Resolution Engine
magma_resolution is MAGMA's dedicated, hardened on-chain resolution committee — the program a
market's outcome is committed and finalized through. It is the successor to the single-key resolver:
where the earlier design let one authority key sign a verdict, magma_resolution requires a
distinct-signer N-of-M oracle committee, adds a 48-hour finalize timelock, and gives the
admin a configure-only role that can never resolve a market.
The program is not on-chain. Its devnet manifest carries "deployed": false, and it is listed as
"deploy-ready, not deployed" — the program id is bound to a real, verified deploy keypair (not a
placeholder), pending the founder running the deploy runbook (issue #258). The off-chain engine
and its crank are also gated OFF (RESOLUTION_ENGINE_ENABLED = 0, shadow mode moves only bonds
and never settles collateral). Until this ships, MAGMA markets resolve through the live
Oracle Brain; this page documents where resolution is heading, not what
settles payouts today.
The committee threshold — distinct-signer N-of-M (≥3-of-5)
A verdict is accepted only when N distinct members of the authorized oracle signer set attest the same outcome. This replaces the pre-hardening single-key (1-of-1) committee; the verdict authority is now the oracle-signer set, not any single key or model.
| Constant | Value | Meaning |
|---|---|---|
MAX_ORACLE_SIGNERS | 5 | Maximum authorized signers in the set (M) |
MIN_ORACLE_THRESHOLD | 3 | Mainnet floor for the distinct-signer threshold (N) |
| Rule | N ≤ M, N ≥ 3 | e.g. 3-of-5; enforced by require!(signer_count ≥ threshold) |
set_oracle_committeerequiresthreshold ≥ MIN_ORACLE_THRESHOLD(3) unless a documented testnet escape hatch is explicitly enabled.- Duplicate signatures are collapsed via a signer bitmap — the same signer cannot be counted twice.
- The committee fails closed until a set is configured.
Who holds the M keys is an operations choice (independent operators / oracle nodes). The program encodes a threshold over an authorized key set; it does not encode "a model decides." A separate multi-model advisory council may inform a signer's verdict off-chain, but it is review-only — it never auto-finalizes, never writes a resolution, and never signs on-chain.
The finalize timelock — 48 hours
| Constant | Value | Meaning |
|---|---|---|
DEFAULT_FINALIZE_TIMELOCK_SECS | 172_800 | Mainnet-default finalize / dispute window — 48h |
MIN_FINALIZE_TIMELOCK_SECS | 21_600 | Hard floor — 6h; update_config rejects anything shorter (outside the testnet flag) |
A standing verdict is never settleable before its window elapses (require!(now > challenge_ends_at)), and the window is snapshotted per-market at open, so a later config change
cannot shorten a live market's window.
The admin configures only — it cannot resolve
The admin role is deliberately bounded. There is no admin path that resolves a market or settles a dispute — verdicts flow only through the N-of-M distinct oracle signers.
| Admin can | Admin cannot |
|---|---|
set_oracle_committee — rotate the signer set (M) and threshold (N) | Resolve or finalize a market |
update_config — tune the finalize timelock, fee, the paused kill-switch, hand off admin (to a Squads key) | Settle a dispute |
| Pause the program (blocks verdict submission / open / finalize / settlement) | Override, inject, or bypass a verdict — even while paused |
Every admin instruction is bound by has_one = admin. The paused kill-switch is a safety brake,
not a resolution path.
The admin panel — built and gated
An operator-facing admin panel exists and is gated off by default:
- Backend (
/v1/admin/resolution/*) is admin-guarded and gated byRESOLUTION_ADMIN_ENABLED(default OFF). It is UNDEPLOYED-aware: it builds IDL-free instructions and, by default, returns an unsigned transaction for a wallet / Squads multisig to sign. Sending is refused while the program is undeployed. - Frontend (the auth-gated
/oracle/adminroute) surfaces an activation state —disabled → awaiting-deploy → awaiting-init → live— and shows an "awaiting deploy (#258)" status while the program is off-chain. No program key ever lives in the browser.
The panel's own canonical honesty string: the admin configures the committee / timelock / pause only; the admin cannot resolve a market — a verdict requires N-of-M distinct oracle signers.
Relationship to the live Oracle Brain
| Oracle Brain | magma_resolution (this page) | |
|---|---|---|
| Status | Live on devnet — settles payouts today | Built, deploy-ready, gated OFF (#258) |
| Where | submit_oracle_resolution / finalize_resolution on magma_backing_vault | Dedicated magma_resolution program |
| Committee | M-of-N oracle processes over a multi-source verdict | Distinct-signer ≥3-of-5 oracle threshold |
| Admin | Public scorecard dispute framework | Configure-only; cannot resolve |
| Timelock | 48h challenge window | 48h finalize timelock (6h floor), snapshotted per market |
Shield has its own variant of this engine that adds a mandatory security-council gate — see Shield — Resolution.