security(contract): make admin cooldown and rotation time-aware and recoverable

[arisu6804]

Problem

Immediate or ambiguous admin changes create takeover risk and can strand control when a pending key is unavailable.

Objective

Deliver a production-quality improvement to administrator rotation and governance controls that creates measurable value for correctness, security, reliability, performance, or maintainability.

Implementation scope

• Implement propose/accept/cancel, cooldown, expiry, and recovery semantics with strict authority and events.

Acceptance criteria

• Acceptance is impossible before cooldown; expired proposals fail; cancellation/recovery cannot bypass active authority policy.

Required validation

• Authorization, fake-time, expiry, replay, cancellation, and event tests.
• Existing tests and CI remain passing.
• Add regression coverage for the original failure mode.
• Do not weaken, delete, or skip unrelated tests to obtain a green build.

PR quality bar

• Keep the PR focused and explain design tradeoffs, compatibility impact, and test evidence.
• Avoid typo-only, documentation-only, cosmetic-only, or unrelated refactor submissions.

Out of scope

• Broad rewrites not required by the acceptance criteria.
• Changes to unrelated services, contracts, or user flows.

[Abuqatadah]

I’d like to work on this issue because the administrator rotation flow is an important security and reliability boundary. I understand that the implementation needs to enforce a strict propose → cooldown → accept lifecycle while also handling expiry, cancellation, recovery, replay protection, and event emission without bypassing the existing authority model.

I’ll first review the current authorization and state-management logic, then implement the rotation semantics with focused regression coverage. I’ll use fake time to validate cooldown and expiry behavior and add tests covering authorization, replay, cancellation, recovery, and emitted events. I’ll also document the relevant design and compatibility tradeoffs in the PR and verify that the existing test suite and CI remain fully green.

[grantfox-oss]

🦊 GrantFox — @Abuqatadah has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #187)
2. Your PR will be reviewed by the RemitFlow maintainers

Good luck! Track your progress on GrantFox.