poc: app operations + trust model

[solimander]

Before & After — master vs soli/gov (this PR)

master (current — system v1.3.0)

graph TB
    classDef eigenlayer fill:#dbeafe,stroke:#3b82f6
    classDef protocol fill:#f3f4f6,stroke:#6b7280
    classDef governance fill:#fef9c3,stroke:#ca8a04

    subgraph Gov["Protocol Governance"]
        computeOps["computeOpsMultisig"]:::governance
        computeWL["computeWhitelisterMultisig"]:::governance
    end

    subgraph Proxies["Contracts (all proxies via ProxyAdmin)"]
        PA["ProxyAdmin"]:::protocol
        AC["AppController\n(impl last deployed in v1.1.1)\n─────────────────\nstartApp: checkCanCall(app)\nstopApp: checkCanCall(app)\nupgradeApp: checkCanCall(app)\nterminateApp: checkCanCall(app)"]:::protocol
        CAVS["ComputeAVSRegistrar"]:::protocol
        CO["ComputeOperator"]:::protocol
        IA["ImageAllowlist\n(added v1.2.0)"]:::protocol
        USDC["USDCDeposit\n(added v1.3.0)"]:::protocol
        AppBeacon["App Beacon → App impl"]:::protocol
    end

    subgraph EL["EigenLayer"]
        PC["PermissionController\n(gates ALL app operations)"]:::eigenlayer
        AM["AllocationManager"]:::eigenlayer
        DM["DelegationManager"]:::eigenlayer
        RM["ReleaseManager"]:::eigenlayer
    end

    computeOps -->|owns| PA
    PA -->|upgrades| AC & CAVS & CO & IA & USDC
    AC -->|"checkCanCall(app) → is admin?"| PC
    AC --> CAVS & CO & RM & AppBeacon
    CAVS --> AM
    CO --> AM & DM
    computeWL -->|operator allowlist| CAVS

Loading

---

soli/gov (this PR — system v1.4.0) — green = new, yellow = changed

graph TB
    classDef eigenlayer fill:#dbeafe,stroke:#3b82f6
    classDef protocol fill:#f3f4f6,stroke:#6b7280
    classDef governance fill:#fef9c3,stroke:#ca8a04
    classDef new fill:#bbf7d0,stroke:#16a34a,stroke-width:2px
    classDef changed fill:#fef08a,stroke:#ca8a04,stroke-width:2px

    subgraph Gov["Protocol Governance"]
        computeOps["computeOpsMultisig"]:::governance
        computeWL["computeWhitelisterMultisig"]:::governance
    end

    subgraph Proxies["Contracts"]
        PA["ProxyAdmin"]:::protocol
        AC["AppController v1.4.0\n─────────────────\nstartApp: ADMIN role\nstopApp: ADMIN or PAUSER role\nupgradeApp: ADMIN role (owner-only if timelocked)\nterminateApp: ADMIN role (owner-only if timelocked)\ntransferOwnership: ADMIN role (owner-only if timelocked)\ngrantTeamRole ADMIN: owner-only if timelocked\n+ grantTeamRole / revokeTeamRole\n+ migrateAdmins"]:::changed
        CAVS["ComputeAVSRegistrar"]:::protocol
        CO["ComputeOperator"]:::protocol
        IA["ImageAllowlist"]:::protocol
        USDC["USDCDeposit"]:::protocol
        AppBeacon["App Beacon → App impl"]:::protocol
        STF["SafeTimelockFactory\n(proxy + impl)"]:::new
        TCI["TimelockControllerImpl\n(clone target)"]:::new
    end

    subgraph TeamGov["Team Governance (deployed by teams via SafeTimelockFactory)"]
        TeamSafe["Gnosis Safe\n(team members)"]:::new
        TeamTC["TimelockController\n(clone, minDelay enforced)"]:::new
    end

    subgraph Roles["App Roles — stored in AppController (per team)"]
        ADMIN["ADMIN\nstart/stop/upgrade/terminate\ntransferOwnership/grantTeamRole"]:::new
        PAUSER["PAUSER\nstop only"]:::new
        DEV["DEVELOPER\nmetadata/builds"]:::new
    end

    subgraph EL["EigenLayer"]
        PC["PermissionController\n(protocol admin only)"]:::eigenlayer
        AM["AllocationManager"]:::eigenlayer
        DM["DelegationManager"]:::eigenlayer
        RM["ReleaseManager"]:::eigenlayer
    end

    computeOps -->|owns| PA
    PA -->|upgrades| AC & CAVS & CO & IA & USDC & STF
    TCI -.->|clone target| TeamTC
    STF -->|deploys| TeamSafe & TeamTC

    AC -->|"app ops → hasTeamRole?"| ADMIN & PAUSER & DEV
    AC -->|"protocol ops → checkCanCall"| PC
    AC --> CAVS & CO & RM & AppBeacon

    TeamSafe -->|PROPOSER + EXECUTOR| TeamTC
    TeamTC -->|"Timelock.schedule → execute (after minDelay)"| AC

    CAVS --> AM
    CO --> AM & DM
    computeWL -->|operator allowlist| CAVS

Loading

---

Timelocked app — sensitive ops flow

When an app's owner is a SafeTimelockFactory-deployed Timelock (AppConfig.timelocked = true), the four sensitive operations require the Timelock itself as msg.sender. There are no dedicated scheduleUpgrade / executeUpgrade functions in AppController — delay is enforced entirely by the Timelock's own queue:

Team members → Safe.proposeTransaction(
    Timelock.schedule(AppController, upgradeApp(app, release), delay)
)
→ (wait minDelay)
→ Safe.proposeTransaction(
    Timelock.execute(AppController, upgradeApp(app, release))
)
→ AppController.upgradeApp(app, release)   // msg.sender == Timelock ✓

The same pattern applies to terminateApp, transferOwnership, and grantTeamRole(ADMIN).

Non-sensitive ops (startApp, stopApp, updateAppMetadataURI, grantTeamRole(PAUSER/DEVELOPER)) are open to any ADMIN role member regardless of timelocked status.

---

Summary

	master (v1.3.0)	soli/gov (v1.4.0)
System version	1.3.0	1.4.0
AppController impl	Unchanged since v1.1.1	New impl — team RBAC
App lifecycle auth	checkCanCall(app) → PermissionController	hasTeamRole → ADMIN / PAUSER / DEVELOPER
Governance tooling	None	SafeTimelockFactory + TimelockControllerImpl
PermissionController role	Gates all app operations	Protocol-level admin ops only
Timelocked sensitive ops	N/A	Owner (Timelock) must call directly; delay enforced by Timelock queue
On-chain pending upgrade tracking	N/A	Removed — use Timelock.getTimestamp(operationId)
compute-tee auth path	PermissionController admin of app	Must hold team ADMIN or PAUSER role