Security Council Manager Affordance Change Action

[godzillaba]

Shifts some of the emergency council's privileges over to the non-emergency council. Specifically these 4 SecurityCouncilManager roles are transferred: MEMBER_ADDER_ROLE, MEMBER_REPLACER_ROLE, MEMBER_ROTATOR_ROLE, MEMBER_REMOVER_ROLE.

yarn ts-node scripts/printAccessControlRoles.ts shows the following roles on the manager:

Checking roles for 0xD509E5f5aEe2A205F554f36E8a7d56094494eDFC "Security Council Manager" on chain 42161

Accounts with '0x0000000000000000000000000000000000000000000000000000000000000000':
0xCF57572261c7c2BCF21ffD220ea7d1a27D40A827

Accounts with 'COHORT_REPLACER':
0x467923B9AE90BDB36BA88eCA11604D45F13b712C

Accounts with 'MEMBER_ADDER':
0x423552c0F05baCCac5Bfa91C6dCF1dc53a0A1641

Accounts with 'MEMBER_REMOVER':
0x6f3a242cA91A119F872f0073BC14BC8a74a315Ad
0x423552c0F05baCCac5Bfa91C6dCF1dc53a0A1641

Accounts with 'MEMBER_ROTATOR':
0x423552c0F05baCCac5Bfa91C6dCF1dc53a0A1641

Accounts with 'MEMBER_REPLACER':
0x423552c0F05baCCac5Bfa91C6dCF1dc53a0A1641

Documentation is also updated to reflect this change.

Proposal data: #290
Seatbelt: ArbitrumFoundation/governance-seatbelt#30

[yahgwai]

This is only consistent with the constitution because we're also making the non emergency governor a 9/12 multisig - so in the future we would need to be careful if we ever reduced the threshold again to move these roles back to the emergency governor.

I dont know how we can guard against. Could do:

1. Add a big comment somewhere about the threshold - but I dont know where we could put a comment that it would get picked up in this case
2. Add a check somewhere in the sec council manager that wont allow these updates to be called unless its by a safe with 9/12 threshold.
3. Add a guard into the non emergency safe that doesnt allow the threshold to be reduced unless a special string is provided eg keccak256("the member roles on the sec council manager have already been revoked")

[godzillaba]

we could put something in gotchas.md or security-council-manager.md but i'm not sure they would be noticed

[godzillaba]

i actually think documenting it should be sufficient, the nonemergency can only do 2 things: queue l2 timelock and call the manager, so when the threshold is changed I would think this would be remembered

[yahgwai]

Ok, lets stick it in the gotchas or something then

[gvladika]

We could add checks/verifications after roles are granted for extra layer of safety (even though it's tested in fork test so probably not necessary)

[godzillaba]

good call

[gvladika]

lgtm

[stonecoldpat]

+1 let's keep it as a strict subset