# Devnet factory authority migration

This report covers the authority handoff, not installation of new factory code. Public launches stay disabled. It is a first-party inspection, not independent certification.

## Exact scope

- Network: Solana Devnet only.
- Existing factory: Ac4F5CNu8tYdUx4RZTKRchFyj5nZ9wG12eh3zDVJn7LV
- Existing Squads vault: GqMSNe6TuhP1KgZontrDAhr4JCwe7FohiRHDBMUFuURy
- Immutable development guard: Xoxj3TWjiyB4893kdNG2L9ffxQHnwxwFuofX3JBJnLa
- Guard configuration for this factory: B1L2knokUtjWZ4HMZj2bzbNHFqGm4CRLkccLeaWN6437
- New loader upgrade authority: Gq9KYLREG3eR7w272Dxd3WAspirzUP498xtYmLNvp72b
- Development voting mint: E2yHAAxMkxe56U5G5gjy796EPm3xJzoYoEbvzRAseYvA
- Developer and rent-refund treasury: 92DFCXk28gwHZLzKoBzKj7tCeLZk3EtEdi5WaLBARjHc
- Guard reviewers: 2xfWrsDopF88hje19HnghXCSbqAmQum297L2KGoAMd3h; 5GcGNF4fTJhBiGLCqwXxFTj5tqWUjRAsGAmMvSMJ5sL4; FqXojD69EQyiT1Vckz3twzMTUXNr4yL3Qe5kcroAV2GM.

Distinct wallets do not establish independent operators. No independence certification is claimed.

## What each signature authorizes

1. Initialize: create the factory-specific guard configuration with the listed developer, reviewers, treasury and development mint. This does not move upgrade authority or install code. The existing vault pays configuration-account rent.
2. Transfer: only after that configuration is verified, move this factory's loader upgrade authority to the derived guard authority above. This changes who can approve future factory upgrades; it is not a cosmetic website update. The factory's operating/custody authority remains the existing Squads vault.

Each step uses a separate proposal in the existing Squads multisig, needs two members' approvals and observes its existing 48-hour onchain delay. The developer cannot bypass it. The development guard permits subsequent reviewed upgrades without its own voting delay after two reviewer attestations. It is a development-only artifact; mainnet requires separately reviewed production governance.

## Verification

Before every signing request the server verifies finalized Devnet accounts, the old factory binary, immutable guard binary, exact governance members, mint authorities/supply, and configuration identities. The client binds review acceptance to the wallet and exact action fingerprint, and compares the stored Squads transaction before approving or executing it. Changed or unverifiable state disables signing.

Compiled local tests execute both steps through the real pinned Squads and guard programs. They reject insufficient quorum and early execution, verify the final loader authority, and prove custody authority stays unchanged. Verifier tests cover wrong genesis, wrong code hash, configuration drift and the three migration stages. Local tests do not mean the live handoff has executed.

After the handoff, stage the separately inspected SOL/e/acc factory artifact, obtain fresh code-upgrade review/signatures, execute it, and run live Devnet launch, trade, settlement and payout tests. Nothing in this migration enables public trading or spends mainnet funds.