Emergency control room · GenLayer Studionet
Emergency power
that cannot self-certify.
A protocol commits its emergency charter in advance. When an incident is declared, independent GenLayer validators read only the approved evidence and decide against the frozen policy. Authority exists only after that decision is final, and then only as one exact, single-use, expiring capability.
Mass of evidence. Mass of consensus. Zero self-certification.
The only path to authority
01
Charter
The protocol commits an immutable natural-language trigger policy, approved evidence hosts, allowed actions and hard limits. Activation is delayed. Versions only move forward.
02
Freeze
An incident freezes the exact action, scope, duration and evidence URLs against the charter digest. The operator’s story is data, never evidence.
03
Consensus
GenLayer validators each fetch only the pre-approved sources, interpret them against the frozen policy, and must independently verify every quoted passage.
04
Finality
Only an assessment that reaches FINALIZED can emit a capability: holder-bound, target-bound, digest-bound, single-use, expiring.
Why GenLayer is the trust model
Remove it and the system collapses
Smart contracts cannot read an incident report, weigh a security advisory, or notice that a source is trying to manipulate its reader. A multisig can, but then a person certifies their own emergency. Mass replaces that person with validator consensus over live web evidence. Without GenLayer there is nobody left who is allowed to say “this is an emergency”.
What a validator actually checks
Not a rubber stamp
- • Re-fetches every approved source itself, and rejects on any HTTP-class disagreement.
- • Verifies each quoted passage byte-for-byte against its own fetch.
- • Rejects trigger clauses that are not grounded in the frozen charter text.
- • Runs a second substantive comparison of clauses and material findings.
- • Treats prompt-injection tripwires as proof the evidence set is compromised.
Invariants, each with a negative test
No capability before FINALIZED
Every privileged message is emitted on="finalized".
No admin pause on the target
The target exposes no owner, admin or governance pause. Not even its deployer can bypass the gate.
Uncertainty fails closed
Unavailable, conflicting, stale, unquoted or injected evidence yields no authority.
Digest-bound everywhere
Gate and target each recompute the action digest. A capability for another target or duration is inert.
Governance proven five times
Publish, activate, open, issue and apply each re-check the target’s governance wallet.
Non-custodial by construction
No payable method, no payout, no user value. Nothing can be stranded.