papers/morpheus/rubric/decentralization-rubric.tex

\documentclass[11pt,a4paper]{article}
\usepackage{../shared/luxcover}
\usepackage{../shared/proposal}
\usepackage[utf8]{inputenc}\usepackage[T1]{fontenc}
\usepackage{amsmath,amssymb}
\usepackage{array}\usepackage{tabularx}
\usepackage{listings}\usepackage{xcolor}
\input{../shared/lstlang}

\newcommand{\code}[1]{\texttt{\small #1}}
\newcommand{\pv}[1]{{\color{muted}\sffamily\scriptsize[#1]}}
\newcolumntype{Y}{>{\raggedright\arraybackslash}X}

\title{Real Decentralization}
\author{Zach Kelling\\\textit{Lux Industries, Inc.}\\\texttt{[email protected]}}
\date{2026}

\begin{document}
\luxcoverpage
\sloppy

\noindent{\color{muted}\footnotesize\sffamily RUBRIC \quad\textbullet\quad Hanzo AI \& Lux Industries \quad\textbullet\quad 2026}\par
\vspace{0.8ex}
\noindent{\LARGE\bfseries Real Decentralization}\par
\vspace{0.4ex}
\noindent{\itshape A testable rubric separating distributed control from theater.}\par
\vspace{0.7ex}
\noindent{\color{rule}\rule{\linewidth}{1.1pt}}\par
\vspace{1.0ex}

\section{The distinction is about powers, not appearances}

Decentralization is a property of powers, not of appearances. Examined
adversarially, every system reduces to a small set of capabilities that can harm
or halt its users: the power to change the code, to move the funds, to stop the
system or exclude a participant, and to set the rules that govern the first
three. A system is decentralized to the exact extent that each such power either
requires the independent consent of many parties or has been removed entirely. It
is centralized at every power that one party, or a small group able to collude,
can exercise alone.

Decentralization theater is the substitution of the appearance of distribution
for the distribution of the powers themselves. A validator count, a token ticker,
a governance forum, and an off-chain poll are all appearances; none of them
constrains a private key that can upgrade a contract or move a treasury. A rubric
separating real from theater therefore ignores appearances and enumerates the powers.

The compact form is the walk-away test: suppose the founding team becomes adversarial
tonight, what can it do to users before anyone reacts, and what can users do without it.

The quantity to measure, for any single power, is the size of its effective control
set: the minimum number of independent parties whose collusion suffices to exercise
it. This is the Nakamoto coefficient, generalized past consensus. It applies to a
bridge multisig, an upgrade key, a governance vote, and the RPC providers a front
end depends on. Two systems can display the same nominal count and differ entirely
in the effective one: what matters is not how many signers a multisig lists but how
many independent people must actually agree. Ronin listed nine validators and had an
effective control set of one \pv{public record}.

\section{The rubric}

Score each power from the state a hostile analyst can demonstrate. \textbf{0
(concentrated)}: one party, or a small colludable set, exercises it with no delay and
no outside consent. \textbf{1 (constrained)}: still held by few, but bounded by a
timelock longer than the time needed to exit together with a unilateral user exit
(forced withdrawal, freeze, or fork), honest training wheels. \textbf{2 (distributed
or removed)}: the independent consent of many parties, or the power removed by
immutability.

\begin{table}[h]\footnotesize\setlength{\tabcolsep}{5pt}\renewcommand{\arraystretch}{1.1}
\begin{tabularx}{\linewidth}{@{}l Y Y@{}}
\toprule
\textbf{Power} & \textbf{Theater (0)} & \textbf{Genuine (2)}\\
\midrule
Upgrade & Instant proxy swap by a team multisig; no timelock & Immutable, or upgrade only via a broad on-chain vote plus a timelock past exit time\\
Custody & \code{onlyOwner} mint / sweep / rescue; a multisig holds the locked assets & No admin can move principal; mint capped or removed\\
Halt / censor & Single sequencer or whitelisted set; owner pause; no forced inclusion & Permissionless production, or a bounded pause with an escape hatch\\
Governance & Off-chain poll a multisig implements at will; insiders alone meet quorum & Governor to timelock to execution none can override; no insider majority\\
Exit & Closed source; balances are operator IOUs; withdrawal stops if the operator does & Open, forkable code; self-custody; unilateral forced withdrawal\\
Liveness & Halts if one firm's front end, RPC, oracle, or indexer stops & Contracts callable directly; many front ends and RPCs; decentralized oracle\\
\bottomrule
\end{tabularx}
\end{table}

Report the six scores as a vector, not a single total: a scalar hides the fact that
matters most, which power is centralized, and the real ceiling is the lowest score
among the powers load-bearing for users' funds and liveness. One instant-upgrade key
returns the whole system to zero on the axis it controls, whatever the other scores
say. A low score is not by itself theater: a system centralized and honest about it
is immature, not dishonest. Theater is the gap between the claimed state and the
measured one, which the rubric records in an honesty flag. A zero disclosed is
training wheels; a zero marketed as decentralization, or as ``secured by'' the
settlement chain, is the case the rubric exists to catch. Every cell is checkable by
someone who does not trust the project, tracing to an address, a function selector, a
stake distribution, or a public incident. The L2BEAT Stages framework applies this
discipline to rollups \pv{public: L2BEAT methodology}; the rubric generalizes it.

\section{Both sides, on the record}

\noindent\textbf{Genuine} (on one axis does not imply genuine on all). Uniswap v2
core pairs are non-upgradeable with no admin power over deposited liquidity, and
SushiSwap's 2020 fork of that open code proved exit. Ethereum L1 carries no
administrative key, staking is permissionless, and its concentration is measured and
published rather than hidden. MakerDAO changes execute only after a governance
timelock MKR holders control. Strongest of all is a removed power: Tornado Cash's
immutable contracts kept running after their deployers were sanctioned, because no
key existed to stop them \pv{public record}.

\noindent\textbf{Theater.} Ronin listed nine validators at five-of-nine with five
keys reachable through one organization, and lost about \$625M to that one
compromise. Multichain marketed distributed MPC while one operator held the keys;
when it was detained, roughly a billion dollars moved unrecoverably. Harmony's
Horizon bridge was two-of-five: two keys moved everything. Signaling governance, an
off-chain poll a multisig implements at its discretion, is voice without power; the
test is whether execution is automatic and un-overridable or manual and
discretionary. A Stage-0 rollup sold as settlement-grade pairs a single sequencer
with an instant upgrade multisig that can rewrite state and reach bridged funds,
where ``secured by'' describes data availability, not control
\pv{public: L2BEAT methodology}.

\section{Applying it: Morpheus}

Scoring Morpheus uses only published facts. The owner of the Base compute diamond
\code{0x6aBE}\dots\code{030a} and of the capital contracts is a five-of-nine Gnosis
Safe, \code{0x1FE0}\dots\code{eBa1E} \pv{verified: on-chain}.

Each of three funded powers is one \code{onlyOwner} call. \textbf{Upgrade 0}: the
funded contracts are UUPS proxies whose \code{\_authorizeUpgrade} is gated only by
\code{onlyOwner} (\code{DistributionV6.sol:776}), upgradeable in one block with no
timelock. \textbf{Custody 0}: the owner adds itself as minter and mints with no
supply ceiling (\code{MOROFT.sol:50,61}), sets any user's staked balance through
\code{manageUsersInPrivatePool} (\code{DistributionV6.sol:175}), and about \$20M in
staked stETH sits behind the same Safe. \textbf{Governance 0}: \code{MOROFT} is a
LayerZero \code{OFT}, not \code{ERC20Votes}, holding no checkpoints
(\code{MOROFT.sol:35}); the MRC process is Markdown proposals with no on-chain
execution, last touched November 2025, so rule-setting is the owner call
\code{editPool} / \code{editPoolLimits} (\code{DistributionV6.sol:102,118})
directing the roughly 76\% of issuance in private pools \pv{verified: repo}. The
full vector is (0,0,0,0,1,1): Halt is a fourth zero, on a single-sequencer Base
diamond the same owner can recut; Exit and Liveness reach 1 because MOR is
self-custodied and callable through several front ends, but not 2 because the same
upgrade key still reaches staked principal.

The July 2026 stipend-leak fix, applied to live Base within a day
\pv{public record}, is direct evidence of the upgrade power: the same key that
closes a bug can open one. Whether this reads as theater or as honest training
wheels turns on the honesty flag, and the advisory MRC process, presented as
governance while binding nothing, is the clearest theater on the vector. The path
from 0 to 1 is specified in ADOPT-03: transfer \code{owner()} to a timelock the
token controls, so every mint, upgrade, and pool edit becomes propose, vote, delay,
execute \pv{see ADOPT-03}. The path from 1 to 2 is distributing the vote itself,
which thin participation can still defeat.

\section{The mirror: our own stack, held to the same test}

A migration passes only if the destination clears the rubric, and deploying a
governance contract is not by itself a passing score. Three failure modes would
reproduce Morpheus's zeros under a nicer name: a launch multisig whose signers
derive from one seed (effective control set one, whatever the threshold reads); a
validator set one operator runs (a high replica count in one cluster is a Nakamoto
coefficient of one); and a vote whose quorum a single emission recipient can meet.
The table scores the components we would actually hand Morpheus, read from our own
repositories at their current state, not their design ceiling.

\begin{table}[h]\footnotesize\setlength{\tabcolsep}{5.5pt}\renewcommand{\arraystretch}{1.05}
\centering
\begin{tabular}{@{}l cccccc c@{}}
\toprule
\textbf{Component, as it stands today} & Up & Cus & Halt & Gov & Exit & Live & \textbf{Flag}\\
\midrule
Morpheus (Base diamond + capital) & 0 & 0 & 0 & 0 & 1 & 1 & open\\
Lux primary network / Quasar & 2 & 2 & 1 & 2 & 2 & 1 & disclosed\\
L2 from \code{l2-template}, at birth & 0 & 0 & 0 & 0 & 2 & 0 & scaffold\\
\code{lux/dao} governance, as deployed & 0 & 0 & -- & 0 & 2 & 1 & disclosed\\
\code{lux/ai} node, served path & -- & -- & 0 & -- & 2 & 0 & disclosed\\
\code{mord} settlement, PoC & 0 & 0 & 0 & -- & 2 & 0 & clean\\
\bottomrule
\end{tabular}
\end{table}

\noindent{\footnotesize\emph{``\,--\,'' marks a power the component does not bear.
The Lux primary network penalizes misbehavior by reward forfeiture, not principal
slashing (\code{uptime\_forfeiture\_mainnet\_test.go:159}), and its mainnet genesis
seats five initial stakers and five bootstrappers
(\code{configs/mainnet/pchain.json}), so its Halt and Governance marks read the
protocol's permissionlessness, not a measured live set.}}

\vspace{0.3ex}
\noindent\textbf{\code{lux/dao} governance.} The mechanism is real:
\code{ModuleGovernorV1} executes through a Safe, \code{VotesERC20StakedV1} is a
non-transferable \code{ERC20Votes} stake, a freeze guard lets holders freeze a rogue
Safe. What it sits on is the finding: \code{governance.md} records all five launch
signers derived from one \code{LUX\_MNEMONIC} seed, so the 3-of-5 has an effective
control set of one until a rotation the document lists as unscheduled, and the
timelock path is deployed beside the Safe but authoritative only ``once token
distribution lands and quorum is reachable'' \pv{verified: lux/dao/governance.md}.
The reference instance \code{zoo/vote} ships with \code{moduleGovernor} and
\code{governor} set to \code{null} \pv{verified: zoo/vote/config/zoo.json}. Every
module is UUPS \code{Ownable2Step}, so decentralization is as strong as who owns the
proxies, today the single-seed Safe.

\noindent\textbf{\code{l2-template} and the validator set.} The generated node
manifest runs a five-replica \code{StatefulSet} in one operator's cluster
(\code{init.sh:240}) with single-replica MPC, KMS, and bridge, and the generated
\code{Token.sol} grants one \code{admin} both roles with an uncapped mint
(\code{init.sh:181,184}) \pv{verified: lux/l2-template}. The software supports
permissionless validation (\code{AddPermissionlessValidatorTx}, a \code{µLUX}
minimum, \code{config/flags.go:320}), but the template does not distribute the set:
a chain born from it is centrally sequenced at birth, decentralizing only if
independent validators later stake in.

\noindent\textbf{\code{lux/ai}, the heal-thyself finding.} \code{cmd/lux-ai/main.go}
mounts every route through \code{corsMiddleware} alone (line 262); no route verifies
the \code{Authorization} header it lists in CORS, and \code{handleChatCompletions}
returns a fixed placeholder (tokens 10/20/30, lines 279, 327), never calling the
quorum settlement \code{pkg/rewards} names the canonical A-Chain path
(\code{rewards.go:382}) \pv{verified: lux/ai}. The quorum-and-slash engine exists;
the served endpoint does not invoke it. Our public inference path is, as shipped,
unauthenticated and not quorum-settled.

\noindent\textbf{\code{mord}.} A single-operator proof of concept that says so:
``not deployed anywhere and it is not audited'' \pv{verified: lux/mord}. Its
settlement improves on Morpheus, a consumer countersignature settling inside block
acceptance, but that is integrity, not decentralization: an honest zero.

\vspace{0.3ex}
\noindent\textbf{Verdict.} As the repositories stand, swapping the five-of-nine for
\code{lux/dao} plus a Lux L2 would, with today's defaults, reproduce an effective
control set of one under a better name, the exact substitution the migration must
avoid. Four checkable changes close the gap: rotate the launch Safe to independent
hardware keys held by distinct people; move \code{owner()} of the modules and admin
roles to the token-controlled timelock and fill the null governor; spread the L2
validators, MPC, KMS, and bridge across independent operators; and route the served
RPC through authentication and the quorum engine. The last we can do today; the
validator set and a vote with non-insider participation our software makes possible
but cannot make true, since thin participation defeats the vote and an empty
validator market the sequencer. Real decentralization is those changes measured, not
the mechanisms shipped.

\vspace{0.5ex}
\noindent{\color{muted}\sffamily\footnotesize RUBRIC. Method behind ADOPT-03 and
LP-318. \; \textbullet\; \texttt{[email protected]}}

\end{document}