simplify-governance

[lehnberg]

Rendered text

---

Summary

This governance iteration replaces the previous process that was set out in RFC#0002 with a simplified and better defined version. Specifically it:

• defines its remit to be around the repos, projects, and communities that are centered around the /mimblewimble GitHub organization;
• reverts the core team to the original technocratic council structure, whose sole responsibility is managing the general fund; and
• explicitly enables individual contributors and teams to self-organize for other aspects of decision making.

---

joint work with @Paouky

[lehnberg]

Assigned @quentinlesceller as shepherd

[quentinlesceller]

Two minor comments below:

[quentinlesceller]

In line with our governance process, this RFC can be considered being in Final Comment Period, with a disposition to merge in two weeks time, on October 13.

Please ensure any comments are made before then!

[MCM-Mike]

We we should use the pull-request for comments I would suggest the following changes to the proposed RFC

Under section Community-level explanation -> Teams sub section -> Other teams to strike out (delete) the "security team"

Why?
Based on my understanding is the security team should not be a self manged team without any core members being part of it. This could have some serious security implications, like in the following example, when we receive a disclosure let say for our CLI Grin-Wallet . At least one core-team member should be informed as well, if there is a serious thread to GRIN.

I do know the team is managed by John, a responsible and hopefully long-term trustworthy person, but I would suggest this security team has at least one core-member who will be informed at any times there is an security issue with GRIN.

This suggestion is again a more centralized approach, but sometimes in IT-Security it is needed to keep GRIN safe.

[DavidBurkett]

@MCM-Mike The assumption you're making is that only council members can be trusted (P.S. there is no "core"). There's no reason to think that the contributors that do the most, and are the most trusted, will even be on the council. The council only exists to deal with funding, nothing else. To require them to be involved with security makes no sense. That's like requiring the finance department at a corporation to be involved with IT security.

[DavidBurkett]

This looks great. Thanks for putting this together @Paouky and @lehnberg

[lehnberg]

@MCM-Mike yes, just to add to what @DavidBurkett writes above:

• there would be no core team if this RFC gets merged.
• the security team is already self-managed. It currently consists of myself and @j01tz (so you have two existing core team members, or 100% of the team constituting of core members at the moment), and we run our own show without the involvement of others. This would continue.

[quentinlesceller]

🎉 Wohooo! This RFC has now been merged!

[lehnberg]

Goodbye, Core team. 👋
Hello council, nice to see you again. 😎