Growth Program: from sensors to Solana devnet

01 / THE NEW BOUNDARY

A score contract became useful for physical custody—and real enough to verify on devnet.

Growth Program v2 now has an experimental Solana devnet identity and a broader product story: the same bounded, versioned score receipt can describe a team, a software project, a consenting contributor, or how well a physical asset was cared for during one period.

This is a continuation, not a rewrite. The earlier Growth Program build note freezes commit d944ee7: legacy containment, the hardened contract, the no-network simulator, and the isolated-validator proof before any public deployment. This note freezes commit 3497678, where the product surface expands and the candidate program plus IDL are recorded on devnet.

The devnet deployment closes the placeholder-identity gap. It does not close custody, independent reproduction, external audit, adversarial testing, indexer, soak, or public UI gates. The repository's decision remains NO-GO beyond experimental devnet.

02 / FROM LOCAL PROOF TO PUBLIC CANDIDATE

The delta is small in Git and large in what can now be claimed.

Commit d944ee7 proved the real Anchor program only on a disposable local validator under a provisional identity. Commit 3497678 changes the declared program address across source, IDL, local tooling, website copy, and tests; adds the dated devnet deployment manifest; and expands the use-case page with sensor-backed physical custody.

Exact release boundarytext · source

$ git diff --stat d944ee7..3497678
# 30 files changed, 718 insertions(+), 116 deletions(-)

The delta does two jobs:
1. expand the product map from people and projects into sensor-backed custody;
2. replace the provisional local identity with a recorded experimental devnet deployment.

The earlier Build Note remains a correct historical snapshot at d944ee7.
This note freezes the next public state at 3497678.

Question	Build Note 006	This release
Where does code execute?	Isolated local validator only	Local validator plus one experimental devnet program
What identity is authoritative?	Provisional test address	Devnet program `DA9e…DAVE`
What can be scored?	Teams, projects, contributors	Those three plus sensor-backed asset custody and 18 adjacent hypotheses
Is there a live public client?	No	No—the hosted simulator remains network-disabled
Release decision	NO-GO for devnet deployment	Deployed experimentally; NO-GO beyond that boundary

03 / WHY THE PRIMITIVE TRAVELS

The reusable part is not “growth.” It is a policy-bound assessment receipt.

The contract never decides whether a team is healthy or a cold room was managed safely. It provides bounded arithmetic, versioned rubrics, period ordering, consent and lifecycle rules, commitments, and append-style assessment history. Domain meaning stays in the issuer's rubric and evidence policy.

POLICY ENVELOPEOrganization · rubric identity · evidence rules · period policyThe comparison boundary that makes a score interpretable

PEOPLE SYSTEMTeamdelivery · quality · collaboration

TECHNICAL SYSTEMProjectsecurity · reliability · governance

CONSENTING PERSONContributorcraft · stewardship · mentorship

PHYSICAL SYSTEMAsset recordcontroller wallet · custody · rotation

Shared receiptscore vector · weighted result · coverage · evidence commitmentCompare only within the same Organization, Rubric identity, evidence rules, and compatible period policy.

One receipt shape, different subjectsThe contract does not define what growth means. An Organization, Rubric identity or commitment, evidence policy, and compatible period policy give one bounded score vector its meaning. A subject public key can control a team, project, contributor profile, or physical-asset record; an asset therefore needs a controller wallet and custody policy.

The invariant under every use casetext · source

Meaning = Organization + Rubric identity/commitment
        + evidence policy + assessment period

Subject public key may represent:
  team controller | project controller | contributor
  asset-associated controller | operational-unit controller

Stored assessment:
  per-pillar score_bps + sample_count + coverage_bps
  weighted_score_bps + weighted_coverage_bps
  period_start + period_end + expires_at
  rubric_commitment + evidence_commitment

Comparison rule:
  compare only inside the same Organization and Rubric identity/commitment,
  under the same evidence policy and a compatible period policy

This distinction prevents a dangerous product slide. “Create a growth contract” in the playground means create an Organization PDA and a versioned Rubric inside one shared program. It does not deploy a new executable. And a ranking shown by a website is not on-chain truth: comparisons are defensible only when Organization, Rubric identity or commitment, evidence rules, and compatible period policy are genuinely shared.

On chain, every subject is a public key. A physical-asset workflow therefore needs an asset-associated controller wallet, plus explicit custody, recovery, and rotation rules for every lifecycle action that requires the subject signature. The program does not make a freezer, tank, or shipment sign for itself.

04 / SENSOR EVIDENCE

The contract receives a grade, not a firehose of readings.

A proposed physical-asset workflow begins with sensors and inspections, but those systems stay off chain. In that architecture, an adapter would check provenance, calibration, signatures, missing intervals, and exceptions before an accountable issuer applies one published rubric to bounded aggregates. Only then would a signed assessment reach Growth v2. The pinned repository does not yet implement or test this adapter or a telemetry verifier.

01 / OBSERVESensorstimestamped readings + inspections

02 / VALIDATEProposed adapterprovenance · calibration · gaps · signatures

03 / GRADEAccountable issuerapply one published rubric version

04 / COMMITGrowth v2aggregates · period · rubric · commitment

OFF CHAINraw telemetry, calibration records, signatures, exception evidence

ON CHAINwho attested, which policy, which period, bounded aggregates, one hash

Integrity boundary: the hash can detect later change; it cannot establish sensor truth.

Proposed observe, validate, grade, commit pipelineProposed architecture, not an implemented repository service: sensors never call the Solana program. Raw telemetry would stay in a governed off-chain evidence system; an adapter would validate it, the issuer would grade bounded aggregates, and Growth v2 would store the declared result and commitment.

Proposed off-chain evidence envelope, illustrativeJSON + pseudocode

// Illustrative off-chain evidence envelope—not an on-chain account.
{
  "schema": "growth-evidence@1",
  "subject": "cold-room:BOS-03",
  "window": { "start": "2026-08-01", "end": "2026-08-31" },
  "sources": [
    { "logger": "T-07", "calibrationCurrent": true, "signed": true }
  ],
  "validation": {
    "expectedSamples": 43200,
    "coverageBps": 9980,
    "excursionMinutes": 11
  },
  "rubric": "COLD-CUSTODY/v3",
  "aggregates": ["five bounded pillar results"],
  "rawTelemetry": "private; retained and disclosed by policy"
}

canonical_payload = canonical_json(bundle)
private_salt = cryptographically_random_bytes(>= 16)

evidence_commitment =
  SHA-256("growth-v2:evidence:v1" || 0x00 || private_salt ||
          0x00 || canonical_payload)

authorized verification discloses canonical_payload + private_salt
through the evidence system's controlled channel

Keeping raw telemetry off chain protects commercial routes, facility operations, and detailed environmental histories from automatic public disclosure. The evidence commitment can later detect whether a disclosed canonical bundle changed when an authorized verifier receives both the bundle and its private salt through a controlled channel. It cannot establish that a logger was installed correctly, that calibration evidence is genuine, or that the issuer did not omit inconvenient readings. The envelope above is article-authored pseudocode; only its domain-separated, salted hash construction follows the repository's commitment guidance.

05 / WORKED EXAMPLE

A month of cold-room operations becomes one inspectable custody receipt.

The website's synthetic BOS-03 example starts with 43,200 expected readings, 99.8% valid coverage, two excursions totaling 11 minutes, a four-minute median response, and a current calibration record. Five declared weights produce a 96.1 result.

BOS-03 synthetic score calculationtext · source

Thermal compliance    40% × 96 = 38.4
Monitoring coverage  20% × 99 = 19.8
Excursion response   20% × 94 = 18.8
Calibration integrity 10% × 100 = 10.0
Access discipline    10% × 91 =  9.1
                                      ────
Synthetic weighted result             96.1 / 100

Context carried beside the result:
  43,200 expected samples · 99.8% valid coverage
  2 excursions / 11 minutes · 4-minute median response
  rubric COLD-CUSTODY/v3 · illustrative evidence hash

The useful object is not “96.1” by itself. It is 96.1 under COLD-CUSTODY/v3, for one declared window, with 99.8% coverage, five visible weights, an accountable assessor, and a commitment to the evidence bundle. A later rubric or a different issuer creates a different comparison boundary.

The example was informed by the World Health Organization's temperature-mapping guidance. It is synthetic; it is not a WHO certification, regulatory finding, or claim about a real facility.

06 / PHYSICAL-ASSET MAP

Six concrete scenarios test whether the abstraction survives contact with operations.

The repository turns six established monitoring practices into protocol hypotheses. Each one needs its own rubric, issuer qualification, calibration rules, privacy policy, and dispute process; the linked agencies describe the operating domain, not an endorsement of this protocol.

Scenario	Possible subject	Illustrative evidence	Practice anchor
Medicine cold-room custody	Room, freezer, shipment, or lot	Temperature distribution, excursions, logger coverage, calibration, response time	WHO
Museum and archive preservation	Gallery, archive room, case, or zone	Humidity, stability, light, pollutants, vibration, uptime, conservation response	NPS
Grain silo stewardship	Bin, silo, commodity lot, or season	Temperature gradients, moisture, CO₂, aeration, hot spots, sampling coverage	USDA
Underground tank integrity	Tank, piping system, or inspection period	Inventory variance, alarms, gauge status, sensor tests, calibration, acknowledgement	EPA
Battery storage safety	Rack, enclosure, site, or operating window	Temperature spread, vent gas, alarms, redundancy, isolation time, maintenance	DOE
Refrigerated food transport	Vehicle, container, route, handoff, or load	Pre-cooling, time–temperature history, door events, uptime, cleaning, handoff	FDA

The same page carries 18 adjacent explorations—bringing the displayed map to 27 concepts when combined with the original three templates and six detailed sensor cases. They are a product backlog, not shipped integrations.

HYPOTHESIS 01