Maintainer Powers
The complete, honest list of what the site maintainer can and cannot do inside the Round Table system.
Who is the maintainer?
Current maintainer: Ylia Callan — creator of Traffic Torch, operator of the Cloudflare infrastructure, holder of the GitHub merge button, and sole person with production database access.
The maintainer role is bootstrap. There is no election mechanism yet. This is a disclosed limitation of v1. A future Meta proposal can define how the maintainer is chosen, rotated, or removed — the current maintainer commits to honoring such a proposal if passed by the community's normal threshold.
What the maintainer CAN do
- 🚀 Deploy code — push changes to production via Cloudflare Pages.
- ⚙️ Deploy the auth worker — restart or update the API on Cloudflare Workers.
- 🗄️ Access the D1 database directly — run any SQL, including UPDATE and DELETE.
- 🔀 Merge pull requests on GitHub — including PRs linked to passed code proposals.
- ✨ Add features — write and deploy new functionality.
- 🎲 Trigger the bench draw — initiate Objector's Bench sortition.
- 🔐 Rotate secrets — change JWT_SECRET, API keys, and other credentials.
What the maintainer CANNOT do (with proof)
❌ Cannot override a vote
A cast vote writes a row to rt_votes and inserts into rt_audit_chain. The maintainer could run UPDATE or DELETE SQL directly — but the chain's SHA-256 hash covers the vote's payload. Any change breaks the chain for that entry and every subsequent one. /api/rt/audit/verify would report intact: false with the exact broken row.
❌ Cannot remove a resolution from history
Every resolution writes an audit entry with prev_hash → this_hash. Deleting a resolution means deleting its chain entry, which breaks the link to the next entry. The daily external snapshots (committed to GitHub at audit-history/) record the historical chain head — so any rewrite is visible against the public record.
❌ Cannot hide a comment they don't own
Comments can only be soft-deleted by the comment's author (deleted_at set on their own entity_id). The maintainer technically could run UPDATE rt_comments SET deleted_at = ... on someone else's comment — but the delete itself would appear in the audit chain (via the author-delete path only). Maintainer direct SQL deletes are not currently chained — this is a disclosed gap and covered in "Limitations" below.
❌ Cannot change a vote tally after close
Closing a vote writes a votes_hash to rt_resolutions — a SHA-256 of the exact vote set at close. Anyone can recompute this hash from the current rt_votes and compare. If they don't match, votes have been altered since close.
Known limitations of v1
- Audit chain doesn't cover maintainer SQL writes. A direct UPDATE or DELETE on
rt_votes,rt_comments, orrt_proposalswon't create a new audit entry. It will break verification for entries that depended on the deleted content, but the SQL itself isn't logged. - Maintainer role is not elected. No formal mechanism for the community to replace the maintainer yet.
- Vote privacy: votes are public by design. This is disclosed in the FAQ — coercion risk is real, and anonymity isn't offered.
- The chain runs on our server. The daily external snapshots help detect rewrites, but they don't prevent them. Absolute trust-minimization would require the chain to live somewhere independent — future work.
Community recourse
If the maintainer goes rogue or the system is compromised:
- Fork the repo. Every line of code, database schema, and audit chain pattern is public on GitHub. A community fork can restart from the same rules.
- Verify the chain first. Run
curl https://traffic-torch-auth.traffictorch.workers.dev/api/rt/audit/verifybefore believing any accusation of tampering. - Check the historical snapshots. Compare today's
audit-history/against earlier commits. A non-monotonic chain_count is a red flag. - Propose a change. The Round Table itself is the mechanism for fixing governance problems — including maintaining the maintainer role.