Skip to content

[0.30][Acceptance] Build the canonical Rust-comparable CKB business corpus #26

Closed
Closed
[0.30][Acceptance] Build the canonical Rust-comparable CKB business corpus#26
Labels
enhancementNew feature or request

Description

@a19q3
a19q3
opened on Sep 7, 2026

Summary

Create the canonical CellScript 0.30 business-equivalence corpus. It turns the claim that CellScript is broadly comparable to hand-written Rust CKB contracts at the application layer into a finite, reproducible release contract with positive, adversarial, stateful, economic, and deployment evidence.

This issue owns the portfolio and its cross-feature composition. Individual language and runtime mechanisms remain owned by their existing issues. A scenario is admitted only when all mechanisms it needs work together through the same authoring, persistent-policy, builder, CKB-VM, and evidence paths promised for 0.30.

Required business families

Fungible asset

  • authorized mint, transfer, bounded split, bounded merge, and burn;
  • replay, missing/extra Cell, wrong amount, overflow, identity, and authorization failures;
  • total-supply or transaction-local conservation policy; and
  • one persistent policy identity across the complete lifecycle.

NFT or DOB

  • mint with unique identity;
  • metadata update and ownership transfer;
  • capacity adjustment and burn; and
  • duplicate identity, stale state, wrong Lock/Type, and unauthorized update rejection.

Order and AMM

  • partial fill or partial order under one persistent order policy;
  • variable-cardinality payment or asset inputs;
  • settlement across interacting resource and Script groups;
  • fee, reserve/accounting, slippage or price-bound checks;
  • authenticated dependency or oracle identity; and
  • cancellation, replay, output reordering, partial-settlement, and wrong-price failures.

Temporal

  • absolute and relative timelock;
  • vesting transition;
  • typed epoch, timestamp, block-number, and Since handling;
  • required header-dependency behavior; and
  • cross-domain, missing-header, early-release, overflow, and boundary failures.

Authorization

  • standard single-signature or maintained Lock integration;
  • multisig creation, threshold change, proposal/spend, and cancellation;
  • issuer authority and exact Script identity;
  • post-signing mutation rejection; and
  • copied-public-owner, wrong-message-domain, wrong-key, partial-signature, and replay failures.

Committed state

  • authenticated witness opening;
  • successor commitment construction;
  • stale, malformed, wrong-root, wrong-index, and wrong-successor rejection; and
  • shared witness-envelope composition with action arguments and output plans.

Multi-Script composition

  • at least three independently built artifacts in one transaction;
  • interacting Type and Lock groups with shared Cells, dependencies, or witnesses;
  • ProtocolBundle role/index/witness/CellDep resolution and conflict reporting;
  • per-group execution and error attribution; and
  • exact package, interface, artifact, deployment, VM, ABI, and network identities.

External verifier

  • one real protocol or cryptographic verifier invoked by exact identity through EXEC or SPAWN/WAIT;
  • accepted and rejected protocol vectors;
  • wrong dependency, hash, adapter, argument, applicability, statement, child status, and post-build substitution failures; and
  • explicit trusted-external evidence without a compiler claim over verifier internals.

Reference and fixture contract

For every scenario where an equivalent maintained Rust implementation is practical:

  • freeze the Rust source commit, toolchain, Cargo lock, target, profile, dependency identities, and build script;
  • run both implementations against the same canonical serialized transaction fixtures;
  • require equal accept/reject outcomes and attribute any differing error surface;
  • bind fixture, source, ELF, sidecar, transaction, and measurement hashes in the report;
  • measure complete transaction cycles and, where possible, isolate the principal Script group;
  • report ELF size, stack, witness bytes, transaction size, occupied capacity, and dependencies; and
  • keep counterexamples and regressions instead of narrowing the corpus after a failure.

A missing or unreachable pinned source invalidates reproducibility evidence. A matched cost row proves only its named scope and build profile.

Cross-feature composition rule

Support for feature A and feature B in separate compilation paths does not establish support for A and B together. Every required scenario must use the same 0.30 path promised to users, including persistent action selection, dynamic roles, complex payloads, authorization, external dependencies, and generated builders where applicable.

The anchor fixture is a coherent authenticated partial-fill order or settlement protocol combining:

  • one persistent multi-action order policy;
  • variable-cardinality asset or payment inputs;
  • multiple resource and Script roles;
  • an authenticated dependency or verifier;
  • partial fill, cancel, and settle actions;
  • generated construction and signing; and
  • a stateful positive lifecycle plus adversarial mutations.

Evidence layers

Each corpus row must record separately:

  • parser/type/IR acceptance;
  • metadata and standalone-checker result;
  • simulator result where applicable;
  • CKB-VM result;
  • stateful bookkeeping result;
  • node dry-run/admission result for release candidates;
  • builder and signing result;
  • deployment identity and network scope;
  • cycles and size measurements; and
  • independent review status.

No lower evidence layer may be relabeled as a higher one.

Completion criteria

  • Every required family has a frozen source and transaction-fixture inventory.
  • The anchor composition fixture combines persistent policy, dynamic groups, multiple resources, and authenticated dependency behavior.
  • Every positive lifecycle consumes outputs produced by earlier verified steps where state continuity matters.
  • Every scenario has explicit adversarial mutations and stable expected outcomes.
  • Matched Rust references are pinned, retrievable, reproducible, and run against identical fixtures.
  • CellScript and Rust agree on every matched accept/reject outcome, or any intentional semantic difference is specified and separately accepted.
  • Builders, signing, CKB-VM, stateful execution, and node admission agree on the exact candidate artifacts.
  • Resource budgets are recorded and enforced without removing required checks.
  • All issue dependencies required by the frozen corpus are complete.
  • dev, ci, backend, and applicable release gates pass.
  • Independent security review covers the anchor composition fixture and each new consensus-facing mechanism.

Non-goals

  • a percentage estimate of all possible Rust contracts;
  • one example per business name without cross-feature composition;
  • changing fixtures to hide an outcome or cost regression;
  • counting external verifier semantics as compiler-proved; or
  • requiring unrestricted recursion, unbounded collections, raw syscalls, inline assembly, or a circuit DSL.

Dependencies

Activity

  1. a19q3
    added
    enhancementNew feature or request
    on Sep 7, 2026

  2. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    0.30 corpus evidence update landed in 1e2f642.

    A content-bound scenario-evidence manifest now grades every business-family row as owner/test inventory only, partial transaction hashes, or exact artifact fixtures. Validation rejects promotion of lower evidence tiers to exact or release evidence. The committed-state family has its first exact authenticated-opening artifact/transaction/resource record, backed by deterministic CKB-VM execution and stable raw/serialized transaction hashes.

    The manifest also records an external reproducibility blocker honestly: the parent-pinned NovaSeal and benchmark submodule commits are no longer fetchable from their configured remotes, and current remote heads were not substituted.

    #26 remains open. Most family rows still need exact canonical fixtures and adversarial/stateful continuity evidence; node admission, selected-network deployment, and independent review are also pending.

  3. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    Follow-up for pushed 0.30 commit e351cb1: the canonical four-artifact/five-group positive settlement anchor is now promoted from transaction-hashes-pinned to exact-artifact-fixture.

    The fixture now independently pins, for order/policy/token/authorization, each ELF artifact hash plus its lowering-record hash, source-map hash, and verified-bundle ID. Those 16 identities are checked in the same test that executes the five Script groups and binds the raw transaction, serialized transaction, ProtocolBundle hash, resources, generated builders, plan, witnesses, and CellDeps. The full business suite was replayed twice at 3/3; scenario-evidence validation is 2/2 and clippy is clean on Rust 1.97.1.

    The evidence manifest still keeps the family at partial coverage because the remaining positive/adversarial inventory rows do not yet have individual exact-artifact records. The unreachable pinned NovaSeal/iCKB commits, node admission, selected-network deployment, and independent review remain explicit blockers; no current remote HEAD was substituted. No TAC, release, deployment, or signing flow was run.

  4. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    Pushed 450c3bb4 on 0.30, upgrading the composition anchor's adversarial evidence from mutation names to exact executed transaction identities.

    All five rejected variants now pin and executable-test their raw and full serialized CKB transaction hashes:

    • wrong authorization credential: raw 0xeeffbecf0ccbdda0d5709b96ccee78e11988a74be00515f96d34e84b8de73ba6, serialized 0x016bbf3f66327bf8d2c0a294eb40b55b12f2ef55a0139a7db1d9493ab3a181a9
    • fungible Type-state inflation: raw 0x582d82554b45f3935929ef8cccb7be0c7bd6667c438b36eab56204df8ce82aa6, serialized 0xd3bd02305c76c60d882d8ac42cf73156f5bb616e1d584e47b4c9ccc41bf405a2
    • settlement-output mismatch: raw 0xb4818b0c429830cf06f09624d699a35ca031f5537dea9ff9d7c6a1203a22fc3d, serialized 0x0a0688f595160f863a4aeaa051044184d31ca0f7ef93694a52c1cd85a700f174
    • persistent-policy state substitution: raw 0x332092f94bc5c7c4b6cd91cf762349b1259addf9366bb9d55b76b024b1c56b07, serialized 0x142aef059b7ddbcebac8322849f551ca6207886c5c4572ad7c4fd419c51a5986
    • authenticated CellDep substitution: raw 0x898696abf01e0342e03a613c4e8a673bded0951d30c19f7941d09445a13797d4, serialized 0xec5200f4f5a6d592de114ed3c366aabd90971e7b4d559334816205c336b3e803

    The scenario-evidence manifest now records exact-artifact fixtures for the positive four-artifact transaction, byte-identical ProtocolBundle materialization, and the inventory's authorization/type-state/output/CellDep substitution rows. tests/business_corpus.rs cross-checks those manifest records against the actually executed transaction hashes and the same four pinned artifact hashes. It reports all stale adversarial identities together.

    Validation on exact Rust 1.97.1: business corpus 3/3 twice; scenario-evidence 2/2; capability-ledger 2/2; focused Clippy with -D warnings; fmt and doc-status checks.

    The multi-Script inventory gap is now specifically the independently hashed partial_fill_then_settle and cancel_live_order transactions plus an exact role_conflict bundle fixture. Other families, unavailable pinned external reference commits, selected-network admission/deployment, and independent review also remain open. No TAC, release, deployment, or signing workflow was invoked.

  5. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    Follow-up a2ee77aa is pushed on 0.30 and completes exact-artifact scenario coverage for the full multi-Script composition inventory (4 positive + 5 adversarial rows).

    New exact stateful evidence:

    • partial_fill precursor: raw 0xcd6b5a6b875958ad5d172a352daf0a5dd331dee23d524481b5df99a78db8345f, serialized 0xadf77c6b46542e61ea4d02098b90a525e087eea39e957340589affe0b78fa3d6
    • successor settle (partial_fill_then_settle inventory record): raw 0x6dfedc2385a4a10e9091db01b759cb87454403b6cd2c5c307037be9320e5e5ad, serialized 0x251d6fc03933adf46189c3e88f485a9ff4d539eb154bd61937b4729bcca8c6d5
    • independent cancel (cancel_live_order): raw 0xe963f8d00bfd0ca964e3c6698f51624c34e7da64ec412ef8015a1c81e37d513d, serialized 0x6057dae1afae897b8f80ac6243409c3592bb5bc8932d65ad34bf0f84f98941d1

    The old stateful setup used allocator-generated input OutPoints whose hashes could vary under parallel execution. It now uses explicit domain-separated fixture OutPoints; the complete business test passed twice with identical identities.

    The remaining role_conflict row is now an actual conflict run: the exact four-artifact transaction is paired with a second exclusive claim on input 0, ProtocolBundle reports PB200, and the adapter rejects the failed report before materialization. Its scenario record is bound to the same raw/serialized transaction and four artifact hashes.

    Validation on Rust 1.97.1: business corpus 3/3 twice, scenario-evidence 2/2, capability-ledger 2/2, focused Clippy -D warnings, fmt, JSON/digest checks, and doc-status checks.

    Issue #26 remains open for exact scenario fixtures in the other seven families, the two unavailable pinned external-reference commits, selected-network node/deployment evidence, and independent review. No TAC, release, deployment, or signing workflow was invoked.

  6. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    0.30 business-corpus update: commit 12df6db is pushed. The committed-state family is now exact-artifact-fixtures for its complete frozen inventory: authenticated_opening + successor_commitment, and stale/malformed/wrong_root/wrong_index/wrong_successor. The new fixture pins exact artifact sidecars plus raw and serialized transaction hashes, and the executable test binds every manifest row back to its CKB-VM result. Multi-Script composition and committed-state are now the two fully exact scenario families; remaining owner-only families, node/deployment evidence, and independent review stay open. No release/TAC/deploy/signing workflow was invoked.

  7. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    0.30 update: commit 8353723 upgrades the temporal business family from owner-test-only coverage to exact-artifact fixtures for every frozen row: 4 positive and 5 adversarial transactions, each bound to the checked artifact and exact raw/serialized transaction hashes. Scenario-evidence validation, capability-ledger validation, and the 3 business-corpus anchor tests pass. Exact families now include multi-Script composition, committed state, and temporal. Remaining repository-local work is exact evidence for the other owner-only families; node/deployment evidence and independent review remain external release gates.

  8. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    0.30 update: commit 297ccb7 completes exact evidence for the fungible-asset family. A separately checked five-action policy now executes a deterministic signed lifecycle for authorized mint, transfer, bounded split, bounded merge, and burn. Six adversarial records pin replay at the persistent live-set boundary plus missing output, wrong amount, checked-add overflow, wrong issuer identity, and missing owner multisig authorization. All 11 rows bind artifact/lowering/source-map/bundle identity and exact raw/serialized transaction hashes. The fixture passed twice, scenario-evidence and capability-ledger validators passed, business anchor 3/3 passed, and Clippy passed. Exact families are now multi-Script composition, committed state, temporal, and fungible asset.

  9. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    0.30 update: commit 313603f completes exact evidence for the authorization family. The deterministic signed policy transaction now binds the bundled standard multisig-v2 Lock, 2-of-2 threshold, issuer authority, and complete Data2 policy Script identity. Adversarial fixtures pin post-signing transaction mutation, copied owner witness, cross-transaction signing domain, wrong key, one-of-two partial signature, and live-set replay to exact raw/serialized transaction identities and actual Lock exit codes. Both authorization and fungible suites passed twice; scenario-evidence, ledger, business-anchor, formatting, and Clippy checks passed. Exact business families are now authorization, fungible asset, committed state, temporal, and multi-Script composition.

  10. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    0.30 update: commit 001d04c indexes five order/AMM rows to exact, already-identical anchor transactions instead of leaving them owner-only: partial fill, cancel, two-order settlement, partial-settlement rejection, and authenticated dependency substitution. Each record carries exact artifact and raw/serialized transaction identities. Coverage is intentionally marked partial, not complete: pool merge, replay, output reordering, and wrong price still need dedicated exact transactions, and the pinned iCKB reference remains unreachable. Scenario-evidence, ledger, business-anchor, and the newly exact authorization/fungible suites all pass.

  11. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    0.30 update: NFT/DOB scenario evidence is now exact in 4cd744ac.

    • Added a deterministic signed persistent policy lifecycle for unique mint, derived metadata-state update, ownership transfer, and burn.
    • Added a separately identified typed-view capacity-adjustment artifact, explicitly avoiding a claim that unsupported in-policy capacity mutation is implemented.
    • Pinned five positive and five adversarial CKB transactions, including duplicate output, stale state, wrong Lock/Type, and missing owner authorization, to artifact/lowering/source-map/bundle identities.
    • Bound all ten frozen NFT/DOB inventory rows in business_scenario_evidence.json; targeted scenario, ledger, anchor, and CKB-VM suites pass.

    Remaining repository-local #26 work is the external-verifier family and four order/AMM rows. Matched-reference reproduction, node/deployment evidence, and independent review remain external blockers.

  12. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    0.30 update: external-verifier scenario evidence is exact in 80f948f6.

    • Added exact CKB-VM fixtures for fixed-identity EXEC and checked SPAWN/WAIT.
    • Added runtime rejections for wrong dependency position/hash, wrong adapter, wrong argument, wrong receipt scope, wrong typed-semantics statement, child failure, and post-build CellDep substitution.
    • Pinned seven independently checked parent artifacts, all lowering/source-map/bundle identities, one 1,232-byte argument-checking child, the always-success child identity, and all ten raw/serialized transactions.
    • Kept the external child internals explicitly at the trusted boundary; the evidence does not claim compiler proof of child semantics.

    All external-verifier inventory rows are now exact. Four order/AMM rows remain repository-local work; matched-reference, node/deployment, and independent-review gates remain external blockers.

  13. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    0.30 update pushed in 7ec38fa: completed the four remaining Order/AMM exact-evidence rows. pool_merge now executes the existing matched CellScript/Rust-scope artifact in CKB-VM; replay reuses the identical raw/serialized transaction identity and is rejected at the local live-set boundary; a new narrow AMM artifact checks constant-product pricing, exact reserve transitions, and output roles, with exact wrong_price and output_reordering rejection transactions. The Order/AMM family is now 9/9 exact-artifact fixtures and all eight frozen business families have exact per-row coverage. Focused scenario runs were stable twice, the three existing business anchor tests pass, targeted clippy passes, and all 46 cellscript-tools unit tests pass. Full package/corpus gates remain blocked only by the already-missing NovaSeal / VS Code submodule files and unreachable pinned references; node admission, deployment, and independent review remain open. No TAC workflow was invoked.

  14. a19q3 commented on Sep 11, 2026

    @a19q3
    a19q3
    on Sep 11, 2026
    CollaboratorAuthor

    Reproducibility follow-up pushed in 59ed25b. The exact scenario rows remain complete, but the ledger now explicitly keeps #26 open until the frozen NovaSeal ee7dbff2… and iCKB equivalence c27bac62… commits are restored. Both configured repositories return No commit found for those SHAs; GitHub commit search and fork enumeration found no recoverable copy. Their current main heads were not substituted.

  15. a19q3 commented on Sep 12, 2026

    @a19q3
    a19q3
    on Sep 12, 2026
    CollaboratorAuthor

    0.30 final repository-local update at 3cf60a1: all positive and adversarial rows across the frozen eight-family business inventory bind exact artifact and raw/serialized transaction identities. The re-accepted reference pins are now remote-retrievable: NovaSeal 1e7c812 and iCKB equivalence 53c5078a; DOB remains 30709c97. The iCKB differential suite passes 220/220.

    The full clean release replay passes. Fresh local production admission on pinned clean CKB 0.207.0 at f7fa443 executes all 43 scoped actions and all 17 scoped locks, with all artifacts deployed and spent and complete strict/on-chain coverage. Independent review was explicitly waived by the maintainer; it was not performed or claimed as passed.

    This issue remains open only for the selected-network deployment evidence required by its acceptance boundary. No selected-network credentials/authority were available, and no TAC, tag, signing, release, or deployment workflow was invoked.

  16. a19q3
    closed this as completedon Sep 19, 2026

  17. a19q3 commented on Sep 19, 2026

    @a19q3
    a19q3
    on Sep 19, 2026
    CollaboratorAuthor

    Closure evidence update, 2026-09-19: the selected-network blocker in the previous comment is resolved, and this issue is closed for the accepted eight-family portfolio. Candidate 74cff5fd passes the strict release corpus check: 8 families, 76 evidence files, release_ready: true.

    The clean candidate passed dev, full ci within release, backend, and release, including fresh pinned CKB f7fa4436 production/stateful acceptance. The Pudge manifest and report cover the accepted twelve-artifact deployment scope. Live readback passed, and both candidate reproductions matched the recorded ELF bytes. This does not claim that every corpus transaction ran on Pudge or that the corpus proves arbitrary Rust equivalence.

    The implementation, website, and editor commits are pushed and retrievable. Independent review was explicitly waived by the maintainer, not performed. #27 retains public publication; #22/#28/#29 retain their deferred scopes. The dated audit records the exact candidate, product pins, evidence digests, and remaining boundary.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions