Decentralization Roadmap

During its early phase, Umia keeps two supervisory capabilities over decision markets: a market opens with Umia's approval, and a security council can pause a winning proposal for a short window after it settles. Today that council is Umia alone. Umia's part in both is temporary, and both are disclosed on Decision Markets and Security and Audits. This page lays out how they are removed: in what order, what takes their place, and what needs to be true before each step. It is updated whenever a stage changes.

What Umia Can Do Today

• Approve a market before it opens. Anyone can draft a decision market. Opening it onchain needs a signature from Umia over its parameters and proposals; that signature is the supervision step of this phase. A market's payload executes as written if it wins, so the check is that the payload does what the proposal says, and that a thin market is not being used to push something harmful through. The signature covers the market definition only: once a market is open, Umia cannot change its parameters, its prices, or its outcome.
• Pause execution after settlement. Each market carries an execution delay, four hours by default and never more than twelve. During it, the security council can pause execution of the winning proposal. Today the council is Umia alone. A pause is reserved for emergencies: an exploit, a loss of funds, criminal activity. It is not for results Umia dislikes. The pause stops execution and nothing else: it cannot pick a different winner, settle a different outcome, or move funds. Lifting it requires the protocol owner, which sits behind a public timelock.
• Set protocol parameters and upgrade shared contracts. The protocol owner is a timelock with a two-day public delay. It sets protocol-wide parameters such as the winning threshold, fees, and the execution delay, and it upgrades the shared contracts. Nothing it does is immediate; every change is visible onchain two days before it can execute.

Rules That Do Not Change

Supervision sits on top of rules the contracts enforce on every market. Those rules are not part of this roadmap; they apply at every stage, and they are what make opening a market safe to leave to anyone.

• Stake from the creator. Whoever opens a market posts the project's minimum stake in its token, locked until trading ends.
• One market at a time. A project runs a single active market; the next can open once the current one settles.
• A winning margin. A proposal executes only if its time-weighted price beats the status quo by the project's configured threshold.
• A delay before execution. A settled result takes effect after a fixed interval. Today that interval is what gives the security council time to act; for a project outside the council's scope, it is simply the gap between a result and its effect.

The Stages

Each stage removes one piece of supervision and names what replaces it. The replacement is never another trusted party: approval gives way to a fee, a stake, and proposal classes; the veto gives way to a council no single party controls, and to the holders' ability to exit.

Stage 0: Supervised

Where the protocol is today. Umia signs every market before it opens, and is the security council's only member, able to pause execution in an emergency.

Nothing is removed yet. This stage is for battle-testing the mechanism on real markets for a while, with a person reviewing every settled market before its execution window closes. Stage 1 begins once that record is long enough to trust.

Stage 1: Teams Open Their Own Markets

A project's operator opens markets for its own project without a signature from Umia. The stake, the single-market rule, and the threshold are unchanged. Markets drafted by anyone else still need Umia's signature, and the council is untouched.

Nothing has to replace approval here. The operator is already bound by the result; what they lose is a wait. Stage 2 begins after team-opened markets have run and executed for a while without Umia needing to step in.

Stage 2: Anyone With Stake Opens a Market

Market creation becomes permissionless: the approval signature comes out of the contracts. Approval, which was a judgment call, is replaced by rules that cost something.

• A cost to open. Whoever opens a market posts the stake, returned in full when the market settles, and pays a small fixed fee to the project's treasury. An honest proposal risks nothing beyond that fee; spam pays the project every time. The exact mechanism is still being designed.
• Proposal classes. High-impact actions (arbitrary calls from the treasury, contract upgrades, liquidation) require a larger stake, a higher winning threshold, and a longer trading window than a budget change or a document upload. Projects choose which classes are open to outside proposers.

From here, its seat on the security council is Umia's only remaining supervisory role in decision markets. Stage 3 begins once the fee and class parameters have held up against real attempts to abuse them on live markets.

Stage 3: The Security Council Becomes Independent

The council stops being Umia alone. It becomes a group of parties with no stake in any one project's outcomes, acting by threshold.

• Independent members. Security firms that review the protocol, operators of other projects on Umia, and holder delegates. Umia keeps one seat among several.
• A threshold. A pause needs several members to agree. No single member, Umia included, can stop a market on its own.
• Pause, never kill. A pause blocks execution and nothing else. Lifting it takes the same threshold, and a paused market can always be superseded by a new one with the same proposal, so a result the market stands behind can be put back to the market.

Stage 4 begins once the council has acted as a group at least once, in an incident or a drill. Holders also have a backstop of their own: a liquidation market, which winds the project down and pays the treasury out to token holders pro rata. It is a market like any other and follows the rules of whatever stage it runs in. A result holders cannot live with is answered by leaving, not by a pause.

Stage 4: The Council Becomes Optional

A project can leave the council's scope. Outside it, the execution delay stays as a fixed, published gap between a result and its effect, with nobody who can act inside it. What remains of Umia's role is the ability to upgrade the contracts, covered below.

This stage begins after a sustained record of markets executed without a pause, and after an independent review of the market and execution contracts in their final form.

Upgrade Authority

The protocol owner, a timelock with a two-day public delay, can upgrade the shared contracts: the hub, the market core, and the treasury implementation that projects share. This is a different kind of power from approval and the council. It does not touch any single market, but an upgrade could in principle change any rule on this page, which is why every upgrade is visible onchain two days before it can execute.

Our stance is that the core contracts stay upgradeable while the protocol is still being built. Decision markets, settlement, and the treasury are still gaining features. Once the protocol reaches the version we consider final, upgradeability is removed, by an upgrade whose only effect is to remove it. Until then, the delay is the protection, and it can lengthen as the protocol matures.

Projects do not have to wait for that. A project can opt out of upgrades to its treasury contract today through a decision market: the market pins the treasury to an implementation the project chooses, and from then on no protocol upgrade changes it. The project takes on its maintenance, fixes included. Markets themselves still run in the shared market core, which stays upgradeable until the protocol reaches its final version.

Why This Order

Approval goes first because it is the larger intrusion: it sits in front of every decision, while the veto sits behind the rare bad one. Within approval, teams go before outsiders because a team is already bound by the result and has the least reason to waste its own market. The council's power goes last, and its membership widens before its power shrinks, because the cost of removing it too early is a treasury that cannot be defended, while the cost of leaving it in one party's hands too long is a trusted party that should not exist.