Deployment & operations

Build and test

npm test fetches a hash-pinned immutable Squads binary for local tests, builds custody without trading fixtures, builds a separate fixture binary, and runs behavioral tests. npm run build and npm run test:browser verify the website. npm run security:dependencies and npm run security:rust inspect dependencies.

The custody build manifest records its SHA-256. Deployment rejects fixture builds or changed binaries. Neither local tests nor a website deployment publish a Solana factory.

Devnet ownership

Supply two reviewer public addresses and disclose who operates them. npm run solana:governance -- ADDRESS_ONE ADDRESS_TWO prepares a devnet 2-of-3 multisig; --broadcast explicitly submits creation. Set EVANGEL_GOVERNANCE_MULTISIG to the multisig account, from which vault 0 is derived. Do not confuse the account with the vault.

npm run solana:fixture -- deploy creates only a dummy mint. npm run solana:deploy is read-only preflight; --broadcast deploys custody, initializes verified quorum governance and transfers upgrade authority to that vault. Test SOL, configured signers and verified finalized receipts are required. Never put a signing key into Vercel, the browser, inference inputs or Git.

Monitor and stabilize

npm run security:monitor checks backing, governance, token authorities and upgrade authority. After the published security review, remediation and a capped pilot, revoke upgrades through a reviewed Squads proposal; this is irreversible. Publish new opt-in program versions for future projects instead of rewriting existing custody promises.

Daily settlement runner

npm run solana:settle-days prints a read-only plan based on finalized chain time. --broadcast uses the local test-only Keychain payer to settle closed days and send available development income to fixed adopted owners. Run after 00:00 UTC from a funded protected host; failed or late runs leave all claims available. No signing key belongs in Vercel.

This version uses factory tag 10. Legacy SOL fee deployments are rejected rather than reinterpreted. Deploy a fresh program with fresh journals; any future funded migration requires a separately reviewed plan.