Repository navigation
[0.30][Runtime] Complete typed bounded CKB transaction-view and syscall adapters #24
Description
Summary
Define and implement one versioned, typed, bounded contract for the CKB transaction data and runtime adapters that production CellScript verifiers may use. This closes the current gap between individually implemented source/byte helpers and a release-level support matrix suitable for the 0.30 business portfolio.
This issue does not add a raw numeric-syscall escape hatch. Each admitted operation must have a typed source, deterministic memory bound, stable failure behavior, metadata and ProofPlan records, lowering, and positive/adversarial CKB-VM evidence.
Current boundary
The 0.26b baseline already exposes useful typed transaction views, exact byte/span reads, transaction preimages, hashes, and bounded EXEC or SPAWN/WAIT adapters. Issue #12 owns temporal and Since domains. Those pieces do not yet share one complete matrix proving which Cell, input, header, witness, Script, hash, source, and syscall-result families are supported together in ordinary, persistent-policy, builder, and independent-checker paths.
Required contract
The 0.30 matrix must decide and test:
- current Script and Script hash;
- Cell data, capacity, occupied capacity, Lock and Type Scripts and hashes;
- input out points and
since; - headers, header dependencies, epochs, timestamps, and block numbers;
- raw witnesses and
WitnessArgsfields with explicit ownership and bounds; - transaction, Script-group, input, output, CellDep, and header-dependency sources;
- indexes, lengths, partial reads, and out-of-bound behavior;
- transaction preimages and exact authorization message domains;
- CellDep lookup and exact-identity EXEC or SPAWN/WAIT adapters; and
- stable errors for syscall failure, malformed Molecule values, invalid sources, invalid indexes, and oversized byte ranges.
Every supported API must identify its source kind, value type, maximum read size, allocation/stack behavior, failure code, evidence tier, and supported entry contexts. Unsupported combinations must fail before production artifact emission.
Implementation phases
Phase 0 — matrix and identities
- inventory the existing source, witness, header, hash, Script, byte, EXEC, SPAWN, WAIT, and IPC APIs;
- classify each as implemented, metadata-only, fail-closed, or outside 0.30;
- define source and value types without changing Edition 2026 meanings;
- assign a versioned runtime-view contract and stable error taxonomy; and
- reconcile witness ownership with [Candidate][Consensus runtime] Implement executable bounded output-plan correspondence #8, [Language design] Add explicit typed openings for digest-committed substate #13, and [Language/Verifier][Research] Add typed zero-knowledge verifier contracts without a circuit DSL #22.
Phase 1 — typed frontend and IR
- expose admitted values and conversions through the authoring grammar and type checker;
- retain source, index, field, byte range, and message-domain provenance in structured IR;
- reject confused source kinds, unchecked narrowing, ambiguous witnesses, and unbounded materialization; and
- update formatter, recovering parser, LSP, VS Code, metadata, constraints, ProofPlan, and source maps together.
Phase 2 — runtime lowering
- lower every admitted operation through canonical CKB syscalls and Source encodings;
- enforce bounds before pointer arithmetic or allocation;
- preserve exact syscall statuses and terminal verification failures;
- support the same admitted contract in ordinary/scoped and persistent-policy entries; and
- keep all unclassified syscalls fail-closed.
Phase 3 — independent and executable evidence
- bind claimed runtime-view operations to machine blocks in the standalone checker;
- add mutations for source, index, length, field, hash, status, and omitted bounds checks;
- run identical fixtures through simulator where applicable and CKB-VM where authoritative;
- add builder and adapter codec parity tests; and
- measure cycles, stack, code size, witness bytes, and transaction size at maximum admitted bounds.
Acceptance matrix
At minimum, cover valid and invalid reads for every admitted source, zero-length and maximum-length byte ranges, indexes 0/nonzero/last/one-past-last/large-u64, missing and malformed witnesses, absent Type Scripts, wrong Script groups, header-dependency presence and absence, since type mismatches, partial syscall reads, wrong CellDep identities, and nonzero child status.
The same operation used from ordinary and persistent-policy paths must either produce the same typed/runtime contract or reject with a documented entry-context error. No metadata-only record may be counted as executable support.
Completion criteria
- A reviewed support matrix classifies every current CKB-facing API.
- All admitted APIs have typed source/value contracts and deterministic bounds.
- Edition 2026 compatibility and the new 0.30 source identity are explicit.
- Formatter, LSP, VS Code, metadata, constraints, ProofPlan, and builders agree.
- CKB-VM positive and adversarial cases cover every admitted row.
- Standalone-checker mutations cover every machine property it claims.
- Worst-case resource measurements are recorded and gated.
-
dev,ci, andbackendgates pass. - Independent review of source decoding, bounds, witness ownership, and syscall failure handling is complete.
Non-goals
- raw syscall numbers or inline assembly;
- unbounded transaction-wide reads or allocator-backed unbounded values;
- silently treating syscall errors as data;
- changing stable Edition 2026 behavior without migration; or
- claiming external verifier internals from successful delegation.
Dependencies
- [Candidate][Consensus runtime] Implement executable bounded Cell-group consumption #7 and [Candidate][Consensus runtime] Implement executable bounded output-plan correspondence #8 for dynamic group selection and output correspondence;
- [Architecture][Builder] Add an artifact-only multi-Script ProtocolBundle #9 through [Language/ABI] Bind runtime Script values to verified package interfaces #11 for multi-Script roles and exact verifier identity;
- [Language/stdlib] Add typed CKB temporal and Since domains #12 for typed temporal and
Sincevalues; - [Language design] Add explicit typed openings for digest-committed substate #13 and [Language/Verifier][Research] Add typed zero-knowledge verifier contracts without a circuit DSL #22 for shared witness ownership; and
- [Docs/strategy] Separate executable-surface closure from product capability completeness #14 for capability-completeness reporting.
Activity
a19q3 commentedon Sep 11, 2026
0.30 evidence update landed in 1e2f642.
This adds the first exact non-cryptographic runtime-view resource profile for the fixed transaction/header/temporal path: 20,673 cycles, 14,040-byte ELF, 5,376-byte stack bound, 60 witness bytes, 469 transaction bytes, and 28 dependency bytes. The shared CKB harness now uses domain-separated deterministic fixture OutPoints and records raw and serialized transaction hashes, so exact fixtures remain stable across processes. The typed runtime-view integration suite passes 7/7.
#24 should remain open. Still required are persistent-policy/builder/checker parity across all admitted rows, maximum profiles for the remaining non-cryptographic Output/GroupOutput/Script/adapter families, full adversarial coverage, and independent/release evidence.
a19q3 commentedon Sep 11, 2026
Follow-up for pushed 0.30 commit 68e01a2: the remaining non-cryptographic Output/GroupOutput/Script resource row is now closed.
The new real CKB-VM fixture distinguishes global Output from current-group GroupOutput and covers fixed fields, an input with no Type Script, complete Lock/Type Script projections, exact 32-byte Script args, the maximum 459-byte Script-args boundary, and one-past-last global/group indexes (stable error 44). It also exposed and fixed an independent-checker gap: legal closed Cell-view to internal Script-reference lowering is now accepted, while non-cell sources and non-internal destinations remain rejected.
The exact profile pins 46,043 cycles, 10,552-byte ELF, 11,344-byte maximum stack frame under a 16,384-byte bound, zero witness/dependency bytes, a 1,743-byte transaction, and artifact/lowering/source-map/bundle/raw-transaction/serialized-transaction hashes. The identity/resource test was replayed twice; the full typed runtime-view suite is now 9/9. Artifact-checker tests, relevant unit tests, clippy, docs/status, and ledger validation pass on Rust 1.97.1.
#24 remains open for persistent-policy and generated-builder parity across all admitted rows, broader standalone machine mutations, remaining non-cryptographic adapter resource rows, independent review, and release gates. No TAC, release, deployment, or signing flow was run.
a19q3 commentedon Sep 11, 2026
Implemented and pushed an additional bounded persistent-policy/runtime-view slice on
0.30in48487521.The canonical
partial_fill/settle/cancelpolicy now reads and enforces the currentGroupInput<OrderState>data_sizeandcapacityin every action. The exact policy artifact is exercised through policy-witness dispatch, generated-builder + ProtocolBundle validation/materialization, the four-artifact/five-group same-transaction CKB-VM anchor, and the stateful prior-outputpartial_fill -> settlepluscancelpath.Pinned evidence was refreshed rather than weakened:
0x5f827a767f28bcc91190945a3eeff396e24b6346e341ebe7643cbb91bac7bb280xbbd907d8ef8062fce1f3e583986ff15910e7a4a15eaa5c7f9fe62cca3cb332160x142c5825a9c6db00c5c9f1e475d640e003f122589bc0703472b03fa3712bff550x558e5ec1ba697d0f919a57ee61dcef485ea843cbfac8c908f490b6edafc5339f0xeeffbecf0ccbdda0d5709b96ccee78e11988a74be00515f96d34e84b8de73ba60x8b6904472b55eec2483f262331bd71b8da3920737f1924031f67e392d0c3e0bdd9eb8c317a4c82f09a91bc607d5c9edf023b19637fe736761c1fd730c46c7bc9Validation: business corpus 3/3 twice; scenario-evidence and capability-ledger unit suites 2/2 each; exact Rust 1.97.1 fmt and focused Clippy; doc-status check. The repo-wide Markdown link check remains blocked only by the already-recorded unavailable pinned iCKB submodule file; no remote-head substitution was made.
Issue remains open for persistent-policy/generated-builder parity beyond this exact GroupInput data-size/capacity slice, remaining standalone-checker/resource rows, independent review, CI/backend, and release evidence. No TAC, release, deployment, or signing workflow was invoked.
a19q3 commentedon Sep 11, 2026
Pushed
e999c30fon0.30, adding the third exact non-cryptographic runtime-view resource profile for the persistent policy path.The same stateful CKB-VM test now measures and gates all three
partial_fill/settle/cancelaction transactions against the canonical policy artifact and its sidecars. Fixed domain-separated input OutPoints make the identities stable under parallel execution.Exact maximum observed values:
The profile also binds the artifact/lowering/source-map/verified-bundle identities and raw + serialized hashes for the partial-fill precursor, successor settle, and independent cancel transactions. Business corpus passed 3/3 twice; typed runtime views 9/9; ledger 2/2; fmt, focused Clippy, JSON/digest, and doc-status checks passed on Rust 1.97.1.
The frozen-corpus scope decision is now explicit: no scenario requires a full Header hash (typed epoch/block/timestamp fields cover the admitted temporal portfolio), and multisig uses the pinned standard multisig-v2 Lock boundary rather than an in-language prefix-preserving signing transform. Either future extension requires a separate typed/bounded contract.
#24 remains open for persistent-policy/builder parity beyond the exact current slice, checker/resource coverage for admitted rows outside the three non-cryptographic profiles, independent review, and release-facing gates. No TAC, release, deployment, or signing workflow was invoked.
a19q3 commentedon Sep 11, 2026
0.30 update: commit 1d7e8fd is pushed. A fourth exact non-cryptographic profile now exercises every Input, current-group GroupInput, and CellDep field together with full Lock/Type Script, OutPoint, Since, and exact 32-byte WitnessArgs projections. It pins artifact/lowering/source-map/bundle and raw/serialized transaction identities plus 92,896 cycles, 16,208 ELF bytes, 22,880 max stack bytes, 124 witness bytes, 597 transaction bytes, and 73 dependency bytes under explicit ceilings. This exposed and fixed the checker-only
InputView<T> -> __ckb_input_out_point_refomission; the checker admits only that closed source/destination pair and rejects Output/CellDep/Source/integer retyping.typed_runtime_viewspassed twice (10/10), checker crate 29/29, artifact checker 36/36, clippy clean. Remaining local scope is persistent-policy/generated-builder parity beyond the current GroupInput data_size/capacity slice; independent review and release evidence remain external gates. No TAC/release/deploy/signing workflow was invoked.a19q3 commentedon Sep 11, 2026
Follow-up pushed in b68925e: the final repository-local parity gap is now covered by an exact
PolicyWitnessV1Type-group artifact. The generated action-record encoder and canonical policy-bundle adapter drive a one-input/one-output resource transition that exercises complete GroupInput/GroupOutput, CellDep and HeaderDep views, OutPoint, Since, bounded entry bytes, and raw transaction hash. Exact identities are pinned with 96,109 cycles, 21,368 ELF bytes, 20,000 max stack bytes, 145 witness bytes, 594 transaction bytes, and 73 dependency bytes.typed_runtime_viewspassed twice at 11/11. The ledger now leaves only independent review (and the documented CI/backend/release gates) before #24 closure; I am not self-certifying those external gates. No TAC/release/deploy/signing workflow was invoked.a19q3 commentedon Sep 12, 2026
0.30 closure update: the bounded typed CKB transaction-view/runtime-adapter contract is complete. The admitted v1 surface covers typed Cell/Input/Output/CellDep/Header/WitnessArgs/Script/hash/source operations without a raw-syscall escape hatch, including dynamic source indexes, exact OutPoint provenance, persistent-policy use, and the generated PolicyWitnessV1 builder path.
Five exact non-cryptographic resource profiles and adversarial CKB-VM coverage bind the complete read-only handle table. The clean release replay at 3cf60a1 passed with all Rust tests, strict backend audit, Clippy -D warnings, product builds, and pinned CKB 0.207.0 production admission. Independent review was explicitly waived by the maintainer for this bounded 0.30 scope; it was not performed or claimed as passed. Full-header hashing and an in-language multisig-prefix signing transform remain explicitly excluded. Closing as complete.
a19q3 commentedon Sep 19, 2026
Documentation follow-up: #24 remains correctly closed for the accepted bounded runtime-view v1 contract. The runtime matrix still contained an old "issue remains open" paragraph and development-only status; those have been corrected in the current audit update.
Implementation candidate 74cff5fd passed
dev, fullciwithinrelease,backend, andrelease, including the typed-runtime-view fixtures and fresh pinned CKB production/stateful acceptance. Independent review was explicitly waived by the maintainer, not performed or reported as passed. Full-header hashing and an in-language multisig-prefix transform remain outside the admitted scope.