Who decides what, and how

The honest summary: TOVIO is currently governed as a single-maintainer project, and says so in writing rather than implying a committee that does not exist. If you are evaluating the project, that is a real concentration risk and you should price it as one — the mitigations below are structural, not reassurances.

Today

A benevolent-dictator model, with one project lead holding final say on technical direction, the contents of the specification, and what ships. The stated reason is stage rather than preference: a single coherent vision moves faster than a committee while the architecture is still being laid down.

Three commitments narrow what that authority covers. The lead decides by consensus where one exists and exercises a tie-breaking veto only where it does not; every cross-cutting decision is recorded as a public decision record with its rationale, so choices can be understood and challenged rather than re-litigated; and the lead does not override the specification-versioning policy or the security-disclosure commitments for expedience. Those two are explicitly out of reach of a single decision-maker's convenience.

The announced path

The model is described as a starting point rather than a destination, with three steps, each announced publicly and recorded as a decision record:

1. Maintainers. Sustained contributors are granted merge rights over specific areas, review and merge within them, and share responsibility for the integration gates.
2. A steering group. Once a stable group of maintainers exists, a small steering group takes over cross-cutting decisions — roadmap, decision-record acceptance, specification promotion — with the lead's role becoming tie-breaker of last resort.
3. A neutral home, if warranted. If adoption merits it, governance may move to a neutral foundation. That transition would itself be a decision record.

Trademark stewardship follows governance: the marks are held by the copyright holder today and move to whatever neutral body assumes governance later.

What governance covers besides who merges

• Specification promotion. A specification moves Draft to Review to Stable only deliberately, and Stable carries two hard preconditions — the independent cryptographic audit for the format and crypto surfaces, and a conformance corpus the reference implementation passes completely.
• Breaking-change announcement. The four required steps, and the rule that a Stable contract is not broken faster than the policy allows even to fix a wart.
• The telemetry commitment. Telemetry is off by default and strictly opt-in, and repository content, paths, diffs, identities, keys, and secrets are never transmitted under any setting. This is stated as a non-negotiable design commitment rather than a configurable default, and any change to what would be collected is itself a decision record and a release-note item.
• Amendment. Material changes to the governance model, the versioning policy, or the telemetry commitments are made by decision record and announced in the release notes, under the same transparency rules they describe.

Community conduct

The project uses the Contributor Covenant, with enforcement reports to conduct@tovio.dev, reviewed with the reporter's privacy respected. It covers every project space the project operates: repositories and their reviews and discussions, the feedback portal and boards, the documentation site, named chat or mailing lists, and project events. A suspected vulnerability is never a conduct report and never belongs in a community space.

Reading this as an evaluator

Ask what happens if the single maintainer stops. The structural answers are the Apache-2.0 licence on the engine, the open specification and conformance corpus, and a complete local clone — see the article on what happens if the project stops. The governance document is where you check whether the promises above have moved since you last read it; it is versioned in the repository, so you can diff it.