Solana memo anchor is devnet — non-authoritative chain-of-custody

Start by reading scripts/attest.mjs to confirm the default Solana network, then find the attestation PDF template and the SECURITY.md “Security pipeline” section. Add the specified devnet caveat to the PDF and document the default and change requirements in SECURITY.md; done means both acceptance criteria are present and accurate.

Source: manual-review
External ID: n/a
Severity: low
Decision: accept-risk
Control mapping: ssdf-ps.1 (provenance)
Labels: kind/compliance, area/compliance, domain/attestation,
compliance/ssdf-ps.1, priority/p3, effort/s

Description

scripts/attest.mjs defaults SOLANA_NETWORK to devnet when not
set. Solana devnet has no settlement guarantees: it is a development
ledger that can be wiped or reset by the cluster operator. Memo
transactions land on a ledger that is not durable in the legal /
audit sense.

For the project's stated purpose (demo of an evidence pipeline
including on-chain anchoring), devnet is appropriate. As a non-
repudiable chain-of-custody anchor for real compliance evidence,
devnet is demonstration, not assurance.

Justification

This is a single-maintainer OSS project, not a regulated production
system. Mainnet anchoring would require a real SOL-funded keypair
and a non-trivial operational commitment. Devnet is the correct
choice for current scope.

Removal / re-evaluation condition

Re-evaluate if (a) the project is used to attest evidence consumed by
an actual auditor or regulator, OR (b) the public-facing pitch
implies "blockchain-anchored compliance" without the "(devnet)"
qualifier.

Acceptance criteria

• Add a one-line caveat to the attestation PDF template clarifying
  "Solana (devnet) — demonstration anchor, not audit-grade
  ledger" (currently the PDF just says "Network: Solana
  (devnet)" which is technically correct but easy to miss).
• SECURITY.md "Security pipeline" section explicitly notes that
  the Solana anchor is devnet by default and what changing it
  requires.