[BFT-A][R6] Freeze immutable curve logic and gate curve parameter changes behind protocol upgrade

[umwelt]

Title

[BFT-A][R6] Freeze immutable curve logic and gate curve parameter changes behind protocol upgrade

Category

• R6 Protocol Upgrade

Authoritative Inputs

• CBE Bonding Curve — Rust Implementation Specification sections 2, 3, and 10
• Team decisions:
  • SELL_CBE is controlled by explicit protocol flag sell_enabled: bool
  • sell_enabled = false at genesis and may become true later by config/upgrade
  • GRAD_THRESHOLD = 2_745_966 * SCALE

Problem

The prior issue assumed a wider native-economics upgrade surface than the new docs support. The curve docs support a tighter split between immutable curve logic and upgrade-gated curve parameters.

Current Behavior

The repo has deterministic upgrade primitives, but there is no curve-specific boundary separating immutable execution logic from mutable curve configuration.

Required Behavior

Freeze immutable curve logic after genesis:

• fixed-width transaction layout
• arithmetic rules
• U256 math discipline
• deterministic sqrt contract
• execution order
• state transition ordering

Require protocol upgrade for documented curve-parameter changes such as:

• band table
• GRAD_THRESHOLD = 2_745_966 * SCALE
• RHO / ALPHA
• fee constants where protocol policy permits
• sell_enabled

This issue does not commit the branch to a specific high-level upgrade-bundle design beyond that documented boundary.

Safety Impact

Without a sealed curve-specific upgrade boundary, future changes can silently alter consensus logic or mutate curve policy unsafely.

Proposed Fix

Establish explicit code and governance boundaries between immutable curve logic and upgrade-gated curve parameters.

Dependencies

• Depends on [BFT-A][R8] Establish canonical CBE curve types and fixed-point state model #1923
• Depends on [BFT-A][R4] Rework genesis to initialize zero-state CBE curve economics #1927
• Depends on [BFT-A][R9] Implement canonical BUY_CBE issuance per mint-on-buy spec #1930
• Depends on [BFT-A][R8] Implement canonical SELL_CBE redemption and solvency checks #1931

Acceptance Criteria

• Immutable curve logic surfaces are explicitly identified in code and tests
• Curve-parameter changes require protocol upgrade handling
• sell_enabled is treated as upgrade-gated config, not ad hoc runtime state
• Invalid curve-parameter updates are rejected before activation
• No historical state rewrite occurs

Test Plan

• Pre-activation parameters remain active
• Activation switches only through protocol upgrade flow
• Invalid band/config/allocation updates rejected
• No historical state rewrite

Cleanup After

• Stop using broad field-by-field governance config for curve parameters without explicit upgrade gating
• Document immutable vs upgrade-gated curve surfaces explicitly

[github-actions]

This GitHub issue proposes enhancing the protocol’s economics upgrade mechanism by introducing an atomic upgrade model for native economics and freezing immutable core logic. The current upgrade model only allows fee-model activations or field-level governance configuration changes, which raises safety concerns about potential unsafe mutations or unintentional alterations to consensus logic. The proposed fix includes creating a bundled upgrade system where parameters can be updated deterministically at a predefined block height, ensuring atomically activated changes and strict rejection of invalid or partial upgrades. Dependencies and an extensive test plan are outlined to validate the changes, aiming to preserve historical state integrity and clearly distinguish mutable parameters from immutable logic. This upgrade would address concerns of maintaining consistent and secure economics logic post-genesis.