Status: Proposed, 12 September 2026. Not decided. Awaits operations and a reviewer (blueprint O01). No signer has been appointed, no multisig exists, and no key is held by this repository or this site. This page states what the operator would be allowed to do and how, so that the authority can be reviewed before anyone holds it.

The operator

• —The operator of a series is one address, set at construction and changeable only by the operator itself (transferOperator). For a pilot it is proposed to be a multisig of at least three signers with a quorum of two, none of whom is a signer for any issuer or custodian of the components, with the signer list published on this site.
• —The operator's whole authority is the list below. Everything not on it — moving backing, changing a component, changing units per lot, paying a claim to a different address, upgrading the contract — does not exist in the contract (ADR-001, ADR-005).

What the operator may do, and under what rule

The treasury of the credit desk

The token record is decided; the credit desk's treasury — the address every top-up goes to, an immutable of the desk that the site verifies against the record on every tick — is the same multisig, and its spending is under this policy:

The desk holds no balance and can move nothing; only the multisig can, and only by its own quorum. No signer may top up a key from the treasury, and no credit is ever granted by the desk outside the chain's TopUp event — the site has no function for it.

The multisig on the launch chain

Safe's canonical 1.4.1 contracts answer at their canonical addresses on Robinhood Chain — read on 12 September 2026 (contracts/evidence/robinhood-launch-probes.json; their code copied at block 61,245,138 into contracts/evidence/safe-1.4.1.robinhood.json): the proxy factory at 0x4e1DCf7AD4e460CfD30791CCC4F9c8a4f820ec67, the L2 singleton at 0x29fcB43b46531BcA003ddC8FCB67FFE91900C762, the fallback handler at 0xfd0732Dc9E303f09fCEf3a7388Ad10A83459Ec99; their code hashes were recorded by the tool, not verified against Safe's release, which a reviewer should do once. So the multisig this policy proposes can be created there.

node scripts/plan-safe.ts <owner> <owner> <owner> [--threshold 2] in contracts/ builds that creation, unsigned: it checks the three contracts have code, encodes setup(owners, threshold, …) and createProxyWithNonce, predicts the Safe's address by CREATE2, has the node simulate the call and refuses if the two differ, and prints to, data and the address for any funded wallet to send. Rehearsed against Robinhood Chain's node with placeholder owners on 12 September 2026 — the simulation and the prediction agreed; nothing was sent; the probe is in the evidence file above. The owners are the register's open question A4; the tool takes them as arguments and decides nothing.

Acting without a hosted interface. Whether or not a hosted Safe interface supports this chain, the quorum can act with nothing off chain: each approving owner sends approveHash(hash) to the Safe from their own wallet — an ordinary transaction — and anyone then sends execTransaction with pre-validated signatures naming the owners that approved; the Safe checks the approvals itself and refuses a short quorum (GS020), a non-owner or an unapproving owner (GS025), and a replay. node scripts/safe-tx.ts --safe <safe> --to <address> --data <hex> [--approved-by <owner>,<owner>] prints the hash (refused unless the Safe's own getTransactionHash agrees — checked read-only against a Safe on Robinhood Chain, recorded in the evidence file above), the approval bytes, who has approved so far, and the execution bytes once the quorum has. scripts/safe-rehearsal.ts does the whole thing on a local chain with Safe's runtime code copied from Robinhood Chain (evidence/safe-1.4.1.robinhood.json): the Safe created where the plan said, a 100 CURB payment from the treasury approved by two owners and executed by a third party, every wrong way refused with its code. The checks workflow runs it on every push.

The transactions, as bytes

node scripts/operator-calldata.mjs <series> <action> … in contracts/ prints to and data for each action above — a permit, a stop, a resume, a rotation — with the reason string carried into the transaction where the contract records it; a stop or a resume without a reason is refused. The multisig signs what it prints. This desk sends nothing and holds no key.

Signer rotation

A signer is replaced by adding the new signer to the multisig, confirming the new signer can co-sign a harmless transaction (a permit for a test address on a local chain, or a no-op), then removing the old one. The series contract is not touched unless the multisig address itself changes, in which case transferOperator is executed by the old quorum to the new multisig and the change is published here before it is executed. A lost signer key is a rotation, not an incident, as long as quorum still holds; if quorum cannot be reached, the series continues to pay claims under existing permits and can neither pause nor grant — that is the designed failure mode.

Decision logging

Every operator transaction has a reason string on chain and an entry in the incident or access log with: the date, the signers, the condition or request that triggered it, the evidence looked at (a link to the desk's condition, the reconciliation, the drift record, the issuer notice), and the expected effect on holders. The log is published, with the access log's personal data left out.

Limits on pausing

• —A mint pause may last as long as the cause lasts. A mint pause of more than 30 days is announced as a likely retirement of the series.
• —A claim pause on a component is reviewed every 7 days and either lifted or re-justified in writing. It is never used to hold one component because the other is short: a shortfall in A halts payments of A by the contract itself (ADR-004) and needs no operator pause of B.
• —A pause is never a reason to change what is owed. The ledger is the ledger.

What exists today

The functions and events named above, in contracts/src/CompanySeries.sol, with tests for the operator's limits; the conditions the desk raises (/api/state → conditions); the drill on the series page, whose sixth scenario hands the operator role to a 2-of-3 multisig (a mock, for the rehearsal) and shows that one signer's proposal does not stop minting, a second confirmation does, the former single key can no longer act, and the resume needs two again — the index carrying both with their reasons. No signers, no real multisig, no logs — because there is nothing to operate yet; the multisig's creation is planned and rehearsed, unsigned, for the day the signers are named.