Fix 0.24 audit blockers

AGENTS.md

@@ -315,8 +315,11 @@ Existing command families to be aware of:
 - `proposals/novaseal` is a submodule (`NovaSeal.git`, branch `main`). Same
   for `proposals/evolving-dob/evolving-dob-profile-v1`.
 - `tools/ckb-tx-measure` depends on `../ckb/util/jsonrpc-types` and
-  `../ckb/util/types`; the gate builds the helper with CellScript's pinned
-  Rust 1.97.1 toolchain so its declared `rust-version` remains enforceable.
+  `../ckb/util/types`; when release validation receives `--ckb-repo`, the gate
+  stages the helper's tracked workspace under `target/` so those same relative
+  paths resolve to the explicit checkout. The gate builds the helper with
+  CellScript's pinned Rust 1.97.1 toolchain so its declared `rust-version`
+  remains enforceable.
 - `--primitive-strict 0.16` is the current production assurance gate; the
   README mentions it and the policy lives in `docs/`.
 

CHANGELOG.md

@@ -1,6 +1,16 @@
 # Changelog
 
-## Unreleased
+## 0.24.0 - 2026-08-17
+
+- Close the 0.24 audit blockers: reject transitive executable resolvers and
+  unsafe Git refs, bound and origin-bind Registry downloads, preserve exact
+  LS-IDL Type-script identity, and stop exposing unexpected service errors.
+  Restore a deliberate Clippy boundary for legacy explicit-context helpers,
+  align package identities with 0.24, and carry the closed 0.23 release and
+  NovaSeal evidence forward.
+- Isolate every CKB-dependent gate check. The backend stateful wrapper accepts
+  `CELLSCRIPT_CKB_REPO`, and release modes propagate `--ckb-repo` to the staged
+  `ckb-tx-measure` workspace instead of silently using another sibling checkout.
 
 - Remove the unreachable external RISC-V toolchain fallback and make the
   audited internal assembler the sole ELF-emission path. Reassign `E2400` to

Cargo.toml

@@ -21,7 +21,7 @@ resolver = "3"
 
 [package]
 name = "cellscript"
-version = "0.22.0"
+version = "0.24.0"
 edition = "2024"
 rust-version = "1.97.1"
 autobins = false
@@ -82,7 +82,7 @@ blake2b_simd = "1.0"
 toml = "0.8"
 hex = "0.4"
 semver = "1.0"
-cellscript-artifact-checker = { version = "=0.22.0", path = "crates/cellscript-artifact-checker" }
+cellscript-artifact-checker = { version = "=0.24.0", path = "crates/cellscript-artifact-checker" }
 
 indexmap = "=2.2.6"
 

README.md

@@ -4,7 +4,7 @@
 </p>
 
 [![CellScript CI](https://github.com/CellScript-Labs/CellScript/actions/workflows/ci.yml/badge.svg)](https://github.com/CellScript-Labs/CellScript/actions/workflows/ci.yml)
-[![Release: v0.22.0](https://img.shields.io/badge/release-v0.22.0-2f6f4e.svg)](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.22.0)
+[![Release: v0.23.0](https://img.shields.io/badge/release-v0.23.0-2f6f4e.svg)](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.23.0)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE-MIT)
 [![Rust 1.97.1](https://img.shields.io/badge/rust-1.97.1-orange.svg)](Cargo.toml)
 [![Targets: CKB](https://img.shields.io/badge/targets-CKB-2f6f4e.svg)](#target-profiles)
@@ -20,8 +20,8 @@ artifacts, together with typed metadata for auditing, policy checks, schema
 binding, and scheduler-aware execution.
 
 The current stable release is
-[CellScript v0.22.0](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.22.0).
-See the [0.22 release notes](docs/releases/CELLSCRIPT_0_22_RELEASE_NOTES.md)
+[CellScript v0.23.0](https://github.com/CellScript-Labs/CellScript/releases/tag/v0.23.0).
+See the [0.23 release notes](docs/releases/CELLSCRIPT_0_23_RELEASE_NOTES.md)
 for its shipped surface, evidence boundaries, and migration checklist.
 The completed 0.23 implementation scope is tracked in the
 [0.23 release notes](docs/releases/CELLSCRIPT_0_23_RELEASE_NOTES.md); those
@@ -122,15 +122,15 @@ curl -fsSL https://raw.githubusercontent.com/CellScript-Labs/CellScript/main/scr
 Or pin a specific version:
 
 ```bash
-CELLSCRIPT_VERSION=0.22.0 curl -fsSL https://raw.githubusercontent.com/CellScript-Labs/CellScript/main/scripts/install.sh | sh
+CELLSCRIPT_VERSION=0.23.0 curl -fsSL https://raw.githubusercontent.com/CellScript-Labs/CellScript/main/scripts/install.sh | sh
 ```
 
 The release page publishes `SHA256SUMS` alongside all four platform archives.
 
 Build the exact published source instead:
 
 ```bash
-git clone --branch v0.22.0 --depth 1 https://github.com/CellScript-Labs/CellScript.git
+git clone --branch v0.23.0 --depth 1 https://github.com/CellScript-Labs/CellScript.git
 cd CellScript
 cargo install --locked --path .
 ```
@@ -732,7 +732,7 @@ policy defaults:
 [package]
 edition = "2026"
 name = "token"
-version = "0.22.0"
+version = "0.24.0"
 entry = "src/main.cell"
 source_roots = ["src"]
 
@@ -916,9 +916,11 @@ the manual, CI, recovery, and external-wallet path.
 - The default source-package authority is
   `https://api.registry.cellscript.dev`; only publicly accepted statuses enter
   ordinary version selection. `CELLSCRIPT_REGISTRY_API_URL` changes that API
-  origin, while `CELLSCRIPT_REGISTRY_URL` explicitly selects the legacy
-  Git/offline discovery authority. An unavailable production API does not
-  silently downgrade to Git discovery.
+  origin, and `CELLSCRIPT_REGISTRY_STATIC_ORIGIN` explicitly trusts a separate
+  immutable-object origin for a private Registry. Snapshot downloads are
+  origin-bound; a lockfile cannot redirect the client to an unrelated host.
+  `CELLSCRIPT_REGISTRY_URL` selects the legacy Git/offline discovery authority.
+  An unavailable production API does not silently downgrade to Git discovery.
 - Registry discovery may grow to include CellScript packages, verifier
   artifacts, deployed artifact records, reproducible artifacts, and external
   CKB tooling artifacts. Dependency resolution stays narrower than discovery.

contracts/registry-type-script/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cellscript-registry-type-script"
-version = "0.22.0"
+version = "0.24.0"
 edition = "2024"
 rust-version = "1.97.1"
 publish = false

contracts/registry-type-script/README.md

@@ -43,7 +43,8 @@ Reproduce the canonical Linux artifact with the pinned container digest:
 contracts/registry-type-script/build_canonical_container.sh
 ```
 
-The deployable artifact is tracked under `artifacts/v0.22.0` and was produced
+The current deployable artifact is tracked under `artifacts/v0.24.0`; the
+identical historical release bytes remain under their versioned directories. It was produced
 for the `x86_64-unknown-linux-gnu` host with the builder image digest recorded
 in `release-manifest.json`. Rust/LLVM may order identical RISC-V functions
 differently on another build host, so the script claims a byte-for-byte

contracts/registry-type-script/release-manifest.json

@@ -1,15 +1,15 @@
 {
   "schema": "cellscript-registry-type-script-release-v1",
-  "version": "0.22.0",
+  "version": "0.24.0",
   "target": "riscv64imac-unknown-none-elf",
-  "artifact": "artifacts/v0.22.0/cellscript-registry-type-script",
+  "artifact": "artifacts/v0.24.0/cellscript-registry-type-script",
   "canonical_build_host": "x86_64-unknown-linux-gnu",
   "canonical_builder_image": "rust@sha256:77fac8b98f9f46062bb680b6d25d5bcaabfc400143952ebc572e924bcbedc3fa",
   "artifact_bytes": 3352,
-  "sha256": "6a7ab8eaa2281fe77ca8c7b092006c52f96006ac2c7e4b013f8f88b7bf1f742a",
-  "ckb_data_hash": "0x8b6de99567accdca438818a55c16534ed10fc335f117709b1487fd2666808bfb",
+  "sha256": "0f48a8736360c121f6ae0f04ab4b0496834f6715d47e3284a0a07add609dede9",
+  "ckb_data_hash": "0x0dd596ade29e06e5bcc00f56abf36ecbe9afaa09f1b26a64436aa37854da622b",
   "script_template": {
-    "code_hash": "0x8b6de99567accdca438818a55c16534ed10fc335f117709b1487fd2666808bfb",
+    "code_hash": "0x0dd596ade29e06e5bcc00f56abf36ecbe9afaa09f1b26a64436aa37854da622b",
     "hash_type": "data1",
     "args_schema": "ckb_script_hash(custody_lock)",
     "args_bytes": 32

contracts/registry-type-script/tests/ckb_vm.rs

@@ -22,7 +22,7 @@ struct Scripts {
 }
 
 fn contract_binary() -> Bytes {
-    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("artifacts/v0.22.0/cellscript-registry-type-script");
+    let path = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("artifacts/v0.24.0/cellscript-registry-type-script");
     std::fs::read(&path).unwrap_or_else(|error| panic!("read tracked canonical artifact {}: {error}", path.display())).into()
 }
 

crates/cellscript-artifact-checker/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cellscript-artifact-checker"
-version = "0.22.0"
+version = "0.24.0"
 edition = "2024"
 rust-version = "1.97.1"
 description = "Bounded independent verifier for CellScript lowering records and CKB RISC-V artifacts"

crates/cellscript-ckb-adapter/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cellscript-ckb-adapter"
-version = "0.22.0"
+version = "0.24.0"
 edition = "2024"
 rust-version = "1.97.1"
 publish = false

crates/cellscript-fiber-adapter/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cellscript-fiber-adapter"
-version = "0.22.0"
+version = "0.24.0"
 edition = "2024"
 rust-version = "1.97.1"
 publish = false

crates/cellscript-tools/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cellscript-tools"
-version = "0.22.0"
+version = "0.24.0"
 edition = "2024"
 rust-version = "1.97.1"
 publish = false

crates/cellscript-tools/src/tooling_release.rs

@@ -470,6 +470,19 @@ pub fn run(root: &Path) -> Result<()> {
         !tx_measure_gate.contains("RUSTUP_TOOLCHAIN"),
         "CKB transaction measure tooling must use CellScript's pinned Rust toolchain",
     )?;
+    for token in [
+        "release_ckb_repo_from_args() {",
+        "staging_dir=\"$(mktemp -d \"$ROOT_DIR/target/cellscript-ckb-tx-measure.XXXXXX\")\"",
+        "cp tools/ckb-tx-measure/Cargo.toml tools/ckb-tx-measure/Cargo.lock",
+        "cp src/bin/ckb_tx_measure.rs",
+        "ln -s \"$ckb_repo\" \"$staging_dir/ckb\"",
+    ] {
+        require(gate_script.contains(token), format!("release CKB checkout propagation is missing '{token}'"))?;
+    }
+    require(
+        gate_script.matches("run_release_auxiliary_checks \"$ckb_repo\"").count() == 2,
+        "release and release-quick must both propagate the selected CKB checkout to auxiliary checks",
+    )?;
     require(
         gate_script.contains("--root \"$ROOT_DIR\" workspace-version"),
         "release source identity must read the root package version from Cargo.toml",

crates/cellscript-wasm/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "cellscript-wasm"
-version = "0.22.0"
+version = "0.24.0"
 edition = "2024"
 rust-version = "1.97.1"
 publish = false

docs/CELLSCRIPT_CKB_ADAPTER.md

@@ -524,7 +524,7 @@ cargo build -p cellscript-ckb-adapter --bin cellscript-deploy
 # Build the canonical Registry Type Script deployment for external signing
 export LOCK_ARG=0x$(cat ~/.ckb/default-lock-arg)  # your secp256k1 lock arg
 cellscript-deploy --rpc http://127.0.0.1:8114 --json build-deploy \
-  --artifact contracts/registry-type-script/artifacts/v0.22.0/cellscript-registry-type-script \
+  --artifact contracts/registry-type-script/artifacts/v0.24.0/cellscript-registry-type-script \
   --lock-arg $LOCK_ARG \
   --name cellscript-registry-type-script \
   --hash-type data1 \

docs/CELLSCRIPT_GATE_POLICY.md

@@ -165,6 +165,18 @@ and validates every step's commit, spent-input liveness, live outputs, cycles,
 serialized size, and occupied capacity. `--stateful-scenarios` remains only as
 an explicit option for bounded runs.
 
+The backend gate normally resolves that checkout as the sibling `../ckb`
+directory. When that path is occupied by another development worktree, set
+`CELLSCRIPT_CKB_REPO` to a separate clean checkout at the exact pinned revision;
+the stateful wrapper forwards it as the acceptance harness's `--ckb-repo`.
+This avoids modifying or stashing an unrelated CKB worktree during validation.
+
+For `release` and `release-quick`, pass the same checkout with `--ckb-repo`.
+The release gate stages the independent `ckb-tx-measure` workspace under
+`target/` with its tracked manifest, lockfile, and source so its relative CKB
+dependencies resolve against that explicit checkout too. The default remains
+the sibling `../ckb`; the tracked lockfile remains bound to the release pin.
+
 The transaction matrix is produced by the native Rust acceptance harness and
 is intentionally labelled as recipe-replayer evidence, not generated-builder
 output. Separately, the gate runs the public `cellc action build` and

docs/CELLSCRIPT_LS_IDL_REGISTRY_PROFILE.md

@@ -107,10 +107,12 @@ uniquely identify executable data. More than one matching deployment returns
 The compatibility route is:
 
 ```text
-GET /idl/:code_hash
+GET /idl/:code_hash[?data_hash=0x...]
 ```
 
 It is retained for existing LS-IDL clients and returns the same original
+bytes for immutable `data`/`data1`/`data2` identities. A Type-hash candidate
+still requires `data_hash`; code hash alone never selects upgradeable code
 bytes. New integrations should use the canonical route so network, hash type,
 and data-hash identity are explicit.
 

docs/CELLSCRIPT_PACKAGE_PROVENANCE_AND_DEPLOYMENT_IDENTITY.md

@@ -454,7 +454,7 @@ source_hash = "blake2b:0xabcd..."
 [package_build]
 edition = "2026"
 compatibility_profile_hash = "blake2b:0xprofile..."
-compiler_version = "0.22.0"
+compiler_version = "0.24.0"
 target_profile = "ckb"
 artifact_hash = "blake2b:0x1234..."
 metadata_hash = "blake2b:0x5678..."
@@ -840,7 +840,7 @@ for audit, offline fixtures, and direct-Git fallback:
       "version": "1.2.0",
       "tag": "v1.2.0",
       "source_hash": "blake2b:0xabcd...",
-      "cellscript_version": "0.22.0",
+      "cellscript_version": "0.24.0",
       "dependencies": {
         "token": { "namespace": "cellscript", "version": "0.3.0" }
       },

docs/releases/CELLSCRIPT_0_24_RELEASE_NOTES.md

@@ -1,9 +1,9 @@
 # CellScript 0.24 Development Release Notes
 
-**Status**: implementation-complete merge candidate; `dev`, `ci`, and
-`backend` passed on 2026-08-10. The refreshed iCKB evidence submodule commit
-`0e18ccd97bd75cac7de9211dc8d344c0bc08942f` is published and bound by the
-parent gitlink; the full release gate remains required before production claims
+**Status**: audit-remediation merge candidate. The refreshed iCKB evidence
+submodule commit `0e18ccd97bd75cac7de9211dc8d344c0bc08942f` is published and
+bound by the parent gitlink. The merge gates must pass for the exact candidate,
+and the full release gate remains required before production claims.
 
 **Source edition**: 2026
 
@@ -301,13 +301,11 @@ or conversion of executable/copy artifacts into source dependencies.
 
 ## Validation
 
-The package/Registry closure passed `dev` and `ci` on 2026-08-10, with the CI
-website phase using the required Node 22 toolchain. The complete `backend` gate
-then passed from an isolated clean checkout containing the refreshed iCKB
-differential evidence, pinned CKB revision
-`f7fa4436737756f97a24e254f22c13a36316ecea`, and CKB SDK `v5.1.0`. This
-covered the compiler tests, Clippy, full strict backend audit, all 218 iCKB
-differential cases, and the production stateful CKB scenario harness:
+The 2026-08-10 `dev`, `ci`, and `backend` results predated later changes on the
+0.24 branch and are not evidence for this merge candidate. The exact audit-fix
+snapshot must pass all three commands below in an isolated checkout using Node
+22, CKB revision `f7fa4436737756f97a24e254f22c13a36316ecea`, and CKB SDK
+`v5.1.0` before merge:
 
 ```bash
 ./scripts/cellscript_gate.sh dev

docs/wiki/Tutorial-12-Phase1-Registry-End-to-End.md

@@ -294,7 +294,9 @@ curl --fail \
   --output idl.json
 ```
 
-The compatibility route `/idl/:code_hash` returns the same original bytes.
+The compatibility route `/idl/:code_hash` returns the same original bytes for
+immutable hash types. Type-hash deployments require `?data_hash=0x...` even on
+that route so an upgrade cannot resolve by code hash alone.
 The Registry proves the document schema, raw-byte digest, executable suffix,
 and deployment identity. It does not prove that the Lock Script correctly
 implements the interface, and it is not a security audit. See the

docs/wiki/_Sidebar.md

@@ -20,6 +20,7 @@
 - [Spore and RGB++ Interoperability Boundaries](https://github.com/CellScript-Labs/CellScript/wiki/Spore-and-RGBPP-Interop-Boundaries)
 - [BIP340 Verifier CellDep ABI](https://github.com/CellScript-Labs/CellScript/blob/nightly-0.24/docs/CELLSCRIPT_SIGNATURE_VERIFIER_ABI.md)
 - [LS-IDL Registry Profile](https://github.com/CellScript-Labs/CellScript/blob/nightly-0.24/docs/CELLSCRIPT_LS_IDL_REGISTRY_PROFILE.md)
+- [CellScript 0.23 Release Notes](https://github.com/CellScript-Labs/CellScript/blob/v0.23.0/docs/releases/CELLSCRIPT_0_23_RELEASE_NOTES.md)
 - [CellScript 0.22 Release Notes](https://github.com/CellScript-Labs/CellScript/blob/v0.22.0/docs/releases/CELLSCRIPT_0_22_RELEASE_NOTES.md)
 - [CellScript 0.24 Development Release Notes](https://github.com/CellScript-Labs/CellScript/blob/nightly-0.24/docs/releases/CELLSCRIPT_0_24_RELEASE_NOTES.md)
 - [Bounded Fiber Interoperability Guide](https://github.com/CellScript-Labs/CellScript/blob/nightly-0.24/examples/fiber/README.md)