I want to add my 2c here as well. I agree with @sprucetree — I think we’re approaching this all wrong.
Let’s rewind and ask: what is a core contributor? This is someone who regularly pushes code, investigates issues, opens new issues, fixes them, and reviews code. And now the crucial thing: what stops anybody from being one? Nothing.
Right now any person can open a pull request, file a new issue, leave a code review, etc. And this is 99.9% of the work to keep Tari functional.
I firmly believe in least required privilege. It’s a security thing. As one of the oldest devs on Tari, I don’t even have view rights on all the code — why? Because I don’t need it.
Look at what happened with OpenSSH and the XZ Utils supply-chain attack (tracked as [CVE-2024-3094]). We don’t need any risk like that. We can have core contributors with zero rights.
We need two security roles: someone with admin rights on the org, and someone with merge rights on the repos. These shouldn’t be gated behind some arbitrary length of public visibility. They should only be granted by the Council, on an invite-only basis, and only when needed.
You could be a superstar dev in the community — push a lot of code, be very active and busy. Even so, Tari doesn’t have to promote you to merge rights if they aren’t required. You still get all the brownie points from having your name in the release notes.