docs(adr): specify slashing and economic penalties

[flo2517]

Stacked on #65 — review that one first. This PR's diff against main will collapse to just ADR-015 once #65 merges.

Motivation

ADR-011 §5 shipped validator rewards and explicitly deferred penalties: "slashing stake for provably bad submissions is the intended long-term deterrent but its economic parameters need their own analysis — out of scope for this ADR, tracked as follow-up work." ADR-012 §6 names that follow-up ADR-015 and makes it the gate for #52. This is it.

The finding that changes #52's shape

Providers bond nothing. pallet-network-validator takes a real bond — ReservableCurrency (lib.rs:161), MinStake (lib.rs:173, MinValidatorStake = 1_000 at runtime/src/lib.rs:106,317), reserved at lib.rs:449, released after UnbondingPeriod at lib.rs:503. pallet-provider-registry has no Currency association at all, and pallet-lease holds no collateral.

#52 asks for financial penalties against providers that miss their availability commitments. There is nothing to take. Provider bonding is a precondition, it is the larger half of the work, and it lands in pallet-provider-registry — a pallet #52 never mentions, whose registration semantics change for every existing caller including the Control Plane's register_provider_for path (ADR-009).

Decisions worth arguing about

• Outlier ≠ dishonest. The trimmed mean in close_round discards the highest and lowest submission by construction, so an honest validator seeing a genuine edge case is trimmed exactly like a liar. Persistent outlier status may inform selection or rewards; it may never slash on its own. What is slashable is equivocation — two conflicting signed submissions for the same (provider, round, dimension) — and evidence contradicted by its own payload_hash. Both are self-incriminating and need no third-party judgement.
• Slashed funds are burned. Never paid to the accuser (manufactures an incentive to fabricate breaches) and never to the counterparty (makes every tenant a beneficiary of its provider's failure). Compensation for a failed lease is a settlement question (Define the metering, billing, escrow, and settlement architecture #19, Implement on-chain escrow smart contract and provider settlement #21); mixing it with slashing corrupts both.
• One bad round never slashes. A governed number of consecutive qualifying rounds is required, and a round that closed at the quorum floor does not qualify at all.
• Exit cannot outrun a slash. Stake in Exiting { available_at } stays slashable, with the invariant UnbondingPeriod >= DisputeWindow + AppealWindow + BreachRounds × round length asserted in the runtime rather than left to whoever next tunes a parameter. Today's values (14_400 vs 300, runtime/src/lib.rs:107,115) leave ample margin.
• No clawback of accrued rewards. pallet-rewards already documents this for upheld disputes and it stays: clawback across unbounded history is unbounded runtime work.

Consequence: #52 gains a dependency on #36

An armed slash is appealable, and the appeal is resolved by a governance origin. Today that is EnsureRoot (runtime/src/lib.rs:316) — one sudo key deciding whether to destroy a participant's stake. That is not an acceptable terminal authority for an irreversible penalty, and it is exactly the centralization this roadmap removes. §6 therefore forbids slashing going live before ADR-020/#36. The mechanism may be implemented, tested, and merged behind a disabled parameter. ADR-012 §5 already places #36 and #52 in the same stage, so this costs no schedule.

ROADMAP.md's v3.0 table is updated to record the coupling.

What it does not solve

A colluding committee majority can still slash an honest provider. ADR-011 §4 and ADR-012 §2 both already flag operator-level collusion as an accepted gap. BreachRounds raises the cost and the appeal path is the backstop; attestation (#61) is the real fix and is deliberately later. The ADR says so rather than implying the problem is closed.

Affected components

None at build time. Constrains future work in blockchain/pallets/{network-validator,provider-registry,rewards}.

Rollback

Revert the commit. Documentation only.

Verification

Every citation was read against the source before being written: blockchain/pallets/network-validator/src/lib.rs:161,173,441,449,503,529,549,639,709,755; blockchain/pallets/rewards/src/lib.rs:182; blockchain/runtime/src/lib.rs:106,107,115,316,317. Confirmed by grep that pallet-provider-registry and pallet-lease contain no Currency, stake, bond, or collateral of any kind.

Refs #52

🤖 Generated with Claude Code