[0.32][ProtocolBundle] Stabilize runtime-selected open cross-Script roles #29

Maintainer decision — 2026-10-11: external audit requirement cancelled

The maintainer explicitly cancelled the external audit / independent human security review requirement for #29 as well as #28. This supersedes prior issue text and comments requiring external review before stable admission. No audit is claimed to have occurred.

Independent software artifact checking, the complete #28 dependency, all-group CKB-VM evidence, transaction/signing substitution rejection, generated-builder/adapter byte parity, bounded resources and applicable unified gates remain required. This waiver does not authorize release publication or deployment, and incomplete technical acceptance still prevents closure.

Accepted scope update — 2026-10-04

The maintainer promoted this issue into the 0.32 implementation scope. Earlier post-v1/deferred wording below records its original separation from 0.30; it is no longer the current version assignment. All required contracts and acceptance evidence remain applicable. The maintainer waived external human security review on 2026-10-11; all technical acceptance remains required. Implementation and technical acceptance are complete; see the completion record above.

Summary

Track runtime-selected/open cross-Script roles that are deliberately outside CellScript 0.30's closed artifact-known role contract in #10.

CKB Scripts do not call peer contracts, and observing a peer Cell does not prove peer authorization. Any open-role design must preserve the distinction between checks performed by the current Script, requirements enforced by ProtocolBundle, and whole-transaction acceptance supplied only when every CKB Script group succeeds.

Dependency

The dependency on #28's independently verified compatible-open Script/verifier handle and receipt model is satisfied. Closed exact roles remain owned by the completed bounded scope of #10.

Required contract

• Select participants only through a verified compatible-open handle/receipt policy; raw Script values and Registry names are insufficient.
• Preserve Lock/Type role, transaction-wide versus group-relative source, complete Script identity, data schema, cardinality, deployment, target/profile, and network identity.
• Distinguish local-owned lifecycle authority, foreign observation, required peer groups, dependency roles, and builder-only assumptions.
• Attribute every claim as checked_by_current_script, required_peer_script_group, checked_by_bundle_dry_run, or guaranteed_only_by_ckb_consensus.
• Bind the concrete participant selected in the final transaction before signing and reject post-build substitution.
• Define upgrade/yank/downgrade behavior through the accepted receipt model rather than implicit compatibility.
• Keep all runtime cardinalities and payloads fixed or explicitly bounded.

Acceptance evidence

• A versioned design record and threat model for open participant selection.
• Same-interface/wrong-artifact, wrong source, wrong role, missing peer group, unbound Registry record, wrong network/deployment, incompatible receipt, yanked version, and post-signing substitution negatives.
• ProtocolBundle all-group dry-run and materialization over byte-identical transactions.
• CKB-VM evidence for the current Script's own observations without claiming fictional peer calls.
• Generated-builder, checker, metadata, LSP/docs, and resource-budget parity.

Non-goals

• Reopening or weakening [Language design] Model typed cross-Script transaction roles without runtime linkage #10's exact closed-role v1 contract.
• Treating interface compatibility as behavioral equivalence.
• Giving observed foreign Cells local consume/create authority.
• Claiming that ProtocolBundle replaces CKB consensus validation.

Relationship

Split from #10 after the bounded 0.30 closed-role scope was implemented. This is post-v1/deferred work and is not a 0.30 release blocker unless a later accepted scope explicitly promotes it.