Restore 0.23 release gate closure

Author: a19q3

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+- Restore the 0.23 release gate after the Python-to-Rust tooling migration by
+  checking the semantic `requires_all_bundled_examples_strict_original_ckb`
+  and emitted `source_provenance` CKB boundaries plus the Rust-backed NovaSeal
+  acceptance summary instead of retired temporary-directory, helper, and shell
+  field names, and refresh the NovaSeal external TCB review template to the
+  current Rust-migrated verifier source-tree hash. CKB transaction-recipe
+  replay now tops up fresh devnet funding when a fixture has no disposable
+  change output and its replacement input cannot fund every typed output.
+  Rebuild the website WASM bundle with the witness-placement-v2 compiler so the
+  playground and native release artifacts expose the same ABI.
 - Add the explicit `cellscript-witnessargs-input-type-v2` placement ABI for
   parameterized CKB entries. Generated wrappers now resolve witnesses relative
   to the active script group, decode the `CSARGv1` payload from

crates/cellscript-tools/src/ckb_acceptance_live.rs

@@ -8,7 +8,8 @@ use serde_json::{json, Map, Value};
 
 use crate::ckb_acceptance::{self, ArtifactRecord, CompileEvidence};
 use crate::ckb_devnet::{
-    always_success_dep, decode_hex, deploy_code, out_point, resolve_ckb_bin, sha256_hex, CkbDevnet, ALWAYS_SUCCESS_CODE_HASH,
+    always_success_dep, decode_hex, deploy_code, funding_cells, out_point, resolve_ckb_bin, sha256_hex, CkbDevnet,
+    ALWAYS_SUCCESS_CODE_HASH,
 };
 use crate::production_evidence::{ACTION_RUNS, EXPECTED_END_TO_END_STATEFUL_SCENARIOS, EXPECTED_EXAMPLES, LOCKS};
 
@@ -183,7 +184,7 @@ impl Replayer<'_> {
         Ok(tx)
     }
 
-    fn balance_change_capacity(&self, tx: &mut Value) -> Result<()> {
+    fn balance_change_capacity(&mut self, tx: &mut Value) -> Result<()> {
         let mut input_capacity = 0_u64;
         for input in tx["inputs"].as_array().context("transaction inputs missing")? {
             let live = self.devnet.rpc("get_live_cell", vec![input["previous_output"].clone(), json!(false)])?;
@@ -210,16 +211,35 @@ impl Replayer<'_> {
                     && output["type"].is_null()
                     && data.as_str().is_some_and(|value| value == "0x")
             })
-            .map(|(index, _)| index)
-            .context("rebound transaction is under-capacity and has no adjustable change output")?;
-        let old_change = parse_hex_u64(&outputs[candidate]["capacity"])?;
-        let fixed = output_capacity - old_change;
-        let new_change = input_capacity.checked_sub(fixed).context("rebound transaction inputs cannot fund fixed outputs")?;
+            .map(|(index, _)| index);
         const ALWAYS_SUCCESS_EMPTY_OCCUPIED: u64 = 4_100_000_000;
-        if new_change < ALWAYS_SUCCESS_EMPTY_OCCUPIED {
-            bail!("rebound change output would be under occupied capacity: {new_change}");
+        if let Some(candidate) = candidate {
+            let old_change = parse_hex_u64(&outputs[candidate]["capacity"])?;
+            let fixed = output_capacity - old_change;
+            if let Some(new_change) = input_capacity.checked_sub(fixed)
+                && new_change >= ALWAYS_SUCCESS_EMPTY_OCCUPIED
+            {
+                tx["outputs"][candidate]["capacity"] = json!(format!("0x{new_change:x}"));
+                return Ok(());
+            }
+        }
+
+        // Some recipe transactions intentionally have no disposable change
+        // output: every output is a typed scenario cell. A replacement
+        // cellbase input can be smaller than the original fixture input, so
+        // add fresh always-success funding instead of mutating scenario state.
+        let deficit = output_capacity - input_capacity;
+        let funding = self.devnet.collect_spendable(deficit)?;
+        let inputs = tx["inputs"].as_array_mut().context("transaction inputs missing")?;
+        for cell in funding_cells(&funding) {
+            inputs.push(json!({
+                "previous_output": out_point(
+                    cell["tx_hash"].as_str().context("funding transaction hash missing")?,
+                    cell["index"].as_u64().context("funding output index missing")?,
+                ),
+                "since": "0x0",
+            }));
         }
-        tx["outputs"][candidate]["capacity"] = json!(format!("0x{new_change:x}"));
         Ok(())
     }
 }

proposals/novaseal

@@ -211,14 +211,14 @@ check_ckb_acceptance_boundaries() {
     local required=(
         'scripts/ckb_cellscript_acceptance.sh::Usage: scripts/ckb_cellscript_acceptance.sh'
         'scripts/ckb_cellscript_acceptance.sh::ckb-acceptance'
-        'crates/cellscript-tools/src/ckb_acceptance.rs::strict-original-ckb'
+        'crates/cellscript-tools/src/ckb_acceptance.rs::requires_all_bundled_examples_strict_original_ckb'
         'crates/cellscript-tools/src/ckb_acceptance.rs::bundled_examples_exact_order'
         'crates/cellscript-tools/src/ckb_acceptance.rs::language_examples_exact_order'
         'crates/cellscript-tools/src/ckb_acceptance.rs::strict_original_ckb_compile_policy_fail_closed'
         'crates/cellscript-tools/src/ckb_acceptance.rs::strict_original_ckb_compile_unexpected_failures'
         'crates/cellscript-tools/src/ckb_acceptance.rs::SOURCE_PROVENANCE_SCHEMA'
         'crates/cellscript-tools/src/ckb_acceptance.rs::BUILD_REPORT_SCHEMA'
-        'crates/cellscript-tools/src/ckb_acceptance.rs::tracked_source_sha256'
+        'crates/cellscript-tools/src/ckb_acceptance.rs::"source_provenance":source_provenance(root)?'
         'crates/cellscript-tools/src/ckb_acceptance_live.rs::ckb_acceptance_pin.json'
         'crates/cellscript-tools/src/ckb_acceptance_live.rs::cellscript-ckb-runtime-provenance-v0.22'
         'crates/cellscript-tools/src/ckb_acceptance_live.rs::fresh-dedicated-cargo-target'
@@ -267,9 +267,9 @@ check_novaseal_acceptance_boundaries() {
         'crates/cellscript-tools/src/ckb_devnet.rs::invalid_paths'
         'crates/cellscript-tools/src/external_handoff.rs::source tree path must not be a symlink'
         'crates/cellscript-tools/src/verifier_pinning.rs::is a symlink inside the NovaSeal'
-        'scripts/novaseal_devnet_stateful_acceptance.sh::acceptance_blocker_count'
-        'scripts/novaseal_devnet_stateful_acceptance.sh::local_blocker_count'
-        'scripts/novaseal_devnet_stateful_acceptance.sh::blocker_count'
+        'scripts/novaseal_devnet_stateful_acceptance.sh::novaseal-acceptance-summary'
+        'scripts/novaseal_devnet_stateful_acceptance.sh::local_blockers acceptance_blockers blockers external_endpoint_status'
+        'scripts/novaseal_devnet_stateful_acceptance.sh::$acceptance_blockers" == "1"'
         'scripts/novaseal_devnet_stateful_acceptance.sh::acceptance_blockers=%s'
         'scripts/novaseal_devnet_stateful_acceptance.sh::external_endpoint_status=%s'
         'scripts/novaseal_devnet_stateful_acceptance.sh::certifier_status=%s'