Loading
Every parameter that decides what a mandate can do sits behind two of three signatures and a fixed delay.
Two signers agreeing is what authorises a change. The wait between that and the change taking effect is what gives anyone relying on the system time to read it and leave. Any single signer can cancel a proposal before it lands, because blocking a change should cost less than making one.
The pause is the exception, and it has to be. A brake that takes two days is not a brake, so the guardian key can stop an administered contract in the same block with no approvals and no wait. It can do nothing else: the call it sends is built inside the timelock and is always pause(). Restarting is a proposal like any other. That is what makes a stolen guardian key an outage rather than a loss.
Release 1 governance is three plain keys and a guardian key, by a deliberate operator decision taken for launch. Two of three is a property of the contract, not yet of the custody. The multisig follows public launch.
Connect a signer key to act on a proposal. Everything on this page is read from the contract and needs no wallet. Proposing, approving, cancelling and executing need one of the three signer keys; the pause needs the guardian key.
Newest first. Read from the contract.
Reading the governance contract.
Proposing counts as your own approval. One more signer and the delay stand between this and the change taking effect.
Every entry here is a call the timelock is the admin for. Anything not on this list is not a change governance can make.
The registry names the timelock as its incoming admin and the handover completes only when the timelock calls this. Until it lands the deploy key is still the registry’s admin and the guardian’s brake does not reach it.
This call takes no arguments.
Takes administration of the provider registry. Every later change to it then waits out this delay as well.
Proposing needs one of the three signer keys. This wallet is not one of them.
Stops an administered contract in the same block. No approvals, no delay, and no other call this key can make.
The guardian key pauses and does nothing else. The call it sends is built inside the timelock and is always pause(), so the key cannot be talked into anything adjacent to a pause. Restarting is an ordinary proposal: two signatures and the full delay. Stopping is instant and starting is not, because a brake that takes two days is not a brake, and a stolen guardian key should cost an outage rather than a loss.
Three contracts carry a pause. The escrow, reputation, the dispute registry, the mandate account factory and the token carry none, so stopping the money path means stopping the registry the agents using it are registered in.
The pause needs the guardian key. This wallet is not the guardian, and no signer key can send it.
Sweeping escrow fees and rotating the escrow treasury are not timelock calls, because the escrow has no admin role. They live on the operator surface, which also builds the staking and buyback proposals through this same form.