Governance overview

fact Governance is implemented in contracts/src/governance/ (veNOTE, NoteGovernor, UpgradeGovernor, GaugeController, EmissionSchedule, Minter, gauges) and in the Governed base every module inherits. This section documents the deployed design; anything marked illustrative is an example, not a promise.

One diagram

NOTE locked in veNOTE is the only source of voting power; there is no delegation and weight decays linearly to zero at unlock. Parameter decisions travel through the 48-hour Timelock; code upgrades through a separate 7-day UpgradeTimelock. Dashed lines: the guardian (Security Council) can cancel queued operations on either timelock and pause, nothing else.

Pages in this section

Page	What it covers
veNOTE	Lock maths, decay curve, minimum and maximum terms, lockFromStaked, withdrawal
Proposals and voting	NoteGovernor and UpgradeGovernor parameters, proposal lifecycle, fractional voting, the two timelocks, Security Council powers and limits
Gauges	Weekly cycle, vote weights, cooldown, how relative weights become emissions and Desk caps, worked weekly example
Emissions	The step-decay schedule, the NOTE epoch cap and how Minter.mintWeekly reconciles the two
Upgradeability and recovery	Hybrid model (immutable core, UUPS periphery), Recovery Unwind, excess sweep, versioned series registry, storage-layout policy
Upgrade safety	The controls that make the upgrade path auditable, under Security

Roles

fact Every module inherits Governed: an owner and a guardian. After DeployGovernance the owner of every module is the 48-hour Timelock; the only thing that can call upgradeToAndCall on a UUPS proxy is the 7-day UpgradeTimelock.

Actor	Timelock (48 h)	UpgradeTimelock (7 d)	Governed contracts
NoteGovernor	PROPOSER, CANCELLER	—	—
UpgradeGovernor	—	PROPOSER, CANCELLER	—
Multisig (optional, launch only)	PROPOSER	PROPOSER	—
Guardian (Security Council)	CANCELLER	CANCELLER	pause(), NoteCore.cancelUnwind, OracleAdapter.revokeForceObserve
address(0)	EXECUTOR (anyone executes)	EXECUTOR	—
Timelock (48 h)	—	—	owner of every module, veNOTE, GaugeController, EmissionSchedule, Minter, gauges, SeriesRegistry
Deployer	admin renounced	admin renounced	none

What each actor cannot do matters as much:

• The guardian cannot propose, execute, unpause, change a parameter or move funds. It can delay a decision (veto a queued operation) and stop new activity (pause). Only the Timelock can unpause.
• The 48-hour Timelock cannot upgrade code. _authorizeUpgrade on every UUPS module reverts NotUpgradeTimelock(caller) for any other caller, so a compromised governance path cannot shorten the 7-day upgrade delay.
• No actor can move escrowed user funds in NoteCore. Recovery Unwind pays holders exactly their recorded entitlement; sweepExcess only moves balances above recordedLiabilities.
• Direct calls to onlyOwner functions from the multisig, guardian or deployer revert OwnableUnauthorizedAccount. DEFAULT_ADMIN_ROLE on both timelocks was renounced at deployment, so roles can only change through the timelock itself.

Parameter map

Module	Parameter	Bound	Effect of change
NoteCore	couponFeeBps, notionalFeeBps	≤ 5,000 / ≤ 500	Future series only
NoteCore	setKeeperReward	—	Observations with closeTs ≥ effectiveAt (24 h grace)
NoteCore	maxCouponCapBps, maxObservations	—	Future series
NoteCore	setFeeSink, setOracle, setCalendar	24 h MODULE_GRACE	Emits ModuleUpdated with effectiveAt; one pending change per slot
NoteCore	createSeries	Validated; reverts CoreDeprecated() on a deprecated core	New series
NoteCore	proposeUnwind, unwind, cancelUnwind, sweepExcess	whenPaused; see recovery	Per-series recovery
SeriesRegistry	register(core), deprecate(version)	Irreversible deprecation	Which core may create series
OracleAdapter	setParams: settlementWindow, maxLookback, maxDeviationBps, deferralWindow, forceDelay, maxRoundWalk, freshLag	forceDelay ≥ 24 h; maxRoundWalk 1 to 500; settlementWindow > closeGrace; freshLag 1 s to 24 h	Immediate
OracleAdapter	setCloseWindow: closeGrace, maxPreCloseLag	closeGrace ≤ 1 h and < settlementWindow; maxPreCloseLag 1 s to 24 h	Immediate
OracleAdapter	setBackupFeed, proposeForceObserve, cancelObservation	Delays	Per feed / per observation
MarketCalendar	setHoliday, setEarlyClose	—	createSeries validation and future timestamp checks
NOTE	setMinter, setMintCapPerEpoch	Cap 100m	Emission pace (hard ceiling for Minter)
sNOTE	setRewardNotifier, setCooldown	≤ 30 days	Immediate
veNOTE	pause / unpause	withdraw never pausable	New locks and top-ups
NoteGovernor	setProposalThresholdBps	≤ 10,000 (InvalidBps)	Proposal threshold; via proposal only
UpgradeGovernor	setProposalThresholdBps, setVotingPeriod, updateQuorumNumerator, updateTimelock	Constructor floors 7 d / 8 % / 7 d; later changes go through the 7-day process itself	Upgrade vote parameters
GaugeController	addType, changeTypeWeight, addGauge, changeGaugeWeight, setDesk	GaugeHasVotes blocks admin weight on voted gauges	Next week boundary
EmissionSchedule	setSchedule (initial, decay bps, period, floor)	decayBps < 10,000; floor ≤ initial	Next mintWeekly
Treasury	asset whitelist, setRedemptionParams, setDesk, setBondDepository, setMaxFeedStaleness, withdrawERC20, withdrawLegs, mintNote	Haircut ≤ 50%, cap ≤ 100%	Reserve composition and floor
BondDepository	markets, controlVariable, setDiscountParams, setDesk	Discount ≤ 50%	Bond pricing
RevenueRouter	setSplit, setAuctionParams, resetAuction, sweep	half-life 5 min to 30 d; bump ≤ 100%; fill 1 bp to 100%	Fee split and auction
Desk	setCaps, setGaugeController, fillCoupon, liquidateToTreasury, sweepToken, setQueueProcessLimit, setMaxFeedStaleness	caps ≤ 100%; queue limit ≤ 50; gauge cap bounded 1% to 40%	Desk exposure. See Desk

Series creation policy

intended Governance publishes a standing template per underlying (autocall 100%, barrier 65%, fortnightly observations, 52-week tenor, coupon floor and cap, refBps) and creates series on a fixed cadence, for example every two weeks per underlying, so that holders can roll. Deviations (different barrier, different tenor) go through a proposal.

Checks before creating a series:

1. All observation timestamps pass isOfficialClose; holidays and early closes for the tenor are registered.
2. No known corporate action (split, spin-off) is scheduled inside the tenor for the underlying, or the series is shortened to end before it.
3. Feed and backup feed are live and agree.
4. notionalCap is set with regard to Stock Token liquidity, since physical settlement can deliver up to N / s0 tokens to COUPON holders at once.
5. The core creating the series is the active version in SeriesRegistry.

Emergency procedures

Situation	Guardian	Timelock
Suspected bug in NoteCore	Pause deposits, strike and observation	Deploy a new core version, register, deprecate the old one; proposeUnwind affected series if needed
Suspected bug in a UUPS module	Pause	Schedule the fix through the 7-day UpgradeTimelock
Oracle feed failure	—	Wait for deferral window; propose force or cancel
Wrong forced price proposed	Revoke	—
Stock Token frozen by issuer	Pause new series on that underlying	Cancel remaining observations; series settles at lastPrice, or unwind
Treasury asset depeg	Pause redemption	Disable asset in valuation, rebalance
Malicious queued operation	cancel on the relevant timelock	—

Pause never blocks claim, redeem, redeemShield, refund, settle, sweepFees or withdrawUnwound in NoteCore, nor Desk withdrawals and queue processing, nor sNOTE withdraw/redeem on a matured request, nor veNOTE withdraw, nor gauge withdraw/exit/getReward. Users can always exit settled or unwound positions.

Process

intended

1. Forum discussion with a written specification of the change and its parameter values. The on-chain description follows # <title> and includes a ## Risk section.
2. Temperature check by NOTE holders.
3. On-chain proposal on the relevant governor. A parameter change takes about 8 days end to end (1 d delay, 5 d vote, 48 h timelock); a code upgrade about 15 days (1 d, 7 d, 7 d).
4. Queued actions are visible on both timelocks for the full delay period; the guardian may cancel.
5. Anyone executes; post-execution report.

Governance does not control user escrow, cannot change the terms of a live series except by cancelling observations or unwinding it at recorded entitlements, and cannot mint NOTE beyond the epoch cap without first raising the cap through the same delayed process.