[ejiromowarin]

Overview

This PR extends ballast_common::access with a two-step admin transfer (propose then accept, both parties signing) and a timelocked path for rotating non-admin roles, so keeper, publisher and pauser keys can be replaced after deployment without redeploying contracts.

Related Issue

Closes #B-0004

Changes

🔐 Access Control

• [MODIFY] contracts/common/src/access.rs

  • Adds propose_admin(new) and accept_admin(); the transfer completes only when the current admin proposes and the new admin accepts.
  • Adds queue_role_change(role, addr) and execute_role_change(id) backed by timelock, so non-admin role rotations wait before taking effect.
  • Leaves the storage layout of Roles unchanged.
  • Unit tests cover propose/accept, wrong acceptor, replay, and unauthorised callers.

• [MODIFY] contracts/AUDIT_NOTES.md

  • Documents which roles rotate immediately (pauser, keeper, if the team agrees) and which wait the 48h timelock.

Verification Results

Not run in this description; run cargo test -p ballast-common to confirm the access unit tests.

Acceptance Criteria	Status
Admin transfer needs both the current admin and the new admin to sign	✅ propose_admin / accept_admin
Rotating a role other than admin is timelocked or admin-only with an event	✅ queue_role_change / execute_role_change
Unit tests in access.rs for propose/accept, wrong acceptor, replay, and unauthorised callers	✅ added in access.rs
Docs describe which roles rotate immediately and which wait 48h	✅ AUDIT_NOTES.md

Closes #4