The judge

The judge decides with no human in the loop. It runs on its own machine, started for each batch of jobs and stopped when they are done.

Build

The judge opens the sealed key with its X25519 secret, decrypts the archive, checks that its sha256 is the commitment, checks the rules, and compiles the crate itself with the pinned toolchain, with no secrets in the environment and a 10 minute cap. A submitted binary is never trusted.

Replay

The original binary, read from mainnet, and the candidate are loaded into two identical local SVMs (LiteSVM). Both receive the same inputs: real instruction data from recent mainnet transactions to the program, the same account states, the same sysvars, then fuzzed variants of those instructions. The corpus is frozen when the program is first snapshotted; its target size is 1,000 real instructions plus 10,000 fuzzed ones, and when a program has fewer usable recent instructions every page prints the real count.

Compare

For every case: success or the exact error (custom codes included), every byte of every account the instruction may write (data, lamports, owner), return data, and the logs with the consumed N of M compute units lines removed. CPI invocations and their order must match. Both binaries run under the same compute budget, taken from each case's own ComputeBudget instructions, so an interpreter that embeds the original bytecode cannot pass.

Verdict

PASS when every case matches and the corpus exercises the program for real: at least 100 cases where the original succeeds. The report is JSON, with its sha256, the source commitment, the corpus hash and the two binary hashes. The keeper records every PASS on Solana as a Memo:

Until the keeper is funded a ticket reads "Memo record pending"; the backfill records every pending proof in one run.

Calibration

This instance proves its judge on a program whose source is already public before it judges anything else: the correct source must PASS and a copy with one change must FAIL with the difference shown. Both are on the proof wall, labelled calibration. Anyone can re-run any verdict with the verifier.