Governance, compliance and assurance
Development status: Overview — Each topic on this page carries its own label. Processes for proposing and deciding protocol changes, changing parameters, delaying and staging changes and handling disputes are being explored, and none operates on any available network; tamper-evident audit logging is part of the planned design, with an experimental library implementation for internal development only. No independent audit results are published, no compliance certification or legal assurance is claimed, and nothing is publicly available for live use.
Before you read: System model: how Cubane is intended to work for its users.
How would Cubane be governed and changed, and what assurance and compliance position is stated? This page orients you across the section: how protocol change is intended to be governed, how records of significant actions are intended to support later review, what is and is not claimed about compliance, and where the assurance status is kept. It states no governance rules and makes no legal or regulatory statement.
What this section covers
Table: the pages in this section, what each covers and the status of each.
| Page | What it covers | Status |
|---|---|---|
| Governance proposals and decisions | How changes to the protocol would be proposed, voted on and carried out through auditable steps | Being explored |
| Governed parameters and policies | The intent that protocol settings change only through an accountable, versioned process | Being explored |
| Time-delayed execution and staged upgrades | The intent that approved decisions take effect only after a period for review, and that upgrades are introduced in stages with safeguards for reversing them | Being explored |
| Disputes and appeals | Governed processes for contesting decisions, including penalty decisions | Being explored |
| Audit trails and tamper-evident logging | Records of significant actions whose alteration could be detected | Experimental implementation exists — internal library only |
| Compliance position and data-protection intent | What is and is not claimed, and where the intended data-protection controls are described | Being explored |
Status at a glance
- Nothing operates. No governance process — proposals, votes, parameter changes, delayed execution, upgrades or disputes — operates on any available network, and none can be used today.
- Governance is being explored. The governance topics carry the label “Being explored”: their design and public interface are not settled.
- One experimental item. The only item in this section with an experimental implementation is the tamper-evident logging library. It is internal and is not a complete audit system.
- No published assurance. No independent audit, certification or resilience results are published; see Security assurance status and reporting problems.
- Intent, not features. Wherever this documentation describes governance, it describes intent. No description should be read as a feature that operates today.
How the topics fit together
- Proposals and decisions are the core process. Parameter changes and protocol upgrades are kinds of decision that this process would cover.
- Delay gives time for review. Delayed execution is intended to give time to review an approved decision before it takes effect; staged upgrades apply the same caution to software changes.
- Disputes provide a path for contesting decisions. Disputes and appeals are intended to provide a governed path for contesting decisions, including the penalty decisions described on Penalties for misbehaviour.
- Audit trails make actions reviewable. Audit trails are intended to make significant actions, including governance steps, reviewable afterwards.
- Emergency controls are separate. Action during incidents is a separate topic, covered on Emergency controls and protocol safeguards.
Two meanings of “audit”
The word is used in two senses that are easily confused.
- An audit trail is a record of significant actions, kept so that it can be reviewed later. It is covered on Audit trails and tamper-evident logging.
- An independent audit is a security review carried out by a party independent of the project. Its status — no published results — is on Security assurance status and reporting problems.
Neither an audit trail nor any experimental component is a certification, or an assurance of security or compliance.
The compliance position in brief
- No compliance certification, legal assurance or legal sufficiency is claimed for Cubane or for anything described in this documentation.
- Intended data-protection controls — owner-controlled visibility with selective disclosure, tamper-evident audit records and optional residency controls — are described on their own pages, each with its own status. None of them is a compliance claim.
- Each organisation remains responsible for assessing its own legal and regulatory obligations. Compliance position and data-protection intent explains the position.
Suggested reading by role
- Auditors and regulators: Known limitations of the experimental prototype, then Security assurance status and reporting problems, Audit trails and tamper-evident logging, Visibility controls and selective disclosure, Compliance position and data-protection intent and Governance proposals and decisions.
- Organisations and enterprise integrators: Compliance position and data-protection intent, then Onboarding an organisation.
- Prospective operators: Time-delayed execution and staged upgrades, then Emergency controls and protocol safeguards and Penalties for misbehaviour.
- Researchers: Governance proposals and decisions, then Disputes and appeals and Design note: accountability for misbehaviour.
Assumptions, trust and limitations
- Governance is intended to make change accountable. It cannot by itself ensure that decisions are good, and no governance outcome is promised.
- Who could take part in governance, how decisions would be made and on what timescales are not described in this documentation.
Not yet available, and how this page will grow
As governance topics are designed, implemented and released, their status on this page would change, and each change would be recorded in the Documentation change log. Further technical reference is not yet available.
What this page does not claim
This page does not claim:
- that any governance process operates on any network;
- any governance rule or participant;
- any compliance, certification or legal assurance;
- any published audit result.
Anything not stated here as available should be treated as unavailable.
Related pages
- Governance proposals and decisions — the core governance process.
- Governed parameters and policies — how protocol settings would change.
- Time-delayed execution and staged upgrades — delay and staging safeguards.
- Disputes and appeals — contesting decisions.
- Audit trails and tamper-evident logging — records of actions; the one experimental item in this section.
- Compliance position and data-protection intent — what is and is not claimed.
- Security assurance status and reporting problems — published assurance evidence (none yet).
Glossary
- Governance
- Governance proposal
- Governed parameter
- Time-delayed execution
- Staged upgrade
- Dispute
- Appeal
- Audit trail
- Tamper-evident log
- Independent audit
References
No approved public references yet.
