[Governance 1/4] Introduce pallet-multi-collective

[l0r1s]

Summary

Part of #2804.

Adds pallet-multi-collective, a generic membership pallet for storing multiple named collectives under a runtime-defined CollectiveId.

This is a building block for governance membership only. It does not add voting, proposing, or runtime governance behavior by itself.

What Changed

• Added pallet-multi-collective.
• Added configurable collective definitions with name, min members, max members, and optional term duration.
• Added membership extrinsics: add_member, remove_member, swap_member, set_members, and force_rotate.
• Added OnMembersChanged and term-rotation hooks for downstream consumers.
• Added integrity checks for invalid collective configuration.
• Added benchmarks, generated weights, README documentation, mock runtime support, and unit tests.

Detailed Reference

See pallets/multi-collective/README.md for the full design reference. It covers the membership storage model, extrinsic behavior, origin configuration, member-change hooks, rotating terms, integrity checks, migration notes, and an example runtime configuration.

Reviewers may want to focus on the boundary behavior: swap_member preserves member count atomically, set_members rejects duplicate input instead of silently deduplicating, and rotating collectives keep their previous membership if the runtime-supplied rotation cannot satisfy the configured minimum size.

Behavioral Impact

No live runtime behavior changes in this PR. The pallet is added to the codebase but is not wired into the Subtensor runtime until the governance wiring PR.

Migration / Spec Version

The pallet defines storage, but this PR does not add it to the runtime. No live storage migration or spec-version bump is required here.

Testing

Suggested local verification:

cargo test -p pallet-multi-collective

[github-actions]

🛡️ AI Review — Skeptic (security review)

VERDICT: SAFE

BASELINE scrutiny: l0r1s has write permission, an older account, substantial prefetched contribution history, no Gittensor allowlist hit, and matching in-PR authorship; branch governance-multi-collective -> governance-umbrella.

Static-only Skeptic review of the prefetched diff found no .github/ai-review/* or .github/copilot-instructions.md modifications. The current diff is scoped to adding pallet-multi-collective, wiring workspace metadata, and tests/weights; origin checks are present on the new extrinsics, membership storage is bounded, and the previously flagged crowdloan/workflow lines are no longer part of this PR diff after the branch/base update.

Findings

No findings.

Prior-comment reconciliation

• 0b7f7e3e: no longer applies — The updated PR diff no longer includes pallets/crowdloan/src/lib.rs, so this prior crowdloan finalization concern is not part of the current PR review surface.
• 8791a1e8: no longer applies — The updated PR diff no longer includes .github/workflows/try-runtime.yml, so this prior self-hosted runner/local-action concern is not part of the current PR review surface.

Conclusion

No malicious pattern or security vulnerability was identified in the current PR diff. Prior findings no longer apply to this review because the files they referenced are absent from the updated diff.

---

📜 Previous run (superseded)

Sev	File	Finding	Status
HIGH	pallets/crowdloan/src/lib.rs:629	Failing finalize can permanently lock crowdloan finalization	⏭️ No longer applies The updated PR diff no longer includes pallets/crowdloan/src/lib.rs, so this prior crowdloan finalization concern is not part of the current PR review surface.
MEDIUM	.github/workflows/try-runtime.yml:33	pull_request workflow loads a PR-mutable local action on self-hosted runners	⏭️ No longer applies The updated PR diff no longer includes .github/workflows/try-runtime.yml, so this prior self-hosted runner/local-action concern is not part of the current PR review surface.

---

🔍 AI Review — Auditor (domain review)

VERDICT: 👍

Gittensor UNKNOWN; author has repo write permission and substantial prior Subtensor contribution history, so review is calibrated as established contributor work.

No blocking domain findings from static review. This PR introduces a standalone pallet-multi-collective and shared OnMembersChanged trait support without wiring the pallet into the live runtime, so no spec-version bump is required for this branch.

The overlapping PRs are expected stacked governance/workspace work rather than better duplicate implementations of this pallet. One PR-body cleanup remains: the Detailed Reference link text names pallets/multi-collective/README.md, but the URL currently points at pallets/signed-voting/README.md.

Findings

No findings.

Conclusion

Approve on domain review: the new membership extrinsics have explicit origins, bounded storage, generated weights, integrity/try-state checks, and broad unit coverage for sorted membership, bounds, hooks, and rotation behavior. I did not run tests because no finding required runtime confirmation.

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

🔄 AI review updated — Skeptic: VULNERABLE

[github-actions]

AI review — see the sticky summary comment for the verdict and the inline comments below for specific findings.

[github-actions]

🔄 AI review updated — Skeptic: VULNERABLE

[github-actions]

🔄 AI review updated — Skeptic: SAFE Auditor: 👍

[UnArbosFour]

How large are member vectors anticipated to be? For small vectors simple iteration is often more efficient than binary search.

[l0r1s]

How large are member vectors anticipated to be? For small vectors simple iteration is often more efficient than binary search.

Biggest collective will be 64 in the initial wiring but we may quickly add new collectives of unknown size. I preferred binary search here instead of linear search to make the pallet future proof even though we have a relatively small overhead for small collectives.