v0 state

pkgPath

pkgPath is this realm's package path, fixed regardless of quarantine location. DAO treasury addresses derive from it, so they are stable across a SAME-PATH redeploy. Moving to a different package path (e.g. .../v1) changes cur.Sub derivation and would strand existing treasuries unless a drain executor ran first (see gnovm/adr/pr5890\_realm\_sub.md §Cross-host identity); this realm ships no such migration executor.

CommonDAOID

CommonDAOID is the ID of the realm's DAO.

daoID

realmLink

daos

// string(ID) -> \*commondao.CommonDAO

invites

// string(address) -> address(inviter)

creators

// string(address) -> struct{}; consumed-invite marker

listed

// string(ID) -> uint64(ID); home-index opt-in

getDAO

mustGetDAO

makeIDKey

isCreator

isCreator reports whether an address has already consumed an invite and may create further DAOs without another one.

isListed

isListed reports whether a DAO opted into the realm's public home index.

setListed

setListed adds or removes a DAO from the realm's public home index.

subpathOf

subpathOf returns the realm sub-identity subpath that acts for a DAO.

daoAddress

createDAO

createSubDAO

newDAOOptions

init.19

bylawsSets

// string(ID) -> \*bylaws.Bylaws

bylawsView

bylawsView returns a DAO's document set or nil when it has none. Read paths (render, public getters, payload building) use this — it never writes realm state, so it is safe under read-only query evaluation.

bylawsOf

bylawsOf returns a DAO's document set, creating an empty one on first use. Only proposal creation calls it; an empty set left behind by a failed proposal is harmless.

isMandatesPath

isMandatesPath reports whether a document path is in the reserved mandates/ folder (or is the bare "mandates" file). Mandates are not council-self-amendable; see amendBylawsKind.New.

amendBylawsProposal

amendBylawsProposal is both the amend-bylaws args struct and the proposal definition it produces (one type serves both roles, like manageKindsProposal). set is the host DAO's document set the executor patches: New receives only a readonly view, so the trusted wrapper passes the mutable set through args (from its own bylawsOf) together with the host daoID for the identity pin. display is the human-readable change, rendered at New against the then-current document.

amendBylawsKind

amendBylawsKind creates proposals that add, amend or remove one of the host DAO's bylaws/mandates documents with a verifiable diff patch. The patch pins the sha256 of the document text it was diffed against, so a passed amendment that raced a concurrent change to the same document fails cleanly (StatusFailed) instead of clobbering it. Decided by supermajority: this is the council amending its OWN governing documents, which the Constitution grants with no special threshold, so the default council rule applies. (The Constitution's simple-majority clause for charter/bylaws/mandate changes is an ANCESTOR power — a parent amending a descendant's documents — which this realm does not implement yet.)

newCouncilUpdatePropDefinition

newCouncilUpdatePropDefinition creates a new proposal definition for adding/removing council members.

councilUpdatePropDefinition

councilUpdatePropDefinition defines a proposal type for adding/removing council members. Adds and removes apply as idempotent set operations, so concurrently passed updates merge in execution order; an update whose final set would empty a non-empty council fails at execution.

newAncestorCouncilUpdatePropDefinition

newAncestorCouncilUpdatePropDefinition creates a proposal definition for an ancestor DAO to modify a descendant's council membership (docs/CONSTITUTION.md :1531-1532). It is hosted and voted in the ancestor; ancestry is verified at proposal validation.

ancestorCouncilUpdatePropDefinition

ancestorCouncilUpdatePropDefinition defines a proposal type for an ancestor DAO to add and/or remove members of a descendant's council. This is the spec's rescue path for a stuck or empty descendant council (:1531-1532): decided by the ancestor's own supermajority, validated as strictly proper ancestry so a DAO can never mutate its own council through this path (that is the self-mutating councilUpdate).

addrStrings

addrStrings converts addresses for markdown list rendering.

kindText

Proposal kind names: the per-DAO registry keys for every proposal type this realm can host. A DAO accepts proposals of exactly the kinds registered on it. The default kinds are registered at DAO creation and the kind set is managed afterwards through the manage-kinds kind (CreateRegisterKindProposal / CreateDeregisterKindProposal).

kindCouncilUpdate

Proposal kind names: the per-DAO registry keys for every proposal type this realm can host. A DAO accepts proposals of exactly the kinds registered on it. The default kinds are registered at DAO creation and the kind set is managed afterwards through the manage-kinds kind (CreateRegisterKindProposal / CreateDeregisterKindProposal).

kindAncestorCouncilUpdate

Proposal kind names: the per-DAO registry keys for every proposal type this realm can host. A DAO accepts proposals of exactly the kinds registered on it. The default kinds are registered at DAO creation and the kind set is managed afterwards through the manage-kinds kind (CreateRegisterKindProposal / CreateDeregisterKindProposal).

kindSubDAO

Proposal kind names: the per-DAO registry keys for every proposal type this realm can host. A DAO accepts proposals of exactly the kinds registered on it. The default kinds are registered at DAO creation and the kind set is managed afterwards through the manage-kinds kind (CreateRegisterKindProposal / CreateDeregisterKindProposal).

kindDissolve

Proposal kind names: the per-DAO registry keys for every proposal type this realm can host. A DAO accepts proposals of exactly the kinds registered on it. The default kinds are registered at DAO creation and the kind set is managed afterwards through the manage-kinds kind (CreateRegisterKindProposal / CreateDeregisterKindProposal).

kindTreasurySpend

Proposal kind names: the per-DAO registry keys for every proposal type this realm can host. A DAO accepts proposals of exactly the kinds registered on it. The default kinds are registered at DAO creation and the kind set is managed afterwards through the manage-kinds kind (CreateRegisterKindProposal / CreateDeregisterKindProposal).

kindTreasuryClawback

Proposal kind names: the per-DAO registry keys for every proposal type this realm can host. A DAO accepts proposals of exactly the kinds registered on it. The default kinds are registered at DAO creation and the kind set is managed afterwards through the manage-kinds kind (CreateRegisterKindProposal / CreateDeregisterKindProposal).

kindTreasuryFreeze

Proposal kind names: the per-DAO registry keys for every proposal type this realm can host. A DAO accepts proposals of exactly the kinds registered on it. The default kinds are registered at DAO creation and the kind set is managed afterwards through the manage-kinds kind (CreateRegisterKindProposal / CreateDeregisterKindProposal).

kindManageKinds

Proposal kind names: the per-DAO registry keys for every proposal type this realm can host. A DAO accepts proposals of exactly the kinds registered on it. The default kinds are registered at DAO creation and the kind set is managed afterwards through the manage-kinds kind (CreateRegisterKindProposal / CreateDeregisterKindProposal).

kindAmendBylaws

Proposal kind names: the per-DAO registry keys for every proposal type this realm can host. A DAO accepts proposals of exactly the kinds registered on it. The default kinds are registered at DAO creation and the kind set is managed afterwards through the manage-kinds kind (CreateRegisterKindProposal / CreateDeregisterKindProposal).

kindExecution

Proposal kind names: the per-DAO registry keys for every proposal type this realm can host. A DAO accepts proposals of exactly the kinds registered on it. The default kinds are registered at DAO creation and the kind set is managed afterwards through the manage-kinds kind (CreateRegisterKindProposal / CreateDeregisterKindProposal).

errInvalidProposalArgs

errInvalidProposalArgs reports a proposal kind invoked with the wrong args type. Wrappers and kinds live in the same package, so this only fires on a realm bug, never on user input.

defaultProposalKinds

defaultProposalKinds lists the proposal kinds seeded on every new DAO (genesis, user-created or sub-DAO). Kinds are stateless singletons that wrap the definition constructors. This is the DAO's starting governance surface; the kind set is managed afterwards through the manage-kinds kind. Ordering here is immaterial — render.gno owns the presentation order.

optInProposalKinds

optInProposalKinds lists the opt-in proposal kinds: they are part of the catalog but NOT default-seeded, so a DAO gains them only after a supermajority manage-kinds register. The execution kind is realm-side (executionKind), not the bare /p/ ExecutionKind, so it can carry the realm's freeze policy (see kindExecution).

proposalKindCatalog

proposalKindCatalog lists every proposal kind this realm can host: the default-seeded kinds plus the opt-in kind (execution). catalogKind resolves against this list, so manage-kinds can register an opt-in kind by name that is not seeded. The executor set stays closed because only catalog kinds are ever registered on a DAO by name. Ordering here is immaterial — render.gno owns the presentation order.

catalogKind

catalogKind returns a catalog kind by name, or nil when the name is not part of the catalog.

HasProposalKind

HasProposalKind reports whether a proposal kind is registered on a DAO.

textArgs

textArgs carries CreateTextProposal parameters to the text kind.

textKind

textKind creates general text proposals.

councilUpdateArgs

councilUpdateArgs carries CreateCouncilUpdateProposal parameters to the council-update kind. dao is the host DAO whose own council the executor mutates: New receives only a readonly view, so the trusted wrapper passes the mutable host handle through args (captured from its own mustGetDAO).

councilUpdateKind

councilUpdateKind creates proposals that add and/or remove members of the host DAO's own council.

ancestorCouncilUpdateArgs

ancestorCouncilUpdateArgs carries CreateAncestorCouncilUpdateProposal parameters to the ancestor-council-update kind. host is the proposing ancestor DAO (read for the ancestry check); target is the descendant whose council the executor mutates. Both handles come from the trusted wrapper via args, since New receives only a readonly view.

ancestorCouncilUpdateKind

ancestorCouncilUpdateKind creates proposals for the host DAO, as an ancestor, to add and/or remove members of a descendant's council.

subDAOArgs

subDAOArgs carries CreateSubDAOProposal parameters to the subdao kind. parent is the host DAO the new SubDAO is created under; the executor mutates it (wiring the child in), so the trusted wrapper passes the mutable host handle through args, since New receives only a readonly view.

subDAOKind

subDAOKind creates proposals that add a SubDAO under the host DAO.

dissolveArgs

dissolveArgs carries CreateDissolutionProposal parameters to the dissolve kind, including the DAO being dissolved: the proposal is hosted in the nearest live ancestor (the host DAO that Propose passes to New), so the definition must operate on the dissolved descendant carried here, never on the host.

dissolveKind

dissolveKind creates proposals that dissolve a DAO or SubDAO.

treasurySpendArgs

treasurySpendArgs carries CreateTreasurySpendProposal parameters to the treasury-spend kind. dao is the host DAO whose own treasury funds the spend (its sub is the funding source, see FundingDAOID); the trusted wrapper passes the mutable host handle through args, since New receives only a readonly view.

treasurySpendKind

treasurySpendKind creates proposals that send coins from the host DAO's own treasury.

treasuryClawbackArgs

treasuryClawbackArgs carries CreateTreasuryClawbackProposal parameters to the treasury-clawback kind. host is the proposing ancestor DAO (read for the ancestry check); target is the descendant whose treasury the executor sweeps (its sub is the funding source, see FundingDAOID). Both handles come from the trusted wrapper via args, since New receives only a readonly view.

treasuryClawbackKind

treasuryClawbackKind creates proposals for the host DAO, as an ancestor, to sweep a descendant DAO's treasury to the descendant's parent.

treasuryFreezeArgs

treasuryFreezeArgs carries CreateTreasuryFreezeProposal parameters to the treasury-freeze kind. host is the proposing ancestor DAO (read for the ancestry / orphan-rescue check); target is the descendant whose treasury the executor freezes or unfreezes. Both handles come from the trusted wrapper via args, since New receives only a readonly view.

treasuryFreezeKind

treasuryFreezeKind creates proposals for the host DAO, as an ancestor, to freeze or unfreeze a descendant DAO's treasury.

errTreasuryFrozen

errTreasuryFrozen reports an execution proposal blocked because the host DAO's treasury is frozen. It is a sentinel so the freeze gate is greppable and testable (the create-time panic and the Validate-time failure share this one message).

executionArgs

executionArgs carries CreateExecutionProposal parameters to the execution kind: a title, a body, and the closure executed on approval. Unlike the governance kinds, the execution kind captures no mutable handle — its only use of the DAO is a freeze-flag read, so its definition holds the readonly host view Propose passes to New rather than a \*CommonDAO from args.

executionKind

executionKind creates proposals that run an arbitrary ExecFunc as the host DAO's own sub on approval. It is the realm-side counterpart of the /p/ commondao.ExecutionKind: identical arbitrary-exec mechanism, but wrapped with the realm's Validable freeze policy (executionPropDefinition.Validate) so a frozen DAO cannot drain its own treasury through it — the /p/ kind carries no such policy. This is the pattern the /p/ extension docs recommend for an arbitrary-exec closure: wrap it with your realm's own checks.

executionPropDefinition

executionPropDefinition defines a proposal that runs an arbitrary ExecFunc as the host DAO's own sub on approval. Its Validate blocks execution while the host treasury is frozen, so an execution proposal can never move funds out of a frozen DAO — matching the treasury-spend freeze gate.

manageKindsProposal

manageKindsProposal is both the manage-kinds args struct and the proposal definition it produces: manageKindsKind.New validates it and returns it unchanged (one type serves both the args and definition roles). dao is the host DAO whose registry the executor mutates: New receives only a readonly view, so the trusted wrapper passes the mutable host handle through args (captured from its own mustGetDAO). A proposal is one of two shapes, both populated only by a trusted wrapper and both by name (the name resolves against the realm catalog): - register: remove=false, name set; - deregister: remove=true, name set. Registering a foreign kind by value is intentionally not offered here: on this realm such a kind would be inert (no propose path). The by-value capability stays available in /p/ (WithProposalKind / RegisterKind) for a downstream realm that authors its own propose wrapper (see /p/ doc.gno, "Extending commondao in your own realm").

manageKindsKind

manageKindsKind creates governance proposals that register or deregister a catalog proposal kind on the host DAO by name — the DAO's one permanent capability to manage which kinds it accepts. Registering adds a kind; deregistering removes one, which blocks new proposals of that kind while in-flight ones still vote and execute. It is decided by supermajority and cannot itself be deregistered (the self-brick guard below), so a DAO always keeps the ability to manage its kind set.

newSubDAOPropDefinition

newSubDAOPropDefinition creates a new proposal definition for adding a SubDAO.

subDAOPropDefinition

subDAOPropDefinition defines a proposal type for adding a SubDAO.

newDissolvePropDefinition

newDissolvePropDefinition creates a new proposal definition for dissolving a DAO. Dissolution sweeps any remaining treasury balance: sub-DAO sweeps go to the parent (fixed, not nameable — the same place a clawback would put the funds); a root DAO has no parent, so its dissolution requires an explicit destination. Both rules are state-independent: parent pointers never change after construction.

dissolvePropDefinition

dissolvePropDefinition defines a proposal type for dissolving a SubDAO.

maxTextBody

maxTextTitle

minTextVotingPeriod

newTextPropDefinition

newTextPropDefinition creates a new general text proposal definition.

textPropDefinition

textPropDefinition defines a proposal type for general text proposals. These type of proposals are not executable so nothing happens when they pass.

hasLiveProperAncestor

hasLiveProperAncestor checks if any proper ancestor of dao is not dissolved.

isProperAncestor

isProperAncestor checks if dao is a proper ancestor of target. Parent pointers are set only at construction and no re-parenting path exists, so ancestry is stable for the lifetime of a proposal.

assertIsProperAncestor

assertIsProperAncestor validates the ancestor relation that authorizes treasury controls over a descendant (docs/CONSTITUTION.md :1507). The relation is strictly proper: a DAO can never claw back or unfreeze itself.

treasuryBalance

treasuryBalance returns the current balance of a DAO's treasury address.

newTreasurySpendPropDefinition

newTreasurySpendPropDefinition creates a proposal definition that sends coins from the DAO's own treasury.

treasurySpendPropDefinition

treasurySpendPropDefinition defines a proposal type for spending funds from the DAO's own treasury (docs/CONSTITUTION.md :1542-1543).

newTreasuryClawbackPropDefinition

newTreasuryClawbackPropDefinition creates a proposal definition that sweeps a descendant DAO's treasury one step up the tree.

treasuryClawbackPropDefinition

treasuryClawbackPropDefinition defines a proposal type for an ancestor DAO to reclaim a descendant's treasury. The destination is fixed — the target's parent — so funds move one step up the tree toward their origin and can never be drained out of the tree entirely. Clawback remains valid against soft-deleted and frozen descendants.

newTreasuryFreezePropDefinition

newTreasuryFreezePropDefinition creates a proposal definition that freezes or unfreezes a descendant DAO's treasury.

treasuryFreezePropDefinition

treasuryFreezePropDefinition defines a proposal type for an ancestor DAO to freeze or unfreeze a descendant's treasury. Freezing does not cascade: ancestors freeze each descendant explicitly. Only a proper ancestor can unfreeze — the frozen DAO's own council cannot.

daoMDLink

daoMDLink returns a markdown link to a DAO's page.

assertCurrent

assertCurrent guards every public crossing entry. Authentication reads cur.Previous() and Execute mints cur.Sub(...) for the executor; both require cur to be the live top-of-frame realm (AGENTS.md / interrealm-v2). Every entry is only reachable via a cross today, so this is defense-in-depth against a future non-crossing caller.

assertRunningPath

assertRunningPath fails closed if this realm is deployed at a package path other than pkgPath. Treasury addresses derive from the pkgPath const (daoAddress), while Execute mints the DAO sub under the running realm's own path (cur.Sub). Those agree only when the running path is pkgPath; a copy deployed elsewhere would read balances at one address and send from another, turning a clean StatusFailed into a mismatch. We reject that at genesis rather than silently diverge.

assertCallerIsUser

assertCallerIsUser rejects a code realm creating a DAO on someone's behalf. New keys the invite and the creators set on the caller, and invites are granted to people, so the caller must be the user itself: either a direct MsgCall (IsUserCall) or that user's own MsgRun frame (IsUserRun, whose address is the signer's own). Both are IsUser; a published realm is neither. Relaying is what this excludes. If a realm could redeem an invite, one invited realm would become a DAO factory for un-invited callers — the vector pr6012\_commondao\_ownership\_rescope.md closed by keying on the transaction origin. Keying on the caller closes it too, but only while the caller cannot be a realm. It bounds who may \*create\* a DAO, not who may sit on one: the members argument may still name realm addresses, and sub-DAO councils are set by proposal (see CreateSubDAOProposal). Handing a DAO to a realm is a council decision, not a creation-time one.

Invite

Invite invites a user to the realm. A user invitation is required to start creating new DAOs.

IsInvited

IsInvited checks if an address has an invitation to the realm.

New

New creates a new CommonDAO and returns its ID. The caller must be a user, not a realm (see assertCallerIsUser), and must hold an invite. The invite is consumed when that caller creates a DAO for the first time, after which the caller may create further DAOs freely. The caller becomes a council member along with any additional member addresses listed on separate lines; those may be realm addresses, so a DAO can be handed to a realm by seating it here and resigning. DAOs with a parent are created through proposals (see CreateSubDAOProposal).

parseInitialMembers

SetListed

SetListed adds or removes a DAO from the realm's public home index. Listing is cosmetic — it affects only how this realm presents the DAO in its own UI — so any single council member of the DAO may toggle it, like Resign. It defaults to off.

IsListed

IsListed reports whether a DAO appears in the realm's public home index.

GetView

GetView returns a read only view of a common DAO searched by ID.

GetBylawsDoc

GetBylawsDoc returns the text of a DAO's bylaws/mandates document, or an empty string when the document does not exist (a stored document is never empty).

ListBylawsDocs

ListBylawsDocs returns the sorted paths of a DAO's bylaws/mandates documents under a prefix (empty prefix lists all).

Vote

Vote submits a vote for a DAO proposal. Voting is allowed to the members of the proposal's electorate: the council snapshot taken when the proposal was created.

Funded

Funded is the optional contract a proposal definition implements when its executor moves funds from a DAO other than the proposal's host: it names, by ID, the DAO whose sub-identity address funds the executor. Execute resolves that DAO, mints its terminal RealmSend-only sub and passes it to the ExecFunc; a definition that does not implement Funded receives the host DAO's own sub by default. The returned ID must identify the DAO the definition validates its fund movement against (e.g. the DAO being spent, swept or dissolved). It lives realm-side, not in /p/: minting a DAO sub needs the host realm's cur (cur.Sub), so only the host — never the package — can honor it. /p/ dispatches CapExempt/Executable/Validable itself, but Execute (the host) is the sole consumer of Funded, so the package has no reason to know it.

Execute

Execute executes a DAO proposal. Executing a proposal that passed early (decided by the default Council rules before its voting deadline) requires the caller to be a council member. Once the voting deadline has passed execution is permissionless: the tally is deterministic, so anyone can finalize the proposal.

Withdraw

Withdraw withdraws an active DAO proposal that has no votes. Only the proposal creator can withdraw it.

Resign

Resign removes the caller from a DAO council. The last remaining council member cannot resign.

isInvited

assertIsInvited

assertDAONameIsValid

assertDAOPurposeIsValid

assertDAODescriptionIsValid

assertCallerIsCouncilMember

CreateTextProposal

CreateTextProposal creates a new general text proposal. Parameters: - daoID: ID of the DAO (required) - title: Title of the proposal (required) - body: Body of the proposal (required) - votingDays: The number of days where proposal accepts votes. The default voting period is 7 days.

CreateCouncilUpdateProposal

CreateCouncilUpdateProposal creates a new proposal to add and/or remove council members. Parameters: - daoID: ID of the DAO (required) - newMembers: Newline separated list of addresses to add to the council - removeMembers: Newline separated list of council addresses to remove

CreateAncestorCouncilUpdateProposal

CreateAncestorCouncilUpdateProposal creates a proposal for an ancestor DAO to add and/or remove members of a descendant's council (docs/CONSTITUTION.md :1531-1532) — the rescue path for a stuck or empty descendant council. It is hosted and voted in the ancestor (daoID) and decided by supermajority; the proposing DAO must be a proper ancestor of the target, verified at proposal validation. Parameters: - daoID: ID of the proposing ancestor DAO (required) - targetID: ID of the descendant DAO whose council changes (required) - newMembers: Newline separated list of addresses to add to the council - removeMembers: Newline separated list of council addresses to remove

CreateSubDAOProposal

CreateSubDAOProposal creates a new proposal to create a new SubDAO. Parameters: - daoID: ID of the parent DAO (required) - name: A name for the SubDAO (required) - purpose: A purpose for the SubDAO (required) - description: A description for the SubDAO - members: Newline separated list of initial SubDAO council addresses (required)

CreateDissolutionProposal

CreateDissolutionProposal creates a new proposal to dissolve a DAO or SubDAO. SubDAOs can only be dissolved by the parent DAO, which owns and controls its sub-DAOs (docs/CONSTITUTION.md :1507). When the parent is itself already dissolved, the proposal is hosted in the nearest non-dissolved ancestor, so orphans below a dissolved middle DAO remain dissolvable. Dissolution sweeps any remaining treasury balance. A sub-DAO's sweep goes to its parent and destination must be empty; a root DAO has no parent, so a valid destination address is required. Parameters: - daoID: ID of the DAO to dissolve (required) - destination: sweep destination, root DAOs only

CreateTreasurySpendProposal

CreateTreasurySpendProposal creates a new proposal to send coins from the DAO's own treasury (docs/CONSTITUTION.md :1542-1543). Parameters: - daoID: ID of the DAO whose treasury is spent (required) - to: recipient address (required) - denom: coin denomination, e.g. "ugnot" (required) - amount: coin amount, must be positive (required)

CreateTreasuryClawbackProposal

CreateTreasuryClawbackProposal creates a new proposal for an ancestor DAO to sweep a descendant DAO's full treasury balance to the target's parent (docs/CONSTITUTION.md :1507). The proposing DAO must be a proper ancestor of the target; a target's own options can never block an ancestor's clawback. Parameters: - daoID: ID of the proposing ancestor DAO (required) - targetID: ID of the descendant DAO to claw back (required)

CreateTreasuryFreezeProposal

CreateTreasuryFreezeProposal creates a new proposal for an ancestor DAO to freeze or unfreeze a descendant DAO's treasury. While frozen, no treasury spend can execute. Only a proper ancestor can unfreeze — the frozen DAO's own council cannot. Parameters: - daoID: ID of the proposing ancestor DAO (required) - targetID: ID of the descendant DAO to freeze or unfreeze (required) - frozen: true to freeze the target's treasury, false to unfreeze

CreateExecutionProposal

CreateExecutionProposal creates a proposal that runs an arbitrary ExecFunc as the DAO's own sub on approval, through the realm's execution kind. The execution kind is opt-in: it is not seeded on new DAOs and must be registered first through a supermajority CreateRegisterKindProposal. Freeze policy: an execution proposal moves value under the DAO's own authority, so it is subject to the treasury freeze exactly like a spend. This wrapper fails fast when the treasury is already frozen, and the definition re-checks at Execute (so a freeze landing after the proposal passed fails it cleanly, StatusFailed, no funds leaving). An ancestor's clawback/dissolution is a separate power and is not blocked by freeze. Sharp edges (known limitations): - The fn closure cannot be encoded in a CLI transaction, so this wrapper is reachable only from a PERSISTENT realm that imports this one and is a council member of the DAO (a realm-in-council). The closure must be authored in that realm so it survives Propose→Execute; a \`maketx run\` script's closure does not persist and cannot execute later. - A closure that panics or runs out of gas aborts the whole Execute tx, so the proposal is stuck Active (every retry re-aborts) and can never finalize. The only recovery is dissolving the DAO (Dissolve dismisses in-flight proposals). Author closures that return an error instead of panicking so a bad execution fails cleanly (StatusFailed) and releases. Parameters: - daoID: ID of the DAO (required) - title: proposal title (raw text, escaped when rendered) - body: proposal body (raw text, escaped when rendered) - fn: the closure executed on approval (required, non-nil)

CreateRegisterKindProposal

CreateRegisterKindProposal creates a proposal to register one of the realm's catalog proposal kinds on a DAO by name, through the permanent manage-kinds kind (e.g. register "execution"). The proposal is hosted and voted in the DAO itself and decided by supermajority; on approval the named catalog kind is registered, so new proposals of that kind can be created. The manage-kinds kind is seeded on every DAO, so this path is always available. Parameters: - daoID: ID of the DAO (required) - kindName: name of the catalog proposal kind to register (required)

CreateDeregisterKindProposal

CreateDeregisterKindProposal creates a proposal to deregister a proposal kind from a DAO by name, through the permanent manage-kinds kind. The proposal is hosted and voted in the DAO itself and decided by supermajority; on approval the kind is deregistered, which blocks new proposals of that kind while in-flight ones still vote and execute. The manage-kinds kind itself cannot be deregistered, so a DAO always keeps the ability to manage its kind set (and to re-register a catalog kind by name). Parameters: - daoID: ID of the DAO (required) - kindName: name of the proposal kind to deregister (required)

CreateAmendBylawsProposal

CreateAmendBylawsProposal creates a proposal to add, amend or remove one of the DAO's bylaws documents with a verifiable diff patch (see gno.land/p/nt/bylaws/v0). The mandates/ folder is reserved: the Constitution grants a council self-power over its Bylaws only, so mandates change from above (creation or an ancestor's amendment — not implemented yet), never through this proposal. The payload is an encoded patch — build it with AmendBylawsPayload (e.g. through a vm/qeval query) or with bylaws.Diff(...).Encode() from a realm. The patch pins the sha256 of the document text it was diffed against, so an amendment racing a concurrent change to the same document fails cleanly instead of clobbering it; a patch already stale at creation is rejected here. Amendments are decided by supermajority — the default council rule; the Constitution names no special threshold for a council amending its own documents. Parameters: - daoID: ID of the DAO (required) - payload: encoded bylaws patch (required)

AmendBylawsPayload

AmendBylawsPayload builds the CreateAmendBylawsProposal payload that changes a DAO's document at path to the proposed text: a new path adds a document, empty proposed text removes one. It diffs against the document's current text and pins its hash, so build the payload fresh (e.g. through a vm/qeval query) and propose promptly — a payload built against superseded text is rejected. Read-only.

assertKindRegistered

assertKindRegistered panics unless a proposal kind is registered on the DAO. Used to gate the opt-in propose paths so they work only after the DAO registered the kind through governance.

mustPropose

mustPropose submits a proposal through one of the DAO's registered proposal kinds and validates it for the current state, panicking on any error. Validation also reruns inside Execute, so this only fails fast at creation.

parseAddresses

containsAddress

containsAddress checks if an address is present in a list.

executing

executing is this realm's GLOBAL re-entrancy latch, the outer of two complementary layers. It is set while a proposal executor is running (inside the public Execute) and rejects any nested Execute — an executor must never trigger another execution, whether of the same DAO or a different one, directly or by crossing back in as its DAO. The two layers guard different invariants and neither subsumes the other: - The /p/ CommonDAO carries per-DAO \`executing\` / \`proposing\` FIELDS (see the package's commondao.gno). Being fields on the owning DAO object, they are writable where a mutable /p/ global is not, so they travel with a standalone /p/ consumer that never wrote a realm-global latch: they give every consumer same-DAO re-entrancy protection (a nested Execute or Propose on the SAME DAO). - This realm-global bool adds what a per-DAO field structurally cannot: it enforces one-executor-per-transaction across ALL DAOs, closing the cross-DAO straddle a per-DAO latch misses — the ancestor-hosted dissolution/clawback case, where an executor running under DAO A's Execute nests an Execute that deletes a DIFFERENT DAO out from under A. A latch keyed on the executing DAO never fires there; a target latch would demand a scattered check at every DAO-mutating executor. The single global bool makes "one executor per tx" a local, unforgettable invariant instead, and also shuts the conditional- execution "free option" (nest a different DAO's Execute, observe in-tx, panic to revert). It is realm module state: a mutable /p/ package global is forbidden (writing one panics the borrow/stamping rule), and the latch must be writable. This global is the realm's, complementing — not replacing — the /p/ per-DAO fields. Vote / Create\* / Withdraw / Resign are deliberately NOT latched: no executor re-enters them, legitimate executors need them (sub-DAO creation, the dissolution sweep), and a proposal executor acting as its DAO in ANOTHER DAO (e.g. casting a council vote) rides those paths. A rejected nested Execute panics. Thrown across the cross() boundary the re-entrant call arrived through, that aborts the whole transaction. The deferred leaveExecute lowers the flag on normal returns (and on any same-transaction recovered panic). Cross-transaction safety does NOT rely on that defer — a rejected re-entry aborts the transaction, and the aborted transaction's realm writes (including this flag) are never committed, so a later transaction can never observe it stuck true.

enterExecute

enterExecute raises the re-entrancy latch, panicking if it is already raised (i.e. this Execute is nested inside another). Pair with a deferred leaveExecute.

leaveExecute

leaveExecute lowers the re-entrancy latch.

dateFormat

trustedMarkdownBody

trustedMarkdownBody marks proposal definitions whose Body returns markdown the definition assembled itself (escaping any embedded user fields with md.EscapeText). Those bodies are rendered verbatim. Every other body — including the execution kind, whose Body is the proposer's raw text — is treated as user-supplied and escaped by the renderer. A definition from an imported package cannot implement this realm-local marker either, so it is escaped too. The render layer is the single escape point: definitions return raw text and opt out only when they render their own markup.

Render

renderHome

renderDAO

renderCreateProposalSection

renderTreasury

renderCouncil

renderTree

renderSettings

renderBylaws

renderProposalsList

renderProposalsListItem

renderProposal

renderProposalStats

renderProposalVotes

renderProposalVote

mustGetDAOFromRequest

mustGetProposalFromRequest

parseRealmPath

voteLink

executeLink

textProposalLink

updateCouncilLink

ancestorCouncilUpdateLink

newSubDAOLink

dissolveSubDAOLink

treasuryClawbackLink

treasuryFreezeLink

treasurySpendLink

registerKindLink

deregisterKindLink

amendBylawsLink

goToDAOLink

goToProposalLink

userLink

isVotingPeriodActive

isExecutionAllowed

currentRealmPath

daoURL

settingsURL

daoProposalsURL

bylawsURL

proposalURL

voteURL