Governance

One governor contract owns every proxy in the desk. Three roles reach it on three paths, and each path trades speed against reach.

One owner, three roles

CallsideGovernor is a single non-upgradeable contract that owns every upgradeable proxy in the system. Every parameter change, every upgrade and every pause routes through it on exactly one of the paths below; there is no side door. The governor itself holds no funds and forwards calls with zero value, so it can direct the desk but never drain it.

The timelock and its classes

The Admin path is a class-delayed timelock. Every operation is scheduled publicly, and its delay depends on which way it moves risk: a change that only tightens the system matures fastest, a loosening change waits longest, and everything else sits in between.

The load-bearing rule is the default: any selector that was never registered in the class map runs on the slowest path, the 72 hours loosening delay. That covers every contract upgrade, since upgradeToAndCall is deliberately left unregistered everywhere. A forgotten registration therefore fails slow, never fast: the worst a gap in the map can do is make governance take longer.

Scheduling emits the full calldata and maturity time on chain, so the delay doubles as a public review window. The delays themselves are constructor immutables; changing them means deploying a new governor and migrating ownership through the old one.

The Risk Council fast path

The Risk Council calls a small allowlist of setters with no delay at all, every one of them a bounded sizing or status knob, or a lift whose whole reach is one running window, rather than a change of logic: at launch, the fed funds input to the interest rate, asset requirements, listing status and exposure caps, lowering the vault deposit cap, the per-asset forced sale clip and batch budget (the most one batch fill may sell, once per clip page of the daily charge), the per-class batch slippage limits, the venue book, the desk fee on a trade inside its ceiling, and the early end of a live USDG depeg pause, with the deploy's governor bootstrap as the list of record. The reason this is safe is that every one of those setters enforces its own hard bounds inside the target contract, per-call move limits, minimum intervals between calls, and floors and ceilings on every value; the depeg clear is bounded by scope instead of by a number, since it can end only the one pause a depeg gets, moves no price and no parameter, and cannot arm a pause or put one back. The governor checks who and when; the target checks what. Speed never buys reach, and widening the council allowlist is itself a timelocked operation.

The Guardian: pause, never move

The Guardian reaches only pause levers, and the allowlists are directional. When the guardian pauses something, it must provide both the pause payload and the exact unpause payload up front, and each is checked against its own separate allowlist: the pause call against the pause list, the recorded unpause against the unpause list. A pause can never be recorded as its own unpause, and nothing outside the unpause list, no rate setter, no transfer, no upgrade, can be smuggled in as the recorded inverse.

A pause expires after 72 hours. Expiry does not clear the pause by itself; it makes the recorded unpause executable by anyone, so no single role can keep the desk frozen quietly. The guardian may lift its own pause early at any time.

The pause levers themselves are narrow: vault deposits, buying power, a per-asset halt on the venue, the oracle deviation guard, and the two circuit breakers on custody’s exits, collateral withdrawals and vault claims, which exist so a ledger bug can be stopped from draining custody while a fix waits out the timelock. There is no lever anywhere in the system that closes the desk on a schedule, because there is no schedule; a halt is per asset and must be chosen deliberately. The guardian also holds one power beyond pausing: it can cancel a still-queued admin operation on the desk's contracts, a safety veto against a compromised or mistaken schedule. That veto stops at the governor itself and at the guardian's own levers: the guardian cannot cancel its own replacement or a registry change, and it cannot cancel an admin lift of a lever it paused. When such a lift lands, the guardian may not re-pause that lever for one expiry window, so a pause the admin has publicly overruled does not come back the next block.

Who holds the roles

The deploy hands every proxy, the venue adapter and the TWAP source to the governor before it finishes and refuses to complete otherwise, so from the desk's first block no key but the governor owns anything, and the ceremony key keeps no role: it is struck from the keeper list before ownership moves. The three roles are three distinct addresses named in the launch config at the governor's constructor, none of them the deployer (the deploy refuses a role equal to it). The governor treats each role as one address and the deploy records whether a contract stands behind each without requiring one: the admin is a single wallet for the auditor phase and moves to a Safe multisig by a scheduled admin change, itself on the slowest delay, before the vault's deposit cap opens to outside depositors, and the Risk Council, the guardian and the foundation treasury may be plain wallets too, each printed at the ceremony for the owner to read back. The Robinhood Chain testnet runs the same governor with all three roles collapsed to its deployer, while the demo chain keeps ownership with its admin key because it redeploys on every boot and no timelock could mature there.

Role handoffs, allowlist changes and selector reclassifications all go through the governor's own timelock on the slowest delay, so not even the admin can widen its own reach in a single transaction. One path to the admin seat does not start from the admin: if the admin can no longer sign, the Risk Council may propose a replacement, the proposal matures on the slowest delay in public, and a signing admin cancels it, so the path works only against an admin that has gone silent and never against one that is present. The concrete delay values live on the parameters page.