v0.1.0 — On-chain core: a private AMM that executes swaps at a posted price

The first milestone of PropAMM Forge: a working private AMM on a test network, with capital that belongs to the owner alone.

A vault is deployed from an empty directory in five forge commands, a quote is posted parametrically (mid, spread, skew, size), swaps execute at that quote, and a stale quote or an oversized order is refused on chain.

What is measured

Every number below comes from the test suite or the benchmark, not from an estimate.

Criterion	Result	Budget
SC-001 — empty directory to first swap	5 commands, 2.4 s	15 minutes, 5 commands
SC-002 — swap instruction cost	22 950 CU on the worst pair (Token-2022 with extensions), 18 647 on plain SPL	60 000 CU
SC-004 — swaps at a stale quote	0 of 1 000 attempts, 200 of them deliberately stale	0
SC-010 (partial) — hard inventory bound	0 violations over 695 swaps	0

Gate at the tag: cargo fmt and clippy -D warnings clean, 227 Rust tests (1 ignored — the end-to-end run against a local validator), 88 TypeScript tests, vendored IDL matches the program.

What is in the box

• programs/propamm-vault — the Anchor program: one shared program, one vault per owner and pair; quote, risk limits and inventory guards; events for accounting. Mints with transfer fees, transfer hooks, permanent delegates or default-frozen accounts are refused at deployment, not at the first swap.
• crates/propamm-quote — the quote math, shared by the program and every off-chain consumer, so the quote and the execution cannot diverge.
• crates/propamm-cli — forge init / deploy / fund / quote / status.
• packages/sdk — TypeScript SDK on @solana/kit: vendored IDL, instruction builders, account and event decoders, golden vectors checked against bytes written by Rust.
• apps/web — the operator console prototype on mock data, published at https://propammforge.github.io/PropAMM-Forge/.

How it is put together

• The program bytecode is shared by everyone: "your own AMM" is your own vault, not your own copy of the program. The vault address derives from the owner and the pair, so the pair's direction is part of the address.
• No oracle price is read on chain. The price is set by an off-chain signer (pricing_authority), which is what keeps the swap inside a router's compute budget.
• Capital moves only by the owner; quoting and emergency halt are separate keys that can be handed over without handing over the capital.
• One canonical artifact: SBPFv0 from cargo-build-sbf (303 320 bytes). anchor build is kept only to regenerate the IDL.

Not here yet

Said plainly, because a demo without this list gives a false impression of what has been proven:

• No pricing engine — quotes are posted by hand through forge quote.
• No aggregator adapter and no router integration.
• No console on real data — every figure in apps/web is drawn, not observed.
• No risk loop — no automatic halt or daily-loss limits.
• No mainnet and no real capital — everything runs on a local validator and devnet with test tokens. Nothing here says how the vault behaves under a real order flow or real MEV.

Program ID: 77Y9n3vWE2noN1u9PTshuWxdDRsrw9UMtejBypUD9wjq.