Atonement

Cosmos Hub Proposal 862 did not change IBC’s packet semantics. It asked the community pool for 8,000 ATOM so a multisignature group could cover relayer gas for three months. The proposal exposes a precise boundary: IBC can verify relayed packets, but it does not make an operator carry a route or absorb the cost of doing so (Cosmos Hub Governance 2023e; IBC 2023).

This article asks when a sovereignty-first architecture makes surrounding institutions load-bearing. Institutional completion names a trace with four parts: a formal design boundary, a function required for a specified service, an identifiable carrier outside that boundary, and a public support, monitoring, repair, or redesign event.

Across the selected episodes, route operation, disclosure, security review, and organizational work sat outside the layer that formalizes chain sovereignty. Public actors addressed that work through fee grants, reports, audits, software releases, and constitutional proposals. AtomOne sharpens the distinction: its constitution authorized Steering and Oversight DAOs, while the ratified text said that neither existed at genesis (AtomOne 2024). On July 15, 2026, Proposal 21 was still in its voting period and the responding node reported v3.3.0 rather than v4 (AtomOne Governance 2026; AtomOne Node API 2026).

The analysis follows each function from protocol promise to operating carrier, distinguishing written authority, deployed authority, and observed operation.

Keywords: Cosmos, IBC, relayers, institutional completion, AtomOne, Interchain Security, liquid staking, blockchain governance, infrastructure maintenance.

On December 13, 2023, Cosmos Hub Proposal 862 entered governance. Its text named six relayer teams, specified a three-of-five multisignature account, requested 8,000 ATOM, and described the support as a three-month response to higher gas fees. The proposal passed (Cosmos Hub Governance 2023e). Nothing in that vote made relayers part of Hub consensus. It financed an operating condition that IBC assumes but does not itself supply (IBC 2023).

That is the problem examined here. Cosmos makes a strong constitutional commitment to sovereign chains and a strong technical commitment to verified interoperation (Kwon and Buchman 2016; IBC 2023). Neither commitment implies institutional emptiness. A route still needs a live process to observe two chains, submit transactions, pay fees, update clients, and respond when the path fails. A foundation report still depends on an organization deciding what to disclose. An on-chain upgrade vote still depends on information about the code being voted on. A constitution can authorize an oversight body without staffing it or giving its powers to a deployed module.

The paper advances a conditional claim:

The verbs matter. The architecture may create that condition, though it does not necessarily cause the later dispute. A gas increase, a maintenance decision, a leadership transition, a disclosure failure, market conditions, or a political conflict may supply the immediate cause. Architecture contributes by locating jurisdiction and repair: who can act, through which surface, with what authority, and under which limits.

The conditional claim can be evaluated through three questions about function, evidence, and institutional status.

Institutional completion is used once, for that trace. It is not a synonym for all maintenance, public goods, informal politics, or organizational failure. A case enters the concept only if the formal boundary, service-specific function, external carrier, and public repair surface can all be named.

This is a theory-developing, single-case process trace (George and Bennett 2005; Gerring 2007). The selected episodes expose a function’s carrier through an on-chain funding request, disclosure demand, security response, software migration, or constitutional proposal.

Governance records establish proposal status and sequence. Source and release records establish available design and implementation, live chain state establishes deployed conditions, and actor-authored records establish what organizations publicly represented. Interested-party allegations remain allegations. The sample locates institutional work in the selected episodes rather than estimating its frequency across Cosmos.

ICS-18 defines the relayer algorithms that move IBC datagrams. The specification describes relayers as the physical connection layer and states the liveness expectation in terms of a correct, live relayer eventually relaying packets. The chains verify what arrives, while operator appointment, route monitoring, and transaction funding remain outside the specification (IBC 2023).

Operator records show how that boundary appears in practice. Polkachu’s gm-ibc README says each relayer maintains its own infrastructure and warns that broken channels can persist before anyone notices (Polkachu 2025). On May 17, 2026, Polkachu’s public inventory listed 37 hubs and 412 channels (Polkachu 2026). That number describes one operator’s displayed footprint on one date rather than the relayer market as a whole.

Two governance records expose different forms of support.

These two records establish documented instances of communities financing gas and service commitments outside the packet-verification protocol. Evaluating prevalence, typicality, and cost allocation would require a broader sample capable of distinguishing burdens borne by users, token holders, validators, and operators.

The inference is correspondingly narrow. For a chosen IBC path, interoperability depends on an operating carrier whose costs and service rules are not fully supplied by ICS-18. Governance can add support after the fact. Whether that arrangement is efficient, recurrent, or concentrated requires route-level traffic, gas, funding, outage, and ownership data beyond this study.

ICS-29 is the direct technical rival. Its opt-in fee middleware allowed a packet fee to be escrowed and distributed to relayer addresses. Any party could supply asynchronous payment, including a module account or community pool. The ibc-go changelog records removal of the middleware in v10 (IBC-Go 2026a; IBC-Go 2026b). The mechanism shows that protocol-adjacent software can internalize relayer financing. Operator appointment, route coverage, and adoption remain separate questions. The selected records establish that named functions were supplied outside the protocol boundary without estimating their prevalence or architectural cause.

The ICF sequence begins before the LSM controversy and should not be collapsed into it.

On April 1, 2023, Proposal 787 entered voting with a formal request for fuller ICF financial transparency, and it passed on April 15 (Cosmos Hub Governance 2023a). Actor-authored ICF pages state that Ethan Buchman would transition the presidency to Brian Crain on August 18, 2023, name transparency and funding effectiveness as priorities, and announce Managing Director Maria Gomez’s departure and an interim management period on July 2, 2024 (Interchain Foundation 2023; Interchain Foundation 2024a).

The ICF annual-report page dated August 15, 2024 describes the report as later than the previous year’s, attributes the delay to leadership changes, and promises improvements in institutional communication (Interchain Foundation 2024b). Proposal 952 entered voting eight days later, declared no confidence in ICF leadership, and requested individual annual reports for 2017 through 2023 within 60 days. It passed on September 6 (Cosmos Hub Governance 2024). The ICF snapshot page dated September 2 identifies itself as the first monthly treasury snapshot, covering August 2024, while Proposal 952 was still voting (Interchain Foundation 2024c).

That observed order forecloses a convenient story if the live ICF publication dates are accurate. The annual report predates Proposal 952’s filing, and the first snapshot predates its passage (Interchain Foundation 2024b; Interchain Foundation 2024c; Cosmos Hub Governance 2024). Proposal 952 itself contains allegations about duty, conflicts, governance, and financial management. A signaling vote is not an adjudication of those allegations.

The firmer finding is institutional. Hub governance repeatedly made disclosure and confidence into public objects (Cosmos Hub Governance 2023a; Cosmos Hub Governance 2024). Foundation materials describe leadership transitions, delayed reporting, and a communications reset (Interchain Foundation 2023; Interchain Foundation 2024a; Interchain Foundation 2024b; Interchain Foundation 2024c). The proposal text supplied no enforcement mechanism by which a signaling vote would compel a separate foundation to produce a specified report. The architecture identifies a voice surface, while disclosure depends on an institution outside that surface.

The dated record orders this episode: authorization first, then dispute, audit, and repair.

Proposal 790 entered voting on April 19, 2023 and passed on May 3. It signaled support for the Liquid Staking Module. Proposal 821 entered voting on August 25 and passed on September 8, specifying the v12 upgrade plan and height (Cosmos Hub Governance 2023b; Cosmos Hub Governance 2023c). Those records establish authorization and intended upgrade content, not execution by themselves.

On October 15, 2024, All in Bits (AiB) published an interested-party account alleging that developers later linked to the DPRK had written substantial portions of the earlier code and that material provenance and security information had not entered the 2023 governance process. The document includes repository links, an Oak Security assessment, screenshots, and a chronology. It also uses accusatory legal and technical language, which this paper treats as claims by an interested party (AiB 2024).

A week later, an Informal Systems maintainer wrote that the current understanding was that North Korean agents had contributed significantly, described the implementation as deeply integrated and costly to maintain, announced two audits, and proposed replacing the architecture (Poffenberger 2024). That record corroborates the existence of a serious provenance and maintenance concern while leaving each organization’s knowledge in April and August 2023 unresolved.

The repair record materially changes the interpretation. Zellic’s public LSM assessment lists one high- and one low-severity finding, with no critical finding (Zellic 2024). Gaia v22.0.0 incorporated fixes identified by OtterSec and Zellic and states that none was critical (Gaia 2025a). Proposal 1000 then passed with a v24 plan that described migration into a refactored x/liquid module, and the v24 release contains that module (Cosmos Hub Governance 2025; Gaia 2025b). On July 15, 2026, a responding Hub node reported Gaia v27.5.0 and the module-specific x/liquid parameter endpoint returned live state (Cosmos Hub Node API 2026; Cosmos Hub Liquid API 2026). The functionality remained; the implementation and maintenance boundary changed.

A June 16, 2025 Cosmos incident report supplies additional counter-evidence about a different contributor. It concerns the account cool-develope and contributions to cosmos-sdk, iavl, and cosmos-db under earlier maintainers. Later review found no active vulnerabilities or malicious code attributable to that actor and records access revocation, credential rotation, binary review, and permission hardening (Cosmos Incidents 2025). It neither confirms nor resolves the separate LSM authorship and disclosure allegations.

The record fixes two observations and excludes one inference.

The institutional point concerns information produced around an upgrade vote. The vote supplied authorization. Contributor verification, audit coverage, disclosure, and maintenance judgment came through organizations around it. Later repair demonstrates capacity to respond while leaving the earlier process’s completeness and the strongest allegations unresolved.

Interchain Security formalized attachment more strongly than ordinary IBC. Consumer chains could borrow validator security from the Hub, and the provider module specified lifecycle and validator obligations (Allen, Berg, and Davidson 2023; Cosmos Hub Team 2026). This is exactly the kind of design that could absorb some dependence into a common regime.

Its later contraction is informative but not dispositive. The February 2026 deprecation notice attributed the change to low demand, limited revenue, validator costs, incident-response work, and technical debt (Cosmos Hub Team 2026). Those are the Hub team’s stated reasons, not independently estimated effects in this paper. Gaia v27 removed the consumer-creation path, and a July 15 responding node reported v27.5.0 (Gaia 2026; Cosmos Hub Node API 2026). At the same height, the provider API returned comdex-1 and elys-1 as the two launched chains, and phase-two module removal had not occurred (Cosmos Hub Provider API 2026).

The rival case changes the theory in an important way. Formalization changes the bundle and location of dependence. Shared security can internalize validator attachment while adding software, coordination, and incident-response obligations. Sovereign IBC leaves security separate while relying on route operators and counterpart governance. The empirical question is which bundle a service carries, not whether one architecture has institutions and the other does not.

AtomOne is often made to carry too much explanatory weight. Its primary record supports a narrower comparison.

The fork’s documented origin is Cosmos Hub Proposal 848, not the October 2024 LSM disclosure or the August 2024 ICF no-confidence proposal. The governance record fixes Proposal 848’s voting close at November 25, 2023 (Cosmos Hub Governance 2023d). GovGen’s own account says it distributed its non-transferable governance token from a snapshot of accounts that voted NO or NO_WITH_VETO, and that it launched in February 2024 to develop the proposed chain’s constitution (GovGen 2024). Later controversies may have reinforced its security and oversight rhetoric, but their dates show that they did not initiate the branch.

AtomOne Proposal 2 submitted the constitution for ratification in December 2024. Voting ended on January 6, 2025, and the proposal passed. The ratified text specifies a minimum three-week voting period, a constitutional majority above 90 percent, conflict declarations, a Steering DAO, Oversight DAOs, and special-purpose DAOs (AtomOne Governance 2025; AtomOne 2024).

The same text supplies its own limit. It says there would be no Steering DAO and no Oversight DAO at genesis. It identifies BUIDLDAO as the sole genesis special-purpose DAO but says that it would initially have no council members (AtomOne 2024). Ratification therefore authorized an institutional architecture. It did not prove that the offices were staffed or that their powers were exercisable on-chain.

The distinction remained live in July 2026. AtomOne v4.0.0 source contained an x/coredaos module intended to translate endorsement, annotation, voting-period extension, and constitutional-veto powers into code (AtomOne 2026). Proposal 21 opened voting on June 25, 2026 and was scheduled to close on July 16. On July 15 it remained in the voting period, and the responding node reported v3.3.0 (AtomOne Governance 2026; AtomOne Node API 2026). The v4 source describes an implementation proposed for deployment; the observed v3.3.0 node did not yet expose it as operating authority.

AtomOne can therefore serve as a design-level counterpoint. Its authors tried to specify monitoring, amendment, and oversight more explicitly than the Cosmos Hub record examined here. Whether those provisions change behavior requires later evidence: deployment, appointments, budgets, proposals, vetoes, conflicts, response times, and contested decisions. AtomOne should not be treated as an already completed falsification test. Until operational evidence exists, it is a constitution before it is a comparative outcome.

The five episodes reveal a recurrent analytical boundary rather than one uninterrupted causal chain.

The causal linkage also has to be stated carefully. Architecture explains the first column and helps locate the second. It does not, by itself, explain every event in the fourth. That separation sets the inference boundary.

The evidence is strongest for functional dependence: a path needs a relayer, an audit needs an auditor, and an authorized office needs an operator. It is moderate for burden allocation, where public proposals and releases identify particular carriers and interventions. Aggregate incidence and behavioral response remain unmeasured, since the study lacks an ecosystem-wide cost estimate, a causal estimate of sovereignty’s effect, and participant-level choice comparisons.

The result is a bounded institutional claim. Sovereignty-first design can make surrounding actors load-bearing when a specified service crosses the protocol boundary without an internal carrier or rule. Stress then reveals the carrier through a funding request, disclosure demand, audit, migration, or constitutional proposal. The concept fails if the function was not required for the named service, if the strongest formal layer already supplied it, or if the alleged carrier cannot be tied to an observed intervention.

Every result reported here is bounded to five selected Cosmos episodes and to public sources as they stood when each was read: Polkachu’s public inventory on May 17, 2026, and chain state on July 15, 2026. The design is a theory-developing, single-case process trace, and each episode entered because a funding request, disclosure demand, security response, software migration, or constitutional proposal made a carrier visible. Frequency across Cosmos, typicality, and cost allocation among users, token holders, validators, and operators fall outside that sample.

Written authority, deployed authority, and observed operation stay separate, and no finding crosses them. AtomOne’s ratified constitution authorized Steering and Oversight DAOs while the same text said neither existed at genesis, which fixes written authority alone. AtomOne v4.0.0 source contains an x/coredaos module, an implementation proposed for deployment. The node that responded on July 15, 2026 reported v3.3.0 and did not yet expose that module as operating authority. Gaia runs the same way: Proposal 1000 authorized the v24 plan, the v24 release contains the refactored module, and the July 15 query of the x/liquid parameter endpoint reports deployed state.

Claim strength varies by domain. Functional dependence carries the strongest support. Burden allocation is moderate, resting on the particular carriers and interventions that public proposals and releases identify. Aggregate incidence and behavioral response remain unmeasured. Route-level traffic, gas, funding, outage, and ownership data lie outside the study, as do an ecosystem-wide cost estimate, a causal estimate of sovereignty’s effect, and participant-level choice comparisons. The behavioral vocabulary is bounded the same way: cost, frequency, relative attractiveness, and loyalty go unestimated, and no exit-over-voice claim is made.

Other limits belong to the episodes themselves rather than to the sample around them. Proposal 952’s allegations about duty, conflicts, governance, and financial management remain allegations, since a signaling vote adjudicates nothing. What each organization knew in April and August 2023 about the LSM’s contributor provenance stays unresolved, together with the completeness of the 2023 governance process and the strongest allegations in that dispute. The Hub team’s stated reasons for deprecating Interchain Security are that team’s account rather than effects independently estimated here, which keeps general conclusions about shared security’s workability and sovereignty’s comparative cost outside the case. The ICF sequence finding carries a condition of its own: it holds if the live publication dates are accurate.

The affirmative claim is conditional: when an architecture formalizes a capability more strongly than it assigns, finances, or monitors a function required to operate that capability, identifiable actors outside the strongest formal layer may become load-bearing, and the five episodes trace that condition to named carriers and public repair surfaces. Two of the observations below would defeat the claim where this article applies it: the first by showing that the specification itself assigns the function, the second by showing that protocol-adjacent software already supplied its financing on the financed routes. Three would defeat findings reported in named sections and leave the conditional standing. Each names an artifact a reader could retrieve. Where the record here does not contain that artifact, the entry says so.

Each condition turns on a specification file, a proposal text, a route-level adoption record, a publication date, or a node response rather than on a forecast. That keeps refutation separate from the broader sample that evaluating prevalence, typicality, and cost allocation would require.

Cosmos formalizes sovereign construction, verified communication, and on-chain voting. Around those capabilities remain functions that must be carried by someone: operating a route, financing gas, producing a report, checking provenance, auditing code, maintaining an attachment, or staffing an office. Public stress makes the carrier visible, and every episode traced here entered the record through one such moment: a funding request, a disclosure demand, an audit, a migration, or a constitutional proposal.

Sovereignty does not necessarily create those burdens, and stronger integration does not eliminate them. Architecture changes their location, their bundle, and the surface through which repair can occur. That is the bounded meaning of institutional completion in this case.

The code can decide who may act. It cannot, by itself, make anyone show up, disclose what they know, pay for the route, or sustain the office that the rule has authorized.