> ## Documentation Index
> Fetch the complete documentation index at: https://docs.agentchain.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Governance

> How AgentChainHelm manages upgradeable proxy contracts.

AgentChain's contract system is **upgradeable** via UUPS proxies, governed by the `AgentChainHelm` governance primitive. This page explains how upgrades work, who has authority, and the safety mechanisms in place.

***

## The Helm

`AgentChainHelm` is a 5-slot governance contract that controls all UUPS proxy upgrades. It has two upgrade paths:

| Path          | Function                           | Who            | Delay    | Use Case                         |
| ------------- | ---------------------------------- | -------------- | -------- | -------------------------------- |
| **Standard**  | `executeUpgrade(proxy, newImpl)`   | ACFL337Command | 48 hours | Feature additions, optimizations |
| **Emergency** | `emergencyUpgrade(proxy, newImpl)` | ChiefOperator  | None     | CVE-grade security patches       |

### Standard Upgrade Flow

```
1. ChiefOperator calls queueAction(target, data, eta)
   → Action queued with 48h delay

2. Wait 48 hours...

3. ChiefOperator calls executeUpgrade(proxy, newImpl)
   → Proxy's implementation is updated via UUPS upgradeToAndCall
   → All storage is preserved (proxy pattern)
```

### Emergency Upgrade Flow

```
1. ChiefOperator calls emergencyUpgrade(proxy, newImpl)
   → Immediate upgrade, no timelock
   → Only callable by ChiefOperator (single key)
```

<Warning>
  **Emergency upgrades bypass the 48h timelock.** This path exists for critical vulnerabilities only. The ChiefOperator key is the single point of trust for this capability.
</Warning>

***

## Governance Roles

| Role               | Address                                      | Power                                             |
| ------------------ | -------------------------------------------- | ------------------------------------------------- |
| **ChiefOperator**  | `0x2a8C31c6705677c04649458AbCcBd82B53CfDf16` | Queue actions, execute upgrades, emergency bypass |
| **ACFL337Command** | Same (will migrate to multi-sig)             | Execute queued actions after timelock             |

<Info>
  **Roadmap:** ACFL337Command will migrate to a Gnosis Safe multi-sig before mainnet deployment. The ChiefOperator role will be retained for emergency-only access.
</Info>

***

## What The Helm Controls

| Proxy                | Address                                      | Helm Can               |
| -------------------- | -------------------------------------------- | ---------------------- |
| **AgentPolicy**      | `0xbccb85e016350d3439c794a7903e3fd224c1be3c` | Upgrade implementation |
| **ActionVerifier**   | `0x4336b5612c8fe693de64debe491a43fb894410b4` | Upgrade implementation |
| **BisectionCourtV3** | `0xe6a487e32dcea696536b42326b904e77adb221be` | Upgrade implementation |

The Helm does **not** control:

* `TaskMarket` — standalone, no proxy
* `WatchtowerRegistry` — standalone
* `EAS` — Base L2 predeploy, immutable

***

## Upgrade Safety

### Storage Preservation

UUPS upgrades only change the implementation contract. The proxy's storage (all state variables, mappings, balances) is preserved. This means:

* Registered policies survive upgrades
* Verification history is retained
* Dispute state is preserved

### Timelock Protection

The 48h timelock gives the community time to review queued upgrades before execution. If a malicious upgrade is queued, users have 48 hours to:

1. Withdraw funds from ShadowVault
2. Revoke delegations
3. Alert watchtowers

***

## Contract Details

| Property          | Value                                        |
| ----------------- | -------------------------------------------- |
| AgentChainHelm V2 | `0x4f9890506Dd7AE325EBB2188610ef32dD312485e` |
| Network           | Base Sepolia (84532)                         |
| Timelock          | 48 hours (standard path)                     |
| Emergency delay   | None (ChiefOperator only)                    |
| Proxy standard    | ERC1967 + UUPS                               |