Merge witness entry ABI v2 into nightly 0.23

Author: a19q3

.github/workflows/release.yml

@@ -77,12 +77,8 @@ jobs:
 
       - name: Install pinned CKB build toolchain
         run: |
-          CKB_TOOLCHAIN="$(python3 - <<'PY'
-          import tomllib
-          from pathlib import Path
-          print(tomllib.loads(Path('../ckb/rust-toolchain.toml').read_text(encoding='utf-8'))['toolchain']['channel'])
-          PY
-          )"
+          CKB_TOOLCHAIN="$(sed -n 's/^channel = "\(.*\)"$/\1/p' ../ckb/rust-toolchain.toml | head -n 1)"
+          test -n "$CKB_TOOLCHAIN"
           rustup toolchain install "$CKB_TOOLCHAIN" --profile minimal
 
       - name: Resolve release version

.github/workflows/website-build.yml

@@ -17,11 +17,6 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
-        with:
-          python-version: "3.12"
-
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:

.gitignore

@@ -8,10 +8,9 @@ editors/vscode-cellscript/dist/
 .idea/
 .vscode/
 .cap/
+.zcode/
 .playwright-mcp/
 .wrangler/
-__pycache__/
-*.py[cod]
 *.swp
 *.swo
 
@@ -55,14 +54,12 @@ proposals/novaseal/v0-mvp-skeleton/build/
 proposals/novaseal/**/.cell/
 proposals/novaseal/v0-mvp-skeleton/target/
 proposals/novaseal/v0-mvp-skeleton/src/.cell/
-proposals/novaseal/v0-mvp-skeleton/scripts/__pycache__/
 proposals/novaseal/v0-mvp-skeleton/verifier/**/target/
 proposals/novaseal/v0-mvp-skeleton/harness/**/target/
 proposals/novaseal/agreement-profile-v0/target/
 proposals/novaseal/agreement-profile-v0/harness/**/target/
 proposals/novaseal/agreement-profile-v0/src/.cell/
 proposals/novaseal/agreement-profile-v0/harness/**/.cell/
-proposals/novaseal/agreement-profile-v0/scripts/__pycache__/
 proposals/novaseal/fungible-xudt-profile-v0/target/
 proposals/novaseal/fungible-xudt-profile-v0/src/.cell/
 proposals/novaseal/rwa-receipt-profile-v0/target/
@@ -77,18 +74,14 @@ proposals/novaseal/fiber-candidate-profile-v0/target/
 proposals/novaseal/fiber-candidate-profile-v0/src/.cell/
 proposals/novaseal/**/.DS_Store
 proposals/novaseal/**/.cap/
-proposals/novaseal/**/__pycache__/
-proposals/novaseal/**/*.py[cod]
 proposals/novaseal/**/*.s
 proposals/novaseal/**/*.elf
 proposals/novaseal/**/*.meta.json
 proposals/evolving-dob/evolving-dob-profile-v1/build/
 proposals/evolving-dob/evolving-dob-profile-v1/target/
 proposals/evolving-dob/evolving-dob-profile-v1/.cell/
 proposals/evolving-dob/evolving-dob-profile-v1/src/.cell/
-proposals/evolving-dob/evolving-dob-profile-v1/scripts/__pycache__/
 proposals/evolving-dob/evolving-dob-profile-v1/.DS_Store
-proposals/evolving-dob/evolving-dob-profile-v1/**/*.py[cod]
 proposals/evolving-dob/evolving-dob-profile-v1/**/*.s
 proposals/evolving-dob/evolving-dob-profile-v1/**/*.elf
 proposals/evolving-dob/evolving-dob-profile-v1/**/*.meta.json

AGENTS.md

@@ -88,8 +88,8 @@ require extra tooling.
 
 | Mode | What it does |
 | --- | --- |
-| `dev` | Explicit workspace-package formatting and checks for the compiler, Fiber adapter, CKB adapter, WASM crate, and CKB SDK builder example; strict backend audit (quick); syntax combo audit (quick); forbidden tracked-file check; `git diff --check`. Run before committing. |
-| `ci` | `dev` coverage plus tests and clippy for every workspace package, full package contents check, website build check (requires `npm`), shell + Python syntax check, and trailing-whitespace check. Run before claiming merge-readiness. |
+| `dev` | Explicit workspace-package formatting and checks for the compiler, Fiber adapter, CKB adapter, WASM crate, CKB SDK builder example, and `cellscript-tools`; strict backend audit (quick); syntax combo audit (quick); parity-gated skill-pack freshness; forbidden tracked-file check; `git diff --check`. Run before committing. |
+| `ci` | `dev` coverage plus tests and clippy for every workspace package, including `cellscript-tools`; full package contents check, website build check (requires `npm`), shell + Python syntax check, parity-gated skill-pack freshness, and trailing-whitespace check. Run before claiming merge-readiness. |
 | `backend` | For IR / codegen / assembler / ABI / ELF / RISC-V changes: explicit workspace-package format checking, `cargo check --locked -p cellscript --all-targets`, `cargo test --locked -p cellscript`, `cargo clippy ... -D warnings`, strict backend audit (full, which itself fires the CKB stateful-scenarios harness via `cellscript_ckb_stateful_scenarios.sh`), `git diff --check`. |
 | `release` / `release-quick` | Everything `ci` does plus release-auxiliary checks (CKB acceptance, NovaSeal pinning, NovaSeal Rust tooling for RISC-V, fresh WASM + VS Code packaging, CKB tx measure tool, etc.) and the CKB acceptance harness (`scripts/ckb_cellscript_acceptance.sh`). These modes need the pinned sibling CKB checkout from `scripts/ckb_acceptance_pin.json`, the NovaSeal submodule, a sibling `ckb-sdk-rust` checkout at tag `v5.1.0`, Docker for the canonical Linux/amd64 WASM build, and `riscv64imac-unknown-none-elf` for NovaSeal verifier builds. Do not run them casually. |
 
@@ -116,6 +116,7 @@ The root `Cargo.toml` declares a virtual workspace with these members:
 - `.` (the `cellscript` library + `cellc` bin at `src/main.rs`)
 - `crates/cellscript-ckb-adapter`
 - `crates/cellscript-fiber-adapter`
+- `crates/cellscript-tools`
 - `crates/cellscript-wasm`
 - `examples/ckb-sdk-builder`
 
@@ -125,6 +126,12 @@ Excluded from the workspace (still buildable through their own manifests):
 defines its own `[workspace]` (no parent) because it pulls `ckb-jsonrpc-types`
 and `ckb-types` from a sibling CKB checkout (`../ckb`).
 
+The 0.23 Python-to-Rust tooling migration is intentionally staged. Only
+`check-skill-pack` and `validate-tooling-release` are currently implemented in
+`cellscript-tools`; `scripts/dev/dual_run_tools.sh` requires their stdout and
+exit codes to match the retained Python implementations. Keep every other
+Python tool authoritative until its own port has equivalent parity evidence.
+
 Features (root crate):
 
 - `default = ["cli", "lsp"]`

CHANGELOG.md

@@ -7,8 +7,12 @@
   to the active script group, decode the `CSARGv1` payload from
   `WitnessArgs.input_type`, preserve wallet/multisig ownership of `lock`, reject
   malformed or wrongly placed payloads, and retain group-relative raw-v1
-  compatibility. A canonical multisig-v2 CKB-VM regression covers a type group
-  whose first input is not transaction input zero.
+  compatibility. Builders place `input_type` before SDK signing because the
+  complete `WitnessArgs` is signed. A canonical signed multisig-v2 CKB-VM
+  regression covers a type group whose first input is not transaction input
+  zero and rejects post-signing witness mutation. The Rust-native v0.23
+  transaction recipes are rebound to the resulting audited ELF data hashes so
+  the production stateful gate cannot silently replay stale code identities.
 
 ## 0.22.0 - 2026-07-19
 

CODING_STYLE.md

@@ -152,9 +152,10 @@ sub-module (e.g. `assembler.rs`, `runtime.rs`, `abi.rs`):
 4. **Delete from back to front.** When removing code by line number with `sed`,
    delete later ranges first to keep earlier line numbers stable.
 
-5. **Brace-count after every deletion.** Use `python3 -c` to verify brace
-   balance before attempting compilation. Off-by-one `sed` ranges can leave
-   orphaned lines or eat closing braces.
+5. **Check delimiters after every deletion.** Run `cargo fmt --check`, then the
+   focused `cargo check --locked -p cellscript --all-targets` before the next
+   extraction. Off-by-one deletion ranges can leave orphaned lines or consume
+   closing braces.
 
 ### Module Boundary: Schema vs Cell Operations vs Orchestration