CPS-0007 | Voltaire era Governance

[Quantumplation]

This CPS tried to frame a set of motivations, goals, constraints, and open questions for the very broad topic of Cardano governance.

Whereas discussions within a specific CIP are most effective when targeted at the specific technical solution in question, a CPS allows for broader philosophical discussion that may shape whether an entirely different CIP is needed.

Despite being generally in support of CIP-1694, I tried to keep this very neutral. I reached out to several people to help review this, including a few that are mildly or staunchly opposed to CIP-1694, and their feedback was that I had been successful in that neutrality.

I also have an open offer: if anyone wants to write a competing CIP to 1694, I'm happy to help refine the technical argument to be the strongest proposal it can be.

I think ultimately the community will be strengthened by these perspectices, and even if the community does align behind 1694, other CIPs can provide useful insights to refining CIP-1694, or provide follow up work to continue improving governance beyond the initial minimum viable governance.

Rendered Version

[hans-repo]

Suggested change

	7. This system is highly dependent on the off chain user experience and community tooling, since very few users are reading raw CBOR dumps from the chain.
	8. This system should be cognizant of the fact that different decisions can have different impact and risk thresholds.
	9. This system cannot avoid the fact that stake pool operators of the network, collectively, always maintain control over a "pocket nuke": under sufficient discontent and misalignment with the will of governance, they can modify the code and initiate an uncontrolled hard fork to produce a separate chain aligned with their values.
	Additionally, here is a more opinionated (and potentially controversial) list of potential considerations for a CIP, presented purely to foster discussion:
	1. There is currently no known decentralized "proof of personhood" system that is well specified and easily implementable, and without such a system, "one lovelace one vote" systems are the most effective defense against sybil attacks.
	2. Given the current near total control over these decisions that these founding powers have, any dilution of power that doesn't compromise the security of the chain or risk a deadlock is a worthwhile step to take.
	3. The system loses legitimacy if participation is extremely low, or participation is severely uninformed; If a significant portion of the Cardano community has not yet had a reasonable opportunity to participate, or the majority of participation is indinstinguishable from randomness, then any decisions made during this time are illegitimate.
	4. Not every ADA holder is interested in *directly* participating in every decision. Often an ADA holders voice can still be heard through delegation to another ADA holder.
	5. If the system contains such a notion of delegation, the ability to withdraw, redirect, or reclaim that voice at any time is an important tool in fighting corruption.
	6. While it may be useful to draw inspiration from existing real-world systems, it should also be understood that blockchain governance will have an entirely different set of constraints. For example, the ADA community does not share one culture or geographic locality. Additionally, the decisions being made are not the same kinds of decisions that a world government needs to make.
	7. The uncontrolled hard fork described above is dangerous (from a safety standpoint) and disruptive (from an economic standpoint); it will likely seriously undermine the cohesion of the Cardano community. For this reason, it should be considered a tool of absolute last resort.
	7. This system cannot rely on a trusted third party.
	8. This system should be able to ensure the legitimacy of decisions. It loses legitimacy if participation is extremely low, or participation is severely uninformed; If a significant portion of the Cardano community has not yet had a reasonable opportunity to participate, or the majority of participation is indinstinguishable from randomness, then any decisions made during this time are illegitimate.
	Additionally, here is a more opinionated (and potentially controversial) list of potential considerations for a CIP, presented purely to foster discussion:
	1. There is currently no known decentralized "proof of personhood" system that is well specified and easily implementable, and without such a system, "one lovelace one vote" systems are the most effective defense against sybil attacks.
	2. This system is highly dependent on the off chain user experience and community tooling, since very few users are reading raw CBOR dumps from the chain.
	3. This system should be cognizant of the fact that different decisions can have different impact and risk thresholds.
	4. This system cannot avoid the fact that stake pool operators of the network, collectively, always maintain control over a "pocket nuke": under sufficient discontent and misalignment with the will of governance, they can modify the code and initiate an uncontrolled hard fork to produce a separate chain aligned with their values.
	5. Given the current near total control over these decisions that these founding powers have, any dilution of power that doesn't compromise the security of the chain or risk a deadlock is a worthwhile step to take.
	6. Not every ADA holder is interested in *directly* participating in every decision. Often an ADA holders voice can still be heard through delegation to another ADA holder.
	7. If the system contains such a notion of delegation, the ability to withdraw, redirect, or reclaim that voice at any time is an important tool in fighting corruption.
	8. While it may be useful to draw inspiration from existing real-world systems, it should also be understood that blockchain governance will have an entirely different set of constraints. For example, the ADA community does not share one culture or geographic locality. Additionally, the decisions being made are not the same kinds of decisions that a world government needs to make.
	9. The uncontrolled hard fork described above is dangerous (from a safety standpoint) and disruptive (from an economic standpoint); it will likely seriously undermine the cohesion of the Cardano community. For this reason, it should be considered a tool of absolute last resort.

[hans-repo]

Starting point 7 in Goals the points became more like "notes" which belong to the next category imo.
The point about proof of identity and the legitimacy should be stated as goals, not just notes. This is especially because these are the two points causing the most controversy, and debates should start from the same set of agreed upon goals.

For example, solving decentralized "proof of personhood" is a long standing computer science problem and probably not going to be solved by the Cardano community (no offense).

I like how you phrased the legitimacy problem, it gives us a good start to define "legitimacy of a decision".

[hans-repo]

Sorry again for the large diff, it seems inevitable when moving lines around, even if the content is very similar

[Quantumplation]

The split isn't intended to be between "goals" and "notes".

Instead, all of them are goals, constraints, considerations, etc.

And then they're split between those that I felt we're fairly uncontroversial (i.e. it's hard to imagine arguing that governance should undermine the security of the protocol), and those that still seem unsettled within the community, regardless of what my own opinions are. For example, you and I feel that proof of personhood is likely unsolvable, but others seem unconvinced. So I'm simple being honest about how much debate there is over the point. :)

[hans-repo]

Ok I see, do you think there should be a "things we know for sure and that form the basis for CIP1694" list? Which is what I thought the "goals" section was, and why I edited it in this way.

[stephen-rowan]

Thanks for this.

Some preliminarily considerations

How is a philosophical discussion framed ? (epistemological) How should it be framed ? (ethical)
What distinguishes the philosophy from the specification ? For example, if a blockchain specification is deterministic does it need a philosophy ? Is not the philosophy implied by the design ?

To date improvement proposals in Bitcoin, ETH, ADA etc have addressed issues around specification. Does this situation change once governance is applied beyond deterministic boundaries ? In other words, when does a specification move from the technical to the political ? Can this be expressed in terms of "human" governance ?

Does this movement from technical to political design also inform how questions are framed ? That is, an issue in a technical specification may be reasonably addressed in terms of problem sensing. But should the same problem sensing approach be applied to political issues ? (An alternative category has been META). Is blockchain governance inherently in danger of being dominated by a technocratic approach ?

The range of human political philosophy cannot be captured by a single deterministic design. Therefore philosophical terms (epistemological, ethical etc.) should be applied sparsely and with great caution. In this context terms such as "motivations, goals, constraints" are contingent value statements. The closest that Blockchain design gets to this is in restricted application of social choice theory (using game theory) that applies conservative (safe) models based on restricted definitions of social preference.

Any statement of values (such as in a constitution) is arbitrary from a political perspective (a political not a technical choice). This only becomes the mission of the blockchain through human intervention.

The protection against Sybil attacks is the necessary application of plutocracy (1c1v) in a deterministic setting. This is also a political constraint on what "skin in the game" means. (e.g. It excludes reputation & capability).

Participation based solely on a number (percentage) is meaningless without a social choice context. The participation has to mean something. It has to reflect social preferences. If these social preferences are only determined by plutocracy this exposes the narrow sense of participation.

If "the ADA community does not share one culture or geographic locality" then should governance be pluralistic not plutocratic ?
Plutocracy operates in the deterministic context in one dimension and erases all other dimensions of meaning. An alignment is assumed here on what can be shared. And the only thing that can be shared is amount of ADA you hold. This sounds like a dystopia.

Can blockchain governance accommodate pluralism ? Does this imply a separation between a deterministic Level 1 and a fragmented Level 2 of side chains ?

[Crypto2099]

Some thoughts and musings I had r.e. governance in no particular order, I don't know if they're necessarily relevant to this document in terms of helping to frame future "constitutional" documentation or rules or specific technical implementations of governance...

1. Cardano currently secures certain aspects of the ledger using refundable deposits to minimize "spam" for behaviors such as: registering a staking address, registering a stake pool. In order to prevent "spam" against the governance system, should there be deposits required for:

   • Voter Registration?
   • Submission of a proposed governance action?

   If yes, what are reasonable amounts for these actions and should deposits be refundable or added to the epochal rewards pot for distribution to all active ADA Delegators?

2. For any proposed governance solution, how does the proposer intend to mitigate the risk of governance deadlock?

3. If a proposed governance solution intends to deviate from the "one lovelace, one vote" system, how do they intend to minimize vote fraud and manipulation?

4. What are the participation quorum requirements of the proposed governance solution?

5. For any proposed governance solution, how will it accomplish resolution of questions pertaining to at least the 3 decision types mentioned in the CPS?

[technologypoet]

Suggested change

IOG in particular has continued to provide skill and resources for years longer than initially intended, and is significantly over-budget and over-extended. IOG has said that they may be unable or unwilling to support development of the chain indefinitely, and so an expedient and iterative approach to governance is likely to have higher positive impact on our ability to maintain velocity as an ecosystem.

IOG in particular has continued to provide skill and resources for years longer than initially intended. IOG has said that they may be unable or unwilling to support development of the chain indefinitely, and so an expedient and iterative approach to governance is likely to have higher positive impact on our ability to maintain velocity as an ecosystem.

[technologypoet]

To the 'nearly every' comment, which ADA holders are not able to participate?

[Quantumplation]

This is to leave space for solutions that have anti-DDOS measures like a small deposit; if you have 1 ada you can't pay the deposit, or sometimes even the transaction fees.

[technologypoet]

https://go.gitcoin.co/passport is one such system

[Quantumplation]

I couldn't find an explanation of how it works beyond just being a standard for different centralized entities to issue "stamps"; if that is the case, who manages the "stamp issuance" for being able to participate in a vote? That's what I meant by "decentralized", but maybe I can emphasize that more.

[hans-repo]

Adding "This system cannot rely on a trusted third party. " as a core goal would help making the "proof of personhood" point less controversial (maybe? 🥲) . It makes it much clearer to the general public why 1 lovelace 1 vote is the best we can do currently.

[technologypoet]

From my understanding it looks to be a protocol where multiple dapps can issue 'stamps' (attestations) in your 'passport' (agreed on data format), which is basically a decentralized way to build up proof of unique humanness. Each dapp can then decide what combination of stamps sufficiently proves this. This is used as a weight on quadratic funding for gitcoin.

I squint and see PGP's web of trust.

I don't know how much of this is available or portable to Cardano.

I'm not saying 1 ADA = 1 vote is not the way to go, but it's interesting that other chains have chosen to tackle this for governance for community grants

[Quantumplation]

That's exactly what Atala Prism is, fwiw. And works great for specific limited domains. The mind balks at getting Cardano to agree to a specific set of stamps that qualify you though 😅 especially when we haven't even started laying that groundwork outside of the standard. There's not a single DID issuer with a single day of reputation yet.

[JaredCorduan]

💯 ☝️

[technologypoet]

Does trust / expertise based delegation result in centralization that subjects Cardano to similar 'Cantillon effect' seen in fiat systems?

[stephen-rowan]

@Crypto2099 comment above (#481 (comment)) led me to the following reflections -

Overall, I see this approach as "minimalism" in blockchain governance. Certainly as any move to Voltaire (autonomy, decentralization etc.) at L1 is concerned. A major problem, in my view, with CIP-1694 is it's "maximalist" elements. Such as a constitution that references human values.

In this context the scoping referred to in 5) above which @Quantumplation outlines as -

1. the "when and how" of changes the ledger rules
2. the "when and how" to update various protocol parameters, and
3. the "when and to whom" to disburse funds from the treasury

can be considered as "minimalism". Although 3) "disbursal of treasury" arguably has a fatal dependency on maximal human concerns.

If the community accepts that CIP 1694 is just a first step or transition to decentralized or autonomous governance then existing plutocratic protections may make sense as a conservative (cautious) strategy. To address, as above, 1) deposits to dissuade spam and, 3) 1c1v as Sybil protection.

In my view, 2) "the risk of governance deadlock" can be best mitigated through a minimal approach. And this would be a kind of statement that accepts the plutocratic status quo (does not try to hide it in process or language) but announces an intention to contain this narrow interpretation of "skin in the game" until more mature solutions are available.

So far, I have not seen any solution at L1 that avoids plutocracy (or 1c1v) therefore governance at L1 is not mature enough to serve pluralistic human needs. So governance with this kind of Sybil resistance needs to be contained. In the short term L2 side chains provide more flexible governance solutions with less critical dependencies.

[JaredCorduan]

I think that this CPS is very well worded and captures the problems great. thank you @Quantumplation !

[michael-liesenfelt]

1. I noticed that ctrl+f returns 0 for "Genesis". Do you want to include discussion(s) about the retirement of the current genesis keys under Goals/Questions?
2. Do you want to discuss preservation of the existing treasury balance during the initiation of governance under Goals/Questions?

[rphair]

@Quantumplation I noticed this is starting to circulate as CPS-0004 - a number which has been given to another problem statement: #418. This CPS is getting well deserved popularity so had to address that ASAP to avoid confusion.

Can you rename the directory to something else that has CPS but not a number it in it?

While in there I did some quick edits to the front matter to fix up some extra characters & passages of text that will mess up the scrapers & indexers. @KtorZ is there any way to add human-readable text to a link in these headers, e.g. for the Discord link title removed in 6ca95b3?

[rphair]

@Quantumplation since you'll likely be in this situation again, here's some guidelines to make sure the number duplication doesn't happen again 😜

https://github.com/cardano-foundation/CIPs/tree/master/CIP-0001#header-preamble

CIP number ... "?" before being assigned

https://github.com/cardano-foundation/CIPs/tree/master/CIP-0001#repository-organization

Before a number is assigned, use ???? as a placeholder number (thus naming new folders as CIP-????).

I had argued for adding language "or CIP followed by a unique identifier, not a number" (e.g. what you have now & what others use while in draft) but it was not adopted.

[Quantumplation]

@rphair yea, using CPS-???? as a number has the unfortunate consequence of having collisions for un-assigned CIPs; i guess if it's in a PR, though, it should be fine.

[rphair]

@Quantumplation The ???? characters have a way of jumping out at people when they look down the folder names in a PR branch... but so does CIP-SomeOtherName without a number. And the ? characters cause problems with Windows file names (I don't observe those problems, but have seen them reported). Next revision of CIP-0001 I will try again to push for a more inclusive strategy. cc @KtorZ

[rphair]

@Quantumplation please rename the containing folder from CPS-Voltaire to CPS-0007 and update the link to the README file in #481 (comment). 🎉

[Quantumplation]

@rphair done (though the readme link doesn't need to be updated, as it always points at the latest version)

[rphair]

thanks @Quantumplation, the updates look good. These links always do indeed point to the latest version of file pathnames... but in this case your pathname is also changing since the directory was renamed; therefore we're changing:

https://github.com/Quantumplation/CIPs/blob/master/CPS-Voltaire/README.md

to

https://github.com/Quantumplation/CIPs/blob/master/CPS-0007/README.md

[rphair]

Merging since this has passed every challenge and so it can be considered as CIP-1694 also progresses.