w00c00 · w00c00 · Aug 10, 2026 · Aug 10, 2026
diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
@@ -113,6 +113,7 @@ jobs:
           PORT=4310 \
           STUDIO_DATA_DIR="$data_dir" \
           SILVERC_LATEST_BIN="$runtime/bin/silverc-latest" \
+          SILVERC_PREVIOUS_BIN="$runtime/bin/silverc-cb34aa5" \
           SILVERC_LEGACY_BIN="$runtime/bin/silverc-legacy" \
           KASCOV_PREFLIGHT_BIN="$runtime/bin/kascov-preflight" \
             "$node_bin" "$runtime/server/index.mjs" >"$log" 2>&1 &

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog
 
+## 0.2.8 — 2026-08-10
+
+- Updated the default SHA-256-pinned official SilverScript compiler to `6f9e078b1d8b5389212755183b592704de99fea5`; retained `cb34aa5` for Studio 0.2.7 reproducibility and `2a3961c` for older projects.
+- Added breaking-change findings for explicit scalar byte/integer conversions: runtime integers use checked `as byte`, while scalar bytes require an explicit `signed()` or `unsigned()` interpretation.
+- Added canonical v1 covenant descriptors to generated lifecycle and atomic `.ssinvite` packages, binding CAIP-2 network, program hash, covenant ID, ABI, state layout, and authorization principals. Legacy packages remain readable with a visible warning.
+- Added a complete TN10 Experimental Groth16 proof-release template with deterministic parameters, exact fixed-recipient value conservation, bounded fees, an operation builder, local preflight, bilingual UX, and mainnet fail-closed policy.
+- Added a pinned Kaspa x402 alpha interoperability profile and explicit admission gates instead of exposing its pre-current-syntax escrow as a deployable template.
+- Recompiled every built-in template against `6f9e078` and expanded regression coverage for compiler migration, descriptor tampering, CAIP-2 aliases, Groth16 package construction, and legacy-package compatibility.
+
+## 0.2.8 — 2026-08-10（中文）
+
+- 默认官方 SilverScript 编译器升级并固定到 `6f9e078b1d8b5389212755183b592704de99fea5`；保留 `cb34aa5` 复现 Studio 0.2.7 项目，并保留 `2a3961c` 复现更早项目。
+- 增加标量 byte/int 显式转换的破坏性变更提示：运行时整数使用带检查的 `as byte`，标量 byte 转整数必须明确选择 `signed()` 或 `unsigned()`。
+- 新生成的生命周期与原子 `.ssinvite` 操作包加入 canonical v1 Covenant Descriptor，绑定 CAIP-2 网络、程序哈希、Covenant ID、ABI、状态布局和授权主体；旧包仍可读取，但会醒目标出缺少描述符。
+- 增加完整的 TN10 Experimental Groth16 证明释放模板，包含确定性参数、固定收款方精确价值守恒、手续费上限、操作构建器、本地预检、中英双语界面和主网失效关闭策略。
+- 增加固定提交的 Kaspa x402 alpha 互操作档案与正式模板准入条件，没有把仍使用旧语法的上游托管合约直接伪装成可部署模板。
+- 使用 `6f9e078` 重新编译全部内置模板，并扩展编译迁移、描述符篡改、CAIP-2 别名、Groth16 操作包和旧包兼容回归测试。
+
 ## 0.2.7 — 2026-08-09
 
 - Raised Studio's conservative covenant-cell default and minimum to 0.5 KAS/TKAS, preventing storage-mass rejection when funding a small covenant from a large faucet or mining UTXO.

diff --git a/README.md b/README.md
@@ -35,8 +35,8 @@ AI 只负责生成候选方案和辅助审查，不能解锁钱包、签名交
 - 中英文界面；首次启动自动读取系统语言，并在系统语言既非中文也非英文时使用时区辅助判断。
 - 用户手动切换语言后，本机选择优先于自动识别。
 - 本地项目工作区，可创建、切换和删除未使用的工作。
-- 双编译器兼容档案：默认固定 `kaspanet/silverscript@cb34aa5e6a598f9e461c4ad7014279ba89251d8d`，并保留 `2a3961c` 旧版用于复现；两者都校验二进制 SHA-256。
-- 内置破坏性变更扫描与安全迁移，识别 `entry`、`checkMsgSig`、`outpointTxId`、artifact `bytecode` 等升级差异；无法安全自动迁移的 `.reverse()` 和位运算会要求人工审查。
+- 三编译器兼容档案：默认固定 `kaspanet/silverscript@6f9e078b1d8b5389212755183b592704de99fea5`，保留 Studio 0.2.7 使用的 `cb34aa5` 和 `2a3961c` 旧版用于复现；三个二进制都校验 SHA-256。
+- 内置破坏性变更扫描与安全迁移，识别 `entry`、`checkMsgSig`、`outpointTxId`、artifact `bytecode` 和显式标量 byte/int 转换；无法安全自动迁移的 signed/unsigned 语义、`.reverse()` 和位运算会要求人工审查。
 - 固定 Kascov 来源提交构建的本地交易预检引擎。
 - 支持 OpenAI、Anthropic、Gemini、OpenRouter、Ollama 和 OpenAI-compatible 接口。
 - AI API Key 使用 scrypt 派生密钥和 AES-256-GCM 加密保存在本机。
@@ -45,6 +45,7 @@ AI 只负责生成候选方案和辅助审查，不能解锁钱包、签名交
 - 支持 BIP39 附加密码；钱包密码和附加密码不会保存为普通偏好设置。
 - 支持 TN10 和 mainnet 自建 wRPC 节点，留空时使用公共节点发现。
 - 支持 `.ssinvite` 可携带操作包、跨设备顺序签名和外部 Covenant 交易包审查。
+- 新操作包携带 canonical v1 Covenant Descriptor，绑定 CAIP-2 网络、程序哈希、Covenant ID、ABI、状态布局和授权主体；旧包仍可读取但会标记缺少描述符。
 - 可替换 `CovenantStateSource` 会在原生 Covenant RPC、outpoint RPC 与 P2SH 地址索引之间回退，并重新验证 outpoint、Covenant ID、脚本和金额。
 - 通用 P2PK co-spend 授权只签指定普通钱包输入，并锁定整笔交易承诺；原子构建器支持 2–32 个不同 Covenant 输入。
 - Kascov 是首选可视化和第二份报告来源，但不是签名、预检或广播的运行依赖。
@@ -60,6 +61,7 @@ AI 只负责生成候选方案和辅助审查，不能解锁钱包、签名交
 | 多继承人签到金库 | 所有者签到、所有者取回、到期分配 | 多继承人资产安排和定期续期 |
 | Merkle 一次性领取（TN10 Experimental） | Merkle 证明领取、超时退款 | 白名单领取和一次性票据 |
 | Commit / Reveal（TN10 Experimental） | Reveal 领取、超时退款 | 域隔离承诺和密封交付 |
+| Groth16 证明释放（TN10 Experimental） | ZK 证明领取 | 可验证计算结果付款；收款钱包固定 |
 | KCC721 四契约包（TN10 Experimental） | Collection、Ticket、NFT、Migration | Covenant 原生 NFT 研究；禁止普通单合约部署 |
 
 每个模板都包含：
@@ -223,6 +225,7 @@ OLLAMA_MODEL=
 仅有 Covenant ID 或 cov hash 不足以签名。外部操作包必须携带待签交易、UTXO、redeem program、ABI、入口、参数、输出和签名槽信息。详见 [可携带 Covenant 操作包](docs/portable-covenant-package.md)。
 
 编译器升级、状态查询与原子授权接口见 [Studio 0.2 架构说明](docs/studio-0.2-architecture.md)。KCC721 包的来源、边界和禁止事项见 [TN10 Experimental KCC721](docs/kcc721-experimental.md)。
+Kaspa x402 的网络标识、操作包映射和正式模板准入条件见 [TN10 Experimental x402 档案](docs/x402-experimental-profile.md)。
 
 ### 网络
 
@@ -290,15 +293,16 @@ AI is limited to candidate generation and review assistance. It cannot unlock wa
 - Chinese and English UI with automatic system-language detection and time-zone fallback.
 - A manual language choice always overrides future automatic detection.
 - Local project workspace with explicit create, switch, and delete actions.
-- Dual compiler profiles: the default is pinned to `kaspanet/silverscript@cb34aa5e6a598f9e461c4ad7014279ba89251d8d`, while `2a3961c` remains available for reproducible legacy builds; both binaries are SHA-256 verified.
-- Built-in breaking-change detection and safe migration for `entry`, `checkMsgSig`, `outpointTxId`, and artifact `bytecode`; removed `.reverse()` and bitwise typing changes require manual review.
+- Three compiler profiles: the default is pinned to `kaspanet/silverscript@6f9e078b1d8b5389212755183b592704de99fea5`; Studio 0.2.7's `cb34aa5` and legacy `2a3961c` remain reproducible, with SHA-256 verification for all binaries.
+- Built-in breaking-change detection and safe migration for `entry`, `checkMsgSig`, `outpointTxId`, artifact `bytecode`, and explicit scalar byte/int conversions; signedness, removed `.reverse()`, and bitwise typing changes require manual review.
 - Pinned Kascov-derived local transaction preflight engine.
 - OpenAI, Anthropic, Gemini, OpenRouter, Ollama, and OpenAI-compatible providers.
 - AES-256-GCM encrypted AI key vault with a scrypt-derived key.
 - Encrypted local wallet with create, import, balance, receive, send, disconnect, and per-transaction signing.
 - One-time mnemonic display and optional BIP39 passphrase support.
 - Direct TN10 and mainnet self-hosted wRPC endpoints with public-node discovery fallback.
 - Portable `.ssinvite` operation packages, sequential cross-device signing, and external covenant-package review.
+- Canonical v1 covenant descriptors bind each new package to its CAIP-2 network, program hash, covenant ID, ABI, state layout, and authorization principals; legacy packages remain readable with a visible missing-descriptor warning.
 - Replaceable `CovenantStateSource` fallback across native covenant RPC, outpoint RPC, and P2SH address indexing, with independent outpoint, covenant ID, script, and value verification.
 - Generic isolated P2PK co-spend authorization plus an atomic builder for 2–32 distinct covenant inputs.
 - Kascov is the preferred visual and secondary-report layer, not a signing, preflight, or broadcast dependency.
@@ -314,6 +318,7 @@ AI is limited to candidate generation and review assistance. It cannot unlock wa
 | Multi-inheritor check-in vault | Owner check-in, owner recovery, mature distribution | Inheritance planning with periodic renewal |
 | Merkle one-time claim (TN10 Experimental) | Merkle proof claim, timeout refund | Allowlists and single-use tickets |
 | Commit / reveal (TN10 Experimental) | Reveal claim, timeout refund | Domain-separated commitments and sealed delivery |
+| Groth16 proof release (TN10 Experimental) | ZK proof claim | Verifiable-computation payment to a fixed recipient |
 | Four-contract KCC721 pack (TN10 Experimental) | Collection, Ticket, NFT, Migration | Covenant-native NFT research; standalone deployment is blocked |
 
 Every template includes bilingual parameter forms and examples, deterministic constructor encoding, full compile verification, per-entrypoint transaction plans, and matching post-deployment builders.
@@ -451,6 +456,7 @@ Never have multiple signers sign separate initial copies. Compare the transactio
 A covenant ID or cov hash alone is not a signing request. An external package must include the exact transaction, UTXOs, redeem program, ABI, entrypoint, arguments, outputs, and signature slots. See [Portable covenant packages](docs/portable-covenant-package.md).
 
 See [Studio 0.2 architecture](docs/studio-0.2-architecture.md) for compiler upgrades, state sources, P2PK authorization, and atomic transaction APIs. See [TN10 Experimental KCC721](docs/kcc721-experimental.md) for provenance, boundaries, and prohibited release claims.
+See the [TN10 Experimental x402 profile](docs/x402-experimental-profile.md) for network identifiers, operation-package mapping, and executable-template admission gates.
 
 ### Networks
 

diff --git a/config/compiler-profiles.json b/config/compiler-profiles.json
@@ -1,24 +1,41 @@
 {
-  "defaultProfileId": "latest-cb34aa5",
+  "defaultProfileId": "latest-6f9e078",
   "profiles": [
     {
-      "id": "latest-cb34aa5",
-      "label": "SilverScript latest (cb34aa5)",
-      "upstreamCommit": "cb34aa5e6a598f9e461c4ad7014279ba89251d8d",
+      "id": "latest-6f9e078",
+      "label": "SilverScript latest (6f9e078)",
+      "upstreamCommit": "6f9e078b1d8b5389212755183b592704de99fea5",
       "binary": "bin/silverc-latest",
       "artifactBytecodeField": "bytecode",
       "syntaxGeneration": 2,
       "status": "experimental",
       "networkPolicy": "tn10-only",
-      "releasedAt": "2026-08-09",
+      "releasedAt": "2026-08-10",
       "notes": [
         "Uses entry syntax for public entrypoints",
         "Exposes transaction introspection as outpointTxId",
         "Uses checkMsgSig for arbitrary-message signatures",
         "Compiler JSON calls the emitted program bytecode",
         "Rejects duplicate function names and entry parameters that shadow contract fields",
         "Restricts ordered comparisons to numeric operands",
-        "Adds the variable-input g16.verify Groth16 verifier builtin"
+        "Adds the variable-input g16.verify Groth16 verifier builtin",
+        "Requires explicit signed(byte) or unsigned(byte) scalar conversion",
+        "Uses value as byte for checked runtime integer-to-byte conversion"
+      ]
+    },
+    {
+      "id": "latest-cb34aa5",
+      "label": "SilverScript previous (cb34aa5)",
+      "upstreamCommit": "cb34aa5e6a598f9e461c4ad7014279ba89251d8d",
+      "binary": "bin/silverc-cb34aa5",
+      "artifactBytecodeField": "bytecode",
+      "syntaxGeneration": 2,
+      "status": "previous",
+      "networkPolicy": "tn10-only",
+      "releasedAt": "2026-08-09",
+      "notes": [
+        "Retained to reproduce Studio 0.2.7 projects",
+        "Allows the pre-6f9e078 scalar byte conversion behavior"
       ]
     },
     {
@@ -43,7 +60,7 @@
       "severity": "error",
       "introducedBy": "0f99803",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-cb34aa5",
+      "toProfile": "latest-6f9e078",
       "pattern": "\\bentrypoint\\s+function\\b",
       "messageZh": "公开入口语法已从 entrypoint function 改为 entry。",
       "messageEn": "Public entrypoint syntax changed from entrypoint function to entry.",
@@ -54,7 +71,7 @@
       "severity": "error",
       "introducedBy": "782a4d7",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-cb34aa5",
+      "toProfile": "latest-6f9e078",
       "pattern": "\\bcheckSigFromStack\\b",
       "messageZh": "任意消息签名内建函数已改名为 checkMsgSig。",
       "messageEn": "The arbitrary-message signature builtin was renamed to checkMsgSig.",
@@ -65,7 +82,7 @@
       "severity": "error",
       "introducedBy": "65421cf",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-cb34aa5",
+      "toProfile": "latest-6f9e078",
       "pattern": "\\.outpointTransactionHash\\b",
       "messageZh": "输入 outpoint 字段已改名为 outpointTxId。",
       "messageEn": "The input outpoint field was renamed to outpointTxId.",
@@ -76,7 +93,7 @@
       "severity": "error",
       "introducedBy": "6869e7d",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-cb34aa5",
+      "toProfile": "latest-6f9e078",
       "pattern": "\\.reverse\\s*\\(",
       "messageZh": ".reverse() 已删除，必须显式重写字节顺序逻辑并重新测试。",
       "messageEn": ".reverse() was removed; rewrite byte ordering explicitly and retest it.",
@@ -87,7 +104,7 @@
       "severity": "integration",
       "introducedBy": "4d88ded",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-cb34aa5",
+      "toProfile": "latest-6f9e078",
       "pattern": null,
       "messageZh": "编译产物 JSON 字段由 script 改为 bytecode；外部工具必须兼容两个字段。",
       "messageEn": "The compiler artifact JSON field changed from script to bytecode; integrations must support both.",
@@ -98,7 +115,7 @@
       "severity": "manual-review",
       "introducedBy": "8b74812",
       "fromProfile": "legacy-2a3961c",
-      "toProfile": "latest-cb34aa5",
+      "toProfile": "latest-6f9e078",
       "pattern": "(?:^|[^&|])(?:<<|>>|\\^|&|\\|)(?:[^&|]|$)",
       "messageZh": "位运算现在仅接受 bytes；请人工确认操作数类型。",
       "messageEn": "Bitwise operators now accept bytes only; review operand types manually.",

diff --git a/docs/kcc721-experimental.md b/docs/kcc721-experimental.md
@@ -6,7 +6,7 @@ Studio 内置的 KCC721 包改编自 `KaspaHUB21/KCC721` v0.2 社区草案，保
 
 本包只允许 `tn10`，风险等级为 `high-experimental`。普通单 Covenant 部署路径被明确禁用，因为 Collection/Ticket/NFT 创世需要专用的多合约 builder 正确计算模板片段、模板哈希、Covenant ID 和 output binding。当前完成的是：
 
-- 四份源码在官方 `silverc@cb34aa5` 下完整编译。
+- 四份源码在官方 `silverc@6f9e078` 下完整编译。
 - 模板使用三步配置向导，不再要求用户手填元数据摘要。名称、描述、图片 URI、外部链接和属性会先规范化为确定性 JSON，再由前后端分别计算并核对 SHA-256。
 - “新集合”明确标记为编译预览，内部使用不可部署的全零哨兵；只有“导入已有 TN10 集合”模式接受从真实创世输出核验的 Collection Covenant ID。
 - NFT 所有者变更绑定独立 P2PK co-spend 输入。
@@ -34,7 +34,7 @@ The bundled KCC721 pack is adapted from the community `KaspaHUB21/KCC721` v0.2 d
 
 The pack is restricted to `tn10` and marked `high-experimental`. Ordinary single-covenant deployment is explicitly blocked because Collection/Ticket/NFT genesis requires a dedicated multi-contract builder to calculate template segments, template hashes, covenant IDs, and output bindings correctly. The current implementation provides:
 
-- Full compilation of all four sources with official `silverc@cb34aa5`.
+- Full compilation of all four sources with official `silverc@6f9e078`.
 - A three-step setup wizard that no longer asks users to type a metadata digest. Name, description, image URI, external URL, and attributes are canonicalized into deterministic JSON, then SHA-256 is independently recomputed by the client and server.
 - A clearly labeled new-collection compile preview with a non-deployable internal all-zero sentinel. Only the existing-TN10-collection path accepts a Collection covenant ID verified from a real genesis output.
 - NFT ownership transitions bound to a separate P2PK co-spend input.

diff --git a/docs/portable-covenant-package.md b/docs/portable-covenant-package.md
@@ -10,6 +10,7 @@ version-1 交易包。
 {
   "version": 1,
   "network": "tn10",
+  "networkCaip2": "kaspa:testnet-10",
   "transactionSafeJson": "{...Kaspa Transaction Safe JSON...}",
   "covenantInput": {
     "index": 0,
@@ -28,7 +29,20 @@ version-1 交易包。
         "kind": "signature",
         "publicKey": "32-byte x-only public key"
       }
-    ]
+    ],
+    "descriptor": {
+      "schema": "kaspa-covenant-descriptor",
+      "version": 1,
+      "profileId": "producer/template/v1",
+      "network": "kaspa:testnet-10",
+      "programSha256": "32-byte hex",
+      "covenantId": "32-byte hex",
+      "abi": { "encoding": "silverscript-json-abi/v1", "sha256": "32-byte hex" },
+      "state": { "encoding": "silverscript-state-layout/v1", "sha256": "32-byte hex" },
+      "controlPrincipals": [],
+      "authorizationPrincipals": []
+    },
+    "descriptorSha256": "canonical descriptor SHA-256"
   },
   "provenance": {
     "kind": "producer-defined",
@@ -46,6 +60,15 @@ the complete transaction.
 当前支持 `sig`、`pubkey`、`int`、`bool`、`byte[]` 和 `byte[N]` 参数。`sig`
 参数代表签名槽；多个本地客户端可以依次导入同一个包并填充自己的签名槽。
 
+New Studio packages include a canonical version-1 descriptor. It binds the CAIP-2
+network, program, covenant ID, ABI, state layout, and recognized principal profiles.
+Unknown principal profiles fail closed. Older packages without a descriptor remain
+readable but are visibly marked as legacy and require stronger independent review.
+
+Studio 新生成的包包含 canonical v1 描述符，绑定 CAIP-2 网络、程序、Covenant ID、ABI、
+状态布局和已识别的主体类型。未知主体 profile 会失效关闭。没有描述符的旧包仍可读取，
+但会明确标成旧版，并要求更严格的独立核对。
+
 ## Why covenant ID alone is insufficient / 为什么只有 covenant ID 不够
 
 A covenant ID identifies a covenant domain, but it does not describe the transaction