v0.2.0 — a live market maker: the quote follows the market without a human

The second milestone of PropAMM Forge. The vault from v0.1.0 now has an
off-chain engine behind it: it reads a real price feed, asks a pricing model,
and posts the quote with the pricing authority key when a side moves past the
threshold or the heartbeat is due. When the feed goes silent, the quote is
withdrawn instead of repeated. The pricing model is the one replaceable part:
built in, in Rust, or a process in another language over a line protocol.

WHAT THE MILESTONE PROVES — everything measured by a command, not by eye

SC-003 a quote update reaches the network 1 slot after a price move
of more than 5 bps (p95; max 2, 0 missed of 200 moves, both models)
against a budget of 2 slots
SC-011 a second pricing model plugs in without touching the transport:
the same engine binary, only MODEL_COMMAND changed; 100 of 100
quotes on chain carry the fingerprint of the model that priced them,
for each of the two models
FR-014 the feed goes silent -> the quote is withdrawn on chain in 1.86 s
against a silence bound of 2 s

Gate at the moment of tagging: cargo fmt and clippy -D warnings clean,
396 Rust tests passed (4 ignored — the end-to-end runs and the live feed),
both end-to-end runs passed again on the tagged commit (SC-001: 5 commands,
2.38 s; SC-003, SC-011 and FR-014 reproduced the numbers above),
88 TS tests, the vendored IDL matches target/idl,
the trace sweep is clean across all 36 commits.

WHAT THE MILESTONE DOES NOT PROVE — and this has to be said out loud at the demo

SC-003 is measured on a local network with a scripted price source: a
stand-in Hermes on a local port, with the same format and the same rhythm
as the live one (one event a second). The moment of each move has to be
known exactly, and the live feed cannot give that. Devnet has other
latencies; the number does not carry over to it.

The engine has not been run against the live feed and devnet together.
A 29-minute recording of live Hermes (SOL/USD) showed 6 % of events older
than 5 s and 27 delivery pauses longer than 2 s. With the default bounds the
engine would withdraw the quote several times in half an hour. That is the
correct behaviour, but whether the pauses come from Hermes or from the
network of the recording machine is not yet known.

Nobody consumes the quote yet: there is no router adapter, so SC-005 and
SC-006 are not proven. The observability console, the collector and the
risk loop with an automatic halt are ahead (SC-007, SC-008, SC-009).

Running the engine around the clock on a free RPC tier does not fit:
measured at 2.53 RPC calls per posted quote, the engine alone needs about
1 900 calls an hour. Devnet is for demo windows.

There is no mainnet and no real capital here. The built-in model is a
frame for the team's own pricing, not a trading strategy.

CONSTRUCTION WORTH KNOWING RIGHT AWAY

The update rule compares the sides of the new quote (bid and ask) with the
last quote sent, not the feed price with the mid on chain. That also
catches a new skew after swaps and a wider spread from an external model.

The engine refuses to start if the whole path does not fit inside the
vault's freshness limit read from chain: heartbeat, plus the model's
response budget in slots, plus 2 slots to land. The old quote must stay
fresh until its replacement lands.

What landed is learned by reading the vault, not by polling signatures:
the same number of calls, but it also catches a lost transaction, a late one
that overwrote a newer quote, and a second engine with the same key.

Hermes has required an API key since 2026-08-26 (PYTH_API_KEY).

v0.1.0 — On-chain core: a private AMM that executes swaps at a posted price

The first milestone of PropAMM Forge: a working private AMM on a test network, with capital that belongs to the owner alone.

A vault is deployed from an empty directory in five forge commands, a quote is posted parametrically (mid, spread, skew, size), swaps execute at that quote, and a stale quote or an oversized order is refused on chain.

What is measured

Every number below comes from the test suite or the benchmark, not from an estimate.

Criterion	Result	Budget
SC-001 — empty directory to first swap	5 commands, 2.4 s	15 minutes, 5 commands
SC-002 — swap instruction cost	22 950 CU on the worst pair (Token-2022 with extensions), 18 647 on plain SPL	60 000 CU
SC-004 — swaps at a stale quote	0 of 1 000 attempts, 200 of them deliberately stale	0
SC-010 (partial) — hard inventory bound	0 violations over 695 swaps	0

Gate at the tag: cargo fmt and clippy -D warnings clean, 227 Rust tests (1 ignored — the end-to-end run against a local validator), 88 TypeScript tests, vendored IDL matches the program.

What is in the box

• programs/propamm-vault — the Anchor program: one shared program, one vault per owner and pair; quote, risk limits and inventory guards; events for accounting. Mints with transfer fees, transfer hooks, permanent delegates or default-frozen accounts are refused at deployment, not at the first swap.
• crates/propamm-quote — the quote math, shared by the program and every off-chain consumer, so the quote and the execution cannot diverge.
• crates/propamm-cli — forge init / deploy / fund / quote / status.
• packages/sdk — TypeScript SDK on @solana/kit: vendored IDL, instruction builders, account and event decoders, golden vectors checked against bytes written by Rust.
• apps/web — the operator console prototype on mock data, published at https://propammforge.github.io/PropAMM-Forge/.

How it is put together

• The program bytecode is shared by everyone: "your own AMM" is your own vault, not your own copy of the program. The vault address derives from the owner and the pair, so the pair's direction is part of the address.
• No oracle price is read on chain. The price is set by an off-chain signer (pricing_authority), which is what keeps the swap inside a router's compute budget.
• Capital moves only by the owner; quoting and emergency halt are separate keys that can be handed over without handing over the capital.
• One canonical artifact: SBPFv0 from cargo-build-sbf (303 320 bytes). anchor build is kept only to regenerate the IDL.

Not here yet

Said plainly, because a demo without this list gives a false impression of what has been proven:

• No pricing engine — quotes are posted by hand through forge quote.
• No aggregator adapter and no router integration.
• No console on real data — every figure in apps/web is drawn, not observed.
• No risk loop — no automatic halt or daily-loss limits.
• No mainnet and no real capital — everything runs on a local validator and devnet with test tokens. Nothing here says how the vault behaves under a real order flow or real MEV.

Program ID: 77Y9n3vWE2noN1u9PTshuWxdDRsrw9UMtejBypUD9wjq.