fix(release): tighten package audit gates

Author: a19q3

.gitignore

@@ -3,6 +3,8 @@ editors/vscode-cellscript/dist/
 
 .DS_Store
 .vscode/
+__pycache__/
+*.py[cod]
 *.swp
 *.swo
 
@@ -14,6 +16,8 @@ editors/vscode-cellscript/dist/
 .cell/
 Cell.lock
 
+proposals/
+
 # Keep translated prose out of the CellScript repository by default.
 # README_CH.md is the one maintained Chinese document.
 *_CN.md

Cargo.toml

@@ -7,14 +7,16 @@ autobins = false
 authors = ["CellScript Core Team"]
 description = "CellScript compiler for the Cell model"
 license = "MIT"
-repository = "https://github.com/tsukifune-kosei/CellScript"
+repository = "https://github.com/a19q3/CellScript"
 exclude = [
     ".gitignore",
     ".rustfmt.toml",
     ".github/",
     "docs/",
     "docs/wiki/",
     "editors/",
+    "proposals/",
+    "scripts/__pycache__/",
     "src/bin/",
     "tools/",
 ]

roadmap/CELLSCRIPT_ROADMAP.md

@@ -28,7 +28,7 @@ The current project direction is simple:
 | Surface syntax | Low-risk syntax pass and 0.13.2 syntax-governance hardening are implemented; authority-sensitive syntax remains staged. | [Surface elegance RFC](../docs/CELLSCRIPT_SURFACE_ELEGANCE_RFC.md), [Syntax-combination audit](../docs/CELLSCRIPT_SYNTAX_COMBO_AUDIT_METHODOLOGY.md), [0.13.2 release notes](../docs/releases/CELLSCRIPT_0_13_2_RELEASE_NOTES.md) |
 | Collections | Stack-backed fixed-width `Vec<T>` helper surface is implemented; cell-backed and generic map ownership remain fail-closed. | [Collections support matrix](../docs/CELLSCRIPT_COLLECTIONS_SUPPORT_MATRIX.md), [0.13 release scope](../docs/releases/CELLSCRIPT_0_13_RELEASE_SCOPE.md) |
 | CKB production evidence | Bundled actions and locks have builder-backed local CKB evidence; full release claims also require stateful coverage for every production acceptance action. | [Metadata and production gates wiki](../docs/wiki/Tutorial-06-Metadata-Verification-and-Production-Gates.md) |
-| Documentation and wiki | Wiki is version-neutral, cookbook-oriented, includes a standard-library chapter, and is published separately to GitHub Wiki. | [GitHub Wiki](https://github.com/tsukifune-kosei/CellScript/wiki) |
+| Documentation and wiki | Wiki is version-neutral, cookbook-oriented, includes a standard-library chapter, and is published separately to GitHub Wiki. | [GitHub Wiki](https://github.com/a19q3/CellScript/wiki) |
 
 ## Release Tracks
 
@@ -209,7 +209,7 @@ Future work:
 
 Source documents:
 
-- [GitHub Wiki](https://github.com/tsukifune-kosei/CellScript/wiki)
+- [GitHub Wiki](https://github.com/a19q3/CellScript/wiki)
 - [Surface elegance RFC](../docs/CELLSCRIPT_SURFACE_ELEGANCE_RFC.md)
 
 ## Roadmap Discipline

scripts/__pycache__/cellscript_syntax_combo_audit.cpython-314.pyc

@@ -171,7 +171,7 @@ check_package_contents() {
     package_files="$(mktemp)"
     printf '\n==> cargo package --list --locked --allow-dirty --offline\n'
     cargo package --list --locked --allow-dirty --offline | tee "$package_files"
-    if grep -E '^(\.github/|docs/|editors/|tools/|src/bin/)' "$package_files"; then
+    if grep -E '^(\.github/|docs/|editors/|proposals/|tools/|src/bin/|.*__pycache__/|.*\.py[co]$)' "$package_files"; then
         printf 'crates.io package includes repository-only files or unpublished helper binaries\n' >&2
         exit 1
     fi

scripts/cellscript_gate.sh

@@ -137,9 +137,14 @@ def main() -> int:
         '"docs/"',
         '"docs/wiki/"',
         '"editors/"',
+        '"proposals/"',
+        '"scripts/__pycache__/"',
     ]:
         require(excluded in cargo_toml, f"Cargo.toml package exclude is missing {excluded}")
 
+    require("__pycache__/" in read(".gitignore"), ".gitignore must ignore generated Python bytecode directories")
+    require("*.py[cod]" in read(".gitignore"), ".gitignore must ignore generated Python bytecode files")
+
     print("valid CellScript tooling release boundary")
     return 0
 

scripts/validate_cellscript_tooling_release.py

@@ -7320,7 +7320,7 @@ mod tests {
     }
 
     #[test]
-    fn ir_verifier_rejects_raw_syscall_status_returned_as_domain_u64() {
+    fn status_boundary_ir_verifier_rejects_raw_syscall_status_returned_as_domain_u64() {
         let status = raw_status_var(0);
         let ir = module_with_instructions(
             vec![raw_status_call(Some(status.clone()))],
@@ -7334,7 +7334,7 @@ mod tests {
     }
 
     #[test]
-    fn ir_verifier_rejects_raw_syscall_status_stored_as_dsl_local() {
+    fn status_boundary_ir_verifier_rejects_raw_syscall_status_stored_as_dsl_local() {
         let status = raw_status_var(0);
         let ir = module_with_instructions(
             vec![
@@ -7351,7 +7351,7 @@ mod tests {
     }
 
     #[test]
-    fn ir_verifier_rejects_dropped_raw_syscall_status() {
+    fn status_boundary_ir_verifier_rejects_dropped_raw_syscall_status() {
         let ir = module_with_instructions(vec![raw_status_call(None)], None, IrTerminator::Return(None));
 
         let err = verify_module(&ir).unwrap_err();
@@ -7360,7 +7360,7 @@ mod tests {
     }
 
     #[test]
-    fn ir_verifier_rejects_raw_syscall_status_in_tuple_field() {
+    fn status_boundary_ir_verifier_rejects_raw_syscall_status_in_tuple_field() {
         let status = raw_status_var(0);
         let tuple = IrVar { id: 1, name: "tuple".to_string(), ty: IrType::Tuple(vec![IrType::U64]) };
         let ir = module_with_instructions(
@@ -7375,7 +7375,7 @@ mod tests {
     }
 
     #[test]
-    fn ir_verifier_rejects_raw_syscall_status_as_domain_call_argument() {
+    fn status_boundary_ir_verifier_rejects_raw_syscall_status_as_domain_call_argument() {
         let status = raw_status_var(0);
         let ir = module_with_instructions(
             vec![
@@ -7406,7 +7406,7 @@ mod tests {
     }
 
     #[test]
-    fn ir_verifier_rejects_raw_syscall_status_produced_without_checked_consumer() {
+    fn status_boundary_ir_verifier_rejects_raw_syscall_status_produced_without_checked_consumer() {
         let status = raw_status_var(0);
         let ir = module_with_instructions(vec![raw_status_call(Some(status))], None, IrTerminator::Return(None));
 
@@ -7416,7 +7416,7 @@ mod tests {
     }
 
     #[test]
-    fn ir_verifier_rejects_unit_runtime_helper_status_stored_as_domain_u64() {
+    fn status_boundary_ir_verifier_rejects_unit_runtime_helper_status_stored_as_domain_u64() {
         let status = raw_status_var(0);
         let ir = module_with_instructions(vec![raw_unit_helper_call(Some(status))], None, IrTerminator::Return(None));
 
@@ -7426,14 +7426,14 @@ mod tests {
     }
 
     #[test]
-    fn ir_verifier_allows_unit_runtime_helper_when_status_is_checked_by_codegen_boundary() {
+    fn status_boundary_ir_verifier_allows_unit_runtime_helper_when_status_is_checked_by_codegen_boundary() {
         let ir = module_with_instructions(vec![raw_unit_helper_call(None)], None, IrTerminator::Return(None));
 
         verify_module(&ir).expect("unit helper statement should be checked by codegen boundary");
     }
 
     #[test]
-    fn ir_verifier_allows_domain_u64_return_tuple_and_call_argument() {
+    fn status_boundary_ir_verifier_allows_domain_u64_return_tuple_and_call_argument() {
         let value = IrVar { id: 0, name: "value".to_string(), ty: IrType::U64 };
         let tuple = IrVar { id: 1, name: "tuple".to_string(), ty: IrType::Tuple(vec![IrType::U64]) };
         let ir = module_with_instructions(