Worked example: protocol upgrade

This controlled-pilot integration shows how Luvion protects one proxy upgrade. The current local implementation includes the canonical upgrade object, role-separated approval state machine, authenticated HTTP API, Luvion certificate, Lit/PKP gate-authorization contract, durable sidecar, evidence export, and a local UUPS gate test.

The dedicated Lit Action is registered to an isolated Group and PKP and has completed a live Chipotle authorization run. The gate and proxy have not been deployed to a public testnet. The HTTP API enters gate_authorized after Lit validation. A caller may then submit only a transaction hash; the configured observer independently verifies the chain, gate runtime-code hash, successful receipt, exact event, block time, confirmation depth, and operation binding before recording scheduled, executed, or cancelled. The service can also discover confirmed events from the fixed Gate with a private persistent block cursor. A scan range advances only after every matching event passes full receipt verification and the state transition is durably stored. Real BSC testnet restart and RPC-failover evidence is still pending.

Scenario

A protocol intends to upgrade proxy 0xProxy on chain eip155:1 to reviewed implementation 0xImplementationV2. The operation must use policy upgrade-mainnet-v3, receive one protocol approval, one security approval, and a 3-of-5 authorization before a timelock can execute it.

1. Build the canonical intent

The adapter binds:

• chain and proxy address;
• new implementation address;
• exact encoded call data and its hash;
• code hash or reviewed build identifier;
• policy version and approval-context hash;
• timelock delay and validity window;
• nonce, request ID, participant set, and key epoch.

Changing the implementation, initializer, call data, chain, or policy produces a different digest and invalidates prior approval.

2. Evaluate policy

The policy checks the permitted proxy, approved implementation/code hash, required role separation, maintenance window, timelock delay, and any external risk or review evidence. Missing, altered, expired, or conflicting data fails closed.

3. Collect approvals and authorization

Eligible protocol and security reviewers approve the same digest. After the role threshold is met, distributed signers verify the request and produce an intent-bound authorization certificate. The coordinator alone cannot create a valid certificate.

4. Enforce at the execution boundary

The Safe module, timelock executor, or protocol administration module verifies the certificate and confirms that the call it is about to execute exactly matches the authorized intent.

Complete protection places every proxy-administrator path, including legacy owners and emergency keys, behind the same verification boundary.

5. Execute and retain evidence

The adapter submits or reconciles the authorized operation using the stable request ID. The final evidence package binds the policy decision, approvals, certificate, timelock transaction, chain receipt, implementation address, code hash, and witness receipt.

In the current local pilot, evidence can be exported after gate authorization. It records chain states only after the observer verifies a matching confirmed transaction, and otherwise explicitly states that no on-chain schedule or execution has occurred.

Acceptance tests

Test	Expected result
Exact reviewed upgrade	Authorized and executed after timelock
Changed implementation or initializer	Rejected before execution
Missing security approval	Authorization unavailable
Reused certificate	Rejected as consumed or replayed
Expired validity window	Rejected and recorded as expired
Coordinator restart	Same request resumes without mixed transcripts
Execution response lost	Reconciled by request ID, not blindly resubmitted
Direct legacy-owner path	Pilot fails non-bypassability acceptance

This pattern can be adapted to signer rotation, mint/burn limits, bridge administration, and emergency controls by changing the canonical operation fields and enforcement point, not the authorization principles.