params state

DelegateSetEvent

Event names. PascalCase with a named const is the house style across r/sys and r/gov; the bare lowercase "set" elsewhere in this realm predates it.

DelegateClearedEvent

Event names. PascalCase with a named const is the house style across r/sys and r/gov; the bare lowercase "set" elsewhere in this realm predates it.

DelegateWriteEvent

Event names. PascalCase with a named const is the house style across r/sys and r/gov; the bare lowercase "set" elsewhere in this realm predates it.

assertDelegate

assertDelegate authorizes a caller as the holder of a delegated capability. want is the authorized package path, or "" when nothing is delegated. The empty check comes FIRST and is load-bearing, not defensive. A direct call from a user account has an empty previous package path — that is exactly what IsUserCall tests — so comparing against an unset slot would compare "" to "" and admit every user on the chain. r/gov/dao's own allowlist has the mirror-image bug (it returns true for everyone when the list is empty), kept there deliberately for genesis bootstrap. Nothing here needs that, so empty denies. Matching is exact, never a prefix. A sub-realm identity minted by cur.Sub(subpath) presents the synthesized path "host#subpath", so a delegate may legitimately be a single DAO hosted by a multi-tenant realm — for instance "gno.land/r/nt/commondao/v0#dao/42". An anchored-prefix match on the host would hand the capability to every DAO that realm hosts, and a bare prefix match would additionally match sibling packages. "#" cannot occur in a real package path, so exact matching on the full string is unambiguous. Takes rlm in the non-crossing dispatch position, matching assertValsetCaller so the two gates stay one shape. subject names what is being written, so the refusal stays specific to the capability rather than generic to the mechanism. params\_valset\_auth.txtar pins valset's exact wording as a regression test for PR #5485.

assertDelegatePath

assertDelegatePath rejects package paths that must never be stored in a delegation slot, at the point a proposal is built rather than when it executes. Rejecting the empty string is the same fail-open guard as in assertDelegate, enforced on the way in as well so an accidental clear-by-empty-set cannot be mistaken for a grant. Requiring the gno.land/r/ prefix excludes user accounts (empty path), pure packages, and ephemeral \`maketx run\` realms — the last of which matters because a run realm's path is non-empty, so a check based on "is this code" would let one through.

countByte

realmPathPrefix

isRealmPath

newDelegateProposal

newDelegateProposal builds the GovDAO proposal that applies a delegation change. apply mutates the slot and is run only when the vote passes. event is emitted from inside the executor, so an observer sees the delegation change exactly when it takes effect rather than when it was proposed. from is the previous holder ("" when none), included so a re-delegation is auditable from the single event without reading prior state. apply returns the holder it replaced, read at EXECUTION time. Capturing that at creation would misreport a re-delegation: two set-proposals created while the slot is empty, then executed in sequence, would both emit from="" even though the second replaced the first.

NewSetFeeCollectorRequest

nodeModulePrefix

haltHeightKey

haltMinVersionKey

NewSetHaltRequest

NewSetHaltRequest creates a GovDAO proposal to halt all chain nodes at the given block height. Once approved and executed, nodes will gracefully stop after committing the specified block, enabling coordinated chain upgrades. minVersion, if non-empty, sets the minimum binary version required to resume after the halt. Nodes will refuse to restart unless their version satisfies the minimum requirement, preventing old binaries from accidentally resuming a chain halted for an upgrade. Example: minVersion="chain/gnoland1.1" prevents gnoland1.0 from resuming. Use height=0 to cancel a previously scheduled halt.

syskey

this is only used for emitting events.

assertNotValsetKey

assertNotValsetKey rejects governance proposals that target the node:valset:\* key family. Those keys are reserved for the realm-side gate in r/sys/params/valset.gno (SetValsetProposal) which checks the immediate caller is gno.land/r/sys/validators/v3. Without this guard, a generic NewSysParam\*PropRequest("node","valset",...) would let any GovDAO supermajority bypass the v3 authorization and write validator-set state directly.

assertNotRunSubmittersKey

assertNotRunSubmittersKey rejects generic proposals that target vm:p:run\_submitters. Same shape as assertNotValsetKey above, and the same reason: the key has a realm-side gate the generic factory would walk past. An empty run\_submitters means the MsgRun gate is OFF. So a non-empty list is the chain deciding who may run code, and a list that names nobody able to create a GovDAO proposal cannot be changed back -- creating a proposal needs MsgRun, because a ProposalRequest carries an Executor that MsgCall cannot build from string arguments. The dedicated ProposeSetRunSubmitters in run\_submitters.gno refuses that list at proposal-creation time, where a human can still act on the refusal. Reserving the key rather than adding the check to all nine factories keeps the number of ways to write this parameter at one.

NewSysParamStringPropRequest

NewSysParamInt64PropRequest

NewSysParamUint64PropRequest

NewSysParamBoolPropRequest

NewSysParamBytesPropRequest

NewSysParamStringsPropRequest

NewSysParamStringsPropRequestWithTitle

NewSysParamStringsPropRequestAddWithTitle

NewSysParamStringsPropRequestRemoveWithTitle

newPropRequest

Render

Render shows who, other than GovDAO, may currently write a chain parameter. This realm had no Render, so the only way to see a delegation was to know it existed and query for it by name. That is the wrong shape for state that grants a capability: someone auditing the chain should be able to see, in one place, whether any parameter is delegated and to whom. Values are rendered without escaping, which is safe here because none of them is free-form. A delegate path has passed assertDelegatePath, which permits only lowercase letters, digits and a few separators; the addresses come from the parameter itself, which the chain validates as bech32; and the valset realm is a compile-time constant.

vmModulePrefix

vmParamsSubmodule

runSubmittersKey

runSubmittersMgr

runSubmittersMgr is the package path authorized to manage run\_submitters. Empty means the capability is not delegated, and empty must deny — see assertDelegate.

runSubmittersGrants

runSubmittersGrants records which addresses the current delegate added, so removal can be scoped to its own grants. The parameter is the source of truth and this is a side table, so the two can disagree — genesis, \`gnogenesis params set\`, or any future direct keeper write produces entries with no grant recorded. That direction is safe: an unrecorded address is simply not removable by the delegate, which is the conservative answer. Cleared whenever the delegation changes hands, so a new delegate never inherits authority over its predecessor's grants.

RunSubmittersManager

RunSubmittersManager returns the package path currently authorized to manage run\_submitters, or "" when the capability is not delegated.

RunSubmittersGrantedBy

RunSubmittersGrantedBy reports whether the current delegate added addr, i.e. whether it may remove it. Exposed so a delegate can check before acting. A delegate that discovers a refusal by panicking mid-proposal-execution is in a bad place: the panic aborts the transaction, and for a DAO whose proposal has already passed, every retry aborts the same way.

IsRunSubmittersDelegate

IsRunSubmittersDelegate reports whether pkgpath currently holds the capability. Pure predicate, for a caller that wants to fail cleanly rather than be panicked at.

ProposeSetRunSubmittersManager

ProposeSetRunSubmittersManager creates a GovDAO proposal handing management of run\_submitters to pkgpath. pkgpath may be a sub-realm identity such as "gno.land/r/nt/commondao/v0#dao/42", which is how a single DAO hosted by a multi-tenant realm is named. Matching is exact, so naming the bare host would authorize the host itself and none of its DAOs.

ProposeClearRunSubmittersManager

ProposeClearRunSubmittersManager creates a GovDAO proposal revoking the delegation. Revocation is immediate on execution because the slot is consulted on every call. It deliberately does NOT remove addresses the delegate added: sweeping them would make the executed effect invisible at vote time, and would silently remove nothing whenever the grant record had drifted. Use the existing whole-list setter to reset the list to a reviewed value.

AddRunSubmitters

AddRunSubmitters adds addresses to the run\_submitters allowlist. Callable only by the delegated manager. Addresses already present are a no-op (UpdateSysParamStrings dedupes), and the chain still validates every entry and enforces the list-length cap, because the update re-sets the whole list.

RemoveRunSubmitters

RemoveRunSubmitters removes addresses from the run\_submitters allowlist. Callable only by the delegated manager, and only for addresses that manager added. Refusing rather than silently skipping is deliberate: a partial removal that reported success would leave the caller believing an address was de-listed when it was not.

GetRunSubmitters

GetRunSubmitters returns the current allowlist.

ProposeSetRunSubmitters

ProposeSetRunSubmitters creates a GovDAO proposal replacing the whole run\_submitters allowlist. This is the only way to set the list by vote: the generic factories refuse the key (see assertNotRunSubmittersKey), so every whole-list write comes through here and carries the rule below. The proposer must be on the list they propose. An empty run\_submitters means the gate is off and anyone may MsgRun. A non-empty one therefore decides who may run code at all -- and a list naming nobody who can create a GovDAO proposal cannot be undone, because creating a proposal needs MsgRun: a ProposalRequest carries an Executor, and MsgCall cannot build one from string arguments. The vote would end governance. Requiring the proposer's own address is a cheap way to prove the list is usable rather than merely plausible. GovDAO refuses a proposal from a non-member (PreCreateProposal, "only members can create new proposals"), so if this proposal exists at all its author is a member -- and they just signed the transaction that created it, so the address demonstrably holds a key. A list that merely NAMES a member proves neither: the address may belong to nobody, since any member can enroll an arbitrary address. Checked here, at proposal creation, rather than inside the executor. Nothing in r/gov/dao recovers from an executor panic, so a check that fires at execution turns a passed proposal into one that can never be executed. Here the refusal reaches a person who can still fix the list and propose again. This is a floor, not an invariant. The proposer may resign from GovDAO later, and the list is not re-checked when they do. It rules out arriving at a dead list in one vote; it cannot rule out drifting into one.

setRunSubmitters

setRunSubmitters replaces the whole allowlist. SetSysParamStrings, not UpdateSysParamStrings: Update with add=true appends non-duplicates onto what is already there, so it can never remove an address or empty the list. This realm reserves the key from the generic factories, so this is the only route by vote -- if it appended, the parameter would be append-only chain-wide, a compromised address could never be de-listed, and the gate could never be turned back off. A named function rather than the executor's body inline, so a test can reach it: a closure held in a ProposalRequest cannot be called from outside.

bankModulePrefix

restrictedDenomsKey

unlockTransferTitle

lockTransferTitle

authModulePrefix

unrestrictedAddrsKey

ProposeUnlockTransferRequest

ProposeLockTransferRequest

ProposeAddUnrestrictedAcctsRequest

ProposeRemoveUnrestrictedAcctsRequest

valoperSubmodule

Valoper sys-param keys consumed by r/gnops/valopers (Register + UpdateSigningKey). Governance can update them via the generic NewSysParam\*PropRequest factories — no realm-side gate is needed because the values only affect fees and throttle inside valopers.

valoperRegisterFeeKey

Valoper sys-param keys consumed by r/gnops/valopers (Register + UpdateSigningKey). Governance can update them via the generic NewSysParam\*PropRequest factories — no realm-side gate is needed because the values only affect fees and throttle inside valopers.

valoperRotationFeeKey

Valoper sys-param keys consumed by r/gnops/valopers (Register + UpdateSigningKey). Governance can update them via the generic NewSysParam\*PropRequest factories — no realm-side gate is needed because the values only affect fees and throttle inside valopers.

valoperRotationPeriodBlocksKey

Valoper sys-param keys consumed by r/gnops/valopers (Register + UpdateSigningKey). Governance can update them via the generic NewSysParam\*PropRequest factories — no realm-side gate is needed because the values only affect fees and throttle inside valopers.

defaultValoperRegisterFee

Default values used when the sys-param has never been set by governance. Zero fees (GNOT transfers are disabled chain-wide pre-fork) and a ~1-hour throttle at 6s/block.

defaultValoperRotationFee

Default values used when the sys-param has never been set by governance. Zero fees (GNOT transfers are disabled chain-wide pre-fork) and a ~1-hour throttle at 6s/block.

defaultValoperRotationPeriodBlocks

Default values used when the sys-param has never been set by governance. Zero fees (GNOT transfers are disabled chain-wide pre-fork) and a ~1-hour throttle at 6s/block.

GetValoperRegisterFee

GetValoperRegisterFee returns the fee (in ugnot) required to call valopers.Register. Defaults to 0 if governance hasn't set it.

GetValoperRotationFee

GetValoperRotationFee returns the fee (in ugnot) required to call valopers.UpdateSigningKey. Defaults to 0.

GetValoperRotationPeriodBlocks

GetValoperRotationPeriodBlocks returns the per-operator rotation throttle (in blocks). Defaults to ~1h worth at 6s/block (600). This is the primary anti-spam defense pre-fee while rotation\_fee stays at 0; tightens further once non-zero fees become enforceable.

valsetSubmodule

Param keys read by gno.land/pkg/gnoland (EndBlocker). Keep in sync with gno.land/pkg/gnoland/node\_params.go. nodeModulePrefix is declared in halt.gno (same package).

valsetDirtyKey

Param keys read by gno.land/pkg/gnoland (EndBlocker). Keep in sync with gno.land/pkg/gnoland/node\_params.go. nodeModulePrefix is declared in halt.gno (same package).

valsetProposedKey

Param keys read by gno.land/pkg/gnoland (EndBlocker). Keep in sync with gno.land/pkg/gnoland/node\_params.go. nodeModulePrefix is declared in halt.gno (same package).

valsetCurrentKey

Param keys read by gno.land/pkg/gnoland (EndBlocker). Keep in sync with gno.land/pkg/gnoland/node\_params.go. nodeModulePrefix is declared in halt.gno (same package).

valsetPubKeyTypesKey

Param keys read by gno.land/pkg/gnoland (EndBlocker). Keep in sync with gno.land/pkg/gnoland/node\_params.go. nodeModulePrefix is declared in halt.gno (same package).

valsetAuthorizedRealm

Param keys read by gno.land/pkg/gnoland (EndBlocker). Keep in sync with gno.land/pkg/gnoland/node\_params.go. nodeModulePrefix is declared in halt.gno (same package).

SetValsetProposal

SetValsetProposal publishes the realm's desired valset. Each entry is "\<bech32-pubkey>:\<decimal-power>"; power=0 removes the validator. The chain reads this on the next EndBlocker, diffs it against valset:current, and propagates the changes to consensus.

GetValsetEntries

GetValsetEntries returns the chain's authoritative committed validator set (the contents of valset:current). This is the V\_{H+2} view — the set that will be active at H+2 once the most recent EndBlock's updates apply, NOT the set signing the current block. Callers that want "what v3 reports as the current validator set" — including the in-flight proposed set during the dirty window — should call GetValsetEffective instead.

ValsetDirty

ValsetDirty reports whether valset:proposed is awaiting EndBlocker. Realm callers MUST treat this as transient: the dirty flag is set by SetValsetProposal and cleared by the chain's EndBlocker (every block where dirty=true on entry exits with dirty=false).

GetValsetEffective

GetValsetEffective returns the set that WILL be active at H+2: valset:proposed if dirty, else valset:current. Used by v3 so that (a) reads after a same-block proposal callback see that proposal's effects, and (b) sequential same-block proposals accumulate correctly on top of each other. Misuse warning: this exists for r/sys/validators/v3's internal reads. Other realms making "is X a validator" decisions should call v3.IsValidator, not this directly, so future changes to v3's read semantics propagate uniformly.

parseValsetSlot

parseEntry

parseEntry splits "\<bech32-pubkey>:\<decimal-power>" and derives the validator address via the chain.PubKeyAddress native helper.

GetValsetPubKeyTypes

GetValsetPubKeyTypes returns the validator pubkey-type allow-list mirrored from consensus params (empty means accept any).

assertValsetCaller

assertValsetCaller authorizes the one realm permitted to write valset params. Delegates to assertDelegate (see delegate.gno) so this realm has exactly one authorized-caller gate rather than two that can drift. The distinction that remains is deliberate and is NOT expressible through a delegation slot: this authorization is a compile-time const, so re-pointing it requires a chain relaunch, and assertNotValsetKey locks GovDAO out of the key family entirely. A vote-settable slot would let one supermajority re-point the valset writer at an arbitrary realm and bypass v3's valoper-existence check, its KeepRunning opt-out, and execution-time pubkey re-resolution.