Week 43 · 2026

Highlights

The smart wallet merged after adversarial review (D5, #55)

The smart wallet merged on Thursday. The delegated spending and deposit restrictions described last week now sit on main, with Aiken validators, MeshJS builders, a Tx3 reference implementation, tests and usage documentation.

The week's work concentrated on what happens when a transaction deliberately tries to evade those restrictions. Robertino Martinez added counterexamples that run the wallet and its delegated scripts against the same transaction; Francisco Joray and Sofia Bobbiesi then closed the gaps:

• State belongs to the NFT-bearing wallet. A second output at the same address can no longer supply a fake permission map or spending history. Spending limits count the authenticated continuation, and stray wallet outputs are rejected so funds cannot be parked in an unspendable output to evade a restriction.
• Time limits cover the transaction's whole validity interval. The spending window records the previous upper bound, and the period budget requires both bounds to fall within one period. Backdating the lower bound no longer lets a member spend a succession of historical budgets.
• Registering a restriction must actually run its script. A certificate alone is insufficient; the wallet requires the corresponding Publish redeemer. Configuration checks also reject duplicate members and script keys, invalid thresholds, and changes to stateless scripts' fixed data.

Permission updates preserve non-ADA assets and explicitly allow an ADA top-up. MeshJS fixes preserve the wallet's full address and use the protocol's actual registration deposit. The documentation also makes the admin's Close escape hatch explicit: delegated restrictions do not remove the administrator's authority.

The Tx3 implementation still cannot exercise delegated-script registration and removal because its language lacks the required certificate blocks. That limitation remains tracked in tx3#164; the MeshJS path covers those flows.

The tokenized bond merged with stricter coupon and vault accounting (D5, #54)

Event-triggered assets also merged on Thursday. The CIP-113 bond now includes its on-chain rules, MeshJS and Tx3 paths, specifications and devnet scenarios on main.

Review found that a certificate for one vault could authorize coupon minting under another vault's policy. The fix binds every positive coupon mint to the certificate's own cnt_policy, including the principal coupon at maturity. The multi-vault negative test was tightened to isolate that check.

Vault redemption now adds up payments to each recipient, excludes the vault's own continuation from those payments, rejects empty or zero-value redemptions, and preserves non-ADA assets. The builders account for script authorizers when calculating transaction indices, and issuer-triggered continuations preserve the certificate's actual value instead of assuming it holds exactly 2 ADA.

The custody model was clarified as escrow, with a permissionless top-up operation that adds funds to the authenticated vault. Sending ADA to a bare vault address is not a substitute. Redemption still depends on available liquidity: issuance does not impose a reserve check or cap future coupon liabilities. Those limits remain explicit in the specification.

Upgradeability became a runnable pair of examples (D5, #57)

Sofia Bobbiesi opened #57 for two ways to evolve a protocol whose validator code cannot change in place:

• Opt-in migration: the owner authorizes moving a V1 UTxO to a new V2 validator. Consent is checked by the original validator, so changing the registry cannot remove that requirement.
• Forced forwarding: a stable validator delegates every spend to the logic script named in a governed registry. Governance can replace that logic without moving the funds.

Both reuse the settings contract's propose/apply mechanism. Counter examples make the behavior executable through Aiken, MeshJS and Tx3, with devnet tests for normal operation and malicious migrations.

The hardening work binds each continuation to the specific input it continues, preventing several inputs from being satisfied by one output. It also preserves token bundles and rejects attached reference scripts. Tests exercise altered state, wrong destinations, missing consent, forged registries and batches containing an invalid input. Friday's recorded run reports 1,179 Aiken checks, 64 MeshJS unit tests, 22 Mesh devnet cases and eight Tx3 devnet cases passing.

The guide documents two governance constraints: closing the settings instance burns its one-shot NFT and permanently disables dependent value exits, and the proposal's delay is anchored to a lower validity bound chosen by the proposer. A production registry must account for both. The PR remained unmerged at the end of the week.

Dijkstra readiness moved from dependency collection to devnet evidence (D1, D8)

The unmerged hardfork-readiness branch accounts for 23 of the tracker's 26 commits. It now connects a register of 19 protocol changes to 61 directly affected components and the wider tooling map, with source citations and decisions about whether each consumer actually uses the affected behavior.

The target is pinned to a cardano-node 11.2 integration revision, not a released 11.2 tag. A local devnet reaches Dijkstra at protocol version 12, and the probes were reproduced on a second machine. The recorded results separate several failures that a dependency list alone could not establish:

• Connecting is not enough to keep following the chain. The node accepts only node-to-client V23. Tested versions of Ogmios, Kupo and db-sync connect successfully, then fail at the first Dijkstra block. Blockfrost continues serving the database left at the last Conway block.
• A declared era does not establish decoder compatibility. Pallas and gouroboros encounter mismatches with the integration node's actual block encoding. CML 6.2.0 fails the captured Dijkstra block and transaction samples. In contrast, @cardano-sdk/core 0.47.1 decodes and reproduces all fifteen captured transactions byte for byte. That result covers those transaction forms, not the SDK's entire Dijkstra surface.
• Some existing transactions survive the transition; others do not. Conway-built payments, deposit registrations, required signers and metadata are accepted in the probe. A deposit-less registration is rejected.

The branch derives an order for upstream fixes from the tools they would unblock, and adds per-tool readiness, evidence and issue/PR links. Manual dismissals retain their reason and the underlying computed state.

It also tried dependency upgrades for Marlowe and Marconi. Marlowe's cardano-api 11.8 solve needs four companion constraints raised; Marconi's solve remains blocked by package-layout and dependency constraints. These were dependency solves only, without compiling or running either tool. The next work is to turn the identified gaps into verified upstream fixes; the prototype and its results had not merged into the public tracker.

Advanced onboarding returned to the atomic swap and expanded deployment (D4, #2059)

Paulo Bressan revised two lectures in the still-unmerged Advanced track.

Optimization replaces the payout queue with the atomic swap already familiar from onboarding. The explanation works from the protocol down: state layout, shared transaction work, validator design, then changes inside one function. The exercise measures three local improvements to the same swap: traverse once, check the address before inspecting value, and stop once enough payment has been found. Readers can see what each change saves without learning another application first.

Going to production now starts with the infrastructure beneath the app: hosted APIs, managed services, running a node and query layer, and building a custom indexing pipeline. It explains rollbacks before taking the oracle through contract deployment, frontend deployment and monitoring.

The oracle example gained Vercel and Cloudflare Blockfrost proxies, so the deployment exercise includes keeping the provider credential on the server. The lecture connects those deployment steps to stale reads, transaction confirmation, operational failures and future contract migration.

The onboarding entrance and AI-readable output became clearer (D4, #2087)

#2087 adds the onboarding welcome: who it is for, what it covers and where to start. It moves the nine design patterns into Advanced lecture 3, between Optimization and Higher assurance, so they become part of the learning path. The PR is stacked on the examples-CI work and remained open on Sunday.

The branch also fixes the generated Markdown consumed by coding assistants. Validator hashes are expanded into the output, and code snippets are resolved page by page. Two pages can use the same snippet expression while importing different source files; each now receives its own code. The preview workflow publishes llms.txt, llms-full.txt and individual Markdown pages to a review branch, making the generated material available before the onboarding reaches the published portal.

cardano-init proposed a simpler JSON flag (D3, #99)

Paulo's #99 replaces --format human|json with a global --json switch. Human-readable output remains the default; the JSON payload and schema_version stay the same. Scripts and agents using --format json would need to change their command line because the old option is removed.

The PR opened on Tuesday and had not merged by the October 25 cutoff. It is proposed work for this report, rather than part of the v0.3.0 release described last week.

SAIB joined the pledge (D1, #181)

Clark Alesna, CEO of SAIB Inc, signed through #181, bringing the merged pledge to 39 signatories.