Governance Overview

fact Governance is implemented in contracts/src/governance/ (veNOTE, NoteGovernor, UpgradeGovernor, GaugeController, EmissionSchedule, Minter, gauges) and in the Governed base every module inherits. This section documents the deployed design; anything marked illustrative is an example, not a promise.

One Diagram

Pages in This Section

Roles

fact Every module inherits Governed: an owner and a guardian. After DeployGovernance the owner of every module is the 48-hour governance; the only thing that can call upgradeToAndCall on a UUPS proxy is the 7-day upgrade governance.

What each actor cannot do matters as much:

• The guardian cannot propose, execute, unpause, change a parameter or move funds. It can delay a decision (veto a queued operation) and stop new activity (pause). Only the governance can unpause.
• The 48-hour governance cannot upgrade code. _authorizeUpgrade on every UUPS module rejects unauthorised calls for any other caller, so a compromised governance path cannot shorten the 7-day upgrade delay.
• No actor can move escrowed user funds in NoteCore. Recovery Unwind pays holders exactly their recorded entitlement; sweepExcess only moves balances above recordedLiabilities.
• Direct calls to onlyOwner functions from the governance, guardian or deployer revert OwnableUnauthorizedAccount. DEFAULT_ADMIN_ROLE on both governance delays was renounced at deployment, so roles can only change through the governance itself.

Parameter Map

Series Creation Policy

intended Governance publishes a standing template per underlying (twelve weekly observations, 12-week tenor, autocall 105% or 110%, barrier 60% to 88%, coupon floor, reference and cap set per underlying so that the band brackets the fair value of the protection; see Templates) and series roll daily per underlying through RollPolicy, so that holders can always roll. Deviations (different barrier, different tenor) go through a proposal.

Checks before creating a series:

1. All observation timestamps pass isOfficialClose; holidays and early closes for the tenor are registered.
2. No known corporate action (split, spin-off) is scheduled inside the tenor for the underlying, or the series is shortened to end before it.
3. Feed and backup feed are live and agree.
4. notionalCap is set with regard to Stock Token liquidity, since physical settlement can deliver up to N / s0 tokens to COUPON holders at once.
5. The core creating the series is the active version in SeriesRegistry.

Emergency Procedures

Pause never blocks claim, redeem, redeemShield, refund, settle, sweepFees or withdrawUnwound in NoteCore, nor Desk withdrawals and queue processing, nor sNOTE withdraw/redeem on a matured request, nor veNOTE withdraw, nor gauge withdraw/exit/getReward. Users can always exit settled or unwound positions.

Process

intended

1. Forum discussion with a written specification of the change and its parameter values. The on-chain description follows # <title> and includes a ## Risk section.
2. Temperature check by NOTE holders.
3. On-chain proposal on the relevant governor. A parameter change takes about 8 days end to end (1 d delay, 5 d vote, 48 h governance); a code upgrade about 15 days (1 d, 7 d, 7 d).
4. Queued actions are visible on both governance delays for the full delay period; the guardian may cancel.
5. Anyone executes; post-execution report.

Governance does not control user escrow, cannot change the terms of a live series except by cancelling observations or unwinding it at recorded entitlements, and cannot mint NOTE beyond the epoch cap without first raising the cap through the same delayed process.