Roles & Control

(Authority Surfaces & Constraints)

2.3 Roles & Control

This page defines administrative authority and control boundaries across the Modulexo system.

All control is exercised through contract-defined functions. No hidden control layer exists.

---

I. Role Overview

The system contains the following role categories:

1. Owner (Execution Contracts)

2. Timelock (Governed Control)

3. Weighted Governor

4. Share Holders

5. Public Participants

Each role has specific, limited authority.

---

II. Owner (Execution Layer)

Applies to:

• RecyclingEngine

• SponsorshipLedger

• RecycleAssetRegistry

• Router

• FeeVault

Verifiable via:

owner()
pendingOwner()

Owner Capabilities

If owner is active (not renounced or transferred):

RecyclingEngine:

• setParams(...)

• transferOwnership()

• renounceOwnership()

Ledger:

• setEngine()

• transferOwnership()

Registry:

• Enable / disable assets (if implemented)

• Parameter updates (if implemented)

Router:

• Adjust rail percentages (if implemented)

Owner cannot:

• Modify historical ledger state • Reverse burn routing • Confiscate weight • Override claim logic

Owner authority is limited to exposed functions.

---

III. Timelock (Governance Executor)

If ownership is transferred to Timelock:

Timelock becomes the owner.

This is verifiable by:

owner() == Timelock address

Timelock executes calls approved by Governor.

Timelock cannot:

• Create proposals • Vote • Override voting outcome

It only executes approved proposals after delay.

---

IV. Weighted Governor

The Governor contract:

• Receives proposals • Manages voting • Enforces quorum • Queues successful proposals

It does not execute state changes directly.

It cannot:

• Modify contract state without Timelock • Bypass quorum • Skip delay

---

V. Share Holders

Share holders:

• Hold Fund shares • Possess voting weight • Can vote on proposals • May submit proposals (if threshold met)

They cannot:

• Directly call controlled contract functions • Override Timelock • Modify ledger state

Their authority is mediated through governance.

---

VI. Public Participants

Public users:

• Can sponsor inventory • Can execute recycle • Can claim distribution

They cannot:

• Modify parameters • Adjust rails • Influence governance without shares • Access privileged functions

---

VII. Control State Types

Each contract exists in one of three control states:

1. Owner-Controlled

Private address retains authority.

2. Governance-Controlled

Ownership transferred to Timelock.

3. Renounced

Ownership set to zero address.

State must be verified per contract in Contract Directory.

---

VIII. Parameter Control Matrix

Contract	Parameter	Controlled By	Mutable
RecyclingEngine	Weight pricing params	Owner / Timelock	Yes (if owner active)
SponsorshipLedger	Engine binding	Owner / Timelock	Yes
Registry	Asset enable	Owner / Timelock	Yes
Router	Rail split	Owner	Yes
Fund	Treasury actions	Governor → Timelock	Yes
Weight ledger math	Distribution formula	Immutable	No

This matrix prevents misunderstanding of control boundaries.

---

IX. Immutable Guarantees

The following cannot be altered unless contract redeployed:

• Distribution formula • accNativePerWeight logic • rewardDebt logic • Claim mechanics • Burn routing logic

If ownership is renounced:

Even parameters become immutable.

---

X. Emergency Controls

If ownership has not been transferred to Timelock:

Owner may adjust parameters within contract-defined limits.

If ownership is renounced:

No emergency adjustment is possible.

There is no hidden admin key.

---

XI. Verification Checklist

To confirm control state:

1. Call owner() on each contract

2. Confirm if it equals:

   • Private address

   • Timelock address

   • Zero address

3. Inspect ownership transfer events

4. Confirm governance proposals affecting ownership

This fully defines authority.