How ENS Becomes the First Foundation with Cryptographic Accountability

The temp check ends with a line worth taking seriously. The goal is a DAO that votes rarely and matters every time it does. That goal is achievable. But achieving it requires answering a question the proposal does not yet answer: how does ENS ensure the Foundation stays mission-aligned between those rare, consequential votes? Mozilla cannot answer that question. Signal cannot. Linux cannot. Every comparable open source foundation cited in the temp check relies on culture, reputation, and founding-generation integrity to hold the line across decades. Those things work until they do not. ENS has something none of those organizations have: a tokenholder base that can enforce accountability cryptographically. The current proposal uses that base as a removal backstop. This proposal argues ENS should use it as a continuous accountability layer -- and that doing so would make ENS the most accountable foundation-led open source project in existence. That is worth demonstrating. AMENDMENT 1: OPEN THE DIRECTOR NOMINATION POOL WITH ZK CREDENTIALS. The temp check models initial board formation on Mozilla, Signal, and ISRG: founder and operator-led, ratified by the community. That is the right starting point. The problem is what happens next. Future independent directors are selected by the existing board. The proposal gives tokenholders ratification authority and removal authority. It does not give them nomination access. The amendment: any candidate for an independent director seat can self-nominate by proving meaningful ENS ecosystem contribution via verifiable credential. Credentials committed on-chain as a Merkle root. Proof of inclusion generated at nomination time. No full contribution history revealed. No committee deciding who counts. This does not change how the initial slate works. It changes what the pool looks like for every seat after that. The people who have built ENS infrastructure, shipped integrations, contributed to governance -- they get a path in that does not run through the board they would be overseeing. Mozilla cannot do this. ENS can. AMENDMENT 2: MAKE QUORUM PROVABLE ON STRUCTURAL TREASURY DECISIONS. Katherine confirmed in the thread: treasury custody transfers from the Governor/Timelock to Foundation governance. That is the right long-term move for a body that needs to execute multi-year capital strategy rather than manage by vote. The tradeoff is that the DAO loses continuous on-chain visibility into roughly 00M in assets. Annual audits and published budgets restore some of that visibility. A tiered authorization structure restores the rest. Tier 1: routine operational spend within the approved annual budget, ED authority. Tier 2: significant decisions outside the approved envelope, board vote with 14-day public comment window published on-chain. Tier 3: structural changes above defined thresholds -- asset liquidation, Endowment mandate changes, major off-chain commitments -- require on-chain tokenholder ratification with a ZK proof of quorum. Minimum participation must be provably met before the vote is valid. Individual voter identities stay private. The DAO that votes rarely and matters every time it does needs to know its votes are actually representative. A quorum proof makes that verifiable rather than assumed. AMENDMENT 3: NULLIFIER-BASED REMOVAL PETITIONS. This amendment is deployable today. Semaphore has been in production for years. No protocol changes required. The current removal process requires petitioners to publicly allege a mission violation before any vote is called. That is a reasonable due process requirement. It is also a chilling effect on anyone whose grant renewal, service provider status, or working relationship with the Foundation makes signing a public document too costly. The amendment: removal petitions filed as nullifier-based commitments on-chain. Identity hidden until a threshold of unique commitments is reached -- suggested at 5% of delegated voting power. At threshold the petition becomes public and the standard 30-day process begins. Petitioners who want to identify themselves can. Those who cannot afford to go first still get counted. The removal authority tokenholders already have does not change. The structural barrier that makes that authority unusable in practice does. WHAT ENS GETS TO PROVE. The temp check is right that ENS has a chance to demonstrate something the broader DAO ecosystem has not yet shown: that a foundation-led model with structural community accountability is more robust than either pure DAO governance or closed-loop foundation governance. These three amendments are how ENS makes that demonstration specific. Not we have removal authority but removal petitions cannot be chilled. Not we publish annual budgets but quorum on structural decisions is provable. Not the board is accountable to the community but the nomination pool is open to anyone who can prove they built here. Mozilla has been running for 25 years on culture and reputation. ENS can run on proof. That is the upgrade.