Problem Statement. Admin is set once at init() and never changed. There is no two-step
rotation, no revocation path for a lost admin key, and no recovery code.
Why it matters. Lost admin keys are an obvious, severe incident. A maintainer must
have a way to rotate the admin without redeploying the Wasm.
Technical Context. KEY_ADMIN is a single value. There is no pending_admin slot.
Expected Outcome.
rotate_admin(new_admin) is callable only by current admin, sets KEY_PENDING_ADMIN.accept_admin() is callable only by pending_admin, replaces KEY_ADMIN, clears
KEY_PENDING_ADMIN, emits AdminRotatedEvent.- A 7-day bounded
accept_admin deadline enforced (configurable).
Acceptance Criteria.
- New test asserts old admin cannot
pause after accepting-rotation is complete.
- New test asserts pending_admin does not gain powers until
accept_admin.
Files or modules likely to be affected. src/lib.rs, tests/aid_escrow_tests.rs.
Difficulty. Hard
Estimated effort. M
Backlog item #23 from `docs/maintainer-issue-backlog.md.
Problem Statement. Admin is set once at
init()and never changed. There is no two-steprotation, no revocation path for a lost admin key, and no recovery code.
Why it matters. Lost admin keys are an obvious, severe incident. A maintainer must
have a way to rotate the admin without redeploying the Wasm.
Technical Context.
KEY_ADMINis a single value. There is nopending_adminslot.Expected Outcome.
rotate_admin(new_admin)is callable only by current admin, setsKEY_PENDING_ADMIN.accept_admin()is callable only bypending_admin, replacesKEY_ADMIN, clearsKEY_PENDING_ADMIN, emitsAdminRotatedEvent.accept_admindeadline enforced (configurable).Acceptance Criteria.
pauseafter accepting-rotation is complete.accept_admin.Files or modules likely to be affected.
src/lib.rs,tests/aid_escrow_tests.rs.Difficulty. Hard
Estimated effort. M
Backlog item #23 from `docs/maintainer-issue-backlog.md.