07 — Contribute
What is needed — collaboration, not capital.
Prometheus deliberately has no central operator and no tenant market. There is nothing to invest in. Six concrete contributions are needed.
Concrete contributions
Six ways to advance the project.
Mirror hosting in the EU
For the Phase 1 pilot period — foundation sponsorship, university data center, or OSS foundation. Requirements: 1 vCPU, 8 GB RAM, 500 GB SSD, ClickHouse-capable, publicly accessible via HTTPS. EU hosting is preferred; other regions are allowed, but then the GDPR responsibility lies with the operator.
Pilot library
A popular JS or Python package whose maintainers are willing to integrate the SDK in a pre-release version and make the Phase 1 telemetry publicly available. This is the most honest test of the entire approach.
Research partner
University or OSS analytics group that tests the K6 acceptance test: Can a researcher answer the reach-doubling question in under two minutes from the Open Data dump? If not, the data format is not suitable.
Open Data license legal clearance
CC-BY-4.0 is resolved, and Phase 1 snapshots already appear under it — with a Provisional clause in the manifest. The final Foundation legal clearance is sought. If it is rejected, the published snapshot remains valid and a re-issue follows under a new snapshot ID.
Anti-Sybil threshold calibration
The mechanism is in place: rate limit per DID, cross-mode plausibility, and burn-in — Proof-of-Work was deliberately rejected. Empirical data is needed on the threshold values: Is the factor of 10 between Track A and Track D appropriate, does the spike flag work in practice, is the 7-day period useful?
Security disclosure
Re-identification demos are explicitly welcome — via the path in
SECURITY.md, with a 90-day deadline. Anyone who shows that
k-anonymity breaks helps the project more than any approval.
Where to go with what
The right channel for each concern.
| Concern | Path |
|---|---|
| Bug or feature | Issue in the repository, preferably with a label |
| Security vulnerability | Path in SECURITY.md — not the issue tracker |
| Re-identification demo | Also SECURITY.md, with 90 days disclosure period |
| Concept question | Issue with label concept |
| Mirror onboarding | Issue with label federation and mirror DID proposal |
| Become a maintainer | Pull request against MAINTAINERS.md, two existing maintainers co-sign |
Demarcation
What Prometheus explicitly is not.
So that no one invests time in a wrong expectation.