[Language/ABI] Support policy-constrained Script instances in compatible-open handles #80

Objective and status

Extend the existing ScriptHandle<I> and VerifierHandle<I> admission model with a separate, versioned policy for constrained Script instances. Permit explicitly bounded argument values under independently checked, on-chain-enforced constraints while retaining the concrete identity and authorisation of every selected instance.

Status: bounded technical implementation completed on the 0.32 branch. #28 and #29 remain completed foundations. Implementation owner: Codex under the maintainer’s 2026-10-17 request. An issue-specific author self-review is recorded; no independent human audit was performed and no earlier waiver is inherited. The linked closure evidence identifies the signed implementation, full gate provenance and retained artifacts. This is not a release or public deployment approval.

Existing boundary and motivation

#28's member encoding commits to the complete Script hash, including concrete args. Both its exact and compatible implementation-selection modes retain that binding. The existing format has no wildcard or schema-only args policy, and #11's exact-handle format remains unchanged.

A consumer may need to admit independently configured instances of approved code without enumerating every concrete argument combination in its immutable member set. This issue owns that general admission contract. Shared code and an accepted argument schema alone must never make two instances interchangeable or grant authority over their Cells.

Before choosing compiler changes, demonstrate a minimal limitation of the existing exact-instance path, identify the smallest owning layer, and include a non-financial constrained-instance use case under #43's general-capability admission rule. A fixed verifier allowlist is a required regression/control example; by itself it does not demonstrate a need for variable instances.

Required design contract

1. Separate two policy dimensions. Preserve [0.32][Language/ABI] Stabilize generic compatible-open Script and verifier handles #28's exact-versus-compatible implementation selection. Define exact-instance versus constrained-instance admission separately, enumerate the supported combinations, and reject unsupported combinations. Freeze new schema identifiers, canonical encoding, domain-separated commitments and migration rules without reinterpreting old bytes or weakening old readers.

2. Bind implementation and instance evidence. Retain the approved executable bytes, independently recomputed interface receipt, Script role, code hash/hash type, actual code CellDep/OutPoint, target/profile/ABI, deployment and network context. Bind the argument schema, constraints, policy version and policy identity. The selected concrete Script, including its actual args, remains identified in the final admission and transaction records. Define any separation between reusable implementation evidence and per-instance evidence explicitly.

3. Authenticate constraints and decode actual args. Specify which fields may vary, allowed values or relations, exact source/index scope, canonical encoding, and byte/count/decoding limits. Begin with bounded fixed-layout argument values unless a demonstrated case requires more. Validate the actual transaction Script args against the authenticated policy in CKB-VM. A witness or Registry record cannot authorise its own expected root, owner or constraints.

4. Specify root and configuration placement. The current [0.32][ProtocolBundle] Stabilize runtime-selected open cross-Script roles #29 native admission path requires the consumer's entire Script args to equal the 32-byte policy root. If the new profile combines that root with instance configuration, define a versioned layout and independently checked root/field accessors. Keep consumer root storage distinct from the selected participant's argument policy, and preserve the existing 32-byte-root path.

5. Preserve instance authority. A permitted argument value establishes only the claim defined by its policy. Owner identity, spending authority, genesis/uniqueness, lifecycle rules and cross-Cell correspondence require explicit enforcing predicates. An instance admitted under the same code and policy cannot replace another instance in an operation that authorises a particular pool, owner, recipient or state lineage. Foreign observation never grants local consume/create authority.

6. Define evolution and downgrade rules. Preserve immutable-snapshot, active/yanked and admission-floor semantics. Specify constraint/schema changes, policy widening, stale policies and cross-mode downgrade rejection. Root replacement or live revocation requires an explicitly authenticated transition contract; a later Registry edit cannot change an immutable root. Type-hash selection retains exact current code/OutPoint and checked history bindings. Compatibility, package updates and policy/deployment authorisation remain separate, consistent with [Toolchain][Upgrade] Add a transactional package, interface, and deployment upgrade plan #20.

7. Keep verifier inputs explicit. The accepted [0.32][Language/ABI] Stabilize generic compatible-open Script and verifier handles #28/[0.32][ProtocolBundle] Stabilize runtime-selected open cross-Script roles #29 spawned-verifier profile is parameterless and inherits its consumer's Script/group context. Distinguish Script args from child argv, IPC requests and proof/public-input codecs. Preserve selected dependency binding, actual SPAWN/WAIT execution and child-failure propagation. This issue does not implicitly add arbitrary verifier argv, hook callbacks or broaden the exact ZK profiles in [Language/Verifier][Research] Add typed zero-knowledge verifier contracts without a circuit DSL #22/[0.32][ZK/P2] Bind bounded multi-Cell transitions to complete protected state sets #44/[0.32][ZK/P3] Track circuit, key and verifier changes with authorized migration evidence #45; any required extension needs an explicit bounded contract and acceptance evidence.

8. Compose with ProtocolBundle. Support existing exact-instance and new constrained-instance admission through [0.32][ProtocolBundle] Stabilize runtime-selected open cross-Script roles #29's existing materialization and generated-builder paths. Bind the concrete participant, role, source/index, schema, cardinality, dependency, witness and instance policy to the complete transaction before signing. Preserve claim attribution to current-Script checks, required peer groups, bundle dry-run and consensus. Interface compatibility or successful membership does not establish peer acceptance or behavioral equivalence.

Acceptance criteria

• A versioned design and threat model fixes supported policy combinations, authority sources, canonical codecs, error behavior and numeric resource limits. Unsupported shapes fail closed.
• Existing [Language/ABI] Bind runtime Script values to verified package interfaces #11 exact handles and [0.32][Language/ABI] Stabilize generic compatible-open Script and verifier handles #28 exact-member encodings, roots, selections and verification retain their semantics, with frozen regression vectors. Old-format inputs cannot be reinterpreted as constrained admission.
• The independent checker verifies the new receipt/policy bindings and advertised machine enforcement. Rebound-hash mutations remove or alter args decoding, bounds, root access, constraint checks, identity binding and rejection paths and are rejected.
• CKB-VM cases cover valid, empty where admitted, maximum and over-limit args; malformed/noncanonical encodings; unauthorised owners; wrong role/source/network/code/CellDep/deployment; stale policies; policy widening/downgrade; and cross-mode proof substitution.
• A fixed verifier allowlist continues to work. Missing/wrong children and failing child predicates reject through actual execution; admitting a verifier is not counted as executing it.
• Two independently configured pools share the same deployed implementation while retaining distinct complete instance identities. Both work independently and concurrently without spending a universal coordinator Cell. Under [DeFi][FIN-11] Canonical pool identity, permissionless creation and reusable state layout #61/[DeFi][FIN-02][M1] Enforce authentic pool custody, asset identity and LP supply #52, demonstrate authentic genesis, configuration, custody and complete required Script groups.
• Both pool A and pool B satisfy the admission policy, yet substituting B's state, reserves, owner or identity into an operation authorised for A rejects at the intended enforcing Script. Also test missing peers and a selected peer that rejects despite valid admission. Negatives use otherwise-valid signatures and correctly constructed unrelated groups so they exercise the intended boundary.
• Native admission, CLI, generated builders and SDK/adapter materialization agree on canonical policy/witness and final transaction bytes. Reject post-check, post-build and post-signing substitutions. Signed-intent/retry integrations retain their separately defined authority boundaries, including [DeFi][FIN-26] Scoped signed intents, delegation, nonces and replay protection #76 where used.
• Source/type checking, lowering, ProofPlan, metadata, independent checker, diagnostics, formatter/LSP/editor, WASM metadata and documentation agree wherever affected. Publish valid and late-invalid cycles, stack/memory, ELF, witness/transaction-byte and capacity budgets at frozen maxima.
• Retain identified source/compiler/checker/artifact/CellDep/transaction evidence and independent reference vectors. Run focused checks and the applicable unified dev, backend and ci gates before technical acceptance; ordinary commits use commit plus focused checks. Node, public deployment, external audit and release claims remain separate.

Dependencies and related work

These links describe design and validation relationships, not native GitHub blocking relationships or release commitments. Pool keys, fee policies, custody and hook business rules remain application-owned; no finance-specific parser, IR or codegen behavior is introduced.