Follow-up from #26 / #16.
The governance-guard multi-sig (contracts/governance-guard) fixes its signer set and threshold at initialize with no way to change them afterward. That was a deliberate scope cut in #26 to avoid shipping signer rotation (its own governance design problem: a majority shouldn't be able to silently lock out a minority, or vice versa) in the same pass as the upgrade mechanism itself.
Right now, if a signer key is lost or compromised, or the signer set just needs to change, there's no path to do that short of a full contract upgrade through the existing (correctly functioning) upgrade flow itself.
Needs a design for how a rotation proposal gets authorized (same threshold as an upgrade? a higher one? a timelock?) before implementation."
Follow-up from #26 / #16.
The governance-guard multi-sig (contracts/governance-guard) fixes its signer set and threshold at initialize with no way to change them afterward. That was a deliberate scope cut in #26 to avoid shipping signer rotation (its own governance design problem: a majority shouldn't be able to silently lock out a minority, or vice versa) in the same pass as the upgrade mechanism itself.
Right now, if a signer key is lost or compromised, or the signer set just needs to change, there's no path to do that short of a full contract upgrade through the existing (correctly functioning) upgrade flow itself.
Needs a design for how a rotation proposal gets authorized (same threshold as an upgrade? a higher one? a timelock?) before implementation."