CODEOWNERS

# CODEOWNERS — human-review gate for security-sensitive paths.
#
# Why this exists: autonomous Claude Code routines (see claude-routines repo)
# open PRs against this PUBLIC repo daily, sourced from public issue bodies, and
# auto-merge them once the `check` status is green. `main` requires 0 approving
# reviews in the general case (preserving that autonomy). This file is the
# hybrid gate: any PR whose diff touches a path below requires an approving
# review from a code owner before it can merge, regardless of CI.
#
# Enforced by the `main-protection` ruleset rule `require_code_owner_review`.
# A code owner must have write access. The autonomous bot MUST run as a
# distinct, non-admin identity (not @schmug) or this gate cannot be satisfied
# (GitHub forbids self-approval) — tracked separately as the bot-identity split.

# CI / supply chain — a PR can otherwise rewrite its own merge gate, since
# pull_request workflows run from the PR head ref.
/.github/                       @schmug
/package.json                   @schmug
/package-lock.json              @schmug
/wrangler.toml                  @schmug

# Documented security invariants and the regression-blocking hooks.
/SECURITY.md                    @schmug
/CLAUDE.md                      @schmug
/.claude/settings.json          @schmug

# Input validation, redirect posture, rate limiting, and prod-mutating
# DB migrations — the highest-blast-radius source paths. rate-limit-do.ts is
# the Durable Object that backs rate-limit.ts's atomic counter — gating the
# policy file while leaving its state store ungated was a gap (#659).
/src/index.ts                   @schmug
/src/rate-limit.ts              @schmug
/src/rate-limit-do.ts           @schmug
/src/db/                        @schmug

# Analyzer modules, orchestration, and scoring — supply-chain / exfiltration risk.
# A malicious new module added under src/analyzers/ (or changes to orchestrator/
# scoring) could exfiltrate DNS data or manipulate grades without gating. Covered
# broadly so that new files in the directory don't slip through the individual-file
# entries that existed previously. Active once bot-identity split (#299) lands.
/src/analyzers/                 @schmug
/src/orchestrator.ts            @schmug
/src/shared/scoring.ts          @schmug

# Account deletion & billing — self-serve erasure orchestration (deletion.ts)
# cancels Stripe subscriptions, hard-deletes the user row, and removes the
# WorkOS identity behind a step-up re-auth + IDOR guard (CLAUDE.md "Account
# deletion (#550, T1/T4/T12)"). Covered broadly so new files under the
# directory are gated too. Surfaced by #599/#600.
/src/account/                   @schmug

# Auth, Stripe billing, and inbound webhook handlers (including payment
# events) — identity and money-adjacent surfaces same-blast-radius as
# account deletion above but not yet covered. Surfaced by #659.
/src/auth/                       @schmug
/src/billing/                    @schmug
/src/webhooks/                   @schmug

# A separately deployed Worker (its own package.json/wrangler.toml, outside
# the main Worker's src/ tree) and the gate script autonomous routines run
# against — both security-adjacent and missed by the entries above.
# Surfaced by #659.
/mta-sts-worker/                 @schmug
/scripts/routine-gate/           @schmug