Architecture

TxODDS authority ──insert_scores_root──▶ txoracle daily_scores_merkle_roots PDA (per epoch day)
                                                        ▲ readonly
TxLINE SSE /scores/stream ──▶ KEEPER (untrusted courier)│
  detects full time ──▶ GET /api/scores/stat-validation │
                     ──▶ tx: post_match_facts ──CPI──▶ txoracle::validate_stat_v2
                                              fw-settle │  gates, get_return_data → bool
                                                        ▼
                                          MatchFacts PDA (immutable fact sheet per fixture)
                                                        ▼
                        fw-markets::settle_market (permissionless account read)
                                                        ▼
                        claim crank ──▶ winners' USDC ATAs ("money lands at the whistle")

  goalshield-mini::claim_payout (reads a Verdict) ◀── the engine is market-agnostic

fw-settle — the SettleKit engine (zero authority)

No config account, no initialize, no pause, no admin instruction. The oracle program id is a compile-time constant per cluster. Every instruction is permissionless: validity comes from proofs, not identity.

Instructions: post_verdict, post_match_facts, attest_native (dual attestation, upgrades verify_mode CPI → DUAL), prove_fixture, prove_odds. The last two complete the trifecta — all three TxLINE validation primitives used on-chain.

fw-markets — the LMSR market maker

• Eight market kinds (see Market types) plus in-play thresholds.
• LMSR C(q) = b·ln Σ e^(q_i/b) in 64.64 fixed point with the max-subtraction stability trick: always a quote, buy AND sell, prices sum to 1, treasury loss bounded at b·ln(1/p_min) by construction. Opening prices seed from TxODDS StablePrice consensus when the feed carries them.
• Ledger positions (not SPL tokens): claim needs no owner signature — the destination is pinned to the owner's ATA, so one instruction serves self-claim and the keeper's push-crank.
• The market admin can only create markets and set fees for future markets; no instruction touches outcomes, vaults, or open markets.

goalshield-mini — the composability proof

~260-line parametric cover: an underwriter escrows a payout against any provable Question (by hash), a buyer pays the premium, and the payout releases the moment a TRUE Verdict for that exact question exists. Its entire oracle integration is three require! lines.

Verification strategy

1. Golden tests execute the dumped production oracle binary with a real devnet roots account and an archived full-time proof — the real verifier accepts the true claim and rejects tampered leaves.
2. mock-txoracle (loaded at the real oracle address in LiteSVM) drives every gate to its exact error code, plus oracle failure modes selected by sentinel timestamps.
3. Live fire on the tournament itself: real fixtures settled end-to-end on devnet, including the corners sum prop against the production oracle.

Failure and attack table