Governance

Governance is the mechanism by which the network's parameters change. It is intentionally narrow: the parameter space is small, the procedures are slow, and certain quantities are constitutionally fixed and not subject to vote.

What is governed

Three classes of decisions:

1. Parameters. Numeric values within constitutional bounds: fee rates, reward splits, audit fractions, latency thresholds, quorum levels.
2. Acceptance sets. The list of approved data licenses, the values document for alignment, the registered embodiments, the active checkpoint per surface.
3. Personnel. Foundation roles with defined responsibilities; subject to scheduled rotation under P11.

What is not governed

Four classes of decisions are not in the parameter space. Changing them requires migration to a new deployment, not a vote.

1. The maximum token supply.
2. The token contract's permission set, in particular the revocation of the mint authority.
3. The public-release requirement for treasury-funded checkpoints.
4. The reserve floor requirement (the floor value is governable, but its existence is not).

These are constitutional. They are documented here to make the boundary of governance explicit.

Voting

Voting power is a function of token holdings and continuous-holding tenure:

$w_i = \min(t_i, T_{\max}) \cdot f(\Delta_i)$

where $t_i$ is the token holding, $T_{\max}$ caps any single voter's nominal weight at a configured fraction of circulating supply, and $f(\Delta_i)$ is a tenure multiplier of holding duration $\Delta_i$, bounded above by a constitutional ceiling. A typical $f$ is

$f(\Delta) = 1 + \min\!\left(\frac{\Delta}{\Delta_{\mathrm{ref}}},\ M_{\max} - 1\right)$

with $\Delta_{\mathrm{ref}}$ a reference holding period and $M_{\max}$ the maximum multiplier. The tenure mechanism reduces flash-borrow attacks without introducing a separate locked-staking instrument.

Proposal classes

Specific quorum and timelock values are deployment parameters published at genesis. The pattern, monotonic with impact, is constitutional.

Delegation

Token holders may delegate their voting weight to named delegates. Delegation is on-chain, public, and revocable in a single block. There is no veto delegate. Delegation does not transfer custody; it transfers only the voting message.

Delegation patterns will produce concentrations of voting power. The codex does not attempt to prevent this; it accepts concentration as the equilibrium of any voluntary mechanism and relies on (a) the slow timelock structure and (b) the constitutional limits to bound the damage of an adversarial concentration.

Off-chain coordination

A public discussion forum hosts pre-vote deliberation. Forum threads are not authoritative. The on-chain vote is the only authoritative artifact. Discussions, signed proposals, vote rationales, and post-vote retrospectives are archived for reference.

The non-permanence of operators (P11)

Every named role in the foundation has a scheduled end. Initial founders, original authors, and current operators all lose their roles by a published date. After that date, no party has a distinguished position in the protocol. This is enforced by:

• Time-locked keyholder rotation. Multisig signers are rotated on schedule; the rotation is on chain.
• Sunset clauses. Foundation-operated services (indexer, gateway, security response) are explicitly time-bounded; renewal requires a governance vote.
• Public commitment. The schedule is part of the codex and changing it is a constitutional act.

P11 is the most aggressive design choice in the codex. It is included because permanent operators are the failure mode that every previous decentralized system has eventually exhibited. The codex's response is to make the operator role temporary by construction.

Failure modes

Voter apathy. Quorum thresholds may not be met. Mitigation: a default action is specified for every parameter; quorum failure leaves the parameter at its default.

Capture by concentration. A single party acquires majority weight. Mitigation: tenure multiplier dilutes acquired weight, timelocks give the community time to fork, constitutional limits bound the damage.

Capture by collusion. Multiple parties coordinate to push through self-dealing proposals. Mitigation: open forum, public vote rationales, foundation watchdog role (during the foundation's lifetime).

These failure modes are described, not solved. The codex does not claim governance is robust; it claims governance is bounded.