond_policy_hooks` for later.
-- No testnet Registry authorisation, deployment, or commitment state.
+- No testnet state or network selector inside the production Registry. Pudge
+  authorisation, deployment, and commitment testing runs in a separately
+  isolated, expiring sandbox.
 - No D1 as primary database.
 
 Source documents:

scripts/cellscript_gate.sh

@@ -390,7 +390,11 @@ run_registry_api_check() {
     fi
     run npm --prefix services/registry-api run check
     run cargo build --locked --manifest-path services/registry-verifier/Cargo.toml
-    run env CELLSCRIPT_REGISTRY_VERIFIER_TEST_BINARY="$ROOT_DIR/services/registry-verifier/target/debug/cellscript-registry-verify" \
+    local verifier_target_dir="${CARGO_TARGET_DIR:-$ROOT_DIR/services/registry-verifier/target}"
+    if [[ "$verifier_target_dir" != /* ]]; then
+        verifier_target_dir="$ROOT_DIR/$verifier_target_dir"
+    fi
+    run env CELLSCRIPT_REGISTRY_VERIFIER_TEST_BINARY="$verifier_target_dir/debug/cellscript-registry-verify" \
         npm --prefix services/registry-api test
     run npm --prefix services/registry-api run build
     run npm --prefix services/registry-api run build:node

services/registry-api/README.md

@@ -472,6 +472,14 @@ use `CKB_MIN_CONFIRMATIONS` to raise or lower the default 24-block confirmation
 floor. The Node adapter, production Compose file, and Worker example pass the
 same settings.
 
+The Node adapter never trusts client-supplied `CF-Connecting-IP`,
+`CF-ASN`, or internal Registry identity headers. `REGISTRY_TRUST_PROXY_HOPS`
+defaults to `0`; the checked-in Compose stacks set it to `1` because ingress is
+restricted to the external TLS proxy. That proxy must overwrite or append the
+actual peer to `X-Forwarded-For`, and direct client access to the API container
+must remain blocked. Change the hop count only when the ingress topology
+changes.
+
 The API container applies tracked additive migrations before serving traffic.
 `0001_initial.sql` is the frozen deployed baseline. `0002` adds the verifier
 queue; `0003` adds multi-wallet principals; `0004` converts an empty legacy
@@ -482,6 +490,8 @@ hash-integrity evidence from semantic verification with `hash_bound`; and
 renames historical chain evidence, adds the current-commitment pointer and
 status projection constraints, and deliberately demotes legacy current claims
 until the mainnet indexer re-observes a sufficiently confirmed live Cell.
+`0008` adds expiring Pudge sandbox state and purge tombstones; `0009` adds the
+browser/CLI authorisation-session lifecycle.
 
 `GET /health` is process liveness and is the Compose container healthcheck.
 `GET /ready` is the traffic and operator gate: it checks store/object access,

services/registry-api/deploy/docker-compose.production.yml

@@ -66,6 +66,7 @@ services:
       CKB_MIN_CONFIRMATIONS: ${CKB_MIN_CONFIRMATIONS:-24}
       ENVIRONMENT: production
       REGISTRY_ENVIRONMENT: production
+      REGISTRY_TRUST_PROXY_HOPS: "1"
       MAX_INCOMING_BODY_BYTES: "7340032"
       MAX_JSON_BODY_BYTES: "6291456"
       MAX_SNAPSHOT_BYTES: "5242880"