Programs reference
The three Anchor programs that make up Entros, with their instructions and accounts.
Entros is built around three on-chain programs and one voter-weight plugin. All programs are built with Anchor 0.32.1 and deployed to Solana devnet.
Framework roadmap. The on-chain programs use Anchor today. The team will measure current transaction costs before deciding whether any hot path should move to Pinocchio. No framework migration is committed.
entros-anchor
GZYwTp2ozeuRA5Gof9vs4ya961aANcJBdUzB7LN6q4b2Owns the Anchor identity state. Holds per-wallet IdentityState PDAs and Token-2022 NonTransferable mints.
Instructions
| Instruction | Purpose |
|---|---|
mint_anchor | Initialize a new Anchor after an enforced validator-signed receipt. Charges the protocol fee. |
update_anchor | Re-verification path. Validates a fresh proof against the current commitment, advances the score, overwrites current_commitment. |
reset_identity_state | Recovery path. Zeroes the score and clears the fingerprint commitment after a 7-day cooldown. Charges the fee. |
authorize_new_wallet | First step of wallet migration. Old + new wallets co-sign to record the successor and delegate the identity token. |
migrate_identity | Second step of wallet migration. The authorized new wallet completes the move; the old mint is closed. |
set_encrypted_baseline | Stores the wallet-encrypted baseline blob so a returning user can recover their baseline from chain. |
rebaseline_anchor | Re-commits the identity under a new projection version. Gated by its own cooldown. |
Accounts
| Account | Seeds | Purpose |
|---|---|---|
IdentityState | ["identity", user] | Score, fingerprint commitments, verification metadata |
Mint | ["mint", user] | Token-2022 NonTransferable mint for the identity NFT |
MintAuthority | ["mint_authority"] | Program-owned authority for all mints |
entros-verifier
4F97jNoxQzT2qRbkWpW3ztC3Nz2TtKj3rnKG8ExgnrfVVerifies Groth16 proofs for re-verification. verify_proof writes a VerificationResult PDA. update_anchor reads that result through constraints bound to the verifier program. Neither program invokes the other.
Artifact generation. The deployed verifier, web client, mobile client, and native prover share the current generation. The
circuitssource and key directory describe an unpublished successor. A coordinated migration must update every consumer together.
Instructions
| Instruction | Purpose |
|---|---|
create_challenge | Records a client-supplied nonce for replay defense |
verify_proof | Validates a Groth16 proof against the on-chain verification key. Stores a VerificationResult. |
close_challenge | Releases rent on a consumed challenge |
close_verification_result | Releases rent on a consumed verification result |
Accounts
| Account | Seeds | Purpose |
|---|---|---|
Challenge | ["challenge", challenger, nonce] | Per-challenge replay record |
VerificationResult | ["verification", verifier, nonce] | Proof outcome record |
Public inputs
The Groth16 circuit takes four public inputs:
| Input | Meaning |
|---|---|
commitment_new | Poseidon commitment of the new behavioral fingerprint |
commitment_prev | Commitment of the previous fingerprint |
threshold | Maximum allowed Hamming distance (default 96 of 256 bits) |
min_distance | Minimum required distance, for anti-replay (default 3) |
entros-registry
6VBs3zr9KrfFPGd6j7aGBPQWwZa5tajVfA7HN6MMV9VWStores protocol configuration, the treasury, validator-registration scaffolding, and the validator signing key. The current verification path does not select registered validators or aggregate a quorum.
Instructions
| Instruction | Purpose |
|---|---|
initialize_protocol | One-time setup of the protocol config |
update_protocol_config | Authority-only update to verification_fee |
set_validator_pubkey | Authority-only write of the validator pubkey used for the mint-receipt binding. Extends a legacy config account when required. |
migrate_admin | Emergency administrative migration of the protocol authority |
register_validator | Deposit SOL and create validator registration state. Selection and assignment remain future work. |
compute_trust_score | Read-only preview of what a score would be given a verification history |
unstake_validator | Return the registered SOL stake immediately and close the validator state |
withdraw_treasury | Authority-only treasury withdrawal |
Stored configuration
| Field | Type | Purpose |
|---|---|---|
min_stake | u64 | Minimum SOL deposit for validator registration scaffolding |
challenge_expiry | i64 | Seconds before an unconsumed challenge is invalid |
max_trust_score | u16 | Cap on the score (10000 on devnet) |
base_trust_increment | u16 | Per-verification increment baseline |
verification_fee | u64 | Lamports charged per verification (default 5_000_000 = 0.005 SOL) |
migration_fee | u64 | Lamports read by the wallet-migration path. No public setter exists today. |
validator_pubkey | Pubkey | Signing key accepted by the first-verification receipt check |
initialize_protocol sets these fields. The current update_protocol_config instruction changes only verification_fee. set_validator_pubkey rotates the signing key.
entros-voter-weight
99nwXzcugse3x8kxE9v6mxZiq8T9gHDoznaaG6qcw534On-chain Realms voter-weight prototype. It reads the voter's Entros Anchor and writes weight 1 when the score and recency checks pass. An ineligible update returns an error.
The JavaScript client, Governance UI registration, automatic vote transaction construction, and plugin chaining remain planned. See the Realms integration guide.
Instructions
| Instruction | Purpose |
|---|---|
create_registrar | Initialize a per-realm registrar with min_trust_score and max_verification_age |
update_registrar | Update the registrar's threshold and recency configuration |
close_registrar | Close a registrar and recover rent |
create_voter_weight_record | Initialize a voter's weight record |
update_voter_weight_record | Recompute the voter's weight against their Entros Anchor |
close_voter_weight_record | Close a voter weight record |
create_max_voter_weight_record | Initialize the realm-wide maximum-weight record |
update_max_voter_weight_record | Recompute the maximum-weight record |