# Livre Wallet Mainnet Beta Runbook

Date: 2026-05-14

This is the execution runbook for moving Livre Wallet from devnet beta to a small mainnet beta. Do not publish a mainnet build until every required value below is filled in and the tiny end-to-end test passes.

## Required Values

| Item | Value | Status |
| --- | --- | --- |
| Multisig threshold | TBD, recommended `2-of-3` for beta | Open |
| Multisig signer 1 | TBD | Open |
| Multisig signer 2 | TBD | Open |
| Multisig signer 3 | TBD | Open |
| Final protocol fee wallet | TBD | Open |
| Mainnet shielded pool program ID | TBD after deploy | Open |
| Mainnet verifier/program IDs | TBD after deploy | Open |
| Mainnet relayer wallet | TBD | Open |
| Mainnet API endpoint | `https://api.solprivatewallet.com` | Planned |
| Mainnet website | `https://solprivatewallet.com` | Live |
| Tiny test amount | TBD, use the smallest supported mainnet pool | Open |

Track the exact final values in `MAINNET_VALUES.md`.

## Authority Plan

Use a multisig upgrade authority during early beta so one lost key or one compromised signer cannot silently upgrade the program.

Recommended beta posture:

- Use `2-of-3` multisig if the signer group is small and trusted.
- Publish the signer public keys or a clear signer policy before mainnet launch.
- Keep an upgrade log in release notes for every beta program upgrade.
- After testing and review, freeze or remove upgrade authority and publish the final transaction.

## Fee Schedule

Final launch target:

- Protocol deposit fee: `0.5%` to the final Livre fee wallet.
- Sponsored shield relayer fee: `0.05%` when a relayer sponsors shielding.
- Private Relay withdraw fee: `0.05%` when a relayer submits the withdrawal proof.

Pools must be created fresh from leaf `0` with the exact final fee schedule. Reusing devnet pools or mismatched fee math will break deposits or private relay withdrawals.

## Mainnet Deployment Order

1. Create and fund the deployer wallet with a small amount of mainnet SOL.
2. Create the beta multisig and confirm the signer threshold.
3. Deploy the mainnet shielded pool program.
4. Transfer or set upgrade authority to the beta multisig.
5. Create fresh mainnet pools from leaf `0`.
6. Confirm each pool denomination, fee collector, relayer fee, and starting leaf count.
7. Configure the mainnet Kora service against mainnet RPC and the final program/pool IDs.
8. Configure at least one backup/community relayer endpoint.
9. Build a separate macOS mainnet release.
10. Publish final IDs, authority status, release hash, and clear mainnet warnings.

## Tiny Mainnet Test

The first mainnet test should use the smallest supported pool and a fresh recipient.

Pass criteria:

- Shield transaction confirms on mainnet.
- The note appears with leaf index `0` for the fresh pool.
- Stats dashboard shows the new pool/deposit count.
- Private Relay withdrawal confirms.
- User public wallet does not pay withdrawal gas for the Private Relay path.
- Relayer wallet pays transaction gas and receives the configured relayer fee.
- Protocol fee wallet receives the configured `0.5%` deposit fee.
- The spent note leaves active notes after refresh.

## Publish Checklist

Before publishing the mainnet build:

- Mainnet app is built separately from devnet.
- Website clearly separates devnet and mainnet downloads.
- SHA256 checksum is published for the exact mainnet ZIP.
- Clean source archive is refreshed after final config changes.
- Mainnet readiness doc lists final program IDs, pool IDs, fee wallet, relayer endpoint, and authority status.
- Emergency Withdrawal is labeled as recovery/testing and Private Relay is the preferred path.
- Relayer operator guide explains how independent relayers can join.