> For the complete documentation index, see [llms.txt](https://jpydf.gitbook.io/jpy-defi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jpydf.gitbook.io/jpy-defi/governance/governance-and-timelock.md).

# Governance & Timelock

Ordinary configuration changes and upgrades to JPY DeFi's proprietary layers are proposed by a multisig and executed through a 12-hour TimelockController. Core risk parameters of live branches cannot be changed, but the dToken and Strategy layers that hold and deploy collateral are upgradeable and have the emergency powers below.

## What governance can do

* Change proprietary-layer operating values such as dToken mint caps, liquidity buffers, and withdrawal waiting periods
* Decide Protocol Treasury budgets and uses, and configure the interest-routing recipient and liquidity allocator
* Add, disable, and replace external venues
* Upgrade proprietary layers such as dToken and Strategy
* Replace price sources and resume branches paused by a price failure ([How Prices Are Determined](/jpy-defi/collateral-and-pricing/oracle.md))
* Finalize the collateral and Core risk parameters of a reserved branch once before activation

The MCR, CCR, SCR, liquidation penalties, and similar values of live branches were finalized at deployment and cannot be changed.

## Scope of the Core

On live branches, anyone can borrow, repay, redeem, liquidate, and deposit to or withdraw from the Stability Pool. Governance has no function to freeze a particular user's JPYdf and no function to stop the Core at will. The exceptions are the branch pause triggered by a price failure (a Core safety mechanism) and the emergency pause of dToken deposits, in-kind redemptions, and claims.

## Timelock and emergency powers

* Upgrades, configuration changes such as mint caps and liquidity buffers, and resuming dToken deposits, in-kind redemptions, and claims after a pause go through the common TimelockController and are executed 12 hours after the proposal. Scheduled changes can be checked on-chain before they execute.
* Replacing a price source (with the 12-hour wait built into the PriceFeedProxy) and resuming a branch paused by a price failure (with no waiting period) are performed directly by the governance multisig, not through the TimelockController.
* A multisig with emergency powers can immediately pause Vault deposits, in-kind redemptions, claims, and allocation to external venues. Emergency-disabling a venue also pauses them at the same time. Resuming requires the 12-hour Timelock.
* A multisig with a higher quorum can immediately confirm a loss of unrecoverable externally deployed principal. The confirmation also pauses dToken deposits, in-kind redemptions, and claims, and the amount confirmed is decided by that multisig. Confirmation can change dToken collateral valuation and liquidation risk.
* Finalizing a reserved branch's collateral and Core risk parameters is a one-time operation through the Timelock and cannot be redone after finalization.

## Cross-chain issuance

Cross-chain issuance is not currently active. JPYdf is registered in the Chainlink CCIP registry (TokenAdminRegistry) with the production Timelock as its administrator, but no transfer route (pool) is set. Opening a route requires a configuration change through the 12-hour Timelock. Separately, granting a bridge the authority to issue JPYdf requires action by the governance multisig and the 48-hour wait built into the JPYdf token (not through the TimelockController). If that authority is compromised after it is granted, JPYdf supply could be affected.