Week 37 · 2026

Highlights

The DAO and the settings protocol both landed on main (D5, #47 + #32)

Two long-running explorations merged within half an hour of each other on Wednesday, and contracts-library's main went from one shipped primitive to three.

• Config parameter management (#32, Sofia Bobbiesi) — open since 11 August, merged at +13,452 / −1,658 across 75 files. Besides the settings protocol itself (validators/settings.ak and a typed variant, plus lib/settings/{mint,spend,types,utils}.ak), it carried in most of the repository's second off-chain lane: the whole Tx3 workspace — devnet genesis, faucet, utilities, a 756-line settings/main.tx3 and a 477-line devnet suite — a MeshJS settings driver with a 746-line e2e test, and the house-keeping that goes with a second toolchain (biome.json, an aiken-fmt.sh, an .editorconfig, a widened CI job).
• DAO governance (#47, Sofia Bobbiesi) — +13,676 / −163 across 64 files. Three validators (stake, proposal, vote) plus the poll_effect candidate, 2,125 lines of Aiken tests across proposal, stake, vote, effect and locks, a 1,405-line dao/main.tx3 with a 1,105-line devnet suite, and a MeshJS driver (stake, proposal, vote, effect, datum codecs) behind a 1,027-line e2e test.

A procedural note, because last week's narrative cited it: #44 is gone. The base branch was rewritten, the reopen failed, and Sofia recreated the same head/base as #47. Same work, new number.

Both issues closed with their PRs — #43 (Implement: DAO) and #27 (Implement Config Parameter Management).

The last mile before the merge was security work (D5)

The DAO did not coast into main. Monday and Tuesday were spent closing attack surface:

• Tagged outputs against double satisfaction. Refund checks moved into validate_vote_tally and now use tagged outputs, so one refund cannot be claimed by two tally transactions.
• Tally DoS heuristics. Explicit heuristics on vote tallying, so a proposal cannot be made uncountable by flooding it — and a design note capping the locks list to keep the stake datum from bloating past what a transaction can carry.
• Settings read only when needed. The validators stopped fetching the settings UTxO on paths that do not consult it — cheaper, and a smaller reference-input surface.
• Checks moved to where they belong. The cosign threshold check moved from the stake validator to the proposal validator; the redundant create threshold check and an unnecessary is_draft check came out.

Plus the ordinary tidying that makes a merge reviewable: StakePositionTokenRedeemer → StakeTokenRedeemer across the tree, a consistent import order, a dropped max-tally test that cost minutes for no extra coverage, and both off-chain drivers re-aligned with the new on-chain shape.

Specs grew usage guides (D5)

The specs written last week got their practical counterpart: a 605-line DAO usage guide and a 373-line settings usage guide, both following the same plan — lifecycle, roles, how to deploy an instance, then the same actions twice, once through MeshJS and once through the Tx3 client, and a Gotchas and safety notes section at the end. The DAO guide opens with its prerequisite ("you need a settings instance first"), which is the honest statement of how the two protocols relate. The Typst transaction diagrams for both were finished and committed as PDFs alongside.

One shape per protocol in docs/ (D5, #49 → #50)

Francisco Joray opened an issue at 21:58 and closed it at 23:07: fold specs/ and docs/explorations/ into one directory per protocol, each holding spec.md, design.typ, design.pdf and usage.md. 37 files moved for a net −317 lines — the reorganization mostly deleted duplication. A Copilot patch fixed the stale vesting README links that the move left behind.

Event-triggered assets picked up on-chain logic (D5)

Three commits on the exploration branch took it past scaffolding: a design document, event-rule hooks and graduation mechanics written up as a CIP-113 substandard, and a validator refactor that implements issuance, transfer and third-party logic. The DAO merge also carried a first MeshJS driver and e2e test for it onto main, ahead of the on-chain side.

Intermediate lectures 10–13 went up for review (D4, #2003)

Paulo Bressan opened the PR that closes the Intermediate track: 77 files, +6,151 / −92, four design lectures each with a runnable Aiken project and, where the lecture has an app, a Mesh app.

• 10, Handling time — a vesting deadline enforced through the transaction's validity window, with the contract never reading a clock.
• 11, Multi validators — a gift card as one script with a mint and a spend handler, and a one-shot policy seeded from a UTxO.
• 12, Modifying state — an oracle whose rate lives on the chain and changes: Update puts the UTxO back, Delete burns the beacon.
• 13, Reference inputs & reference scripts — a consumer that reads the oracle's datum as a reference input, then the same consumer published once and unlocked through it.

The 19 commits inside the window are the shape of the thing being found rather than written: the oracle's beacon split out into its own one-shot policy and the two oracle lectures reworked around that split; lectures 10 and 11 given their own projects and transaction diagrams; a Mesh app added for the gift card; the consumer's fee paid from the wallet so the published script stays unspent; the vesting validator switched to the stdlib deadline check; and a small validatorHash.js helper so every script hash quoted in the prose is read from the example blueprints rather than pasted.

The tracker (D1, #31)

Romain Soulat opened the first dependency PR the site has had: next 16.2.10 → 16.3.4 plus npm audit fix, clearing every open Dependabot advisory (npm audit → 0 vulnerabilities), with AGENTS.md's pinned-version note updated to match. Still open at week's end. The rest of devx-updates' movement was its own plumbing — W36's highlights.

A note on the commit count

247 of the week's 270 commits are contracts-library, and almost all of that is history, not work: merging #47 and #32 pulled two long-lived branches — #32's reaching back to early July — into the window at once. 57 commits were newly authored this week: 29 by Sofia Bobbiesi, 27 by Francisco Joray, 1 by Robertino Martinez.