Robonomics: replacing Sudo with a two-track OpenGov sized for a small community

Ecosystem
1

Hi all, Sergei from Robonomics, a parachain on Polkadot for IoT and cyber-physical systems. This follows our Tech Talk thread on Robonomics 5.0, part one (the runtime-only repo on polkadot-omni-node).

Runtime 50 is now live on Polkadot, and the next step of our 5.0 roadmap is governance. Today every privileged action on Robonomics goes through Sudo, held by a developer multisig. The network is in early production now, and a cloud for IoT that calls itself open can’t be steered by a developer key. So in version 5.1 we replace Sudo with standard OpenGov.

What we ship. pallet-referenda, pallet-conviction-voting, pallet-whitelist, pallet-preimage and pallet-scheduler, stock Polkadot SDK, benchmarked. We keep the mechanism and drop most of the structure around it: no Council, no Fellowship, no treasury tracks. Two tracks only:

Track Decision Approval Support Deciding at once
Root up to 14 days 90% → 51% 50% → 15% 1
Whitelisted Caller up to 3 days 99% → 80% 2% → 1% 10

Anyone can open a Root referendum, and XRT holders vote with conviction (1x for 7 days up to 6x for 224 days). The fast track is for reviewed technical fixes: a core-team collective of up to 7 members, with half of them agreeing, can whitelist the hash of one exact call. That executes nothing by itself. The call still needs a public referendum with at least 1% of all XRT voting aye.

Handover in two steps. First the pallets ship while the multisig keeps Sudo as a safety net. Then the first real referendum is a runtime upgrade that removes Sudo. If it passes, it also proves that governance can upgrade the chain without developer access.

Questions for other parachain teams:

  1. Has anyone removed Sudo by referendum? Anything you wish you had kept as a recovery path?
  2. The old 4.x governance pallets (Democracy, Preimage, Scheduler) left storage behind under the same names. Did you clean it up with killPrefix before reusing the names, or with a migration?

Full write-up: Robonomics 5.0: handing the keys to XRT holders
Code: Introduced governance pallets by akru · Pull Request #652 · airalab/robonomics · GitHub

4

Update: the OpenGov stack is in release 51 “Governance” (spec_version 51). It is built and published, not enacted yet: Polkadot still runs 50.

What landed, as described above:

  • pallet-preimage, pallet-scheduler, pallet-referenda, pallet-conviction-voting, pallet-whitelist, pallet-collective (#652).
  • Two tracks only. Root for runtime upgrades and any privileged call. Whitelisted Caller as a fast track: the Core Team collective can only whitelist a call hash, and a public XRT-holder referendum still decides.
  • No Council, no developer Root key. This is stage A: Sudo stays only as a recovery path. The next step is the runtime upgrade that removes Sudo, submitted and enacted through OpenGov itself (#633).

The same release moves our CPS pallet to a Scope / Access authority model ([#653]): a Scope is the boundary of a subtree with its own owner, Access grants Write or CreateScope inside it, a node’s parent never changes, and changing the owner starts a new Scope generation, so old grants stop working at once. Clients get the effective owner through CpsApi::resolve_scope on the standard runtime API, no custom RPC. This part is breaking for integrators: move_node, transfer_ownership, accept_ownership, delete_scope are gone.

Next release: Sudo removal through OpenGov, and Subscription with Scope-funded transactions, so an owner-funded device can send its first transaction without holding XRT.

I’ll post the Sudo-removal referendum here when it goes up. The questions above on support thresholds and on removing Sudo by referendum are still open, and experience from other small parachains is very welcome.

5

Update: runtime 51 is enacted on Robonomics (Polkadot), block #5,545,191. OpenGov is live: Root and Whitelisted Caller tracks are open, Sudo stays only as a recovery path. The Sudo-removal referendum is next — I’ll post it here when it goes up.