const EmergencyPauseFor, PauseAllowance, MaxPauseAhead
The pause durations, in their own file so a node fixture, which cannot wait days, can replace this file alone; TestProductionDurations pins them.
Package memba\_bridge\_v1 governs the ten Memba application realms published before memba\_gov. It becomes each app's...
Package memba_bridge_v1 governs the ten Memba application realms published before memba_gov. It becomes each app's admin through the app's own two-step handover, so the apps' code does not change, and turns memba_gov approvals into the app's owner-only calls.
Every governed entrypoint is a direct call by a seated member. It reads the app's live pre-state, encodes it with the call's arguments and the app's tenure (how many times the bridge has accepted it), and consumes exactly that approval from memba_gov before calling the app: an approval voted on another state, app, action, argument or tenure never matches. Action ids are "<app>.<Op>"; the invalidation scope is the app, or an object of it where actions are independent.
Accept, ExpirePause and the reads need no vote. EmergencyPause needs a seated member, no vote, and expires by itself. Approval tells a proposer exactly what an entrypoint call would consume, from the same code.
The pause durations, in their own file so a node fixture, which cannot wait days, can replace this file alone; TestProductionDurations pins them.
Accept takes the admin role the 2-of-3 nominated the bridge for. It needs no vote: the nomination is the decision. A paused app is refused: only a pause the bridge started can be ended by its rules.
AddMember adds a new member; it never rewrites an existing member's roles.
Approval returns, as JSON, the proposal a governed entrypoint call would consume if made now: target this realm, with the action, args, scope and minimum class given. call is the entrypoint's name and its arguments after pid, daoauth-encoded in order (strings s:, addresses a:, integers i: or u:, booleans b:). It refuses a call its entrypoint would refuse before voting, and holds only while the state it binds is unchanged.
CancelTransfer withdraws a staged admin before the recipient accepts.
CreateChannel adds a channel. Channels are permanent (at most 20).
Curate runs a curator action on one listing: approve, reject (with a reason), delist, restore or clearflags. Every approval binds the listing's status; approve and restore, which publish, also bind its content, and clearflags binds the flags it clears. Editing or flagging a listing thus cannot void a reject or delist vote, and cannot slip new content past one.
EmergencyPause pauses app for 7 days, without a vote. Each member may use it once per 30 days, so one key cannot keep an app closed.
ExpirePause lets anyone end the bridge's pause of app once it is over. A SetPause that keeps app paused longer must execute before then. Once the bridge no longer governs app, its record no longer applies: anyone drops it, and the app, now its new admin's, is left as it is.
PauseEpisode returns how many pauses of app the bridge has started; a SetPause approval binds it.
PausedUntil returns the unix end of the bridge's pause of app, or 0 (also once the bridge no longer governs app).
ProposeFeeRecipient stages escrow's fallback fee recipient, used only when market_config's treasury is unusable.
ResolveDispute settles one disputed milestone: refund pays the client the whole amount, otherwise the freelancer is paid less the fee. Either way escrow pays out at most the milestone's amount, which is checked. A milestone is disputed at most once (a resolution is final); binding the height of that dispute means no approval can be voted before it exists.
SetPause ends the bridge's pause of app now (until = 0) or keeps app paused until the unix time until, at most 30 days ahead. The approval names the pause episode, so it never ends a later pause.
SetQuestSigner rotates the key every quest voucher is checked against.
SetTreasury points the fees of market_config (which escrow also pays into) or of the App Store at addr.
Tenure returns how many times the bridge has accepted app; every approval for app binds it as its last argument.
TransferAdmin stages to as the app's next admin: the 2-of-3, a successor bridge, or anyone the DAO names. The recipient accepts by its own call.
Unhide shows an item again and dismisses its flags.