On Wed, May 11, 2022 at 7:42 AM ZmnSCPxj via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> wrote:

I think the state of the art has advanced to the point where we can say "OP_CAT in tapscript enables non recursive covenants and it is unknown whether OP_CAT can enable recursive covenants or not".

A. Poelstra in https://www.wpsoftware.net/andrew/blog/cat-and-schnorr-tricks-i.html show how to use CAT to use the schnorr verification opcode to get the sighash value + 1 onto the stack, and then through some grinding and some more CAT, get the actual sighash value on the stack.  From there we can use SHA256 to get the signed transaction data onto the stack and apply introspect (using CAT) to build functionality similar to OP_CTV.

The missing bits for enabling recursive covenants comes down to needing to transform a scriptpubkey into an taproot address, which involves some tweaking.  Poelstra has suggested that it might be possible to hijack the ECDSA checksig operation from a parallel, legacy input, in order to perform the calculations for this tweaking.  But as far as I know no one has yet been able to achieve this feat.