Problem
Single-step administrator changes are vulnerable to mistakes, lost keys, or accidental transfer to an incorrect address.
Objective
Deliver a production-quality improvement to administrator management that creates measurable value for correctness, security, reliability, performance, or maintainability.
Implementation scope
- Add propose, accept, cancel, and expiry semantics for administrator rotation.
- Restrict each action to the correct current or pending authority.
- Emit events and prevent stale proposals from being accepted after expiry.
Acceptance criteria
- A new administrator cannot take control without explicit acceptance.
- The current administrator can cancel an unaccepted proposal.
- Expired proposals are rejected and leave the active administrator unchanged.
Required validation
- Authorization matrix, expiry, cancellation, replay, and event tests.
- Existing tests and CI remain passing.
- Add regression coverage for the original failure mode.
- Do not weaken, delete, or skip unrelated tests to obtain a green build.
PR quality bar
- Keep the PR focused on this issue and explain design tradeoffs.
- Include test evidence, compatibility impact, and migration or rollout notes where relevant.
- Avoid typo-only, documentation-only, cosmetic-only, or unrelated refactor submissions.
Out of scope
- Broad rewrites not required by the acceptance criteria.
- Changes to unrelated services, contracts, or user flows.
Problem
Single-step administrator changes are vulnerable to mistakes, lost keys, or accidental transfer to an incorrect address.
Objective
Deliver a production-quality improvement to administrator management that creates measurable value for correctness, security, reliability, performance, or maintainability.
Implementation scope
Acceptance criteria
Required validation
PR quality bar
Out of scope