Attestation ledger
An Anchor program where reviewers publish verdicts, bound to the deployed bytes, and co-sign each other's reviews.
The flow
- A registry authority creates a registry, adds reviewers and sets a k-of-n threshold.
- A reviewer runs
tidemark attest: the CLI fetches the deployed program, reviews it against the pre-upgrade snapshot and publishes the verdict hash. - Other reviewers run
tidemark approve, which re-runs the whole review and co-signs only if they reach the same verdict. - An entry is final at k approvals. Anyone can check the chain with
verify-ledgeror the web app.
What v3 guarantees
| Property | How |
|---|---|
| Reviewed bytes are the deployed bytes | attest reads the program's ProgramData on chain, hashes the ELF itself and refuses unless it equals the reviewed hash; it records the deploy slot |
| Approvals cover every field | each approval signs SHA-256("tidemark/approval/v1" ‖ entry_hash); the entry hash covers program, hashes, risk, rules, deploy slot and config version |
| The registry survives key rotation | its address comes from the first authority, stored as seed_key; rotation only changes a field |
| Reviewer changes are visible | config_version bumps on every reviewer, threshold or authority change and is recorded per entry |
| Entries can't be edited or dropped | each entry hashes the previous one; clients recompute every link and PDA |
| No double votes | one Approval account per reviewer per entry |
Verify a registry
shell
tidemark verify-ledger --program 8f43wqFP4wZ8NLrJgBrGXDrXp92FgxSvM9Ng21GrgPq6 \ --registry GpkPYw7vbvyj3mZAKQY4zbsD9Pojtnpk78Sf4AQCsc9v \ --rpc https://api.devnet.solana.com --rpc <SECOND_RPC>
It also prints the ledger program's own upgrade authority and warns if the ledger was redeployed after entries were written, and it counts approvals by reviewers added after an entry.
Deployments
| Version | Program id | Status |
|---|---|---|
| v3 | 8f43wqFP4wZ8NLrJgBrGXDrXp92FgxSvM9Ng21GrgPq6 | Live on devnet. Registry GpkPYw7vbvyj3mZAKQY4zbsD9Pojtnpk78Sf4AQCsc9v: the demo upgrade, bound to its deploy slot and co-signed 2 of 2 |
| v2 | BFZg7MYzVzz1YypfmF2B6p842CXx33SBFGmSGep2TLLc | Live on devnet, still verified by every client. Registry 72HSqJR6Y2uiedNWVQxDDRXYr9LjB4cDUn3Me2AtenxU |
Who controls the ledger itself
Both devnet ledgers can only be upgraded through a Squads v4 multisig (
8jGmTqcvXfp8taPTq6u5Tmorbu7pByKGDmy4eYU2xki9): 2 of 3 members approve, then a one-hour timelock runs before the upgrade can execute. On devnet one maintainer holds all three member keys, so this demonstrates the mechanism, not independent control. Next come independent members, a longer timelock, and freezing the program; v3 is built for SBPF v3 so it can still be frozen after SIMD-0500.