Draft PR: NSM language updates.

.github/actions/render/action.yml

@@ -1,9 +1,29 @@
-name: Render ZIPs
-description: GitHub Action to compile ZIPs only
+name: Render All
+description: GitHub Action to compile ZIPs and the protocol specification.
 author: Deirdre Connolly and Daira-Emma Hopwood
 runs:
-  using: docker
-  image: ../../../Dockerfile
-  # Runs "make all-zips".
-  args:
-    - all-zips
+  using: composite
+  steps:
+    - uses: DeterminateSystems/nix-installer-action@c5a866b6ab867e88becbed4467b93592bce69f8a # v21
+
+    - name: Restore Nix store cache
+      id: nix-cache
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      with:
+        path: /tmp/nix-closure
+        key: nix-devshell-${{ runner.os }}-${{ hashFiles('flake.lock', 'flake.nix') }}
+
+    - name: Import cached Nix store paths
+      if: steps.nix-cache.outputs.cache-hit == 'true'
+      shell: bash
+      run: nix-store --import < /tmp/nix-closure/store.nar
+
+    - shell: bash
+      run: nix develop --profile /tmp/dev-profile --command make all
+
+    - name: Export Nix store for caching
+      if: steps.nix-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        mkdir -p /tmp/nix-closure
+        nix-store --export $(nix-store -qR /tmp/dev-profile) > /tmp/nix-closure/store.nar

.github/workflows/publish.yaml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: publish
           fetch-depth: 0
@@ -43,14 +43,13 @@ jobs:
           if ! ( grep -E '^[0-9a-f]{40}$' base_ref ); then exit 1; fi
 
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5
 
       - name: Merge `main` to the `publish` branch
         run: |
           set -x
           git config --global user.name 'github_actions'
           git config --global user.email 'actions@github.com'
-          git config --global --add safe.directory /github/workspace
           version="$(git describe --tags --abbrev=6 origin/main |sed 's/-1-g.*//')"
           # Merge preferring the version in main.
           git merge -s recursive -Xtheirs origin/main --commit -m 'Auto-deploy: merging "main" branch'
@@ -59,23 +58,23 @@ jobs:
           git tag -f "${version}-auto"
 
       - name: Compile ZIPs and Zcash Protocol Specification
-        uses: ./.github/actions/render-protocol
+        uses: ./.github/actions/render
 
       - name: Set `.gitignore` to not ignore `rendered/`
         # This needs to be afer rendering so that it is not considered to make the tree dirty.
         run: sed -i 's@^rendered/$@@' .gitignore
 
       - name: Commit and push to `publish` branch
-        uses: EndBug/add-and-commit@v9.1.4
+        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
         with:
           add: 'rendered'
           default_author: github_actions
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4
         with:
           path: 'rendered'
 
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4

.github/workflows/render.yml

@@ -8,43 +8,42 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 3
 
-      - name: Verify nonexistence of `rendered`
+      - name: Verify nonexistence of `rendered` and `base_ref`
         shell: bash
         run: |
           if [ -e rendered ]; then exit 1; fi
+          if [ -e base_ref ]; then exit 1; fi
 
-      - name: Set git config
-        run: git config --global --add safe.directory /github/workspace
-
-      - name: Compile ZIPs
-        uses: ./.github/actions/render
+      - uses: DeterminateSystems/nix-installer-action@c5a866b6ab867e88becbed4467b93592bce69f8a # v21
 
-  render-protocol:
-    needs: render
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5.0.1
+      - name: Restore Nix store cache
+        id: nix-cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
-          fetch-depth: 100
+          path: /tmp/nix-closure
+          key: nix-devshell-${{ runner.os }}-${{ hashFiles('flake.lock', 'flake.nix') }}
 
-      - name: Verify nonexistence of `rendered` and `base_ref`
-        shell: bash
-        run: |
-          if [ -e rendered ]; then exit 1; fi
-          if [ -e base_ref ]; then exit 1; fi
+      - name: Import cached Nix store paths
+        if: steps.nix-cache.outputs.cache-hit == 'true'
+        run: nix-store --import < /tmp/nix-closure/store.nar
 
-      - name: Set git config
-        run: git config --global --add safe.directory /github/workspace
+      - name: Compile ZIPs
+        run: nix develop --profile /tmp/dev-profile --command make all-zips
 
       - name: Set base ref
         run: |
           git show --format=%H --no-notes --no-patch "HEAD~1" -- |tee base_ref
           if ! ( grep -E '^[0-9a-f]{40}$' base_ref ); then exit 1; fi
 
       - name: Compile Protocol Specification
-        uses: ./.github/actions/render-protocol
+        run: nix develop --profile /tmp/dev-profile --command make all
+
+      - name: Export Nix store for caching
+        if: steps.nix-cache.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p /tmp/nix-closure
+          nix-store --export $(nix-store -qR /tmp/dev-profile) > /tmp/nix-closure/store.nar

.github/workflows/updatecheck.yml

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5.0.1
+        uses: actions/checkout@v6.0.2
 
       - name: Check dependencies
         shell: bash

README.rst

@@ -167,7 +167,7 @@ written.
     <tr> <td><span class="reserved">76</span></td> <td class="left"><a class="reserved" href="zips/zip-0076.rst">Transaction Signature Validation before Overwinter</a></td> <td>Reserved</td> <td class="left"><a href="https://github.com/zcash/zips/issues/130">zips#130</a></td>
     <tr> <td>112</td> <td class="left"><a href="zips/zip-0112.rst">CHECKSEQUENCEVERIFY</a></td> <td>Draft</td> <td class="left"></td>
     <tr> <td>113</td> <td class="left"><a href="zips/zip-0113.rst">Median Time Past as endpoint for lock-time calculations</a></td> <td>Draft</td> <td class="left"></td>
-    <tr> <td><span class="reserved">204</span></td> <td class="left"><a class="reserved" href="zips/zip-0204.rst">Zcash P2P Network Protocol</a></td> <td>Reserved</td> <td class="left"><a href="https://github.com/zcash/zips/issues/352">zips#352</a></td>
+    <tr> <td>204</td> <td class="left"><a href="zips/zip-0204.rst">Zcash P2P Network Protocol</a></td> <td>Draft</td> <td class="left"><a href="https://github.com/zcash/zips/issues/352">zips#352</a></td>
     <tr> <td><span class="reserved">217</span></td> <td class="left"><a class="reserved" href="zips/zip-0217.rst">Aggregate Signatures</a></td> <td>Reserved</td> <td class="left"><a href="https://github.com/zcash/zcash/issues/2914">zcash#2914</a></td>
     <tr> <td><span class="reserved">219</span></td> <td class="left"><a class="reserved" href="zips/zip-0219.rst">Disabling Addition of New Value to the Sapling Chain Value Pool</a></td> <td>Reserved</td> <td class="left"><a href="https://github.com/zcash/zips/issues/428">zips#428</a></td>
     <tr> <td>222</td> <td class="left"><a href="zips/zip-0222.rst">Transparent Zcash Extensions</a></td> <td>Draft</td> <td class="left"></td>
@@ -212,6 +212,7 @@ written.
     <tr> <td>2005</td> <td class="left"><a href="zips/zip-2005.md">Quantum Recoverability</a></td> <td>Draft</td> <td class="left"><a href="https://github.com/zcash/zips/issues/1135">zips#1135</a></td>
     <tr> <td>guide-markdown</td> <td class="left"><a href="zips/zip-guide-markdown.md">{Something Short and To the Point}</a></td> <td>Draft</td> <td class="left"></td>
     <tr> <td>guide</td> <td class="left"><a href="zips/zip-guide.rst">{Something Short and To the Point}</a></td> <td>Draft</td> <td class="left"></td>
+    <tr> <td>template</td> <td class="left"><a href="zips/zip-template.md">{Template for new ZIPs}</a></td> <td>Draft</td> <td class="left"></td>
   </table></embed>
 
 Drafts without assigned ZIP numbers
@@ -286,7 +287,7 @@ Index of ZIPs
     <tr> <td>201</td> <td class="left"><a href="zips/zip-0201.rst">Network Peer Management for Overwinter</a></td> <td>Final</td>
     <tr> <td>202</td> <td class="left"><a href="zips/zip-0202.rst">Version 3 Transaction Format for Overwinter</a></td> <td>Final</td>
     <tr> <td>203</td> <td class="left"><a href="zips/zip-0203.rst">Transaction Expiry</a></td> <td>Final</td>
-    <tr> <td><span class="reserved">204</span></td> <td class="left"><a class="reserved" href="zips/zip-0204.rst">Zcash P2P Network Protocol</a></td> <td>Reserved</td>
+    <tr> <td>204</td> <td class="left"><a href="zips/zip-0204.rst">Zcash P2P Network Protocol</a></td> <td>Draft</td>
     <tr> <td>205</td> <td class="left"><a href="zips/zip-0205.rst">Deployment of the Sapling Network Upgrade</a></td> <td>Final</td>
     <tr> <td>206</td> <td class="left"><a href="zips/zip-0206.rst">Deployment of the Blossom Network Upgrade</a></td> <td>Final</td>
     <tr> <td>207</td> <td class="left"><a href="zips/zip-0207.rst">Funding Streams</a></td> <td>[Revision 0: Canopy, Revision 1: NU6] Final</td>
@@ -384,4 +385,5 @@ Index of ZIPs
     <tr> <td>2005</td> <td class="left"><a href="zips/zip-2005.md">Quantum Recoverability</a></td> <td>Draft</td>
     <tr> <td>guide-markdown</td> <td class="left"><a href="zips/zip-guide-markdown.md">{Something Short and To the Point}</a></td> <td>Draft</td>
     <tr> <td>guide</td> <td class="left"><a href="zips/zip-guide.rst">{Something Short and To the Point}</a></td> <td>Draft</td>
+    <tr> <td>template</td> <td class="left"><a href="zips/zip-template.md">{Template for new ZIPs}</a></td> <td>Draft</td>
   </table></embed>

flake.nix

@@ -4,44 +4,98 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
     flake-utils.url = "github:numtide/flake-utils";
+    multimarkdown6 = {
+      url = "github:zcash/MultiMarkdown-6/543434c9df78b6be9e8125ff19a5e6934dc8ba82";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.flake-utils.follows = "flake-utils";
+    };
   };
 
-  outputs = { self, nixpkgs, flake-utils }:
-    flake-utils.lib.eachDefaultSystem (system:
+  outputs =
+    {
+      self,
+      nixpkgs,
+      flake-utils,
+      multimarkdown6,
+    }:
+    flake-utils.lib.eachDefaultSystem (
+      system:
       let
         pkgs = nixpkgs.legacyPackages.${system};
+        mmd = multimarkdown6.packages.${system}.default;
+
+        # Pin docutils and rst2html5 to the versions specified in zip-guide.rst.
+        docutils = pkgs.python3Packages.docutils.overridePythonAttrs (old: rec {
+          version = "0.21.2";
+          src = pkgs.fetchPypi {
+            pname = "docutils";
+            inherit version;
+            hash = "sha256-OmsYcy7fGC2qPNEndbuzOM9WkUaPke7rEJ3v9uv6mG8=";
+          };
+        });
+
+        # This is a separate PyPI package from docutils' built-in rst2html5;
+        # it provides its own HTML5 writer with different math handling.
+        rst2html5 = pkgs.python3Packages.buildPythonPackage rec {
+          pname = "rst2html5";
+          version = "2.0.1";
+          pyproject = true;
+
+          src = pkgs.fetchPypi {
+            inherit pname version;
+            hash = "sha256-MJmYyF+rAo8vywGizNyIbbCvxDmCYueVoC6pxNDzKuk=";
+          };
+
+          build-system = [ pkgs.python3Packages.poetry-core ];
+
+          dependencies = [
+            docutils
+            pkgs.python3Packages.genshi
+            pkgs.python3Packages.pygments
+          ];
+
+          # rst2html5_.py is a top-level module referenced by the entry point
+          # but poetry-core's include directive doesn't always install it.
+          postInstall = ''
+            cp rst2html5_.py $out/${pkgs.python3.sitePackages}/
+          '';
+
+          # Tests require additional fixtures not included in the PyPI tarball
+          doCheck = false;
+        };
       in
       {
         devShells.default = pkgs.mkShell {
-          buildInputs = with pkgs; [
+          buildInputs = [
             # Core dependencies for render.sh
-            python3Packages.docutils  # provides rst2html5
-            pandoc                    # pandoc markdown renderer
-            multimarkdown             # multimarkdown renderer
-            perl                      # perl for text processing
+            rst2html5 # rst2html5 2.0.1 (PyPI)
+            pkgs.python3Packages.pygments # syntax highlighting for code blocks
+            pkgs.pandoc # pandoc markdown renderer
+            mmd # multimarkdown renderer (zcash fork)
+            pkgs.perl # perl for text processing
 
             # Build system dependencies
-            gnumake                   # make command for building
-            git                       # required by Makefile for safe.directory
+            pkgs.gnumake # make command for building
+            pkgs.git # required by Makefile for safe.directory
 
             # LaTeX dependencies for protocol PDF generation
-            (texlive.combine {
-              inherit (texlive) scheme-full;
+            (pkgs.texlive.combine {
+              inherit (pkgs.texlive) scheme-full;
             })
 
             # Python dependencies for links_and_dests.py
-            python3
-            python3Packages.beautifulsoup4
-            python3Packages.html5lib
-            python3Packages.certifi
+            pkgs.python3
+            pkgs.python3Packages.beautifulsoup4
+            pkgs.python3Packages.html5lib
+            pkgs.python3Packages.certifi
 
             # Standard utilities (usually available, but ensuring they're present)
-            coreutils                 # sed, grep, cat, basename, wc, diff, cp, rm, mkdir, touch
-            bash                      # shell interpreter
-            gnused                    # GNU sed
-            gnugrep                   # GNU grep
-            diffutils                 # diff command
-            findutils                 # utilities for finding files
+            pkgs.coreutils
+            pkgs.bash
+            pkgs.gnused
+            pkgs.gnugrep
+            pkgs.diffutils
+            pkgs.findutils
           ];
 
           shellHook = ''
@@ -63,4 +117,4 @@
         };
       }
     );
-}
+}

render.sh

@@ -32,11 +32,11 @@ fi
 title="$(basename -s ${filetype} ${inputfile} | sed -E 's|zip-0{0,3}|ZIP |; s|draft-|Draft |')$(grep -E '^(\.\.)?\s*Title: ' ${inputfile} |sed -E 's|.*Title||')"
 echo "    ${title}"
 
-Math1='<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.25/dist/katex.min.css" integrity="sha384-WcoG4HRXMzYzfCgiyfrySxx90XSl2rxY5mnVY5TwtWE6KLrArNKn0T/mOgNL0Mmi" crossorigin="anonymous">'
-Math2='<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.25/dist/katex.min.js" integrity="sha384-J+9dG2KMoiR9hqcFao0IBLwxt6zpcyN68IgwzsCSkbreXUjmNVRhPFTssqdSGjwQ" crossorigin="anonymous"></script>'
-Math3='<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.25/dist/contrib/auto-render.min.js" integrity="sha384-hCXGrW6PitJEwbkoStFjeJxv+fSOOQKOPbJxSfM6G5sWZjAyWhXiTIIAmQqnlLlh" crossorigin="anonymous" onload="renderMathInElement(document.body);"></script>'
+Math1='<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.33/dist/katex.min.css" integrity="sha384-fgYS3VC1089n2J3rVcEbXDHlnDLQ9B2Y1hvpQ720q1NvxCduQqT4JoGc4u2QCnzE" crossorigin="anonymous">'
+Math2='<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.33/dist/katex.min.js" integrity="sha384-YPHNAPyrxGS8BNnA7Q4ommqra8WQPEjooVSLzFgwgs8OXJBvadbyvx4QpfiFurGr" crossorigin="anonymous"></script>'
+Math3='<script defer src="https://cdn.jsdelivr.net/npm/katex@0.16.33/dist/contrib/auto-render.min.js" integrity="sha384-JKXHIJf8PKPyDFptuKZoUyMRQJAmQKj4B4xyOca62ebJhciMYGiDdq/9twUUWyZH" crossorigin="anonymous" onload="renderMathInElement(document.body);"></script>'
 
-Mermaid='<script defer src="https://cdn.jsdelivr.net/npm/mermaid@11.12.1/dist/mermaid.min.js" integrity="sha384-LlKSgo4Eo5GuF/ZrstLti44dE+GC5XAJ7TSu0Nw9Q3vIZF2QMnkRcK7BUoLabYLF" crossorigin="anonymous" onload="mermaid.initialize({ startOnLoad: true });"></script>'
+Mermaid='<script defer src="https://cdn.jsdelivr.net/npm/mermaid@11.12.3/dist/mermaid.min.js" integrity="sha384-jFhLSLFn4m565eRAS0CDMWubMqOtfZWWbE8kqgGdU+VHbJ3B2G/4X8u+0BM8MtdU" crossorigin="anonymous" onload="mermaid.initialize({ startOnLoad: true });"></script>'
 
 ViewAndStyle='<meta name="viewport" content="width=device-width, initial-scale=1"><link rel="stylesheet" href="css/style.css">'
 

zips/draft-arya-dairaemma-disable-addition-of-transparent-chain-value.md

@@ -2,7 +2,7 @@
     ZIP: XXX
     Title: Disabling Addition of New Value to the Transparent Chain Value Pool
     Owners: Arya <arya@zfnd.org>
-            Daira-Emma Hopwood <daira-emma@electriccoin.co>
+            Daira-Emma Hopwood <daira@jacaranda.org>
     Status: Draft
     Category: Consensus
     Created: 2025-08-13