Week 40 · 2026

Highlights

The pledge went out to a hundred maintainers (D1)

This week the pledge stopped waiting to be found. #34 added the invitation tooling. build-recipients.py picks unsigned maintainers from the ecosystem map. send.sh opens one personal issue per maintainer, spaced 10 to 20 minutes apart, and re-reads the signatory list before each one, so nobody who signed mid-run is asked. 118 invitations went out during the week. They account for most of the week's 32 comments, which is why the counter is so high.

Thirteen new signatures merged, in five PRs (#158 and #166 with five each, plus #95, #160 and #167). Several signatories came in through the invitation itself: their issue closed when their signature landed. The list now has 35 signatories. The new ones include developers and founders behind Cardanoscan, Masumi and NMKR, Charli3, Andamio, ADA Handle (Kora Labs), No.Witness Labs, NUFI/AdaLite and TxBody, and Hydra at Input Output, along with independent contributors.

The replies were as useful as the signatures:

• Some maintainers support the principles but won't sign. One will not put their name to a document that can still change. Another prefers not to sign anything but will "do my best to adhere to its principles", and points out that opinionated design can make parallel utilities legitimate. That second point belongs in the pledge's next revision.
• One reply questioned IO's standing to ask, citing past ecosystem funding decisions. That is a credibility gap the initiative closes by how it acts, not by what the pledge says.
• One maintainer has left the Cardano ecosystem. #164 removed them from the map's team listings so the recipient builder can't pick them again. A follow-up commit dropped three logins that no longer resolve on GitHub.

cardano-init: an Evolution template a backend can use (D3, #87, #79)

#87 (@0xBora) makes the Evolution gift-card template return unsigned transactions. Before, createGiftCard and redeemGiftCard signed and submitted internally, which only works when the builder is also the signer. Now build and sign are separate steps, matching the MeshJS template: build returns the unsigned transaction, a new signAndSubmit signs it, and node.ts exposes the provider client for a backend that builds without a wallet. The motivation is downstream: the Developer Portal is building a sample dApp on top of a cardano-init project, with a backend that builds and a browser wallet that signs. The portal's dApp templates will start from cardano-init instead of their own scaffolding.

#79, open since 20 August, fixed the missing contributor attribution in release notes. git-cliff silently skips GitHub handle resolution when it has no token or can't infer the repository, and on a fresh release branch it had neither. cliff.toml now pins the remote, RELEASING.md passes GITHUB_TOKEN and documents the pitfall, and the changelog was regenerated with by @handle restored on every release.

The smart wallet got a spec, pluggable restrictions and two off-chain drivers (D5)

Fifteen commits from Francisco Joray (+4,740 / −196 across 43 files) took the smart wallet from a validator to a full exploration.

The 263-line spec.md sets out the model. A wallet is one NFT-bearing UTxO behind a fixed M-of-N signature floor, with the members and threshold read from a settings UTxO. Everything beyond the floor is a delegated withdraw-0 script listed in the datum as Pairs<ScriptHash, Data>, and the Data is that script's own mutable state. Spending requires the floor and every delegated script, while the spending validator knows nothing about what those scripts check. That is what keeps the restrictions open-ended.

The on-chain work filled in the rules that keep this safe:

• A script can't join without validating itself. A script added at mint or by UpdateConfig must be registered in the same transaction, and its publish handler checks its own starting state.
• A script can't be unregistered behind the wallet's back. Unregistration is accepted only when the script is actually leaving the wallet, and Close unregisters all of them. Otherwise anyone could unregister a delegated script and freeze the wallet.
• A Deposit redeemer lets a depositor add funds without being able to spend them or change the config.

Two example restrictions ship with it, one of each kind. spending_limit is stateless, with its bound fixed at compile time. spending_window is stateful: it records the last spend and limits how often the wallet can pay out, reading now from the validity range's lower bound. The off-chain side arrived in one day: a MeshJS driver with e2e suites for the wallet and for the withdrawal scripts, and a Tx3 protocol (792-line main.tx3) with its own devnet suite.

The spec is upfront that this is a first version. The admin is still a compile-time parameter, and withdrawal scripts are per-wallet. Both are slated to become ordinary, shareable delegated scripts.

Event-triggered assets got their CIP-113 base and their tests (D5)

Eighteen commits on 28-explore-event-triggered-assets (+6,009 / −591 across 38 files), most by Sofia Bobbiesi, with Francisco Joray joining for the off-chain tests:

• A CIP-113 base to build against. The CIP-113 core blueprint, its bond management, and an upgrade multisig were brought into the branch, so the bond is built against the substandard it extends. Policy IDs are resolved at runtime rather than compiled in, and the reference token now carries the graduated asset's policy.
• About 1,160 lines of Aiken tests: issuance (572), the event gates (252), transformation (181) and the graduated-asset policy (158).
• Both off-chain lanes. The bond lifecycle has a Tx3 protocol (a 1,423-line main.tx3 and an 849-line devnet suite) and a rewritten MeshJS e2e suite on a new CIP-113 deployment harness.

Advanced lecture 1 grew two multi-step exercises (D4, #2011)

Paulo Bressan reorganized Detecting vulnerabilities into single-step and multi-step attacks (+1,687 / −129). The gift-card shop stays as the single-step exercise, and two new projects cover the multi-step side. Each one ships an open validator and a fixed one:

• The splitter (resource limit). Anyone may donate to a shared pot, and any token counts as a donation. An attacker donates worthless dust tokens a few at a time until reading the pot costs more execution units than a transaction is allowed. At that point nobody can split it, and the ADA is stuck. Every step was allowed, and no single one broke a rule.
• The vault's stake part. Anyone may donate to an owner's vault, and the donor gets to choose the stake part of the returned UTxO, and with it who collects the vault's staking rewards.

Separately, every onboarding Aiken example moved to compiler v1.1.24 and stdlib v4, with the tools lecture updated to match. #2011 is still open, and review has requested changes.

A note on the commit count

All 46 commits are new work, not history. 33 are contracts-library, split 18 to event-triggered assets and 15 to the smart wallet, all on unmerged branches. 10 are the tracker's pledge work, 2 are the Developer Portal, and 1 is cardano-init.