I built an open-source node editor for experimenting with covenant scripts.
You can wire nodes together and it builds the taproot output, assembles the tapscript, computes the sighash, and runs the script in an interpreter that reports what each opcode did to the stack. Every hash and every signature is computed in the browser.
Every graph has a permalink, so the nine worked examples below open already built and running. Click one and step through it.
| Example | |
|---|---|
| Vault | BIP 119. Delay to notice a theft, and a cold path to stop it |
| Congestion control | BIP 119. One transaction commits to a tree of payouts |
| Delegation | BIP 348. Hand someone one spend without handing them your key |
| Oracle payout | BIP 348 + 119 |
| Rebindable state | BIP 448. The update leaf is three bytes |
| Rebindable state, the older way | BIP 118. The same channel with an ANYPREVOUT key type |
| Merkle proof | BIP 347. A script folds a leaf back into a root it commits to |
| CAT-only covenant | BIP 347. No CSFS: the script builds its own signature |
| Recursive covenant | BIP 347 + 348. A coin that can only be spent back into itself |
If there is a construction you would like wired up as an example, say so and I will add it 
.
A selector in the header sets which proposals you assume are active, and every script is marked enforced, degraded, or open against that choice.
Source is MIT, except the interpreter fork, which keeps the CC0 dedication it came with.
*Copying a permalink uploads the graph, which is what makes the link short; nothing else leaves the browser.