Problem
Pending approvals can survive signer-set changes, allowing stale signers to count or leaving thresholds unreachable.
Scope
- Add a monotonically increasing signer epoch and signer-set hash.
- Bind proposals and approvals to an epoch with an explicit snapshot/invalidation rule.
- Prevent removed signers and stale approvals from later epochs.
- Validate every signer/threshold change for reachable quorum.
- Add expiry, cancellation, idempotent execution, and replay-resistant IDs.
- Govern signer changes after bootstrap.
- Emit events sufficient for external reconstruction.
Acceptance criteria
- Approval validity is unambiguous across rotations.
- Threshold never exceeds eligible signers.
- Duplicate approvals never increase quorum.
- Terminal proposals cannot revive.
- Bootstrap authority is permanently constrained.
- UI explains epoch and counted approvals.
Required tests
Add/remove/rotate around partial approval, threshold changes, removed/re-added signer, concurrent final approval/rotation, and random governance sequences.
Non-goals
Harden native governance; no external DAO required.
Problem
Pending approvals can survive signer-set changes, allowing stale signers to count or leaving thresholds unreachable.
Scope
Acceptance criteria
Required tests
Add/remove/rotate around partial approval, threshold changes, removed/re-added signer, concurrent final approval/rotation, and random governance sequences.
Non-goals
Harden native governance; no external DAO required.