Week 45 · 2026

Highlights

cardano-init added six tools and smoke-tests every one (D3, #109–#124)

Four new templates merged during the week, each implementing the shared gift-card example against the common blueprint and .env:

• Lucid Evolution and Blaze (TypeScript, off-chain), by Paulo Bressan.
• Plutarch (Haskell, on-chain), pinned to v1.15.0 on GHC 9.8. Plutarch has no blueprint output, so the template generates one the same way as Plinth. The PR also fixed doctor, which had reported Plutarch projects as Plinth.
• PyCardano (Python, off-chain), marked experimental.

Two more, Apollo (Go, off-chain) and Pebble (on-chain, experimental), were opened during the week and merged on Monday, November 9. With them the registry grows from 15 to 21 tools. Pebble needed two workarounds: it emits no blueprint, and MeshJS can't decode the newest builtins it would otherwise compile to. Running Pebble scripts in the Scalus emulator also required bumping Scalus to 1.4.1, whose emulator defaults to protocol version 11.

CI now covers every DApp tool. #121 extends the smoke tests to 16 tool rows and doubles the devnet round trips to 8, so Plinth, Plutarch and Scalus now mint and redeem on a real Yaci devnet. CI also fails if a new tool is registered without a smoke test. #119 runs the checks for the tools a pull request touches on the PR itself, rather than only in the scheduled runs.

The devnet work also uncovered the following fixes:

• The MeshJS devnet smoke had been red since October 27. #110 works around a Mesh provider that rejected Yaci's HTTP 200 responses, and fetches the chain's cost models instead of using Mesh's defaults. Both provider fixes are already upstream in MeshJS; the local shim goes once they are released.
• doctor now catches missing and outdated tools. It requires the yaci-devkit CLI for Yaci projects (#117) and, with #123, checks minimum versions. An old Yaci DevKit used to pass doctor and then time out 150 seconds into the test.
• Devnet teardown stops everything. #124 stops the whole process group, where previously yaci-cli and the node could keep running after just test or a Ctrl-C.

Robertino Martinez's #120 groups list by role and adds optional tool icons for terminals that can draw them.

#123 and #124 merged on Monday after the cutoff. All of this shipped in v0.4.0 on Tuesday, November 10.

The contracts library closed its security findings (D5, #75–#83)

The code-quality pass from last week moved into its security phase. Five more PRs merged into the improve-code-quality integration branch. Its PR to main, #61, was still open on Sunday.

• DAO: double voting and tally spoofing (#76). A fresh vote lock could be pruned when the transaction's upper bound equalled the voting deadline, letting the same stake vote twice on one proposal. Tallies now count only votes spent with the tally redeemer, so a cancelled vote can't be counted.
• Settings: no more backdated proposals (#75). The apply delay is now measured from the proposal's validity upper bound, which the ledger forces to cover the slot where it lands. Last week this was documented as a constraint.
• Smart wallet: delegation hijack (#81). A Spend could swap the wallet's stake credential while keeping everything else. It now must keep the full address, as Deposit already did. This is the same class of bug fixed in vesting last week.
• Reference-script griefing across contracts (#79, #81). Permissionless top-ups and deposits could attach an arbitrary script to the bond vault or the wallet, making later spends more expensive. All five contracts now forbid it.
• Cheaper checks (#83). Comparing Data directly instead of through CBOR serialization cut up to 3.1M CPU units per smart-wallet spend, with no behavior change.

Each fix ships regression tests and spec updates, and was verified with aiken check at 1,000 samples plus the MeshJS and Tx3 devnet suites. The affected script hashes changed. Sofia Bobbiesi's #87, opened on Sunday, makes CI run on the integration branch and pick up every test file. So far, PRs into that branch have run no checks.

The vesting hardening described last week, #72, merged on Monday, November 2.

Upgradeability merged with forwarding for every script purpose (D5, #57, #85)

Upgradeability merged on Sunday. It went in together with #85, which addresses its review:

• Forced forwarding now covers spend, mint, withdraw, publish and vote, not only spending. The delegate checks every item routed to it and rejects any kind it doesn't handle.
• Delegates may register a stake credential but not deregister it.
• The demo shows datum evolution: the new logic reads both the old and new datum shapes and writes the new one.
• The reusable library is split from the counter demo, on-chain and in MeshJS.

The guide now covers the exit window, registering delegates before repointing, one settings instance per protocol, and when to choose forced forwarding over opt-in migration.

A documentation site for the library, #78, opened on Thursday. It renders each contract's spec and usage guide with transaction diagrams and an llms.txt, without copying the canonical documents. Upgradeability is left for a follow-up.

Dijkstra readiness: Ledger hardware wallets and Aiken diagnosed (D1, #188)

Ledger signing doesn't break wholesale, but several narrower paths do. The ledgerjs diagnosis ran 27 assertions against the unmodified library and 62 CLI decode observations from node 11.2.0:

• Legacy certificates. Stake registration with the legacy certificates still signs, then fails under Dijkstra. Wallets need to use the newer certificates with an explicit deposit.
• New fields silently dropped. Dijkstra's new transaction fields and script guards can't be represented by the current host and device protocol. The library drops them without an error, so a device can sign a different body from the one intended.
• Wallet-side encodings. List-form redeemers and duplicate witnesses are newly rejected. These are wallet serializer fixes, not device fixes.

The findings were reported upstream on Friday as ledgerjs-hw-app-cardano#58. No physical device or firmware emulator was tested.

An Aiken diagnostic guide separates two tracks. Existing V3 validators are not invalidated by Dijkstra, but transaction decoding, evaluator agreement and execution budgets still need checking on the real node. V4 authoring is new work: Aiken currently rejects plutus = "v4". An offline smoke runner ships with it.

The scheduled readiness refresh failed on November 3, when 6 of 48 tools couldn't be rebuilt. Both causes were in the CI toolchain, not the data: three Go repos now need Go 1.26.10, and parallel Rust version checks raced each other. #188 fixes both; it opened on Saturday and merged on Wednesday, November 11.