> For AI agents: the documentation index is at https://docs.nimbusprivacy.xyz/llms.txt, and every page is available as Markdown at its URL with .md appended.

# Robinhood membership changes (/guardians/robinhood-membership)

A Robinhood guardian node's controller can open and complete its own departure without the cluster leader's approval. The cluster must be activated and unfrozen, the node must hold a committee seat, and no other membership ceremony may already be running.

## Completing a departure

When a controller opens its own removal, the registry records that the ceremony belongs to the controller role. The node's current controller can then complete that removal without a leader proposal. Another caller can complete it only with the leader's matured removal proposal. A removal opened through cluster governance still requires that proposal, including when the target node's controller completes it.

For example, Alice controls a seated node and Bob leads its cluster. Alice opens her own removal and then completes it. Bob does not need to submit a proposal or send a transaction. If Carol tries to complete Alice's removal, Carol needs Bob's matured proposal.

Completion still requires an unfrozen cluster and the matching removal ceremony. Removing a founding member before cluster activation always requires a matured proposal.

## Cancelling a departure

The node's current controller can immediately cancel a removal it opened itself, keeping its seat. The leader and other callers must wait until the configured ceremony timeout has elapsed before cancelling that departure. For a ceremony opened through governance, the current leader retains immediate cancellation authority.

In the example above, Alice can withdraw her departure immediately. Bob can clear it only after the timeout if Alice leaves it unfinished. If Alice rotates her controller key, the replacement controller holds these permissions.

The registry clears the controller-origin marker when a removal completes or a ceremony is cancelled. Opening a ceremony through governance resets it, so a later governance ceremony does not inherit a controller's permissions.

## Attestations belong to a node

A Robinhood boot or key rotation document binds the cluster and node identifiers, the enclave identity key and the committee signing address. Two records that share a controller still need documents for their own identities. An authorised controller rotation preserves the node's identity, so the replacement controller can record and use a document issued for that node.

For example, Alice controls nodes 7 and 8 in one registry cluster. A document for node 7 cannot boot node 8, even if Alice supplies the same enclave key and signing address. It also cannot boot node 7 in another cluster. This binding distinguishes records within the registry; chain and registry address domain separation is unchanged.

The enclave's Robinhood identity is configured independently of its Solana node identifier and its share index. Both Robinhood identifiers must be supplied together and must be nonzero. A node without that configuration issues its Solana registration bundle without a Robinhood registration document.

## Coordinating a format upgrade

The guardian registry and the enclave producer must use the same attestation format. Controller-bound documents from the earlier format cannot boot or rotate a node under this format. Deploy the matching producer image and configure its registry identity before issuing replacement guardian documents, and update the approved measurement and the node's manifest pin for that image.

Upgrade the registry with the pool and services built against its interface version. The existing interface-version checks refuse a guardian registry from another version.


Last updated 15 October 2026