The proposal system is the way changes to the platform state and policy are suggested, discussed, voted on by the council, and finalized as accepted or rejected.
A proposal is a motion to change the state or policy of the system in some way. There are a wide variety of such proposal types, each type having a different
- set of required input parameter values
- requirements and risks of proposing
- barrier for getting accepted
- delay to being put into motion when accepted
The reason for this differentiation across types is because different proposals have very different effects, and carry very different risks of failure or abuse. The proposal system has the responsibility of coordinating the different actors involved in the lifetime of a proposal, from submission to finalization.
The relevant roles in the proposal system are
- Proposer: A member that has submitted an instance of a specific proposal type. A given member can submit multiple proposals at once, or over time.
- Council Members: They are tasked with voting on proposals, which determines whether the proposals are accepted or not, as well as discussing a proposal with the proposer, and leaving a rationale for their vote.
Each council member can submit at most one vote per proposal, and it includes the following:
- Rationale: A human readable description of why they are voting as they are.
- Type: There three types
- Approve: Proposal should be approved.
- Reject: Proposal should be rejected. Additionally, it can be expressed whether it should be slashed as part of the rejection.
- Abstain: Voter has no position on outcome.
A proposal type is a parametrized intention to have some effect on the platform. The set of proposal types will increase considerably in the future, and the current types are listed below.
All proposal types have constant values for a shared set of parameters that are common across all types, thee are called proposal constants. The name and semantics of each constant is listed in the table below.
Whenever a proposal of a given type is created, the proposer must provide values for a set of parameters. The parameters fall into one of two categories: general and type-specific. Each parameter will also have some constraint on the valid range of values. The general proposal parameters are
- Proposer: Member identifier of the proposer.
- Title: A human readable title.
- Rationale: A human readable description text that is intended to hold the rationale for the proposal should be accepted. It is expected that some social convention will emerge on the appropriate encoding of this text, for example markdown, that would facilitate consistent input and display across client applications.
- Trigger: An optional block number where the proposal is to be executed.
- Staking Account: The account that holds the funds that will be locked for staking, if required.
The type-specific parameters for each proposal type are listed with the proposals below.
When a proposal is submitted, a set of conditions on the values of the input parameters (only) are evaluated, these are called creation conditions, and creating the proposal fails if they are not satisfied. These are things like for example respecting the upper bound on the amount of money you are asking for in a spending proposal. Importantly, these checks are pure, they only depend on parameters, not the state of the system.
A proposal may be approved, and at some point the actual business logic that embodies its intended effect has to be executed. This is always much later than when the proposal was first created, and it may very well be possible to have a proposal which originally looked would have had its intended effect to no longer be applicable because the state of he system has changed in the intermediate. An example could be that a funding proposal requires more money than the council currently can spend due to other spending that may have occurred since the proposal was approved. These conditions are called execution conditions, and importantly, they are not checked at any time prior to execution of this business logic.
A proposal is defined by the following information
- Id: A unique non-negative integer identifier.
- Type: Which type of proposal this is.
- General Parameters: Values for general proposal parameters.
- Type-Specific Parameters: Values for type-specific proposal parameters.
- Stage: The life-cycle stage of a proposal, as defined precisely in the next section.
- Votes: The set of votes currently associated with the proposal.
- Council Approvals: How many prior councils have approved the proposal, starts at 0.
- Starting Block: The block where the deciding period was initiated.
- Discussion: A single threaded discussion about the proposal, as defined in the discussion section.
Below is a list of the stages a proposal can be in, and what each of them mean:
- Deciding: Initial stage for all successfully created proposals. This is the only stage where votes submitted can actually impact the outcome. If a new council is elected, any present stake is slashed by
REJECTION_FEE, the staking lock is removed and the proposal transitions to the rejected stage.When a vote is submitted it is evaluated as such:
APPROVAL_THRESHOLDare satisfied, then increment council approvals counter. If counter now is
CONSTITUTIONALITYthen remove staking lock and transition to gracing stage, otherwise transition to dormant stage.
SLASHING_THRESHOLDare satisfied, but point (1) is not, then slash full stake, remove the lock and transition to the rejected stage.
- 3.If points (1) and (2) are not and cannot be satisfied by any future a outstanding votes, then slash stake by up to
REJECTION_FEE, remove lock and transition to rejected stage.
DECIDING_PERIODblocks pass while still in this stage, apply checks (1-3) with same transition and side-effect rules as above.
- Dormant: Was approved by current council, but requires further approvals to satisfy
CONSTITUTIONALITYrequirement. Transitions to deciding stage when next council is elected.
- Gracing: Is awaiting execution for until trigger block, or
GRACING_LIMITblocks since start of period if no trigger was provided. When this duration is over, the execution conditions are checked, if they are satisfied the proposal transitions to the execution succeeded stage, if they are not, it transitions to the execution failed stage.
- Vetoed: Was halted by SUDO, nothing further can happen. This is removed at mainnet.
- Slashed: Was rejected with full stake penalty by the current council.
- Execution Succeeded: Execution succeeded, nothing further can happen.
- Execution Failed: Execution failed due to unsatisfied execution conditions, nothing further can happen.
- Rejected: Was not approved, nothing further can happen.
It useful to designate any proposal in the stages deciding, dormant or gracing, as an active proposal, and any other proposal is said to be an inactive proposal. Votes can not be submitted for inactive proposal.
Before mainnet, an extra transition rule is worth bearing in mind is that, for any active proposal, SUDO can initiate veto, which results in transition to vetoed stage.
The stages and transitions, excluding SUDO dynamics, are summarized in the image below.
Proposal life-cycle stages.
As described, proposals may require staking to be submitted. A single account must be used to provide the stake for a proposal, and it cannot be used to hold stake for any other proposals or purpose, except voting, at the same time. The staking is implemented as a lock with id
A single threaded discussion is opened for each successfully created discussion. A thread can be in two discussion modes, open or closed. In open mode, any member can post a message, while in closed mode, only the active council, the original proposer, or one among a set of whitelisted members can post. Mode can be changed by member or council member at any time, and default mode is open. Both council members and proposer can curate whitelist by adding and removing members. A poster can edit a post an unlimited number of times, but only if they have access. A thread can no longer be updated in any way (mode, posting, edits, etc.) when
DISCUSSION_LINGERING_DURATIONhave passed since being rejected or executed. Lastly, at most
MAX_POSTS_PER_THREADcan be posted in a single thread.
This section includes proposals that concern the platform as whole in terms intended effect and type-specific parameters.
Note that the distinction between
signaland the rationale parameter is that the rationale is the why and this is the what.
amountis greater than zero.
amountis no more than
- there is at least one account
- the council budget is no less than the sum of
- the council budget is reduced by the sum of
- for each account in
accountsits fund is augmented by its corresponding amount in
The block after this proposal is executed will follow the rules of the runtime captured in
Same as when creating an opening for workers in the given group with given inputs, except signer check.
Same as when creating an opening for workers in the given group with given inputs, except the opening type is for lead.
Same as when cancelling an opening for workers in the given group with given inputs, except signer check.
Same as when cancelling an opening for workers in the given group with given inputs.
Same as when filling opening in group for worker with given inputs, except
winnersand signer check.
Same as when filling opening in group for worker with given inputs, except
Same as when slashing a worker in group with given inputs, except
- signer check,
- worker corresponding to
worker_idmust be lead.
Same as when slashing a worker in group with given inputs.
Same as when terminating a worker in group with given inputs, except signer check.
Same as when terminating a worker in group with given inputs, and removing lead designation.
Same as when updating reward of a worker in group with given inputs, except signer check.
Same as when updating reward of a worker in group with given inputs.
stake_amountis greater than zero.
Same as when decreasing worker stake in group with given inputs, except signer check.
Same as when decreasing worker stake in group with given inputs.
budget_updateis non-negative, then this it must be no more than the council budget, otherwise the absolute value must be no more than the current group budget.
budget_updateis non-negative, then this amount is reduced from the council budget and credited to the group budget, otherwise the reverse.
new_validator_countis no less than the
pallet_stakingmodule storage and no greater than
pallet_stakingmodule with given input.