@coordination-network/contracts 0.0.1

package/CredentialRevocationRegistry.sol

@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import { ISemaphore } from "@semaphore-protocol/contracts/interfaces/ISemaphore.sol";
+import { IRevocation } from "./revocation/interfaces/IRevocation.sol";
+import { IRevocationRegistries } from "./revocation/interfaces/IRevocationRegistries.sol";
+
+import { NetworkMemberGate } from "./base/NetworkMemberGate.sol";
+
+/// @title CredentialRevocationRegistry
+/// @notice The network's one revocation registry. A single tree holds every revoked credential,
+/// whoever issued it, and every write is authorised by an anonymous membership proof from an
+/// approved network member.
+/// @dev One registry rather than one per issuer is what keeps issuer hiding intact. The circuit hides
+/// which approved issuer signed a credential and outputs the root it proved non-membership against;
+/// picking which registry to ask about that root would name the issuer. So {isValidRoot} takes the
+/// root alone, and with one tree, which tree a holder syncs says nothing about its issuer either.
+///
+/// The tree, its root history and its LeanIMT+ stay in the {IRevocation} deployment. This contract
+/// adds only who may write and a registry-free read surface.
+///
+/// The registry's admin is this contract, and no write path reads `msg.sender`, so a member can
+/// submit from a fresh stealth address with a paymaster covering the gas. The cost is that any
+/// approved member can revoke any credential unattributably; {unrevoke} makes a wrong one repairable.
+///
+/// The tree reads a holder needs are public on {REVOCATION} under {REGISTRY_ID}, not mirrored here.
+contract CredentialRevocationRegistry is NetworkMemberGate {
+    /// @notice The mutation a member proof authorises.
+    enum RevocationAction {
+        Revoke,
+        RevokeMany,
+        Unrevoke,
+        UpdateCommitment
+    }
+
+    /// @dev Domain of the message a proof commits to. Clients derive the message identically.
+    string constant REVOCATION_MESSAGE_DOMAIN = "coordination-network.credential-revocation-registry.revocation.v1";
+
+    /// @notice The constant half of a revocation message, hashed once at deployment.
+    bytes32 public immutable REVOCATION_DOMAIN_SEPARATOR;
+
+    /// @notice The revocation service holding this registry's tree and root history.
+    IRevocation public immutable REVOCATION;
+
+    /// @notice This network's registry on {REVOCATION}, created at deployment and administered by
+    /// this contract.
+    /// @dev Public because a holder needs it to read the tree off {REVOCATION}. A verifier does not.
+    uint256 public immutable REGISTRY_ID;
+
+    /// @notice Thrown when the deployment is given no revocation service.
+    error ZeroRevocationService();
+
+    /// @param semaphore The Semaphore deployment holding the approved-member group.
+    /// @param networkMemberGroupId The approved-member group to gate writes on.
+    /// @param revocation The revocation service to create this network's registry on.
+    constructor(ISemaphore semaphore, uint256 networkMemberGroupId, IRevocation revocation)
+        NetworkMemberGate(semaphore, networkMemberGroupId)
+    {
+        if (address(revocation) == address(0)) revert ZeroRevocationService();
+
+        REVOCATION = revocation;
+
+        // This contract is the admin, so the gated functions below are the only way in. The tree
+        // starts empty, and the circuit canonicalises an empty-registry witness to a zero root, so
+        // presentations verify from the first block.
+        REGISTRY_ID = revocation.createRegistry(address(this));
+
+        REVOCATION_DOMAIN_SEPARATOR = keccak256(abi.encode(REVOCATION_MESSAGE_DOMAIN, address(this)));
+    }
+
+    /// @notice Revokes a credential, on an approved member's authority.
+    /// @param revocationCommitment The credential's revocation commitment.
+    /// @param lowLeafIndex The commitment's predecessor slot, computed off chain against the tree
+    /// state this transaction executes in. If another write lands first this reverts; recompute and
+    /// resubmit the same proof.
+    /// @param proof Membership proof bound to this exact revocation.
+    function revoke(uint256 revocationCommitment, uint256 lowLeafIndex, NetworkMemberProof calldata proof)
+        external
+        onlyNetworkMember(_revocationMessage(RevocationAction.Revoke, revocationCommitment), proof)
+    {
+        REVOCATION.revoke(REGISTRY_ID, revocationCommitment, lowLeafIndex);
+    }
+
+    /// @notice Revokes several credentials in one call, on an approved member's authority.
+    /// @dev Cheaper than one {revoke} per commitment, and the answer to contention on a shared tree:
+    /// one proof and one transaction for the batch.
+    /// @param revocationCommitments The commitments to revoke, in insertion order.
+    /// @param lowLeafIndices Each commitment's predecessor index, in the tree state after the
+    /// earlier commitments in the batch have been inserted.
+    /// @param proof Membership proof bound to this exact batch.
+    function revokeMany(
+        uint256[] calldata revocationCommitments,
+        uint256[] calldata lowLeafIndices,
+        NetworkMemberProof calldata proof
+    ) external onlyNetworkMember(_revocationBatchMessage(revocationCommitments), proof) {
+        REVOCATION.revokeMany(REGISTRY_ID, revocationCommitments, lowLeafIndices);
+    }
+
+    /// @notice Undoes a revocation, on an approved member's authority.
+    /// @dev The credential becomes valid again everywhere, including for verifiers still on an older
+    /// root. Here because an anonymous revocation cannot be pinned on anyone, so a wrong one has to
+    /// be repairable.
+    /// @param revocationCommitment The revoked commitment.
+    /// @param predecessorIndex The physical index of the leaf whose `nextValue` is the commitment.
+    /// @param proof Membership proof bound to this exact un-revocation.
+    function unrevoke(uint256 revocationCommitment, uint256 predecessorIndex, NetworkMemberProof calldata proof)
+        external
+        onlyNetworkMember(_revocationMessage(RevocationAction.Unrevoke, revocationCommitment), proof)
+    {
+        REVOCATION.unrevoke(REGISTRY_ID, revocationCommitment, predecessorIndex);
+    }
+
+    /// @notice Replaces a revoked commitment with another one, reusing its slot, on an approved
+    /// member's authority.
+    /// @param oldRevocationCommitment The revoked commitment to replace.
+    /// @param newRevocationCommitment The commitment to put in its place.
+    /// @param oldPredecessorIndex The physical index of the old commitment's predecessor.
+    /// @param newPredecessorIndex The physical index of the new commitment's predecessor, in the
+    /// tree state after the old commitment has been unlinked.
+    /// @param proof Membership proof bound to this exact replacement.
+    function updateRevocationCommitment(
+        uint256 oldRevocationCommitment,
+        uint256 newRevocationCommitment,
+        uint256 oldPredecessorIndex,
+        uint256 newPredecessorIndex,
+        NetworkMemberProof calldata proof
+    ) external onlyNetworkMember(_revocationUpdateMessage(oldRevocationCommitment, newRevocationCommitment), proof) {
+        REVOCATION.updateRevocationCommitment(
+            REGISTRY_ID, oldRevocationCommitment, newRevocationCommitment, oldPredecessorIndex, newPredecessorIndex
+        );
+    }
+
+    /// @notice Whether a root may back a revocation proof right now.
+    /// @dev The verifier's only on-chain read, and it takes the root alone, so a verification has
+    /// nothing issuer-specific to pass. Accepts the current root, plus any root superseded less than
+    /// the registry's window ago, so a revocation landing mid-presentation spares honest proofs.
+    /// @param revocationRoot The root the proof was built against.
+    /// @return True if the root is currently accepted.
+    function isValidRoot(uint256 revocationRoot) external view returns (bool) {
+        return REVOCATION.isValidRoot(REGISTRY_ID, revocationRoot);
+    }
+
+    /// @notice The registry's current revocation root.
+    /// @dev Mirrored here because building a non-membership proof starts with it. Zero while the tree
+    /// is empty, matching the circuit's empty-registry witness. The cast is because tree reads live on
+    /// {IRevocationRegistries}, which the same deployment implements.
+    /// @return The root.
+    function getRevocationRoot() external view returns (uint256) {
+        return IRevocationRegistries(address(REVOCATION)).getRevocationRoot(REGISTRY_ID);
+    }
+
+    /// @dev Binds a proof to one single-commitment mutation: the action and the commitment, at this
+    /// registry on this chain. The separator and chain id matter because this contract does not own
+    /// its group: two deployments can share one, and one deployment can sit at the same address on two
+    /// chains with the same root.
+    ///
+    /// The predecessor index is not bound. It is a witness the LeanIMT+ validates, not a privilege, so
+    /// leaving it out lets a member who lost a race recompute it and resubmit the same proof; a revert
+    /// does not burn the nullifier.
+    /// @param action Which mutation the proof authorises.
+    /// @param revocationCommitment The commitment being written.
+    function _revocationMessage(RevocationAction action, uint256 revocationCommitment) private view returns (uint256) {
+        return uint256(
+            keccak256(abi.encodePacked(REVOCATION_DOMAIN_SEPARATOR, block.chainid, action, revocationCommitment))
+        );
+    }
+
+    /// @dev Binds a proof to one batch. The commitments come last and are the only variable-length
+    /// field, so the encoding is unambiguous. The action differs from {RevocationAction.Revoke}
+    /// because a one-commitment batch would otherwise pack identically to a single revocation.
+    /// @param revocationCommitments The commitments being revoked, in insertion order.
+    function _revocationBatchMessage(uint256[] calldata revocationCommitments) private view returns (uint256) {
+        return uint256(
+            keccak256(
+                abi.encodePacked(
+                    REVOCATION_DOMAIN_SEPARATOR, block.chainid, RevocationAction.RevokeMany, revocationCommitments
+                )
+            )
+        );
+    }
+
+    /// @dev Binds a proof to one replacement. Both commitments are fixed width, so binding both fixes
+    /// which replacement is authorised.
+    /// @param oldRevocationCommitment The commitment being replaced.
+    /// @param newRevocationCommitment The commitment replacing it.
+    function _revocationUpdateMessage(uint256 oldRevocationCommitment, uint256 newRevocationCommitment)
+        private
+        view
+        returns (uint256)
+    {
+        return uint256(
+            keccak256(
+                abi.encodePacked(
+                    REVOCATION_DOMAIN_SEPARATOR,
+                    block.chainid,
+                    RevocationAction.UpdateCommitment,
+                    oldRevocationCommitment,
+                    newRevocationCommitment
+                )
+            )
+        );
+    }
+}

package/ERC5564Announcer.sol

@@ -0,0 +1,17 @@
+// https://github.com/ScopeLift/stealth-address-erc-contracts/blob/main/src/ERC5564Announcer.sol
+// SPDX-License-Identifier: CC0-1.0
+pragma solidity ^0.8.34;
+
+import { IERC5564Announcer } from "./interfaces/IERC5564Announcer.sol";
+
+/// @notice `ERC5564Announcer` contract to emit an `Announcement` event to broadcast information
+/// about a transaction involving a stealth address. See
+/// [ERC-5564](https://eips.ethereum.org/EIPS/eip-5564) to learn more.
+contract ERC5564Announcer is IERC5564Announcer {
+    /// @inheritdoc IERC5564Announcer
+    function announce(uint256 schemeId, address stealthAddress, bytes memory ephemeralPubKey, bytes memory metadata)
+        external
+    {
+        emit Announcement(schemeId, stealthAddress, msg.sender, ephemeralPubKey, metadata);
+    }
+}

package/IdentityRegistry.sol

@@ -0,0 +1,121 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import { ISemaphore } from "@semaphore-protocol/contracts/interfaces/ISemaphore.sol";
+
+import { NetworkMemberGate } from "./base/NetworkMemberGate.sol";
+
+/// @title IdentityRegistry
+/// @notice Resolves a networkId to its meta-stealth address. Reads are public and ungated. Every
+/// write is authorised by an anonymous Semaphore membership proof against the approved-member
+/// group, so the registry learns that an approved network member made the change and not which one.
+/// @dev No write path looks at `msg.sender`, which is what lets a member submit from a fresh stealth
+/// address with a paymaster covering the gas. The proof is bound to the exact update it carries: see
+/// NetworkMemberGate for the binding, and Semaphore for membership, the recent-root window and the
+/// nullifier set that stops a proof being submitted twice.
+contract IdentityRegistry is NetworkMemberGate {
+    /// @notice The update a member proof authorises.
+    enum UpdateAction {
+        Register,
+        Update,
+        Remove
+    }
+
+    /// @dev Domain of the message a proof commits to. Clients derive the message identically.
+    string constant UPDATE_MESSAGE_DOMAIN = "coordination-network.identity-registry.update.v1";
+
+    uint256 public constant META_STEALTH_ADDRESS_LENGTH = 66;
+
+    /// @notice The constant half of an update message, hashed once at deployment.
+    bytes32 public immutable UPDATE_DOMAIN_SEPARATOR;
+
+    /// @notice The networkId => meta-stealth address mapping
+    mapping(bytes32 networkId => bytes metaStealthAddress) public identity;
+
+    event IdentityRegistered(bytes32 indexed networkId, bytes metaStealthAddress);
+    event IdentityUpdated(bytes32 indexed networkId, bytes metaStealthAddress);
+    event IdentityRemoved(bytes32 indexed networkId);
+
+    error InvalidMetaStealthAddressLength();
+    error AlreadyRegistered(bytes32 networkId);
+    error NotRegistered(bytes32 networkId);
+
+    /// @param semaphore The Semaphore deployment holding the approved-member group.
+    /// @param networkMemberGroupId The approved-member group to gate writes on.
+    constructor(ISemaphore semaphore, uint256 networkMemberGroupId) NetworkMemberGate(semaphore, networkMemberGroupId) {
+        UPDATE_DOMAIN_SEPARATOR = keccak256(abi.encode(UPDATE_MESSAGE_DOMAIN, address(this)));
+    }
+
+    /// @notice Registers a networkId alongside its meta-stealth address, on an approved member's
+    /// authority.
+    /// @param networkId The identity being registered.
+    /// @param metaStealthAddress The ERC-6538 meta-stealth address to resolve to.
+    /// @param proof Membership proof bound to this exact registration.
+    function registerIdentity(bytes32 networkId, bytes calldata metaStealthAddress, NetworkMemberProof calldata proof)
+        external
+        onlyNetworkMember(_updateMessage(UpdateAction.Register, networkId, metaStealthAddress), proof)
+    {
+        if (identity[networkId].length != 0) revert AlreadyRegistered(networkId);
+
+        identity[networkId] = metaStealthAddress;
+        emit IdentityRegistered(networkId, metaStealthAddress);
+    }
+
+    /// @notice Repoints an existing networkId at a new meta-stealth address, on an approved member's
+    /// authority.
+    /// @param networkId The identity being updated.
+    /// @param newMetaStealthAddress The ERC-6538 meta-stealth address to resolve to.
+    /// @param proof Membership proof bound to this exact update.
+    function updateIdentity(bytes32 networkId, bytes calldata newMetaStealthAddress, NetworkMemberProof calldata proof)
+        external
+        onlyNetworkMember(_updateMessage(UpdateAction.Update, networkId, newMetaStealthAddress), proof)
+    {
+        if (identity[networkId].length == 0) revert NotRegistered(networkId);
+
+        identity[networkId] = newMetaStealthAddress;
+        emit IdentityUpdated(networkId, newMetaStealthAddress);
+    }
+
+    /// @notice Clears a networkId entry, on an approved member's authority.
+    /// @param networkId The identity being removed.
+    /// @param proof Membership proof bound to this exact removal.
+    function removeIdentity(bytes32 networkId, NetworkMemberProof calldata proof)
+        external
+        onlyNetworkMember(_updateMessage(UpdateAction.Remove, networkId, ""), proof)
+    {
+        if (identity[networkId].length == 0) revert NotRegistered(networkId);
+
+        delete identity[networkId];
+        emit IdentityRemoved(networkId);
+    }
+
+    /// @dev The Semaphore message binding a proof to one update of this registry: the payload, plus
+    /// the chain id.
+    ///
+    /// The payload is what stops a proof authorising a different update. The domain separator and
+    /// the chain id place that update at one registry on one chain. Both are load-bearing, because
+    /// this contract does not own its group: two registries can be pointed at the same group id, and
+    /// the same registry can be deployed to the same address on two chains with the same members
+    /// admitted in the same order, which gives the same root. Without the separator a proof meant
+    /// for one of them would authorise the other.
+    ///
+    /// The meta-stealth address is the only variable-length field and it comes last, so the packed
+    /// encoding is unambiguous. Rejects a malformed meta-stealth address here, before the proof is
+    /// verified, so a length mistake does not read as a bad proof.
+    /// @param action Which mutation the proof authorises.
+    /// @param networkId The identity being written.
+    /// @param metaStealthAddress The meta-stealth address being written, empty for a removal.
+    function _updateMessage(UpdateAction action, bytes32 networkId, bytes memory metaStealthAddress)
+        private
+        view
+        returns (uint256)
+    {
+        if (action != UpdateAction.Remove && metaStealthAddress.length != META_STEALTH_ADDRESS_LENGTH) {
+            revert InvalidMetaStealthAddressLength();
+        }
+
+        return uint256(
+            keccak256(abi.encodePacked(UPDATE_DOMAIN_SEPARATOR, block.chainid, action, networkId, metaStealthAddress))
+        );
+    }
+}

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ethereum Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/NetworkMemberGovernance.sol

@@ -0,0 +1,264 @@
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.34;
+
+import { ISafeGovernance, ISafeOwnerManager } from "./interfaces/ISafeGovernance.sol";
+import { NetworkMemberGroup } from "./NetworkMemberGroup.sol";
+import { NetworkMemberRegistry } from "./NetworkMemberRegistry.sol";
+
+/// @title NetworkMemberGovernance
+/// @notice The governance operations of the network, each as one call: admit a member, remove one, and
+/// leave voluntarily.
+/// @dev Admitting a member changes state in three places: the record in the NetworkMemberRegistry,
+/// the leaf in the Semaphore group NetworkMemberGroup administers, and the Safe's own owner set, which
+/// is what makes the new member an approver of the next candidate. Without this contract those are
+/// three calls someone has to pack into a MultiSend batch, with the threshold in the third written by
+/// whoever built it. Every approver would then have to decode that batch and recompute the threshold to
+/// know what it is approving.
+///
+/// Here they are one call whose behaviour is fixed in code:
+///
+///  - the threshold is not an input. {governanceThreshold} computes it from the Safe's live owner
+///    count, so no caller can lower it;
+///  - removal reads the member's commitment and signer from the registry, so it cannot be pointed at
+///    the wrong leaf or the wrong owner;
+///  - nothing takes arbitrary calldata, so a quorum approving `admitMember` is approving an admission
+///    and nothing else;
+///  - each operation pins the member count it was built against. A Safe evaluates a quorum at execution
+///    time, and normally relies on its nonce advancing to invalidate transactions signed against an
+///    older owner set. A module call does not advance the nonce, so {exitNetwork} can shrink the set
+///    and the threshold with it while approvals are still accumulating. Without the pin, three
+///    approvals recorded when four were required would execute once a departure made three a
+///    majority. With it, any change to the member set invalidates every transaction built against the
+///    old one.
+///
+/// What an approver has to check shrinks to the arguments of a single call.
+///
+/// Authority. Admission and removal are the Safe's alone, so both carry a majority of the members'
+/// signatures. To reach the Safe's owner-set functions, which only the Safe may call, this contract
+/// must be enabled as a Safe module: it makes the Safe call itself. That module power is why the
+/// {onlySafe} check is the most security-critical line here.
+///
+/// {exitNetwork} is the one door that does not go through the Safe, because departure should not need
+/// the consent of the members being left. It is confined by a different invariant, and the second most
+/// important line here: a caller may only ever act on the membership whose governance signer it is.
+/// The worst a stolen governance signer achieves through it is destroying that one member's own
+/// membership, which is also the worst that member could do to itself.
+///
+/// The registry and the group stay owned by the Safe, not by this contract, so the Safe keeps its own
+/// direct path to those contracts and this contract is purely additive.
+///
+/// All three addresses are immutable, so moving governance to a new Safe means deploying a new
+/// orchestrator against it, transferring the registry and the group, and enabling the new module.
+contract NetworkMemberGovernance {
+    /// @notice The smallest member set the network will shrink to. One, so the network is symmetric:
+    /// it can be founded with a single member and it can shrink back to one, rather than trapping a
+    /// shrinking set at a size it can never leave.
+    /// @dev Zero is refused because an ownerless Safe is unrecoverable: no key could ever admit a
+    /// member again, and the registry and the group would be frozen with no path back. A single
+    /// member is a bootstrap state with no fault tolerance and no check on that member, documented
+    /// in the runbook, not a size to operate at.
+    uint256 public constant MIN_MEMBERS = 1;
+
+    /// @notice The governance Safe. Its owner set is the approver set.
+    ISafeGovernance public immutable SAFE;
+
+    /// @notice The registry holding member records.
+    NetworkMemberRegistry public immutable REGISTRY;
+
+    /// @notice The contract administering the approved-member Semaphore group.
+    NetworkMemberGroup public immutable GROUP;
+
+    event NetworkMemberAdmitted(bytes32 indexed memberNetworkId, address governanceSigner, uint256 threshold);
+    event NetworkMemberRemoved(bytes32 indexed memberNetworkId, address governanceSigner, uint256 threshold);
+    event NetworkMemberExited(bytes32 indexed memberNetworkId, address governanceSigner, uint256 threshold);
+
+    error OnlyGovernanceSafe();
+    error OnlyGovernanceSigner(bytes32 memberNetworkId);
+    error ZeroAddress();
+    error NotApproved(bytes32 memberNetworkId);
+    error MemberSetTooSmall(uint256 memberCountAfter);
+    error MemberCountChanged(uint256 expected, uint256 actual);
+    error NotASafeOwner(address account);
+    error SafeCallFailed(bytes returnData);
+
+    /// @dev Restricts an operation to the governance Safe, so it always carries a majority of the
+    /// members' signatures. This contract is a Safe module, which means it can make the Safe act; this
+    /// check is what confines that power to the two operations it guards, {admitMember} and
+    /// {removeMember}. {exitNetwork} is guarded by its own invariant instead.
+    modifier onlySafe() {
+        if (msg.sender != address(SAFE)) revert OnlyGovernanceSafe();
+        _;
+    }
+
+    /// @param safe The governance Safe.
+    /// @param registry The member registry, owned by that Safe.
+    /// @param group The member group, owned by that Safe.
+    constructor(ISafeGovernance safe, NetworkMemberRegistry registry, NetworkMemberGroup group) {
+        if (address(safe) == address(0) || address(registry) == address(0) || address(group) == address(0)) {
+            revert ZeroAddress();
+        }
+
+        SAFE = safe;
+        REGISTRY = registry;
+        GROUP = group;
+    }
+
+    /// @notice The signatures a Safe of `memberCount` network members must require: a majority, one
+    /// more than half. Five members need three, eight need five.
+    /// @dev The rule, on chain and computed rather than supplied. Every operation here sets the
+    /// threshold from this function, so no caller can move it anywhere else.
+    /// @param memberCount How many members the Safe has owners for, after the operation.
+    /// @return The required number of signatures.
+    function governanceThreshold(uint256 memberCount) public pure returns (uint256) {
+        return memberCount / 2 + 1;
+    }
+
+    /// @notice The threshold the Safe will require once one more member is admitted.
+    /// @return The threshold after an admission.
+    function thresholdAfterAdmission() external view returns (uint256) {
+        return governanceThreshold(SAFE.getOwners().length + 1);
+    }
+
+    /// @notice Admits a network member: its record, its group leaf, and its seat at the Safe.
+    /// @dev One call, so a quorum cannot be talked into signing a differently shaped batch, and the
+    /// threshold comes from {governanceThreshold} rather than from the calldata.
+    /// @param memberNetworkId The member to admit.
+    /// @param semaphoreCommitment Its Semaphore identity commitment.
+    /// @param governanceSigner The address that becomes its seat at the Safe.
+    /// @param expectedMemberCount The member count this transaction was built against. Not a policy
+    /// input: the threshold is still computed, and this only makes the transaction stale the moment the
+    /// member set changes, so signatures cannot carry over to a set their signers never saw.
+    function admitMember(
+        bytes32 memberNetworkId,
+        uint256 semaphoreCommitment,
+        address governanceSigner,
+        uint256 expectedMemberCount
+    ) external onlySafe {
+        uint256 memberCount = _checkMemberCount(expectedMemberCount);
+        uint256 threshold = governanceThreshold(memberCount + 1);
+
+        _execFromSafe(
+            address(REGISTRY),
+            abi.encodeCall(
+                NetworkMemberRegistry.approveNetworkMember, (memberNetworkId, semaphoreCommitment, governanceSigner)
+            )
+        );
+        _execFromSafe(address(GROUP), abi.encodeCall(NetworkMemberGroup.addNetworkMember, (semaphoreCommitment)));
+        _execFromSafe(
+            address(SAFE), abi.encodeCall(ISafeOwnerManager.addOwnerWithThreshold, (governanceSigner, threshold))
+        );
+
+        emit NetworkMemberAdmitted(memberNetworkId, governanceSigner, threshold);
+    }
+
+    /// @notice Removes a network member from all three places.
+    /// @dev The commitment and the signer are read from the registry rather than passed in, so a
+    /// removal cannot be pointed at another member's leaf or another member's seat.
+    /// @param memberNetworkId The member to remove.
+    /// @param merkleProofSiblings The membership proof for its leaf, computed off chain against the
+    /// group state this transaction will execute in.
+    /// @param expectedMemberCount The member count this transaction was built against, for the reason
+    /// given on {admitMember}.
+    function removeMember(bytes32 memberNetworkId, uint256[] calldata merkleProofSiblings, uint256 expectedMemberCount)
+        external
+        onlySafe
+    {
+        _checkMemberCount(expectedMemberCount);
+
+        address governanceSigner = REGISTRY.governanceSignerOf(memberNetworkId);
+        if (governanceSigner == address(0)) revert NotApproved(memberNetworkId);
+
+        uint256 threshold = _withdrawMember(memberNetworkId, governanceSigner, merkleProofSiblings);
+
+        emit NetworkMemberRemoved(memberNetworkId, governanceSigner, threshold);
+    }
+
+    /// @notice Leaves the network, giving up this member's record, its group leaf and its seat.
+    /// @dev Callable by the member's own governance signer and nobody else, so a member can leave
+    /// without asking the members it is leaving. It is also how a member that is winding down avoids
+    /// leaving a dead seat behind: a seat nobody can sign for still counts toward the owner count, and
+    /// therefore toward the threshold everyone else has to reach.
+    ///
+    /// Departure is irreversible in one respect worth knowing before calling it: rejoining means a new
+    /// request and a new place in the Semaphore group, and every credential this member issued stops
+    /// verifying as soon as its record is gone.
+    /// @param memberNetworkId The member leaving, whose governance signer must be the caller.
+    /// @param merkleProofSiblings The membership proof for its leaf, computed off chain against the
+    /// group state this transaction will execute in.
+    function exitNetwork(bytes32 memberNetworkId, uint256[] calldata merkleProofSiblings) external {
+        address governanceSigner = REGISTRY.governanceSignerOf(memberNetworkId);
+        if (governanceSigner == address(0)) revert NotApproved(memberNetworkId);
+        // The invariant that confines this door: the caller acts on its own membership, never another's.
+        if (msg.sender != governanceSigner) revert OnlyGovernanceSigner(memberNetworkId);
+
+        uint256 threshold = _withdrawMember(memberNetworkId, governanceSigner, merkleProofSiblings);
+
+        emit NetworkMemberExited(memberNetworkId, governanceSigner, threshold);
+    }
+
+    /// @dev Reverts unless the Safe's owner set is still the size the caller's transaction was built
+    /// against. {exitNetwork} needs no such check: it carries no signatures to go stale.
+    /// @param expectedMemberCount The member count the transaction assumed.
+    /// @return memberCount The live member count, equal to `expectedMemberCount`.
+    function _checkMemberCount(uint256 expectedMemberCount) internal view returns (uint256 memberCount) {
+        memberCount = SAFE.getOwners().length;
+
+        if (memberCount != expectedMemberCount) revert MemberCountChanged(expectedMemberCount, memberCount);
+    }
+
+    /// @dev Takes a member out of the registry, the group and the Safe's owner set, and moves the
+    /// threshold down with the member count. Shared by {removeMember} and {exitNetwork}, which differ
+    /// only in who may ask.
+    /// @param memberNetworkId The member being withdrawn.
+    /// @param governanceSigner Its governance signer, already read from the registry.
+    /// @param merkleProofSiblings The membership proof for its leaf.
+    /// @return threshold The threshold the Safe now requires.
+    function _withdrawMember(bytes32 memberNetworkId, address governanceSigner, uint256[] calldata merkleProofSiblings)
+        internal
+        returns (uint256 threshold)
+    {
+        // Ownership first: a member whose seat is already gone should say so, rather than report
+        // whatever the floor check happens to conclude about a set it is not part of.
+        address previousOwner = _previousOwner(governanceSigner);
+
+        uint256 memberCountAfter = SAFE.getOwners().length - 1;
+        if (memberCountAfter < MIN_MEMBERS) revert MemberSetTooSmall(memberCountAfter);
+
+        uint256 semaphoreCommitment = REGISTRY.semaphoreCommitmentOf(memberNetworkId);
+        threshold = governanceThreshold(memberCountAfter);
+
+        _execFromSafe(address(REGISTRY), abi.encodeCall(NetworkMemberRegistry.removeNetworkMember, (memberNetworkId)));
+        _execFromSafe(
+            address(GROUP),
+            abi.encodeCall(NetworkMemberGroup.removeNetworkMember, (semaphoreCommitment, merkleProofSiblings))
+        );
+        _execFromSafe(
+            address(SAFE), abi.encodeCall(ISafeOwnerManager.removeOwner, (previousOwner, governanceSigner, threshold))
+        );
+    }
+
+    /// @dev The owner preceding `owner` in the Safe's owner linked list, which `removeOwner` takes.
+    /// Walked on chain so no caller has to supply it. The sentinel address precedes the first
+    /// owner.
+    /// @param owner The owner being removed.
+    function _previousOwner(address owner) internal view returns (address) {
+        address[] memory owners = SAFE.getOwners();
+
+        for (uint256 i = 0; i < owners.length; ++i) {
+            if (owners[i] == owner) return i == 0 ? address(0x1) : owners[i - 1];
+        }
+
+        revert NotASafeOwner(owner);
+    }
+
+    /// @dev Makes the Safe perform `data` against `to`, as an enabled module. The Safe returns a
+    /// failure flag instead of bubbling an inner revert, so the reason is bubbled here to keep a
+    /// failed governance operation diagnosable.
+    /// @param to The contract the Safe should call.
+    /// @param data The calldata.
+    function _execFromSafe(address to, bytes memory data) internal {
+        (bool success, bytes memory returnData) = SAFE.execTransactionFromModuleReturnData(to, 0, data, 0);
+
+        if (!success) revert SafeCallFailed(returnData);
+    }
+}