This file lists the currently authorised maintainers of the prometheus-project repository. At least two maintainer DIDs from different organisations have to co-sign the following federation artefacts before they take effect (concept/ADR-v2-0001, ADR-v2-0006):
mirrors.jsonin theprometheus-federationrepositoryalias-table.jsonin theprometheus-federationrepository (ADR-v2-0008)- Release tags of the form
proto-vX.Y.Z(dev-docs/adr-dev/ADR-DEV-0003) - Schema major bumps (
submission.vN.json)
Active maintainers#
| Handle | Organisation | DID (did:key:z…) | Role |
|---|---|---|---|
mortisnexus | (initial bootstrap — organisation not yet determined) | did:key:z<TODO-bootstrap-key> | Tech lead, proto maintainer |
<TODO-co-maintainer> | (TODO — a second organisation is mandatory) | did:key:z<TODO-second-key> | Co-signer duty for federation artefacts |
Stop criterion for the federation launch: for as long as only one maintainer DID is listed, mirrors.json is to be formally marked with bootstrap_single_sig: true (ADR-v2-0006), and Open Data consumers may warn about it. The second co-signer has to be found before the first production mirror launch (concept/06-offene-punkte.md P1-6, bootstrap funding + multi-org binding) — suggestions are welcome as an issue in the repository.
Generating a DID (for new maintainers)#
A maintainer DID is generated once per person; the private key never leaves the maintainer's host:
cd src/proto/crypto-py
. .venv/bin/activate
python3 -c "
from prometheus_proto import didkey, ed25519
priv, pub = ed25519.generate_keypair()
print('private (hex, KEEP SECRET):', priv.hex())
print('public (hex): ', pub.hex())
print('did:key: ', didkey.public_to_did(pub))
"Put the private value into a file under ~/.config/prometheus/maintainer-keys/ with chmod 600; do not store it in the repository (that is exactly what .secure/ is for in local clones — and .secure/ is gitignored, see .gitignore).
Roles & responsibilities#
| Role | Responsibility |
|---|---|
| Tech lead | Schema drift, ADR review, maintaining the sprint INDEX, final architecture decisions |
| Co-signer | Multi-sig on federation artefacts (see above), an independent reality check on critical ADRs |
| Sprint owner | One owner note in the sprint header per sprint (see sprints/); the owner may delegate but stays responsible until sign-off |
| Privacy lead | Watches over the k-anon constraints and the D-2-1 re-identification risks (concept/03-risikoprofil.md), decides on the DP noise parameters from phase 2 |
| Mirror operator liaison | The interface to mirror operators, owner of the mirrors.json updates and of the terms-of-service template versions |
Joining / leaving#
New maintainers are proposed by a pull request against this file, with the following in place at the time the PR is merged:
- The PR body contains the new DID, handle, organisation and the role being asked for.
- Two existing maintainers co-sign the merge (via git PGP or an ed25519 detached signature over the commit hash, with the result filed under
.maintainers/— the directory layout is to be fixed in a futureADR-DEV-0004). - Within 14 days, one successful co-sign on the next federation artefact (evidence of the ability to do a reality check).
Departures follow the same path — a PR + co-sign + a public audit log entry (Sigstore Rekor).