v0.3.0 — Cover that runs as a deployment

Three attestors and the API now run on a server of their own, and a compromise
of a protocol's admin key is paid out by those attestors alone, in seconds, with
anyone able to watch.

Details

• Against the hosted attestors on devnet (2026-10-09): 10 of 10 reproduced
  compromises paid out, one incident per event, slowest cycle 4.2s (was ~20s at
  v0.1.0); the declared-maintenance control was left alone
• The vote that completes the quorum carries the payout in the same instruction
  (FR-012)
• p95 confirmation -> payout 10s over 20 runs, $0.006 in fees per incident
  (were 12s and $0.008)
• The app and the landing page read real devnet data through a public read-only
  API; /health shows how far each attestor has looked and goes red when one
  falls silent
• Attestors pick up newly registered protocols without a restart; an event from
  before a policy began is not covered
• mandate-declare CLI: a covered protocol submits, narrows and revokes its own
  declarations
• devnet:compromise:hosted reproduces the run with no workers of its own

What is not here yet
The capital and the policies are ours; every attestor is run by us and stakes
nothing; no mainnet, no external audit.

Migration
New Postgres cache since v0.1.0: run pnpm --filter @mandate/db db:migrate
(with DATABASE_MIGRATION_URL) before starting the API on a fresh deployment.
The existing deployment is already migrated.

v0.1.0 — Cover that pays itself out

What's new

Parametric cover for Solana protocols, live on devnet — when a protocol's
privileged admin access is used in a way it never declared, the pool pays the
protocol's treasury automatically. No claim, no assessor, no human in the loop.

Measured on devnet

	Budget	Result
Compromise shapes recognised, of ten reproduced	≥ 9	10
False incidents, over 819 real historical privileged transactions	0	0
Offending transaction → money in the treasury	≤ 180s	~20s
Confirmation → payout initiated (p95)	≤ 30s	12s
Fees to carry one incident	≤ $1.00	$0.008

The control matters as much as the count: a maintenance operation the protocol
had declared in advance is left alone. Without that, "ten of ten" is equally the
score of a system that opens an incident on everything it sees.

Deployment

Program DsRdHv4QRYQ7teVhwuLVttktF792gvDFQdiuraQ4eF4P on Solana devnet.
Demo interface: https://mandate210.github.io/mandate/

What this release is not

• The web interface still runs on mock data.
• The capital in the pool and the policies are ours; outside underwriters cannot
  deposit yet.
• Every attestor is run by us, so quorum independence is arithmetic rather
  than factual.
• On devnet the declaration delay is 30s where the product parameter is 24h, and
  the settlement asset is our own mint. Both are fixed forever in that deployment
  and are properties of the demonstration.
• No mainnet and no external audit.