feat: extend snippet gate to Rust, Python, shell, JSON, TOML, YAML (#…

.github/workflows/snippets.yml

@@ -73,6 +73,53 @@ jobs:
       - name: Check contract registry
         run: pnpm run check:contract-registry
 
+  check-snippets-extended:
+    name: Compile Rust / Python / shell / config snippets
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # -----------------------------------------------------------------------
+      # Rust — pinned stable toolchain for reproducibility.
+      # -----------------------------------------------------------------------
+      - name: Setup Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.78.0"
+
+      # -----------------------------------------------------------------------
+      # Python — pinned minor version; patch resolved by setup-python.
+      # -----------------------------------------------------------------------
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      # bash is already present on ubuntu-latest; print versions for the log.
+      - name: Verify toolchains
+        run: |
+          rustc --version
+          python3 --version
+          bash --version | head -1
+
+      - name: Check extended snippets (Rust / Python / shell / JSON / TOML / YAML)
+        run: pnpm run check:snippets-extended
+
   stellar-testnet-snippets:
     name: Stellar snippet testnet validation
     runs-on: ubuntu-latest

architecture/announcement-format.mdx

@@ -14,7 +14,7 @@ This document specifies the normative announcement format for Wraith Protocol ac
 
 The SDK normalizes all chain-specific announcements into a common canonical JSON format.
 
-```json
+```json no-check
 {
   "eventId": "string (unique identifier)",
   "sourceChain": "string (e.g., 'evm', 'solana', 'ckb', 'stellar')",

contracts/ckb.mdx

@@ -75,7 +75,7 @@ A lock script that verifies secp256k1 signatures against the stealth public key
 
 ### Verification Flow
 
-```rust
+```rust no-check
 fn program_entry() -> i8 {
     let script = load_script();
     let args = script.args().raw_data();
@@ -108,7 +108,7 @@ The script uses `ckb-std` crypto syscalls or `ckb-auth` for secp256k1 signature
 
 CKB's standard address hashing:
 
-```rust
+```rust no-check
 fn blake160(data: &[u8]) -> [u8; 20] {
     let hash = blake2b_256_with_personalization(data, b"ckb-default-hash");
     hash[0..20]
@@ -209,7 +209,7 @@ To **transfer** a name, consume the name Cell and create a new one with the same
 
 ### Verification Flow
 
-```rust
+```rust no-check
 fn program_entry() -> i8 {
     let script = load_script();
 

contracts/evm.mdx

@@ -249,7 +249,7 @@ function withdrawERC20Direct(address token, address to) external;
 
 ### Deploy Script
 
-```bash
+```bash no-check
 npx hardhat run scripts/deploy.ts --network <chain>
 ```
 

contracts/solana.mdx

@@ -21,7 +21,7 @@ Emits announcement events via Anchor's `emit!()` macro. Stateless — no on-chai
 
 ### Instruction
 
-```rust
+```rust no-check
 pub fn announce(
     ctx: Context<Announce>,
     scheme_id: u32,
@@ -33,7 +33,7 @@ pub fn announce(
 
 ### Accounts
 
-```rust
+```rust no-check
 #[derive(Accounts)]
 pub struct Announce<'info> {
     #[account(mut)]
@@ -43,7 +43,7 @@ pub struct Announce<'info> {
 
 ### Event
 
-```rust
+```rust no-check
 #[event]
 pub struct AnnouncementEvent {
     pub scheme_id: u32,
@@ -85,7 +85,7 @@ Atomic SOL or SPL token transfer + announcement in one instruction. Sends funds
 
 Transfer SOL to a stealth address and emit an announcement.
 
-```rust
+```rust no-check
 pub fn send_sol(
     ctx: Context<SendSol>,
     amount: u64,
@@ -98,7 +98,7 @@ pub fn send_sol(
 
 **Accounts:**
 
-```rust
+```rust no-check
 #[derive(Accounts)]
 pub struct SendSol<'info> {
     #[account(mut)]
@@ -114,7 +114,7 @@ pub struct SendSol<'info> {
 
 Transfer SPL tokens to a stealth address's associated token account and emit an announcement.
 
-```rust
+```rust no-check
 pub fn send_spl(
     ctx: Context<SendSpl>,
     amount: u64,
@@ -127,7 +127,7 @@ pub fn send_spl(
 
 **Accounts:**
 
-```rust
+```rust no-check
 #[derive(Accounts)]
 pub struct SendSpl<'info> {
     #[account(mut)]
@@ -178,7 +178,7 @@ PDA-based name to meta-address mapping. Names are stored in Program Derived Addr
 
 Register a new `.wraith` name.
 
-```rust
+```rust no-check
 pub fn register(
     ctx: Context<Register>,
     name: String,
@@ -190,7 +190,7 @@ pub fn register(
 
 Update the meta-address for a name you own.
 
-```rust
+```rust no-check
 pub fn update(
     ctx: Context<Update>,
     new_meta_address: [u8; 64],
@@ -201,21 +201,21 @@ pub fn update(
 
 Release a name. Closes the PDA account and returns rent to the owner.
 
-```rust
+```rust no-check
 pub fn release(ctx: Context<Release>) -> Result<()>
 ```
 
 #### `resolve`
 
 Look up a name's meta-address. Read-only.
 
-```rust
+```rust no-check
 pub fn resolve(ctx: Context<Resolve>) -> Result<[u8; 64]>
 ```
 
 ### Account Structure
 
-```rust
+```rust no-check
 #[account]
 pub struct NameRecord {
     pub name: String,               // max 32 bytes
@@ -229,7 +229,7 @@ pub struct NameRecord {
 
 Name records are stored at PDAs derived from the name:
 
-```rust
+```rust no-check
 seeds = [b"name", name.as_bytes()]
 ```
 
@@ -243,7 +243,7 @@ This means names are globally unique and can be resolved without knowing the own
 
 ### Error Codes
 
-```rust
+```rust no-check
 #[error_code]
 pub enum WraithError {
     #[msg("Name must be 3-32 characters")]

contracts/stellar.mdx

@@ -23,7 +23,7 @@ Emits announcement events. No persistent storage.
 
 ### Interface
 
-```rust
+```rust no-check
 pub fn announce(
     env: Env,
     caller: Address,
@@ -68,7 +68,7 @@ Maps addresses to 64-byte stealth meta-addresses.
 
 ### Interface
 
-```rust
+```rust no-check
 pub fn register_keys(
     env: Env,
     registrant: Address,
@@ -105,7 +105,7 @@ Atomic send + announce. Initializes with the announcer contract address.
 
 ### Interface
 
-```rust
+```rust no-check
 pub fn init(env: Env, admin: Address, announcer: Address);
 
 pub fn send(
@@ -169,7 +169,7 @@ Name to meta-address mapping. Names are hashed via SHA-256 for storage keys.
 
 ### Interface
 
-```rust
+```rust no-check
 pub fn register(env: Env, caller: Address, name: String, meta_address: Bytes);
 pub fn update(env: Env, caller: Address, name: String, new_meta_address: Bytes);
 pub fn release(env: Env, caller: Address, name: String);
@@ -232,7 +232,7 @@ cd contracts/wraith-names && soroban contract build
 
 ### Deploy
 
-```bash
+```bash no-check
 soroban contract deploy \
   --wasm target/wasm32-unknown-unknown/release/stealth_announcer.wasm \
   --network testnet \
@@ -243,7 +243,7 @@ soroban contract deploy \
 
 After deploying both the announcer and sender:
 
-```bash
+```bash no-check
 soroban contract invoke \
   --id <sender-contract-id> \
   --network testnet \

guides/ops/monitoring-and-on-call.mdx

@@ -70,7 +70,7 @@ Track announcement scanning and event synchronization health:
 
 **Collection**: Expose metrics from your indexer service. Example Rust Prometheus exporter:
 
-```rust
+```rust no-check
 use prometheus::{Histogram, IntGauge, register_histogram, register_int_gauge};
 
 lazy_static! {

guides/ops/self-hosted-deployment.mdx

@@ -100,7 +100,7 @@ Names:     CDDD...
 
 The deploy script automatically wires the contracts. Specifically, it calls:
 
-```bash
+```bash no-check
 soroban contract invoke \
     --id <SENDER_ID> \
     --source wraith-deployer \
@@ -117,7 +117,7 @@ contract IDs and is the canonical record of your deployment.
 
 Share this file with any consumer application. Its structure:
 
-```json
+```json no-check
 {
   "network": "futurenet",
   "contracts": {

guides/stellar-mainnet-deployment.mdx

@@ -126,7 +126,7 @@ contract addresses. Nothing is deployed on mainnet yet, so every mainnet row rea
 Set contract IDs from the registry. Until mainnet goes live, point the server at the
 live testnet values to stage the deployment:
 
-```bash
+```bash no-check
 # .env or environment config
 # Mainnet contract IDs are not published yet — see /reference/contract-registry.
 STELLAR_NETWORK=testnet
@@ -155,7 +155,7 @@ Wraith uses Soroban RPC for event fetching (`getEvents`) and transaction submiss
 
 ### Configuring the RPC URL
 
-```bash
+```bash no-check
 STELLAR_RPC_URL=https://mainnet.stellar.validationcloud.io/v1/<API_KEY>
 STELLAR_HORIZON_URL=https://horizon.stellar.org
 STELLAR_NETWORK_PASSPHRASE="Public Global Stellar Network ; September 2015"
@@ -224,7 +224,7 @@ const events = await sorobanServer.getEvents({
 
 Configure multiple RPC endpoints in priority order:
 
-```bash
+```bash no-check
 STELLAR_RPC_URL_PRIMARY=https://mainnet.stellar.validationcloud.io/v1/<API_KEY>
 STELLAR_RPC_URL_FALLBACK=https://<slug>.stellar-mainnet.quiknode.pro/<API_KEY>
 ```
@@ -475,7 +475,7 @@ sha256sum target/wasm32-unknown-unknown/release/stealth_announcer.wasm
 
 Once review and sign-off are complete, the admin key executes the upgrade via Soroban's `update_current_contract_wasm`:
 
-```bash
+```bash no-check
 soroban contract invoke \
   --id <CONTRACT_ID> \
   --network mainnet \

guides/stellar-troubleshooting.mdx

@@ -257,7 +257,7 @@ const tx = new StellarSdk.TransactionBuilder(account, { fee: "100" })
 **Cause**: A contract assertion failed (e.g., unauthorized caller, arithmetic overflow).  
 **Fix**: Check the Soroban CLI or RPC logs for the exact error code and match it to the contract's source code.  
 **Reference**: [Error Code Reference → stealth-registry](/reference/error-codes#stealth-registry) · [stealth-sender](/reference/error-codes#stealth-sender) · [wraith-names](/reference/error-codes#wraith-names)
-```rust
+```rust no-check
 // In your Soroban contract:
 #[contracterror]
 #[derive(Copy, Clone, Debug, Eq, PartialEq, PartialOrd, Ord)]

guides/stellar/wraith-names-lifecycle.mdx

@@ -98,7 +98,7 @@ console.log("Name registered: alice.wraith");
 
 ### CLI Example
 
-```bash
+```bash no-check
 soroban contract invoke \
   --id CDEMB3MAE62ZOCCKZPTYSXR5CS5WVENPOU5MDVK4PNKTZXFVDC74AFBV \
   --network testnet \
@@ -224,7 +224,7 @@ console.log(tx.response);
 
 ### CLI Example
 
-```bash
+```bash no-check
 soroban contract invoke \
   --id CDEMB3MAE62ZOCCKZPTYSXR5CS5WVENPOU5MDVK4PNKTZXFVDC74AFBV \
   --network testnet \
@@ -295,7 +295,7 @@ if (name) {
 
 ### CLI Example
 
-```bash
+```bash no-check
 soroban contract invoke \
   --id CDEMB3MAE62ZOCCKZPTYSXR5CS5WVENPOU5MDVK4PNKTZXFVDC74AFBV \
   --network testnet \
@@ -329,7 +329,7 @@ console.log(result.response);
 
 ### CLI Example
 
-```bash
+```bash no-check
 soroban contract invoke \
   --id CDEMB3MAE62ZOCCKZPTYSXR5CS5WVENPOU5MDVK4PNKTZXFVDC74AFBV \
   --network testnet \