# Evangel: first development upgrade inspection

## Decision and scope

Prepared for human review, not signed or executed. This is a same-bytecode loader rehearsal on Solana Devnet. It installs the exact existing development guard binary on the disposable target. There is no functional code change. It is not a factory release, a mainnet release, or an independent audit.

## Exact identities

- Guard: Xoxj3TWjiyB4893kdNG2L9ffxQHnwxwFuofX3JBJnLa
- Disposable target: H1EKDzq9RsZNXA7XnJfrHgsEed5JfL1ZKYh37d7ziysR
- Configuration: 63g3VLCFKDFLZeck7rDS5dACZYzPp93gXStfFfZNNqnK
- Target authority: DyXUeiX16K1e9fCoiAoNM24YPogWT3JKMaEhq7uKTfxm
- Staged buffer: EU1WQ5Uqcx3A3RWnFUvm7VkkK7AxCokNSYVrCopvcGy5
- Proposal: BvtrEPPFLsqu2JTRYzjRjqacBfjHvJYGnxztbU8B4cPF
- Nonce / generation: 0 / 0
- Developer: 92DFCXk28gwHZLzKoBzKj7tCeLZk3EtEdi5WaLBARjHc
- Reviewers: 2xfWrsDopF88hje19HnghXCSbqAmQum297L2KGoAMd3h, 5GcGNF4fTJhBiGLCqwXxFTj5tqWUjRAsGAmMvSMJ5sL4, FqXojD69EQyiT1Vckz3twzMTUXNr4yL3Qe5kcroAV2GM
- Fixed rent-refund treasury: 92DFCXk28gwHZLzKoBzKj7tCeLZk3EtEdi5WaLBARjHc

## Inspected artifact

- Code SHA-256: c3fddb612283036972b5976bf9c3f18388da3e8f5cfa402d8970876ce029600d
- Byte length: 152792
- Current allocated executable SHA-256: c3fddb612283036972b5976bf9c3f18388da3e8f5cfa402d8970876ce029600d
- Rust source SHA-256: a42c0f9db18fd483a915dd8e5b923f4c14c10458d75df052bf24f7f59d484cd9
- Build: solana/dao with devnet-bootstrap; developmentOnly=true.
- Development upgrades require two distinct configured reviewer attestations and have no governance delay or automatic development expiry. Proposal attestations expire after seven days; approved execution expires 10 days 6 hours after approval.

## Inspection and safeguards

The guard rejects wrong proposers, wrong reviewer keys, altered buffers, altered base code, stale generations and duplicate execution. The client pins these exact addresses, code hash and this report hash, and verifies finalized Devnet accounts again before each signing request. The buffer authority is sealed to the guard PDA before proposal creation. Execution increments the configuration generation, marks the proposal executed and invokes the Solana loader atomically. Buffer rent returns to the fixed treasury above; no token transfers or factory custody changes are included.

The immutable guard cannot rewrite itself. The disposable target has no business accounts. The configured developer and reviewer addresses match the previous confirmed setup; separate addresses do not prove independent people. Local compiled SBF tests cover immediate governance approval, two-reviewer quorum, unauthorized signers, stale approvals, base/buffer tampering, replay, expiry, public-mode timing and irreversible activation. Those local checks do not substitute for this pending participant-signed Devnet transaction.

## What to sign

1. Developer: create this exact proposal (pays proposal-account rent and transaction fees in Devnet SOL).
2. Two of the three reviewers: attest to this proposal and this report hash. Each pays their own Devnet transaction fee.
3. Any funded wallet: execute after both attestations finalize. No governance countdown applies; normal network confirmation and loader slot requirements still apply.

Do not sign if a displayed address, hash, purpose or recipient differs. An expired or stale proposal must be freshly inspected; never reuse approval for different code. Public deployment still requires a separately reviewed production artifact and the factory's existing authority migration process.