# Roles & Control

## 2.3 Roles & Control

This page defines administrative authority and control boundaries across the Modulexo system.

All control is exercised through contract-defined functions.\
No hidden control layer exists.

***

## I. Role Overview

The system contains the following role categories:

1. **Owner (Execution Contracts)**
2. **Timelock (Governed Control)**
3. **Weighted Governor**
4. **Share Holders**
5. **Public Participants**

Each role has specific, limited authority.

***

## II. Owner (Execution Layer)

Applies to:

* RecyclingEngine
* SponsorshipLedger
* RecycleAssetRegistry
* Router
* FeeVault

Verifiable via:

```
owner()
pendingOwner()
```

#### Owner Capabilities

If owner is active (not renounced or transferred):

RecyclingEngine:

* `setParams(...)`
* `transferOwnership()`
* `renounceOwnership()`

Ledger:

* `setEngine()`
* `transferOwnership()`

Registry:

* Enable / disable assets (if implemented)
* Parameter updates (if implemented)

Router:

* Adjust rail percentages (if implemented)

Owner cannot:

• Modify historical ledger state\
• Reverse burn routing\
• Confiscate weight\
• Override claim logic

Owner authority is limited to exposed functions.

***

## III. Timelock (Governance Executor)

If ownership is transferred to Timelock:

Timelock becomes the owner.

This is verifiable by:

```
owner() == Timelock address
```

Timelock executes calls approved by Governor.

Timelock cannot:

• Create proposals\
• Vote\
• Override voting outcome

It only executes approved proposals after delay.

***

## IV. Weighted Governor

The Governor contract:

• Receives proposals\
• Manages voting\
• Enforces quorum\
• Queues successful proposals

It does not execute state changes directly.

It cannot:

• Modify contract state without Timelock\
• Bypass quorum\
• Skip delay

***

## V. Share Holders

Share holders:

• Hold Fund shares\
• Possess voting weight\
• Can vote on proposals\
• May submit proposals (if threshold met)

They cannot:

• Directly call controlled contract functions\
• Override Timelock\
• Modify ledger state

Their authority is mediated through governance.

***

## VI. Public Participants

Public users:

• Can sponsor inventory\
• Can execute recycle\
• Can claim distribution

They cannot:

• Modify parameters\
• Adjust rails\
• Influence governance without shares\
• Access privileged functions

***

## VII. Control State Types

Each contract exists in one of three control states:

#### 1. Owner-Controlled

Private address retains authority.

#### 2. Governance-Controlled

Ownership transferred to Timelock.

#### 3. Renounced

Ownership set to zero address.

State must be verified per contract in Contract Directory.

***

## VIII. Parameter Control Matrix

| Contract           | Parameter             | Controlled By       | Mutable               |
| ------------------ | --------------------- | ------------------- | --------------------- |
| RecyclingEngine    | Weight pricing params | Owner / Timelock    | Yes (if owner active) |
| SponsorshipLedger  | Engine binding        | Owner / Timelock    | Yes                   |
| Registry           | Asset enable          | Owner / Timelock    | Yes                   |
| Router             | Rail split            | Owner               | Yes                   |
| Fund               | Treasury actions      | Governor → Timelock | Yes                   |
| Weight ledger math | Distribution formula  | Immutable           | No                    |

This matrix prevents misunderstanding of control boundaries.

***

## IX. Immutable Guarantees

The following cannot be altered unless contract redeployed:

• Distribution formula\
• accNativePerWeight logic\
• rewardDebt logic\
• Claim mechanics\
• Burn routing logic

If ownership is renounced:

Even parameters become immutable.

***

## X. Emergency Controls

If ownership has not been transferred to Timelock:

Owner may adjust parameters within contract-defined limits.

If ownership is renounced:

No emergency adjustment is possible.

There is no hidden admin key.

***

## XI. Verification Checklist

To confirm control state:

1. Call `owner()` on each contract
2. Confirm if it equals:
   * Private address
   * Timelock address
   * Zero address
3. Inspect ownership transfer events
4. Confirm governance proposals affecting ownership

This fully defines authority.