Introduction

layoutd is a small, off-chain Rust command-line tool for the Solana/Anchor ecosystem. It reads two versions of an on-chain account struct, computes a byte-level diff, classifies each field change as SAFE, REVIEW, or DANGER by Borsh byte-safety, generates the migration code it can prove correct, and blocks unsafe upgrades in CI. It never touches the chain — it is a code generator and a safety gate.

The problem it solves#

On Solana, a program upgrade replaces the executable in place, but the account data already stored on-chain keeps its old byte layout. The new code expects the new layout, so reading old bytes through the new struct silently corrupts data — shifted offsets, misread fields, and in the worst case lost funds. The dangerous part is never your intent; it’s the byte-level consequence of a change that humans routinely get wrong, which is exactly what an audit catches and CI does not.

What makes it different#

Most tools either generate migrations optimistically or do nothing. layoutd takes a third path: it automates the provably-safe part, scaffolds the dangerous part behind a recorded acknowledgement, and refuses to let danger be silent.

• Zero false-safe verdicts. The tool may say “I can’t prove this, review it” as often as needed, but never calls something safe that isn’t.
• Deterministic. The same two inputs always produce identical output — essential for a CI gate you can trust.
• Narrow on purpose. It models bytes and proves migrations; it does not attempt business logic it cannot see.

Where to go next#

New here? Start with Installation, then run the Quickstart to see a real diff in under a minute. Want the conceptual model first? Read The Risk Model. You can also return to the landing page for the high-level overview.