Repository navigation
The second milestone of PropAMM Forge. The vault from v0.1.0 now has an
off-chain engine behind it: it reads a real price feed, asks a pricing model,
and posts the quote with the pricing authority key when a side moves past the
threshold or the heartbeat is due. When the feed goes silent, the quote is
withdrawn instead of repeated. The pricing model is the one replaceable part:
built in, in Rust, or a process in another language over a line protocol.
WHAT THE MILESTONE PROVES — everything measured by a command, not by eye
SC-003 a quote update reaches the network 1 slot after a price move
of more than 5 bps (p95; max 2, 0 missed of 200 moves, both models)
against a budget of 2 slots
SC-011 a second pricing model plugs in without touching the transport:
the same engine binary, only MODEL_COMMAND changed; 100 of 100
quotes on chain carry the fingerprint of the model that priced them,
for each of the two models
FR-014 the feed goes silent -> the quote is withdrawn on chain in 1.86 s
against a silence bound of 2 s
Gate at the moment of tagging: cargo fmt and clippy -D warnings clean,
396 Rust tests passed (4 ignored — the end-to-end runs and the live feed),
both end-to-end runs passed again on the tagged commit (SC-001: 5 commands,
2.38 s; SC-003, SC-011 and FR-014 reproduced the numbers above),
88 TS tests, the vendored IDL matches target/idl,
the trace sweep is clean across all 36 commits.
WHAT THE MILESTONE DOES NOT PROVE — and this has to be said out loud at the demo
SC-003 is measured on a local network with a scripted price source: a
stand-in Hermes on a local port, with the same format and the same rhythm
as the live one (one event a second). The moment of each move has to be
known exactly, and the live feed cannot give that. Devnet has other
latencies; the number does not carry over to it.
The engine has not been run against the live feed and devnet together.
A 29-minute recording of live Hermes (SOL/USD) showed 6 % of events older
than 5 s and 27 delivery pauses longer than 2 s. With the default bounds the
engine would withdraw the quote several times in half an hour. That is the
correct behaviour, but whether the pauses come from Hermes or from the
network of the recording machine is not yet known.
Nobody consumes the quote yet: there is no router adapter, so SC-005 and
SC-006 are not proven. The observability console, the collector and the
risk loop with an automatic halt are ahead (SC-007, SC-008, SC-009).
Running the engine around the clock on a free RPC tier does not fit:
measured at 2.53 RPC calls per posted quote, the engine alone needs about
1 900 calls an hour. Devnet is for demo windows.
There is no mainnet and no real capital here. The built-in model is a
frame for the team's own pricing, not a trading strategy.
CONSTRUCTION WORTH KNOWING RIGHT AWAY
The update rule compares the sides of the new quote (bid and ask) with the
last quote sent, not the feed price with the mid on chain. That also
catches a new skew after swaps and a wider spread from an external model.
The engine refuses to start if the whole path does not fit inside the
vault's freshness limit read from chain: heartbeat, plus the model's
response budget in slots, plus 2 slots to land. The old quote must stay
fresh until its replacement lands.
What landed is learned by reading the vault, not by polling signatures:
the same number of calls, but it also catches a lost transaction, a late one
that overwrote a newer quote, and a second engine with the same key.
Hermes has required an API key since 2026-08-26 (PYTH_API_KEY).