[Open Question] Conformance profiles and the capability/behavior manifest

[oa-sarvesh]

Context

The convergence model (Whitepaper §5.2) requires a machine-readable capability/behavior manifest so a counterparty's system can determine compatibility before transacting — analogous to Sui's on-chain TokenPolicy discovery and ERC-3643's pre-trade canTransfer check.

The question

What does a minimal conformance profile look like, and how should the manifest be structured so counterparties can negotiate compatibility automatically?

How to contribute

• Draft a manifest schema (implemented behaviors, policy/registry pointers, metadata anchor, event schema version).
• Propose conformance levels (e.g., Core / Restricted / Settlement-capable) and what each requires.
• Describe the discovery mechanism per execution model: where does the manifest live on EVM, Sui, Solana, Fabric?

Reference: Whitepaper §5.2 (Discovery), §5.3.

[SergeevDmitry]

One field I'd consider required in the manifest: who controls each privileged behavior, not only which behaviors exist.

Freezable, ForceTransferable, Pausable, Recoverable and supply changes all mean very different things depending on who can invoke them. A counterparty evaluating a token needs to know, for example, whether a forced transfer can be triggered by an automated compliance key or only by the issuer's governance with a delay.

Sketch per privileged behavior:

forceTransferable:
  controller: <address | DID>      # who can invoke
  controllerType: multisig | timelock | single-key | contract
  threshold: "3-of-5"              # if multisig
  delay: P1D                       # timelock / admin-transfer delay, ISO 8601
  scope: any-holder | blocked-holders-only
pausable:
  controller: ...
  blocksHolderUnwind: false        # e.g. redemption cancel still works while paused (see #46)

Why: in our EVM deployment we deliberately split these. Seizure (ERC-7943 forcedTransfer, freeze) belongs only to the issuer's admin multisig, never to the compliance role, because that role may sit on a server key, and seizure is a legal act that should answer to governance. Pause is a narrow emergency switch with no seizure power. Admin transfer has a ≥24h delay in production. None of this is visible from "implements ForceTransferable" alone, yet it's exactly what a risk or legal reviewer asks first.

For conformance levels, this suggests that a "Restricted" profile should require the controller fields for every privileged behavior it declares.

Reference: role matrix at https://github.com/devlab-group/rwa-platform-evm/blob/master/docs/spec/roles.md