TxPlan (YAML) transaction building + Plutus + on-chain validation; toolchain & CI modernization

.github/workflows/ci.yml

@@ -1,9 +1,9 @@
 name: CI
 on:
   push:
-    branches: [main]
+    branches: [main, develop]
   pull_request:
-    branches: [main]
+    branches: [main, develop]
 
 jobs:
   test:
@@ -19,11 +19,15 @@ jobs:
       - uses: actions/checkout@v4
       - uses: graalvm/setup-graalvm@v1
         with:
-          java-version: '25'
+          java-version: '25.0.3'
           distribution: 'graalvm'
       - uses: oven-sh/setup-bun@v2
-      - name: Install pytest
-        run: python3 -m pip install --break-system-packages pytest
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install Python test deps
+        run: python3 -m pip install --break-system-packages pytest pyyaml
       - name: Build native library
         run: ./gradlew :core:nativeCompile
       - name: Run JVM tests
@@ -38,3 +42,22 @@ jobs:
         run: ./gradlew :wrappers:rust:test
       - name: Run JS tests
         run: ./gradlew :wrappers:js:test
+
+  # Windows: verify the native library (libccl.dll) builds and core logic passes.
+  # Wrapper test coverage on Windows (Go cgo, C Makefile, etc.) is tracked separately
+  # in TODO.md.
+  windows:
+    runs-on: windows-latest
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@v4
+      - uses: graalvm/setup-graalvm@v1
+        with:
+          java-version: '25.0.3'
+          distribution: 'graalvm'
+      - name: Build native library (libccl.dll)
+        run: ./gradlew :core:nativeCompile
+      - name: Run JVM tests
+        run: ./gradlew :core:test

.github/workflows/integration-tests.yml

@@ -0,0 +1,76 @@
+name: Integration Tests (DevKit)
+
+# Runs the wrappers' integration tests against a local Yaci DevKit Cardano devnet.
+# These exercise real build -> sign -> submit round trips. The devnet's admin API is
+# exposed on :10000. Heavier than the unit CI, so it runs on PRs to main/develop and on demand.
+on:
+  pull_request:
+    branches: [main, develop]
+  workflow_dispatch:
+
+jobs:
+  integration-tests:
+    name: Integration Tests (Cardano Dev-Net)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: graalvm/setup-graalvm@v1
+        with:
+          java-version: '25.0.3'
+          distribution: 'graalvm'
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 'stable'
+      - uses: dtolnay/rust-toolchain@stable
+      # Node.js is needed for the npm-based yaci-devkit CLI.
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - name: Install Python test deps
+        run: python3 -m pip install --break-system-packages pytest pyyaml
+
+      - name: Install Yaci DevKit
+        run: npm install -g @bloxbean/yaci-devkit
+
+      # Start the devnet in the background; it warms up while the native lib builds.
+      - name: Start Yaci DevKit
+        run: nohup yaci-devkit up --enable-yaci-store > devkit.log 2>&1 &
+
+      - name: Build native library
+        run: ./gradlew :core:nativeCompile
+
+      - name: Wait for DevKit admin API (:10000)
+        run: |
+          echo "Waiting for Yaci DevKit admin API..."
+          for i in $(seq 1 60); do
+            if curl -sf http://localhost:10000/local-cluster/api/admin/devnet >/dev/null 2>&1; then
+              echo "DevKit is ready (attempt $i)."
+              exit 0
+            fi
+            echo "Attempt $i/60 - not ready yet, waiting 5s..."
+            sleep 5
+          done
+          echo "DevKit did not become ready in time." >&2
+          exit 1
+
+      - name: Python integration tests
+        run: ./gradlew :wrappers:python:integrationTest
+
+      # The Go and Rust test tasks already include their integration tests, which
+      # skip themselves when DevKit is down and run when it is up.
+      - name: Go integration tests
+        run: ./gradlew :wrappers:go:test
+
+      - name: Rust integration tests
+        run: ./gradlew :wrappers:rust:test
+
+      - name: JS integration tests
+        run: ./gradlew :wrappers:js:integrationTest
+
+      - name: Upload DevKit log on failure
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: devkit-log
+          path: devkit.log

.github/workflows/portable-linux-lib.yml

@@ -0,0 +1,116 @@
+name: Portable Linux lib (glibc baseline)
+
+# Guards the distro-portability of the shipped libccl.so. native-image can't emit a static library
+# (oracle/graal#3053), so portability is achieved by building the .so against an OLD glibc baseline:
+# inside manylinux_2_28 the resulting lib references no symbol newer than GLIBC_2.17, so it runs on
+# RHEL/CentOS 7+, Amazon Linux 2, Ubuntu 18.04+, Debian 9+ and every newer distro. See
+# docs/adr/0008-linux-glibc-baseline-portability.md. This builds it, asserts the glibc floor, proves it
+# actually runs on glibc 2.17 (centos:7) — catching any regression that pulls in a newer symbol.
+
+on:
+  pull_request:
+  push:
+    branches: [develop, main]
+  workflow_dispatch:
+
+jobs:
+  glibc-baseline:
+    name: Build libccl.so on glibc 2.28 baseline (manylinux_2_28)
+    runs-on: ubuntu-latest
+    container:
+      image: quay.io/pypa/manylinux_2_28_x86_64
+    env:
+      GRAALVM_URL: https://download.oracle.com/graalvm/25/archive/graalvm-jdk-25.0.3_linux-x64_bin.tar.gz
+      # The guarantee: the .so must require no glibc symbol newer than the builder's glibc (2.28).
+      # (In practice native-image tops out at 2.17 — the centos:7 job below enforces that strictly.)
+      BASELINE: "2.28"
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Show build-container glibc
+        run: ldd --version | head -1
+
+      - name: Ensure build prerequisites (gcc toolset, zlib headers)
+        run: |
+          set -eux
+          gcc --version | head -1 || dnf install -y gcc
+          dnf install -y zlib-devel || true
+
+      - name: Install Oracle GraalVM 25.0.3
+        run: |
+          set -eux
+          mkdir -p /opt/graalvm
+          curl -fsSL -o /tmp/graalvm.tar.gz "$GRAALVM_URL"
+          tar xzf /tmp/graalvm.tar.gz -C /opt/graalvm --strip-components=1
+          echo "JAVA_HOME=/opt/graalvm" >> "$GITHUB_ENV"
+          echo "/opt/graalvm/bin" >> "$GITHUB_PATH"
+
+      - name: Toolchain versions
+        run: |
+          set -eux
+          "$JAVA_HOME/bin/java" -version
+          "$JAVA_HOME/bin/native-image" --version
+
+      - name: Build native library
+        run: ./gradlew :core:nativeCompile --no-daemon --stacktrace
+
+      - name: Assert glibc floor (<= 2.28)
+        run: |
+          set -eux
+          SO=core/build/native/nativeCompile/libccl.so
+          test -f "$SO"
+          objdump -T "$SO" | grep -oE 'GLIBC_[0-9]+\.[0-9]+(\.[0-9]+)?' | sort -uV > /tmp/syms.txt
+          echo "---- GLIBC symbol versions required ----"; cat /tmp/syms.txt
+          MAX=$(sed 's/GLIBC_//' /tmp/syms.txt | sort -V | tail -1)
+          echo "---- Max required: GLIBC_$MAX (guarantee: <= $BASELINE) ----"
+          HIGHER=$(printf '%s\n%s\n' "$MAX" "$BASELINE" | sort -V | tail -1)
+          if [ "$HIGHER" != "$BASELINE" ]; then
+            echo "FAIL: libccl.so requires GLIBC_$MAX, newer than baseline GLIBC_$BASELINE"
+            exit 1
+          fi
+          echo "PASS: libccl.so runs on any system with glibc >= $MAX"
+
+      - name: Compile the smoke harness against libccl.so
+        run: |
+          set -eux
+          ND=core/build/native/nativeCompile
+          gcc native-test/src/smoke.c -I"$ND" -L"$ND" -lccl -Wl,-rpath,'$ORIGIN' -o "$ND/smoke"
+
+      - name: Stage runnable artifact (lib + harness together)
+        run: |
+          set -eux
+          mkdir -p dist
+          cp core/build/native/nativeCompile/libccl.so dist/
+          cp core/build/native/nativeCompile/smoke dist/
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: libccl-glibc-baseline
+          path: dist/
+
+  run-on-old-distro:
+    name: Run libccl.so on glibc 2.17 (centos:7)
+    needs: glibc-baseline
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: libccl-glibc-baseline
+          path: dist
+
+      # Run the prebuilt binary inside centos:7 (glibc 2.17) WITHOUT installing anything. This is a
+      # strict run-on-2.17 guard: if some change pushes the required glibc above 2.17, the loader
+      # here fails. We don't use a `container:` for the job because GitHub's node-based actions can't
+      # run inside glibc 2.17; `docker run` keeps the actions on the modern runner.
+      - name: Load + run on centos:7
+        run: |
+          set -eux
+          chmod +x dist/smoke
+          docker run --rm -v "$PWD/dist:/work" -w /work centos:7 bash -c '
+            set -eux
+            ldd --version | head -1
+            echo "---- libccl.so shared-lib deps on this host ----"
+            ldd ./libccl.so
+            echo "---- running harness ----"
+            ./smoke
+          '

.github/workflows/release.yml

@@ -4,37 +4,86 @@ on:
     tags: ['v*']
 
 jobs:
-  build:
+  # macOS + Windows: stable ABIs, no glibc-portability concern. Built on the native runner.
+  build-native:
     strategy:
       matrix:
         include:
           - os: macos-14
             platform: macos-aarch64
             ext: dylib
-          - os: ubuntu-latest
-            platform: linux-x86_64
-            ext: so
+          - os: windows-latest
+            platform: windows-x86_64
+            ext: dll
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
       - uses: graalvm/setup-graalvm@v1
         with:
-          java-version: '25'
+          java-version: '25.0.3'
           distribution: 'graalvm'
       - name: Build native library
         run: ./gradlew :core:nativeCompile
       - name: Package
+        shell: bash
         run: |
           cd core/build/native/nativeCompile
+          # On Windows native-image also emits an import library (libccl.lib) needed
+          # to link against the DLL; include it when present.
+          EXTRA=""
+          [ -f libccl.lib ] && EXTRA="libccl.lib"
           tar czf ccl-bridge-${{ github.ref_name }}-${{ matrix.platform }}.tar.gz \
-            libccl.${{ matrix.ext }} libccl.h graal_isolate.h
+            libccl.${{ matrix.ext }} libccl.h graal_isolate.h $EXTRA
       - uses: actions/upload-artifact@v4
         with:
           name: ccl-bridge-${{ matrix.platform }}
           path: core/build/native/nativeCompile/ccl-bridge-*.tar.gz
 
+  # Linux: built in an OLD-glibc container (manylinux_2_28) so the shipped libccl.so runs on
+  # glibc >= 2.17 (RHEL/CentOS 7+, Amazon Linux 2, Ubuntu 18.04+, Debian 9+) instead of only the
+  # very newest distros. Portability is verified continuously by portable-linux-lib.yml; here we
+  # re-assert the floor before shipping. See docs/adr/0008-linux-glibc-baseline-portability.md.
+  build-linux:
+    name: build (linux-x86_64, glibc 2.17 baseline)
+    runs-on: ubuntu-latest
+    container:
+      image: quay.io/pypa/manylinux_2_28_x86_64
+    env:
+      GRAALVM_URL: https://download.oracle.com/graalvm/25/archive/graalvm-jdk-25.0.3_linux-x64_bin.tar.gz
+    steps:
+      - uses: actions/checkout@v4
+      - name: Ensure build prerequisites
+        run: dnf install -y zlib-devel || true
+      - name: Install Oracle GraalVM 25.0.3
+        run: |
+          set -eux
+          mkdir -p /opt/graalvm
+          curl -fsSL -o /tmp/graalvm.tar.gz "$GRAALVM_URL"
+          tar xzf /tmp/graalvm.tar.gz -C /opt/graalvm --strip-components=1
+          echo "JAVA_HOME=/opt/graalvm" >> "$GITHUB_ENV"
+          echo "/opt/graalvm/bin" >> "$GITHUB_PATH"
+      - name: Build native library
+        run: ./gradlew :core:nativeCompile --no-daemon --stacktrace
+      - name: Assert glibc floor (<= 2.28)
+        run: |
+          set -eux
+          SO=core/build/native/nativeCompile/libccl.so
+          MAX=$(objdump -T "$SO" | grep -oE 'GLIBC_[0-9]+\.[0-9]+(\.[0-9]+)?' | sed 's/GLIBC_//' | sort -V | tail -1)
+          echo "libccl.so max required: GLIBC_$MAX"
+          HIGHER=$(printf '%s\n2.28\n' "$MAX" | sort -V | tail -1)
+          [ "$HIGHER" = "2.28" ] || { echo "FAIL: requires GLIBC_$MAX > 2.28"; exit 1; }
+      - name: Package
+        run: |
+          cd core/build/native/nativeCompile
+          tar czf ccl-bridge-${{ github.ref_name }}-linux-x86_64.tar.gz \
+            libccl.so libccl.h graal_isolate.h
+      - uses: actions/upload-artifact@v4
+        with:
+          name: ccl-bridge-linux-x86_64
+          path: core/build/native/nativeCompile/ccl-bridge-*.tar.gz
+
   release:
-    needs: build
+    needs: [build-native, build-linux]
     runs-on: ubuntu-latest
     permissions:
       contents: write

CLAUDE.md

@@ -4,4 +4,4 @@
 
 - **Cardano Client Lib (CCL)**: https://github.com/bloxbean/cardano-client-lib
 - **Local CCL source**: `/Users/satya/work/bloxbean/reference/cardano-client-lib`
-- **Target CCL version**: 0.7.1
+- **Target CCL version**: 0.8.0-pre4

README.md

@@ -50,7 +50,7 @@ ccl-bridge/
 **For core developers** (building from source):
 - **[GraalVM 25+](https://www.graalvm.org/)** (includes `native-image`)
   ```bash
-  sdk install java 25.0.2-graal   # via SDKMAN
+  sdk install java 25.0.3-graal   # Oracle GraalVM, via SDKMAN
   ```
 
 **Language runtimes (install whichever you need):**
@@ -138,6 +138,11 @@ curl -L https://github.com/bloxbean/ccl-bridge/releases/latest/download/ccl-brid
 curl -L https://github.com/bloxbean/ccl-bridge/releases/latest/download/ccl-bridge-v0.1.0-linux-x86_64.tar.gz | tar xz -C /usr/local/lib/
 ```
 
+> The Linux `libccl.so` is built against an old **glibc 2.17** baseline (in a `manylinux_2_28`
+> container), so it runs on any glibc ≥ 2.17 — RHEL/CentOS 7+, Amazon Linux 2, Ubuntu 18.04+,
+> Debian 9+, and all newer distros. (It does **not** run on musl-only systems such as Alpine; a
+> musl variant is a possible future addition.) See [ADR-0008](docs/adr/0008-linux-glibc-baseline-portability.md) for the why.
+
 Then set the library path:
 
 ```bash
@@ -396,8 +401,8 @@ bridge.close();
 
 ## Upstream
 
-- **Cardano Client Lib**: [bloxbean/cardano-client-lib](https://github.com/bloxbean/cardano-client-lib) v0.7.1
-- **GraalVM**: 25.0.2 (`native-image --shared`)
+- **Cardano Client Lib**: [bloxbean/cardano-client-lib](https://github.com/bloxbean/cardano-client-lib) v0.8.0-pre4
+- **GraalVM**: Oracle GraalVM 25.0.3 (`native-image --shared`)
 
 ## License