What code can be managed by governance

[kennyrowe]

Today in the weekly office hours the issue of contact governance was discussed. @Chris-Hibbert mentioned that additional documentation needs to be created that describes how to identify what code is under governance authority. There are three basic things that need to be documented.

• How to identify what parameters of a contract can be changed with governance
• How Zoe filtering works in order to prevent certain invitations from being created
• How a contract API can be changed as a result of governance

[Chris-Hibbert]

The third bullet is in reference to the ability of governance to invoke declared APIs in the contract. There's nothing that can be done during execution to change the API.

An example of a governed API is in the Reserve contract, where governance can invoke addLiquidityToAmmPool().

[Chris-Hibbert]

At a higher level, the question that was asked was about style guidelines for contract developers so they can support the legibility of governance. This is something that we need to write down. There are informal rules that we follow in developing our contracts, and we want to help our developers to do the same.

[dckc]

fixed in #999 along with #952: Contract Governance

• How to identify what parameters of a contract can be changed with governance

#999 is more about writing a governed contract. It has a "Governance Package Aims" box that mentions visibility by clients, but it leaves the substance of the matter to the README and the Attacker's Guide in the @agoric/governance package.

• How Zoe filtering works in order to prevent certain invitations from being created

The section on filters is something of a stub; it does cite a reasonably good discussion, though:

• How to add a contract level pause feature? agoric-sdk#8172

• How a contract API can be changed as a result of governance

The example in the API governance section is where the EC can add and remove oracle operators. The reserve contract would be a good one, since it's probably simpler. But the EC/oracle example cites full production client UI code; I'm not aware of any client code for the reserve governed API.