params source realm

Event names. PascalCase with a named const is the house style across r/sys and r/gov; the bare lowercase "set" elsewhere in this realm predates it.

AddRunSubmitters adds addresses to the run_submitters allowlist.

Callable only by the delegated manager. Addresses already present are a no-op (UpdateSysParamStrings dedupes), and the chain still validates every entry and enforces the list-length cap, because the update re-sets the whole list.

GetRunSubmitters returns the current allowlist.

GetValoperRegisterFee returns the fee (in ugnot) required to call valopers.Register. Defaults to 0 if governance hasn't set it.

GetValoperRotationFee returns the fee (in ugnot) required to call valopers.UpdateSigningKey. Defaults to 0.

GetValoperRotationPeriodBlocks returns the per-operator rotation throttle (in blocks). Defaults to ~1h worth at 6s/block (600). This is the primary anti-spam defense pre-fee while rotation_fee stays at 0; tightens further once non-zero fees become enforceable.

GetValsetEffective returns the set that WILL be active at H+2: valset:proposed if dirty, else valset:current. Used by v3 so that (a) reads after a same-block proposal callback see that proposal's effects, and (b) sequential same-block proposals accumulate correctly on top of each other.

Misuse warning: this exists for r/sys/validators/v3's internal reads. Other realms making "is X a validator" decisions should call v3.IsValidator, not this directly, so future changes to v3's read semantics propagate uniformly.

GetValsetEntries returns the chain's authoritative committed validator set (the contents of valset:current). This is the V_{H+2} view — the set that will be active at H+2 once the most recent EndBlock's updates apply, NOT the set signing the current block. Callers that want "what v3 reports as the current validator set" — including the in-flight proposed set during the dirty window — should call GetValsetEffective instead.

GetValsetPubKeyTypes returns the validator pubkey-type allow-list mirrored from consensus params (empty means accept any).

IsRunSubmittersDelegate reports whether pkgpath currently holds the capability. Pure predicate, for a caller that wants to fail cleanly rather than be panicked at.

NewSetHaltRequest creates a GovDAO proposal to halt all chain nodes at the given block height. Once approved and executed, nodes will gracefully stop after committing the specified block, enabling coordinated chain upgrades.

minVersion, if non-empty, sets the minimum binary version required to resume after the halt. Nodes will refuse to restart unless their version satisfies the minimum requirement, preventing old binaries from accidentally resuming a chain halted for an upgrade. Example: minVersion="chain/gnoland1.1" prevents gnoland1.0 from resuming.

Use height=0 to cancel a previously scheduled halt.

ProposeClearRunSubmittersManager creates a GovDAO proposal revoking the delegation.

Revocation is immediate on execution because the slot is consulted on every call. It deliberately does NOT remove addresses the delegate added: sweeping them would make the executed effect invisible at vote time, and would silently remove nothing whenever the grant record had drifted. Use the existing whole-list setter to reset the list to a reviewed value.

ProposeSetRunSubmitters creates a GovDAO proposal replacing the whole run_submitters allowlist.

This is the only way to set the list by vote: the generic factories refuse the key (see assertNotRunSubmittersKey), so every whole-list write comes through here and carries the rule below.

The proposer must be on the list they propose.

An empty run_submitters means the gate is off and anyone may MsgRun. A non-empty one therefore decides who may run code at all -- and a list naming nobody who can create a GovDAO proposal cannot be undone, because creating a proposal needs MsgRun: a ProposalRequest carries an Executor, and MsgCall cannot build one from string arguments. The vote would end governance.

Requiring the proposer's own address is a cheap way to prove the list is usable rather than merely plausible. GovDAO refuses a proposal from a non-member (PreCreateProposal, "only members can create new proposals"), so if this proposal exists at all its author is a member -- and they just signed the transaction that created it, so the address demonstrably holds a key. A list that merely NAMES a member proves neither: the address may belong to nobody, since any member can enroll an arbitrary address.

Checked here, at proposal creation, rather than inside the executor. Nothing in r/gov/dao recovers from an executor panic, so a check that fires at execution turns a passed proposal into one that can never be executed. Here the refusal reaches a person who can still fix the list and propose again.

This is a floor, not an invariant. The proposer may resign from GovDAO later, and the list is not re-checked when they do. It rules out arriving at a dead list in one vote; it cannot rule out drifting into one.

ProposeSetRunSubmittersManager creates a GovDAO proposal handing management of run_submitters to pkgpath.

pkgpath may be a sub-realm identity such as "gno.land/r/nt/commondao/v0#dao/42", which is how a single DAO hosted by a multi-tenant realm is named. Matching is exact, so naming the bare host would authorize the host itself and none of its DAOs.

RemoveRunSubmitters removes addresses from the run_submitters allowlist.

Callable only by the delegated manager, and only for addresses that manager added. Refusing rather than silently skipping is deliberate: a partial removal that reported success would leave the caller believing an address was de-listed when it was not.

Render shows who, other than GovDAO, may currently write a chain parameter.

This realm had no Render, so the only way to see a delegation was to know it existed and query for it by name. That is the wrong shape for state that grants a capability: someone auditing the chain should be able to see, in one place, whether any parameter is delegated and to whom.

Values are rendered without escaping, which is safe here because none of them is free-form. A delegate path has passed assertDelegatePath, which permits only lowercase letters, digits and a few separators; the addresses come from the parameter itself, which the chain validates as bech32; and the valset realm is a compile-time constant.

RunSubmittersGrantedBy reports whether the current delegate added addr, i.e. whether it may remove it.

Exposed so a delegate can check before acting. A delegate that discovers a refusal by panicking mid-proposal-execution is in a bad place: the panic aborts the transaction, and for a DAO whose proposal has already passed, every retry aborts the same way.

RunSubmittersManager returns the package path currently authorized to manage run_submitters, or "" when the capability is not delegated.

SetValsetProposal publishes the realm's desired valset. Each entry is "<bech32-pubkey>:<decimal-power>"; power=0 removes the validator. The chain reads this on the next EndBlocker, diffs it against valset:current, and propagates the changes to consensus.

ValsetDirty reports whether valset:proposed is awaiting EndBlocker. Realm callers MUST treat this as transient: the dirty flag is set by SetValsetProposal and cleared by the chain's EndBlocker (every block where dirty=true on entry exits with dirty=false).