Who decides
Governance — who decides, and what they hold
Independence is not a slogan but a structure: who decides, with what authority, and where their limit lies — published here so that anyone can hold us to it.
The structure below is the binding design of the system (actually built into the code and the permissions), but the names have not been announced yet. Before the public launch, the names of the senior administrators and their biographies will be published here — a platform that asks for your trust tells you who stands behind it.
The roles and their limits — exactly as the system holds them
Assigning roles, permanent bans, creating national referendums, and ruling on committee recommendations. Cannot: alter a sealed result (the ledger prevents that cryptographically, not administratively), read anyone’s ID number (it is never stored as text at all), delete a line from the audit log, or change its own account status from the dashboard.
Reviewing proposals within a declared deadline (7 days, which the Watch page holds us to), archiving with a stated reason, and reading the audit log. No authority over accounts or referendums — and none over the status of any staff account.
Writing the official reply to published proposals within a declared deadline (30 days). The reply is issued in the platform’s name and stays attributed to its author in the audit log.
Authority inside their own committee only: running its deliberation and raising its recommendations. It grants them nothing on the platform outside it, and every hiding decision is recorded under their name.
The constraints built into the system, not into promises
- Every administrative decision sits in an audit log that no interface can edit or delete.
- Dashboard roles are required to use two-step verification in production — a password alone opens no session.
- The permissions guard denies on absence rather than allowing: an admin route that does not declare its roles is locked, not open, and a build-time checker reports it.
- The platform holds itself to account in public: queue ages and late replies are published on Watch with the same numbers the dashboard sees.
- There is no map of "how a region voted" — for anyone, ourselves included.
- The row that holds your vote does not hold your name: in its place sits a fingerprint whose key lives outside the database, and it differs from one referendum to the next. A stolen copy of the database on its own — a backup, or a warrant demanding "the data" — cannot say who voted for what, and cannot link your stance in one referendum to your stance in another.
What is not settled yet — plainly
- The names: who the senior administrators are, and their biographies — published before the public launch.
- The legal entity: the form of registration and its country (which determines who can apply legal pressure to us — and is therefore chosen carefully, not quickly).
- The mechanism for changing this document itself: who amends the governance, and by what quorum.
The detailed moderation manual (the grey cases and how they are decided) is published in the code repository: docs/MODERATION.md — and will be shown here as soon as it is formally adopted. See also the funding ledger.