names state

Render

admin

enabled

paused

nameLookupFn

nameLookupFn returns (addr, ok) for a given registered name. Allows the verifier function to be unit-tested without wiring up r/sys/users state — production binds resolveCurrentName as the lookup, tests pass nil (PA-only) or a fake.

IsAuthorizedAddressForNamespace

IsAuthorizedAddressForNamespace checks if the given address can deploy to the given namespace. See package doc for the two authorization paths and the pause semantic. Pre-Enable, all checks pass (testing/dev convenience).

resolveCurrentName

Enable

Enable enables the namespace check for this realm. The namespace check is disabled initially to ease txtar and other testing contexts, but this function is meant to be called in the genesis of a chain.

IsEnabled

ProposeSetPaused

ProposeSetPaused returns a GovDAO proposal request that, when voted through and executed, toggles the chain-wide deploy gate. When the realm is paused, the verifier rejects EVERY namespace check — PA (personal-address) included — until a subsequent ProposeSetPaused(false) proposal executes. This is an emergency halt. A paused state means NO new MsgAddPackage transactions land at any path on the chain. Existing realms continue to receive MsgCall traffic normally — pause is scoped to addpkg, not to all VM operations. Use cases: - Bug discovered in this realm or r/sys/users that requires a hotfix before further deploys can be trusted. - Wallet/signature-layer incident under investigation. (A "compromised controller" use case was considered and removed: the controller's RegisterUser path is direct into r/sys/users and does NOT go through this verifier, so pause does not freeze new registrations. To contain a compromised controller, the appropriate flow is ProposeControllerRemoval in r/sys/users, not pause here.) The narrow alternative (pause registered-name path only, preserve PA) was considered and rejected. See package doc for rationale. Gated on GovDAO proposal at T1 tier — not the hardcoded admin used by Enable. Pause is consequential enough to warrant a tier-restricted governance vote rather than a single-multisig click. T1 filter prevents lower-tier members from spamming pause proposals to dilute attention. Trade-off is response time: a T1 vote takes hours-to-days; if a faster emergency-halt mechanism is needed, that belongs at a different layer (e.g. an ante-handler-level chain pause), not here. Pause is orthogonal to the pre-Enable bypass: before Enable, the verifier returns true regardless of paused state. So executing a pause proposal before Enable has no effect on deploys, but the value persists and applies the moment Enable runs. To avoid this staging trap, operators should call Enable BEFORE any pause proposals are voted in. Idempotency: calling ProposeSetPaused(v) when the realm's current paused state already equals v panics at proposal-creation time so voters never see a proposal whose execution would no-op.

setPaused

setPaused is the private actuator behind ProposeSetPaused's executor callback. It is unexported to ensure no path outside the proposal flow can flip the flag — every state change goes through GovDAO. Emits NamespaceEnforcement{Paused,Unpaused} with the executor's realm path for off-chain audit trails.

IsPaused

IsPaused reports the current value of the pause flag. Note: when the realm is pre-Enable, IsPaused may return true but the verifier will still pass-through (pre-Enable bypass takes priority).

verifier

verifier checks namespace deployment permissions. lookup is the registered-name resolver — pass nil to disable that path (used by tests that want to exercise PA-only behavior). Order of checks (top to bottom, first matching wins): 1. !isEnabled → return true (pre-Enable: testing/dev bypass) 2. isPaused → return false (emergency halt — INCLUDES PA) 3. invalid input → return false 4. PA match (addr.String() == namespace) → return true 5. Registered-name lookup match → return true 6. otherwise → return false The pause check is intentionally above the PA check. A SetPaused(true) halts every deploy regardless of namespace shape.