Upstream contracts + v0.16 alpha

.agents/skills/smoke-test-rust-multisig-sdk/SKILL.md

@@ -39,9 +39,9 @@ Record the returned commitment — you'll paste it into the demo's "GUARDIAN com
 2. Declare the published crates as registry dependencies pinned to the release under test:
    ```toml
    [dependencies]
-   miden-multisig-client = "0.15.1"
-   guardian-client       = "0.15.1"
-   miden-client          = "0.15.0"
+   miden-multisig-client = "0.16.0"
+   guardian-client       = "0.16.0"
+   miden-client          = "=0.16.0-alpha.1"
    tokio                 = { version = "1", features = ["full"] }
    ```
 3. Port or copy the exact menu/action code from `examples/demo/src/` into that scratch project. Keep the prompts identical so the workflows in `references/workflow-matrix.md` still apply verbatim.

.agents/skills/smoke-test-ts-multisig-sdk/SKILL.md

@@ -36,9 +36,9 @@ If the commitment does not round-trip into `status().multisig.guardianPubkey` af
    ```json
    {
      "dependencies": {
-       "@openzeppelin/miden-multisig-client": "0.15.1",
-       "@openzeppelin/guardian-client": "0.15.1",
-       "@miden-sdk/miden-sdk": "0.15.0"
+       "@openzeppelin/miden-multisig-client": "0.16.0",
+       "@openzeppelin/guardian-client": "0.16.0",
+       "@miden-sdk/miden-sdk": "0.16.0-alpha.1"
      }
    }
    ```

.github/workflows/ci.yml

@@ -27,11 +27,13 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@351f82a4dc29e4159746a068ed925da17341219f # 1.89.0
         with:
-          toolchain: 1.93.0
+          toolchain: 1.96.1
           components: llvm-tools-preview
 
       - name: Install system dependencies
@@ -82,6 +84,122 @@ jobs:
           fail_ci_if_error: true
           token: ${{ secrets.CODECOV_TOKEN }}
 
+  contract-behavior:
+    # MockChain behavior suite for the upstream guarded-multisig component
+    # (crates/contracts/tests/) plus the multisig client's integration tests.
+    # These live in tests/ directories, which the coverage job's `--lib` run
+    # never executes — without this job the contract authentication paths
+    # (update signers, per-procedure thresholds, guardian rotation, replay
+    # protection) have no CI coverage at all.
+    name: Contract Behavior Tests
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'OpenZeppelin'
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@351f82a4dc29e4159746a068ed925da17341219f # 1.89.0
+        with:
+          toolchain: 1.96.1
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libpq-dev
+
+      - name: Cache cargo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-contracts-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-contracts-
+
+      - name: Run contract behavior and SDK integration tests
+        run: cargo test -p miden-confidential-contracts -p miden-multisig-client --all-targets
+
+  ts-sdk:
+    # Cross-SDK parity gates for the TypeScript multisig client. The vitest
+    # suite pins PROCEDURE_ROOTS against the Rust `procedure_roots` example
+    # output and the vendored MASM against its generated constant; the
+    # Playwright run is the byte-for-byte account-determinism gate (TS-built
+    # account id/commitment == Rust builder). A miden-standards or
+    # @miden-sdk/miden-sdk bump that shifts procedure roots or storage layout
+    # fails here instead of stranding deployed accounts silently.
+    name: TypeScript SDK Tests
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'OpenZeppelin'
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
+        with:
+          egress-policy: audit
+
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@351f82a4dc29e4159746a068ed925da17341219f # 1.89.0
+        with:
+          toolchain: 1.96.1
+
+      - name: Install system dependencies
+        run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libpq-dev
+
+      - name: Cache cargo
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/git
+            target
+          key: ${{ runner.os }}-cargo-ts-${{ hashFiles('**/Cargo.lock') }}
+          restore-keys: |
+            ${{ runner.os }}-cargo-ts-
+
+      # The vitest parity test shells out to this example; prebuilding keeps
+      # the test itself fast and its failure modes distinct from build errors.
+      - name: Prebuild procedure_roots example
+        run: cargo build --example procedure_roots -p miden-multisig-client
+
+      # miden-multisig-client consumes guardian-client via a `file:` link, so
+      # its `dist` (gitignored) must be built before the linked install below
+      # can resolve the client's types and runtime.
+      - name: Build linked guardian-client
+        working-directory: packages/guardian-client
+        run: npm ci && npm run build
+
+      # The runner's preinstalled Node (>= 18, per the package engines field)
+      # is used directly to avoid adding an unpinned action.
+      - name: Install package dependencies
+        working-directory: packages/miden-multisig-client
+        run: npm ci
+
+      - name: Run vitest parity and unit tests
+        working-directory: packages/miden-multisig-client
+        run: npm test
+
+      - name: Build package
+        working-directory: packages/miden-multisig-client
+        run: npm run build
+
+      # channel 'chrome' in playwright.config.ts uses the runner's system
+      # Chrome; no browser download required.
+      - name: Run browser determinism gate
+        working-directory: packages/miden-multisig-client
+        run: npm run test:browser
+
   clippy:
     name: Clippy
     runs-on: ubuntu-latest
@@ -94,11 +212,13 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@351f82a4dc29e4159746a068ed925da17341219f # 1.89.0
         with:
-          toolchain: 1.93.0
+          toolchain: 1.96.1
           components: clippy
 
       - name: Install system dependencies
@@ -118,6 +238,9 @@ jobs:
       - name: Build (generate protobuf descriptors)
         run: cargo build --package guardian-server
 
+      - name: Check shared crate with production features
+        run: cargo check --package guardian-shared --lib
+
       - name: Run clippy
         run: cargo clippy --all-targets --all-features -- -D warnings
 
@@ -133,11 +256,13 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@351f82a4dc29e4159746a068ed925da17341219f # 1.89.0
         with:
-          toolchain: 1.93.0
+          toolchain: 1.96.1
           components: rustfmt
 
       - name: Check formatting
@@ -155,11 +280,13 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@351f82a4dc29e4159746a068ed925da17341219f # 1.89.0
         with:
-          toolchain: 1.93.0
+          toolchain: 1.96.1
 
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libpq-dev
@@ -190,11 +317,13 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+        with:
+          persist-credentials: false
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@351f82a4dc29e4159746a068ed925da17341219f # 1.89.0
         with:
-          toolchain: 1.93.0
+          toolchain: 1.96.1
 
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y protobuf-compiler libpq-dev

AGENTS.md

@@ -227,7 +227,7 @@ When docs are not updated after a visible behavior change, note why in the final
 ## 11) Versioning Policy
 
 - Keep crate/package versions aligned with the active Miden dependency line.
-- Current baseline is Miden `0.14.x`; changes must remain compatible with that line unless migration is explicit.
+- Current baseline is the Miden `0.16` pre-release line (exact-pinned alphas) across the Rust workspace and `packages/miden-multisig-client`. Changes must remain compatible with that line unless migration is explicit.
 - If a change requires moving to a new Miden line, treat it as a coordinated release task:
   1. Update workspace/dependency constraints.
   2. Update both multisig SDKs and both base clients as needed.