The Timelock Has a Side Door: A Roles-Modifier Register for the ENS Endowment

The executable Foundation proposal has moved in a materially important way. It no longer asks voters to hand over the DAO's ENS tokens or the operational wallet, and it adds a 9-day timelock plus Security Council cancellation rights for Endowment transactions. That is a real concession. It should be treated as one. But the forum clarification exposes a narrow technical gap that the current debate has not isolated enough. When Coltron asked whether the timelock applies to transactions executed by kpk through the Zodiac Roles Modifier, or only to owner-level transactions, Katherine answered: "It would only affect operations based on regular multisig ops, not via the zodiac roles modifier." That answer may be operationally necessary. Active Endowment management cannot wait nine days for every swap order, hedge, rebalance, renewal, or low-risk execution path. A timelock that blocks ordinary treasury operations can make the Endowment worse, not safer. But the opposite failure is just as real. If the timelock covers only owner-level transactions while a wide Roles Modifier path remains fast and under-described, then the concession voters think they are receiving is incomplete. The question is not whether the Roles Modifier should exist. The question is whether voters can see what authority moves through it, what authority cannot, and what happens if the fast path expands. ENS should add a Roles-Modifier Register to the Foundation transition. ## Mechanism: Roles-Modifier Register and Transaction-Class Map 1. Publish the role scope before the vote closes or before the first post-vote Endowment action. The Foundation or Endowment manager publishes a plain-language register of every Zodiac Roles Modifier permission that can be used without the 9-day owner-level timelock. The register should state: - the role name; - the executing address or role holder; - the contracts and function selectors in scope; - the transaction classes allowed; - any per-transaction and per-period limits; - the reason the action cannot practically sit behind a 9-day timelock; - the reporting cadence for uses of that role. This does not require disclosing a private trading strategy. It requires disclosing the shape of delegated authority. 2. Classify Endowment actions into three lanes. Lane A: owner-level governance actions. These stay under the 9-day timelock and Security Council cancellation mechanism. Examples: permission changes, signer changes, mandate expansion, new broad asset authority, custody architecture changes. Lane B: fast-path treasury operations. These may use the Roles Modifier without the 9-day delay when delay would create market, execution, or operational harm. Examples: swaps, rebalances, expiring orders, routine liquidity movement, low-risk operational execution within a DAO-ratified investment policy. Lane C: prohibited fast-path actions. These cannot use the Roles Modifier without either owner-level timelock treatment or explicit DAO ratification. Examples: transferring strategic control, adding a new asset class outside policy, increasing delegated authority limits, routing funds to related parties, changing the manager's own permissions, or making payments that look like grants, compensation, or vendor selection rather than treasury management. 3. Add a public fast-path digest. For Lane B actions, the Foundation or Endowment manager publishes a regular digest. Daily is ideal during active periods; weekly is acceptable if activity is low. Each entry should include: - date and transaction hash; - role used; - transaction class; - amount band; - asset pair or asset class where disclosure is safe; - whether the action was inside the published investment policy; - any exception note. This is not real-time pre-clearance. It is after-the-fact legibility for the fast path. 4. Add a role-change trigger. Any expansion of Roles Modifier authority should be treated as owner-level. If the Foundation or Endowment manager wants to add selectors, raise limits, add a new role holder, add a new asset class, or move a transaction class from Lane C to Lane B, that change goes through the 9-day timelock and Security Council cancellation path. The fast path can execute inside the box. It cannot silently redraw the box. 5. Add abuse and drift triggers. The DAO or Security Council should receive an automatic review trigger if any of these happen: - a Lane C action is executed through the Roles Modifier; - role scope changes without owner-level treatment; - fast-path actions repeatedly lack digest entries; - a single role holder executes above published amount limits; - related-party payments or grant-like payments appear in the fast path; - more than a defined share of Endowment activity moves through undocumented roles. The default cure should be proportional: corrected digest, temporary limit reduction, role suspension, external review, or moving a class of actions back to owner-level timelock treatment. ## Why this matters now The live executable is no longer the same object as the original temp check. The right critique is not "nothing changed." Things changed. The right question is whether the changed safeguards cover the actual operational surface. The current public promise is easy for voters to remember: Endowment actions get a 9-day timelock and Security Council cancellation right. The technical reality is more specific: owner-level actions get that treatment, while some Zodiac Roles Modifier operations do not. That distinction is too important to live only in one forum reply. ## Budget request Budget request: $55,000 for a 45-day implementation and review sprint. - $10,000 to produce the role-scope register and transaction-class map; - $10,000 for legal and treasury review of which actions must stay fast; - $10,000 for technical validation of function selectors, limits, and current role permissions; - $10,000 to build or adapt a public digest template and archive; - $10,000 for delegate review materials before the first renewal or post-vote checkpoint; - $5,000 for corrections, external review, and a final gap report. This is small compared with the Endowment, and it protects both sides of the argument. Supporters of the Foundation get a workable fast path for real treasury operations. Skeptics get proof that the timelock concession is not hollow. Voters get a map of where power actually sits. ## Why this is not duplicative This is not another custody proposal. It accepts the revised executable's basic structure and focuses on the technical surface that remains after the concession. It is not another generic transparency dashboard. It names one concrete mechanism: Zodiac Roles Modifier authority over Endowment operations. It is not another argument about board selection, treasury transfer, grants, registrants, or voting power. It also does not repeat the Ratification Covenant or Renewal Charter lane. Those proposals say concessions should become executable and mapped to future checkpoints. This proposal identifies one specific concession whose implementation depends on an unglamorous but decisive technical distinction: timelocked owner-level actions versus fast-path Roles Modifier actions. If the executable already includes a public Roles Modifier register, transaction-class map, fast-path digest, role-change trigger, and abuse triggers, this proposal becomes redundant. If it does not, ENS should add them before voters are asked to treat the timelock as complete.