# Governance and role-separation disclosure

## Scope and non-assertions

No signer, guardian, attester, adjudicator, design partner, deployer, operator, or auditor is named or assigned by this package. The package does not assert the deployed governance implementation, threshold, timelock, guardian behavior, or signer custody arrangement. Those facts are blocked pending engineering and V2/V3 audit results.

The V3 draft sources include more than one governance-form source artifact. One contains a conventional multisig transaction interface and another contains a `createProposal`/`signProposal`/`executeProposal` interface with a 24-hour constant and a three-guardian emergency path. Before any proposal is populated, engineering must select a compiled source, provide its hash/build/ABI, and an independent reviewer must verify the deployed implementation and configuration. A template is not evidence that the required 3-of-5/24-hour control is live.

## Required separation controls

| Function | Required disclosure/control | Cannot be inferred from this package |
|---|---|---|
| Signer / guardian | List address, custody model, threshold, timelock, rotation/revocation process, conflict disclosure, and emergency scope | Identity, count, actual threshold, or guardian authority |
| Attester | Authority, scope, independence classification, evidence policy, expiry/revocation process | That an attester is independent or qualified |
| Adjudicator | Appointment basis, threshold, conflict policy, deadlines/defaults, appeal/payout boundary | That a dispute process is active or fair |
| Design partner | Consent, limited scope, data role, no implied governance privilege, exit path | Partner name, enrollment, or permission |
| Deployer / factory operator | Exact callable methods, ownership/controller state, deployment cap, post-deployment verification | Factory permission or ability to deploy |
| Proposer / executor | Single-action proposal, decoded calldata review, 3 valid approvals, timelock measurement, post-state verification | That an unsigned template is approved or executable |

A person/entity may not simultaneously approve evidence, adjudicate a dispute, and control the affected payout without a disclosed and independently accepted conflict-control exception. A design partner is not a signer, guardian, attester, or adjudicator by virtue of participation.

The capped Base pilot has a strict operational maximum of **one active,
explicitly allowlisted design partner**. The checked-in prepared manifest has
zero. The controller's allowlist is not by itself a one-partner invariant, so
the approved manifest, single-purpose proposal, and independent post-state
review must confirm both the one entry and the absence of any other active
partner before writes can be considered.

## Approval record minimum

For each action: one exact action class, linked manifest/version, immutable source/build reference, decoded calldata, target/value, three distinct signer approvals using the required phrases, creation/executable timestamps, conflict disclosures, and a post-execution verification record. Missing evidence is a stop.
