# trinity_dao

Foundational Draft v0.1 of the Trinity Universe DAO, saved as Anchor source. The constitution is the page at `/dao/`. This crate is not a deployment.

`declare_id!("TrinityDao11111111111111111111111111111111")` is the placeholder from the draft. It is not a 32-byte program id. It is not the wars escrow `Gv574JYHt5MRiXFsAT9r5R1KRwKYh8pQ8SGVcJ5oagph`. It is not the trinity_game testnet address `5hnL69pihmwEGsrn1jcfRTVXHezD3tv9xCw3aVfwfdWe`. No keypair was generated for this draft. Do not build it, deploy it, or send a transaction to it.

Anchor is pinned to 0.28.0 because the source reads bumps with `ctx.bumps.get(...)`. A later workspace sketch named 0.30.1. Those APIs differ (`ctx.bumps.dao_state` on 0.29+). The sketch lives in `sketches/workspace.md` and is not a Cargo workspace.

## What the saved program does

- `initialize_dao`, `create_proposal`, `vote`, `finalize_proposal`, `execute_proposal`.
- Voting power is `sqrt(governance token balance)` only. Ship power and tenure are named in the constitution and are not counted here.
- `execute_proposal` matches a proposal type and calls a stub. Every stub returns `Ok(())`. No CPI runs. No treasury token moves. The proposal is then marked executed.

## Defects that block any deploy

These are in the draft on purpose so a later reader does not treat a paste as a safe DAO.

1. Quorum is `total_votes >= total_votes * quorum_percentage / 100`. When the percentage is 100 or less, that comparison passes whenever anyone voted. Eligible voting power is never stored, so the check cannot see an absent majority.
2. `execute_proposal` does not read a passed flag. `finalize_proposal` does not write one. After `execution_slot`, a proposal can be marked executed whether the vote failed, never met a real quorum, or was never finalized. `canceled` is stored and never consulted.
3. `token_power` uses `(balance as f64).sqrt() as u64`. Floating point is not a deterministic on-chain weight. An integer square root is required before this function can assign voting power.
4. `sketches/cpi.rs` lists the accounts a later treasury spend would need. It is not part of the crate, and it contains no transfer. The crate stub moves nothing. A transfer without the treasury PDA signer seeds would not be a signed treasury spend.
5. `initialize_dao` has no authority check on the payer. The first caller of the `dao_state` PDA sets the authority pubkey and the voting parameters.
6. Proposal space is a fixed `8 + 512` bytes while `parameters` is a `Vec<u8>`. A long payload does not fit. `size_of` on the other accounts is the struct header, not a measured Anchor layout.
7. The live token balance is read at vote time. A borrowed balance counts. There is no snapshot.
8. Ship ownership, TrinityCore immutability, planets 0–99, and wallet sovereignty are constitutional text. This program has no instruction that enforces them, and no TrinityCore dependency.

The supermajority test in this file is `for_votes * 100 >= total_votes * supermajority_percentage`. An earlier sketch compared for-votes with against-votes. That earlier comparison is not what this file does.

Genesis, the founder-signer variant, is a separate crate at `../genesis-dao`. Its execute path still requires the founder authority to sign.