Upgrade Policy#

This policy records the release-review expectations for Seesaw program upgrades and admin authority control. It complements docs/operations/governance-runbook.md; the runbook remains the operational source for proposal construction, simulation, execution, and rollback.

Release Signoff Boundary#

The Solana program is upgradeable unless the release evidence proves an immutable no-upgrade-authority state. Do not describe a release as immutable, trustless in the upgrade sense, or fully production ready until the evidence bundle records the current ProgramData account, upgrade authority, config authority, multisig/governance control, deploy or upgrade signatures, and finalized/rooted slot evidence.

The external release evidence must remain the source of truth for:

• Program ID, ProgramData address, deployed program hash, and release build artifact hash.
• Upgrade authority and config authority.
• Multisig/governance proposal, quorum, signer set, approval, execution, and rollback plan.
• Before and after Config snapshots for admin parameter changes.
• Reviewer signoff for the exact release commit.

Required Reviews#

Before public launch or any production upgrade, attach evidence for:

1. ProgramData/config account review against mainnet-beta.
2. Production multisig or immutable authority control.
3. Governance runbook review for the release commit.
4. Simulation output for any upgrade or admin-only instruction.
5. Finalized execution evidence for any production proposal.
6. Rollback proposal or rollback plan.
7. STRAT-9 signoff from docs/operations/business-legal-security-signoff.md.

These reviews are external signoff requirements. This document does not claim they have been completed.