[Specification] The "Dead-Man’s OIDC": Thermodynamic Failover & Emergency Continuity

Motivation: The “Centralized Identity” Paradox

Using OIDC for sub-500ms onboarding is the gold standard for Velocity, but it introduces a critical dependency. If the OIDC provider de-platforms the DAO or suffers a global outage, the “Invisible Handover” becomes a “Permanent Lockout”.

We propose the Dead-Man’s OIDC (DMO): a Zodiac-compatible circuit breaker that automatically shifts governance from Social Trust (OIDC) to Physical Trust (Hashpower) if the identity bridge fails.

The Protocol: Thermodynamic Circuit Breaker

The system operates in two states: Standard (OIDC) and Emergency (Thermodynamic).

• The Heartbeat: The OIDC bridge must post a “Liveness Attestation” to the Zodiac module every NN blocks.
• The Trigger: If the Liveness Attestation is missing for more than XX consecutive blocks (e.g., 2 hours of downtime), the Thermodynamic Circuit Breaker trips.
• The Failover: The Safe Zodiac Module instantly revokes the OIDC-linked signers and activates the Miner-DAO Fallback.

Emergency Governance: Miners as Custodians

When in Emergency Mode, the “Throne” is not empty. Governance is assumed by the Miner-DAO (the same entities already forwarding 5% to the treasury).

• Work-Based Signing: During the failover, the ability to sign transactions is granted to any miner who can prove they have contributed at least Y\%Y% of the hashrate over the last 1,000 blocks.
• The “Glass Box” Recovery: This is not a permanent takeover. The Miners’ only authorized role in Emergency Mode is to:
  Maintain essential industrial functions (paying for “Digital Oil”).
  Vote on a Governance Reset to link the DAO to a new, redundant OIDC or ZK-Identity provider.
• Restoration: Once a new identity provider is verified via the Miner-DAO consensus, the “Standard” mode is restored, and the miners return to their role as neutral infrastructure providers.

Technical Implementation: The Zodiac Guard

The DMO is implemented as a Zodiac Guard sitting between the OIDC Module and the Safe Avatar.

• Internal Timer: A smart contract tracking the last_oidc_heartbeat block height.
• Entropy Verification: In Emergency Mode, the Guard requires a DifficultyBuffer proof, a cryptographic check that the signer is indeed a current miner on the L1 (ETC).
• Latency: The shift to Emergency Mode is Atomic (1 block). Restoration takes a 24-hour “Cooling Period” to prevent flash-loan style governance attacks.

Comparative Resilience: OIDC vs. DMO