Records and clocks

Section 4 of 22

Keep separate records for a proposal, each implementation revision, each release candidate, and each payment entitlement. One release can contain several contributions. One contributor can complete accepted work even when a later combined release fails. Linking the records preserves that distinction.

Each flow instance carries its current state, exact input versions, applicable rule version, authorized action, evidence references, and any deadlines. Execution jobs also carry an identifier used to prevent duplicate effects. This identifier lets another worker resume the job without issuing the same payment twice.

Use one recorded source of truth for an authorization. A queue delivers work, and Git holds source and files, but neither can contradict the authoritative permission record. The promotion controller holds queued action identity, executor authority, delay, cancellation, and execution status. The authenticated off-chain records hold evaluation, coverage, and challenge facts that its executor checks. Database and transport choices remain implementation details within that split.

The DAO also has operating states, such as normal operation, degraded operation, and a scoped pause. These restrict individual flows. A pause can stop affected credential issuance while reports and recovery continue. It should not freeze every action merely because one service is unavailable.

Distinct clocks

Clock	Starts when	Purpose and completion
Work deadline	The paid scope and assignment are accepted.	Limits how long the implementer or DAO may leave the assignment unfinished. The terms define extension and cancellation.
Evaluation period	The exact candidate is available to the required runners.	Collects prescribed tests, samples, and attack-search work. Completing elapsed time alone does not complete missing evaluation.
Member challenge window	Members can access the candidate, required baseline results, and evidence needed to challenge it.	Gives members a real opportunity to object before activation. It cannot expire while the essential test access is unavailable.
Execution delay	A valid authorization is queued under a rule requiring delayed execution.	Provides notice before a consequential action. The executor must still check current authority when it acts.
Payment observation period	The accepted contribution reaches the agreed observable-use milestone.	Determines when conditional compensation matures. It is separate from the pre-production challenge window.
Recovery deadline	A job enters a recorded recovery state.	Bounds retries and escalation before the attempt closes or a continuing service restriction is declared.

The thirty-day period concerns conditional compensation. A release can go live before that payment matures. Standard and emergency release clocks have separate purposes and settings.

Testing and challenges can overlap after the required baseline results are available. If further scheduled attack testing must finish before release, promotion waits for it even if the member window has closed. A finding can block the candidate at any time. A material change to the target requires new relevant evidence and a fresh opportunity to challenge the changed target.

Required record contents

The names below specify logical records. They do not prescribe a database or claim an API already exists.

Record	Required contents
Work assignment	Participant, scope, acceptance conditions, quote, license terms, resource budget, rule version, deadlines, and linked revisions.
Candidate	Domain, source tree and build hashes, model and configuration references, corpus and policy versions, coverage decision or targeted-classification proof, predecessor, and proposed actions.
Evaluation	Candidate identifier, runner and runner version, complete prescribed run list, inputs, expected and observed results, failures, unavailable runs, costs, and evidence authentication.
Judgment	Target and question, decision-maker's assignment, disposition, reasons, evidence, rule version, expiry, and allowed effect.
Authorization	Exact action and target, issuing authority, applicable rule, expiry, replay protection, and any required predecessor state or delay.
Execution	Authorization identifier, worker assignment, attempts, external transaction or job identity, confirmed outcome, and reconciliation status.
Challenge or incident	Affected target, report evidence and access policy, qualification, blocking scope, assigned authority, clocks, decisions, and follow-up.
Payment entitlement	Accepted quote and milestone, recipient record, asset and conversion terms, reserved amount, due or disputed portions, and settlement outcome.

Publish an event when a record changes state. Keep the prior version and the evidence that justified the change. Correct an erroneous record with a linked correction rather than erasing its history. Public events can identify confidential evidence by hash and controlled-access reference.

Authenticate decision payloads with their intended system, action type, and target. An on-chain authorization also identifies the intended chain and contract. Apply an expiry and a single-use identifier where reuse could duplicate or redirect an effect. The controller must compare the current state when committing a transition so two workers cannot act on incompatible snapshots.

Record pending external actions before dispatch. After an interruption, reconcile the transaction or provider job before issuing another effect. A worker lease expiring does not prove that its earlier action failed.