Release CellScript 0.16.2

Author: a19q3

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "cellscript"
-version = "0.16.1"
+version = "0.16.2"
 edition = "2021"
 rust-version = "1.92.0"
 autobins = false

Cargo.toml

@@ -606,7 +606,7 @@ policy defaults:
 ```toml
 [package]
 name = "token"
-version = "0.16.1"
+version = "0.16.2"
 entry = "src/main.cell"
 source_roots = ["src"]
 
@@ -685,8 +685,9 @@ registry dependency resolution remain experimental and fail-closed.
 | `cellc scheduler-plan` | Consume scheduler hints and report serial/conflict policy |
 | `cellc ckb-hash` | Compute CKB default Blake2b-256 hashes for builders and release evidence |
 | `cellc explain-assumptions` | Emit v0.16 builder-assumption evidence from ProofPlan metadata |
-| `cellc validate-tx` | Validate transaction JSON shape against builder assumptions before signing |
-| `cellc solve-tx` | Emit a deterministic transaction template from metadata |
+| `cellc validate-tx` | Validate transaction JSON shape against builder assumptions before signing; add `--production` to reject fixture-only resource identities |
+| `cellc resource-identity` | Generate passive resource identity artifact and plan JSON for output type scripts |
+| `cellc solve-tx` | Emit a deterministic transaction template plus resource identity contract from metadata |
 | `cellc deploy-plan` | Emit a reproducible deployment plan |
 | `cellc verify-deploy` / `diff-deploy` / `lock-deps` | Verify, compare, and lock deployment metadata |
 | `cellc proof-diff` / `profile` / `trace-tx` / `audit-bundle` | Emit v0.16 audit and debug reports |

README.md

@@ -89,6 +89,68 @@ A production builder must:
 The compiler can give lower bounds and requirements. The builder supplies the
 transaction-specific proof.
 
+## Resource Identity Contract
+
+For CKB targets, `constraints.ckb.resource_identities` records the compiler's
+current resource identity contract for schema-backed CellScript resources and
+receipts.
+
+Statuses have builder meaning:
+
+- `ckb-type-id-builder-managed` means the builder must install the declared CKB
+  TYPE_ID script and preserve the compiler metadata for that identity.
+- `compiler-passive-identity-available` means `cellc resource-identity` can
+  emit a passive resource identity artifact and JSON plan for that resource.
+
+Scoped action artifacts are active verifiers. They must not be used as passive
+type-script identities for newly-created resource Cells. `cellc validate-tx`
+rejects transactions whose output type script uses the current scoped action
+artifact hash as a resource identity, because CKB would execute that artifact
+during output creation and the entry wrapper may expect action witness bytes.
+
+Use `cellc resource-identity` to generate the compiler-owned passive badge:
+
+```bash
+cellc resource-identity examples/amm_pool.cell \
+  --target-profile ckb \
+  --identity Token=token-a \
+  --identity Token:token_b_out=token-b \
+  --identity Pool=pool-main \
+  --plan-output build/resource-identities.json
+```
+
+The plan contains the exact `{ code_hash, hash_type, args }` type script each
+created resource Cell should wear. `--identity TYPE=INSTANCE` sets a type-level
+default; `--identity TYPE:BINDING=INSTANCE` overrides one create binding when
+the same resource type needs more than one passive identity. Production
+builders should pass the plan back into validation:
+
+```bash
+cellc validate-tx --against build/action.elf.meta.json \
+  --resource-identities build/resource-identities.json \
+  build/tx.json --json
+```
+
+Fixture scripts such as `always_success` can still be useful in local shape
+tests, but they are not production resource identities. Treat them as
+`always_success_fixture_only`: acceptable in fixture, harness, or negative-test
+contexts; forbidden as the type script for real `MintAuthority`, `Token`,
+`Pool`, or `LPReceipt` resource outputs.
+
+For production-facing validation, pass `--production`:
+
+```bash
+cellc validate-tx --against build/action.elf.meta.json \
+  --resource-identities build/resource-identities.json \
+  --production \
+  build/tx.json --json
+```
+
+In production mode, `validate-tx` rejects known fixture-only resource type
+identities such as the devnet `always_success` code hash and all-zero
+placeholder hashes. This keeps fixture plumbing useful without allowing it to
+become a resource identity scheme.
+
 ## Mass Constraints
 
 For CKB, `constraints.ckb` exposes compiler-estimated compute, storage,

docs/CELLSCRIPT_CAPACITY_AND_BUILDER_CONTRACT.md

@@ -35,6 +35,8 @@ drafts. Released versions should use non-draft filenames.
   note and release-evidence summary.
 - `docs/releases/CELLSCRIPT_0_16_1_RELEASE_NOTES.md` is the final 0.16.1 release
   note and release-evidence summary.
+- `docs/releases/CELLSCRIPT_0_16_2_RELEASE_NOTES.md` is the final 0.16.2 release
+  note and release-evidence summary.
 
 Release candidates and planning notes should not live here unless they are the
 final release record.

docs/README.md

@@ -39,6 +39,31 @@ launch.bootstrap_token or launch.launch_token
 `launch_token` materialises the Pool and LP receipt topology directly. It does
 not link or call the `amm_pool.seed_pool` entry at runtime.
 
+## Resource Identity Boundary
+
+There are three separate script roles in this flow:
+
+- scoped action artifacts are active verifiers for one selected CellScript
+  action;
+- resource type scripts are passive or lifecycle-stable identity badges for
+  `MintAuthority`, `Token`, `Pool`, and `LPReceipt` Cells;
+- fixture badges such as `always_success_fixture_only` are local test
+  scaffolding only.
+
+Do not use an action artifact such as `token_mint_with_authority.elf` as the
+passive type script for a newly-created resource Cell. CKB executes output type
+scripts during creation, so the generated `_cellscript_entry` wrapper will look
+for action witness bytes and can fail with `entry-witness-abi-invalid`.
+
+Current compiler metadata exposes this boundary through
+`constraints.ckb.resource_identities` and `cellc solve-tx` under
+`transaction_plan.resource_identities`. Entries marked
+`compiler-passive-identity-available` should be materialized with
+`cellc resource-identity`, which emits the passive artifact plus the exact
+`{ code_hash, hash_type, args }` scripts to place on resource outputs. A
+production builder must not replace that passive identity with the scoped
+action artifact.
+
 ## Entry Action Selection
 
 Do not rely on "the first action runs on creation" as a protocol rule. Cell
@@ -131,6 +156,20 @@ cellc entry-witness examples/amm_pool.cell \
 For `launch_token`, the `distribution` payload is exactly four
 `(Address, u64)` entries, so it is 160 bytes: `4 * (32 + 8)`.
 
+## One-Line Builder Contract Bundle
+
+After building the scoped artifact and producing a candidate transaction JSON,
+run the compiler-facing contract checks as one shell bundle. Replace `META` and
+`TX` with the generated `.meta.json` sidecar and transaction file:
+
+```bash
+INPUT=examples/amm_pool.cell ACTION=swap_a_for_b META=build/amm_swap_a_for_b.elf.meta.json TX=build/swap.tx.json RID=build/resource-identities.json MIN_OUT=49000 TO=0x1111111111111111111111111111111111111111111111111111111111111111; cellc resource-identity "$INPUT" --target-profile ckb --identity Token=token-default --identity Token:token_out=token-b --identity Pool=pool-main --identity LPReceipt=pool-main --plan-output "$RID" --json && cellc abi "$INPUT" --target-profile ckb --action "$ACTION" && cellc constraints "$INPUT" --target-profile ckb --entry-action "$ACTION" && cellc solve-tx "$INPUT" --target-profile ckb --entry-action "$ACTION" --primitive-strict 0.16 --json && cellc entry-witness "$INPUT" --target-profile ckb --action "$ACTION" --arg "$MIN_OUT" --arg "$TO" --json && cellc explain-assumptions "$INPUT" --target-profile ckb --entry-action "$ACTION" --primitive-strict 0.16 --json && cellc validate-tx --against "$META" --resource-identities "$RID" "$TX" --production --primitive-strict 0.16 --json
+```
+
+`cellc entry-witness` emits the raw `_cellscript_entry` payload. Do not wrap it
+in `WitnessArgs.input_type` unless the CellScript source explicitly reads that
+separate CKB witness surface.
+
 ## ProofPlan And Builder Assumptions
 
 Before signing, builders should inspect both the proof plan and the concrete
@@ -158,7 +197,8 @@ particular, verify:
 
 - each cell-bound parameter resolves to the expected input or output Cell;
 - output data matches the generated Molecule schema;
-- output type scripts use the intended artifact and script args;
+- resource output type scripts follow `constraints.ckb.resource_identities`;
+- scoped action artifacts are not used as passive resource type identities;
 - CellDeps or script refs resolve to the intended code cells;
 - capacity floors and occupied capacity are both satisfied;
 - the transaction size and cycle budget are measured from the final
@@ -187,13 +227,16 @@ The relevant flows are:
 - AMM lifecycle: seed, add liquidity, swap, and remove liquidity operate on
   live `Pool`, `Token`, and `LPReceipt` Cells.
 
-External builder repos should mirror those flows instead of using
-`always_success` token stand-ins for the token and pool state path. It is fine
-to keep `always_success` locks for pure locking scaffolding, but token Cells,
-Pool Cells, LP receipts, and the MintAuthority hand-off should be real
-CellScript typed Cells when testing this bootstrap sequence.
+External builder repos should mirror those flows, but should treat
+`always_success` resource type scripts as `always_success_fixture_only` badges.
+They prove the transaction shape is plausible; they do not prove the production
+resource identity story. The compiler now exposes passive resource identity
+contracts in metadata and emits resource identity plans so builders can fail
+early instead of discovering identity mistakes through an opaque action-witness
+error. Use `cellc validate-tx --production` to reject known fixture identities
+before signing.
 
 The production gate now exercises these flows with original scoped strict
 artifacts for `token.cell`, `amm_pool.cell`, and `launch.cell`; generated
-harnesses remain only as fallback coverage for examples that are not part of
-this bootstrap path.
+harnesses and passive fixture badges remain coverage scaffolding, not the
+external-builder production identity contract.

docs/examples/token_amm_bootstrap.md

@@ -0,0 +1,43 @@
+# CellScript 0.16.2 Release Notes
+
+**Status**: Released as `v0.16.2`.
+
+**Release date**: 2026-06-21.
+
+**Release tag**: `v0.16.2`.
+
+**Updated**: 2026-06-21.
+
+CellScript 0.16.2 is a builder-ergonomics patch for CKB resource identity
+handoff. It keeps the 0.16 compiler/runtime scope, while making external
+transaction builders less dependent on copied harness conventions.
+
+## Highlights
+
+- `cellc resource-identity` emits a compiler-owned passive resource identity
+  artifact and JSON plan for resource output type scripts.
+- `cellc validate-tx --resource-identities` checks created resource outputs
+  against the generated passive identity plan.
+- `cellc validate-tx --production` rejects known fixture-only resource
+  identities, including devnet `always_success` and all-zero placeholders, when
+  they appear as real resource output type scripts.
+- `cellc explain-assumptions` and `cellc solve-tx` can be scoped with
+  `--entry-action` or `--entry-lock`, so external builders can consume the
+  selected entrypoint contract instead of whole-module noise.
+- `cellc solve-tx --json` now exposes structural builder-evidence requirements
+  and a fixture identity policy.
+- Builder docs clarify that scoped action artifacts are active verifiers and
+  must not be used as passive `MintAuthority`, `Token`, `Pool`, or `LPReceipt`
+  resource identities.
+
+## Validation
+
+The release patch was validated with the v0.16 CLI/backend suite:
+
+```bash
+cargo test --test v0_16 -- --nocapture
+```
+
+The suite covers resource identity plan generation and validation, scoped
+assumption/solver output, wildcard structural evidence requirements, active
+artifact misuse rejection, and production fixture-identity rejection.

docs/releases/CELLSCRIPT_0_16_2_RELEASE_NOTES.md

@@ -43,7 +43,7 @@ In practical terms, this means:
 The initial 0.16.0 release kept some bundled-example bootstrap paths
 conservative. The current 0.16 patch line closes the token/AMM/launch and NFT
 first-cell lifecycle gaps; see
-`docs/releases/CELLSCRIPT_0_16_1_RELEASE_NOTES.md` for the current production
+`docs/releases/CELLSCRIPT_0_16_2_RELEASE_NOTES.md` for the current production
 example evidence.
 
 ### Better Builder Handoff

docs/releases/CELLSCRIPT_0_16_RELEASE_NOTES.md

@@ -152,8 +152,8 @@ Release-facing CKB evidence comes from the repository root:
 ```
 
 The bundled examples are covered by the current local production evidence suite.
-The 0.16.1 patch line also closes the token/AMM/launch and NFT first-cell
-bootstrap examples used by external builders.
+The 0.16.2 patch line also closes the token/AMM/launch and NFT first-cell
+bootstrap builder handoff, including passive resource identity checks.
 New external contracts still need their own metadata review, builder evidence,
 security review, and chain acceptance evidence before they should be called
 production-ready.

docs/wiki/Home.md

@@ -405,5 +405,5 @@ commands unless you create a `Cell.toml` there.
   contracts.
 - Read `docs/releases/CELLSCRIPT_0_15_RELEASE_NOTES.md` for the release boundary.
 - Read `roadmap/CELLSCRIPT_0_16_ROADMAP.md` and
-  `docs/releases/CELLSCRIPT_0_16_1_RELEASE_NOTES.md` for the implemented
+  `docs/releases/CELLSCRIPT_0_16_2_RELEASE_NOTES.md` for the implemented
   0.16 ProofPlan soundness and metadata-assurance boundary.