Move Timelock Module

The problem

Multisig controls who can act, but not when. Without a delay between proposal and execution, a bad or compromised action goes through as soon as it has enough signatures, and nobody gets a chance to catch it first.

What I did

• Built the timelock as a resource account owning its own SignerCapability: creators propose, executors execute once a minimum delay has elapsed, and neither role is granted implicitly to the deployer.
• Committed only the script hash on-chain at proposal time, keyed by salt so the same script can be queued more than once. The bytecode is supplied at execution and checked against the commitment.
• Mirrored the existing governance script-resolution model rather than adding VM prologue support, so the module lands without touching the transaction pipeline.
• Made execution atomic. If the resolution script aborts, the executed flag rolls back and the proposal stays live rather than being burned.
• Included self-governance, so the timelock’s own configuration can only be changed through the timelock.

Stack