ADR-0005: Execution environment: fork the SVM, wrap it deterministically

Fork Agave's SVM rather than reimplement: bug-for-bug compatibility is the product promise the compatibility matrix depends on, and divergence risk is the one risk we cannot bound. Costs accepted: upstream…

Status: accepted (accepted — spike confirmed (onchain/svm-spike, SPIKE-OK)). Dated 2026-08-15.

Status: accepted — spike confirmed 2026-08-15 (onchain/svm-spike, SPIKE-OK) · Prompt: §5 D3, §6 C1

Spike result: the deployed solieum_scc.so executes in-process on the forked runtime (solana-program-runtime 1.18.26 + BPF loader + system builtin) with no validator, no RPC, no wall clock; two independent executions of initialize from identical genesis produce byte-identical state roots at 14 583 CU. The fork decision stands.

Decision (to be confirmed by the Step 4 spike)

Fork Agave's SVM rather than reimplement: bug-for-bug compatibility is the product promise the compatibility matrix depends on, and divergence risk is the one risk we cannot bound. Costs accepted: upstream tracking treadmill; a wrapping layer that pins every divergent surface (Clock semantics, rent, fee accounting) explicitly per the matrix.

Determinism charter applies with no exceptions

The fraud proof is worthless if two honest nodes disagree: no floats, no map-order dependence, no wall-clock, byte-identical state roots across machines — enforced by a CI harness replaying identical blocks on different hosts (§7.3) from Step 5 onward.

Spike exit criteria (Step 4)

Run recorded Solana transactions through the forked SVM in a harness; diff account states against mainnet reality; produce the first honest rows of the compatibility matrix from observation, not intention.

Reversal trigger

If the fork's surface proves un-pinnable across upstream releases, reimplement the narrow subset instead — with the matrix shrinking to what is actually supported, stated publicly.