Ukiyo Network · Governance layer
Agency for smart contracts roadmap
Observe → decide → simulate → act / escalate
1. Mission & boundaries
Never invents evidence · Never holds capitalPolicy-bounded agents between oracle feeds and on-chain markets. Agents propose; contracts enforce; keys stay off-model.
| Holds | Produces | Never does |
|---|---|---|
| Policy engine, allowlists, escalation, runtime | Approved / rejected / escalated decisions + audit | Produce scores, custody LP funds, free-write txs |
Observe → Decide → Simulate → Act / Escalate
2. Current state
Building · Local policy stubs- White paper + site brief live
- Local MVP: bands, allowlist, simulate, escalate, audit
- Missing: on-chain PolicyEngine, fork sim, HSM signer
3. MVP scope (deep)
- Bands: high ≥8000 advance · mid 5500–7999 reprice/notify · low <5500 pause · stale → pause
- Degraded/Recovering haircut −500 bps before banding
- Allowlist only: mint, advance, reprice, pause, notify
- Escalate if amount > $25k auto-cap or pause-lift / stale policy
- 2-of-2 human approve/reject
Empty allowlist authorizes nobody.
| Action | Target | Bounds |
|---|---|---|
| mint | VerifiedOrderNFT | once per orderId |
| advance | IndustrySpool | amount ≤ maxAdvance |
| reprice | IndustrySpool | spread 50–2000 bps |
| pause / notify | IndustrySpool | notify codes enum |
4. Runtime loop
- Observe registry score/state + spool state
- Decide band → typed allowlisted proposal
- Simulate expected state diff
- Act via separate signer — or escalate
- Audit every step
| Action | Expected diff | Reject if |
|---|---|---|
| pause | paused; balances same | balance change |
| reprice | spread in bounds | out of range |
| notify | event only | storage write |
| advance | outstanding+=amt; supplier | wrong amt/recipient |
| mint | NFT exists | duplicate |
5. Phases
Phase 0 · Local brain
Band mapper + simulate + escalate in MVP workspace demo.
Phase 1 · Weeks 5–6 · Sepolia loop
- Deploy PolicyEngine
- Typed calldata builders
- Signer separated from decision
- 2-of-2 queue
Exit: E2E high-score advance; unknown selector rejected.
Phase 2 · Months 3–4 · Pilot ops
- Escalation console
- Notify channels
- Runbooks + metrics
Phase 3 · Months 5–8 · Hardening
- Fork simulation
- Argument-level bounds
- Novelty escalation
- Timeboost only for pause/reprice
- Timelocked policy
Phase 4 · Months 9–12+ · Mainnet agency
- HSM/MPC · m-of-n
- Governed mainnet allowlists
- Optional confidential policy proofs
6. Tickets
| ID | Work | When |
|---|---|---|
| AGY-1 | PolicyEngine allowlist + caps | MVP |
| AGY-2 | Band mapper | MVP |
| AGY-3 | Simulate gate | MVP |
| AGY-4 | Sepolia runtime | MVP |
| AGY-5 | Escalation 2-of-2 | MVP |
| AGY-6 | Ops console | Phase 2 |
| AGY-7 | Notify adapters | Phase 2 |
| AGY-8 | Fork simulation | Phase 3 |
| AGY-9 | Arg-level decoders | Phase 3 |
| AGY-10 | Novelty escalation | Phase 3 |
| AGY-11 | Timelock governance | Phase 3–4 |
| AGY-12 | HSM/MPC signer | Phase 4 |
7. Security
- Model never receives keys / RPC / mutable policy
- Signer accepts only policy-approved calldata
- Stale oracle → pause band
- Show rationale + sim diff on escalations
8. Next (after Oracle/SPOOL deployables)
- Freeze allowlist sighashes vs SPOOL
- AGY-1 deploy script
- Split decision worker from signer stub