CODEOWNERS

The last gate, at merge time on GitHub — the sensitive paths that cannot reach main without the operator’s review.

Everything else in the enforcement plane acts while an agent is running: the gate at write time, Landlock at the kernel, the sweep just after. .github/CODEOWNERS is the gate at the end — the point where a pull request asks to merge. It maps sensitive paths to a required reviewer (the operator, @mareekkk), and GitHub’s branch protection refuses the merge until that reviewer approves.

Why a merge-time gate too

The runtime gates assume the agent is running under the shim, with the policy loaded and the wall up. CODEOWNERS doesn’t assume any of that — it lives on GitHub and triggers on the diff itself. Even a change authored outside the normal path still has to pass a human at merge. It is the backstop to the backstops.

What it guards

The owned paths line up closely with the protected paths and the hard rules — the same things, guarded again at a different moment:

Path	Why it’s owned
engineering-standards/**	The standards, invariants, and the policy.
AGENT_POLICY.yaml	The canonical policy — changing the rules needs review (and the meta scope).
CLAUDE.md, AGENTS.md	The agent instruction files.
docs/adr, docs/rfcs, docs/prds	The decision record.
auth / secret paths	Anything touching credentials.
operator_authority/**	The enforcement code itself.
compose / deploy files	Service definitions and deploy scripts.
the dashboard sidebar file	Backs HARD RULE 7-bis (never hide UI).
migration paths	Backs HARD RULE 4 (schema before code).
.github/workflows/** + CODEOWNERS itself	So the rules can’t be quietly edited out of the rules.

That last row matters: CODEOWNERS owns the CI workflows and itself. You cannot weaken the merge gate, or the checks behind it, without the operator approving the weakening.

The dismissed-approval trap

GitHub dismisses an existing CODEOWNERS approval when a PR is force-pushed (rebased) or its base branch changes. The old “yes” no longer counts. HARD RULE 14 exists precisely for this: after such an event an agent must re-request the operator’s review first, and only then tell the operator it needs re-approval — otherwise the PR drops out of the operator’s review queue and the ask is dead on arrival.

The CI checks alongside it

Branch protection runs a battery of jobs that must pass before merge, each enforcing a rule from elsewhere on this site:

• policy-consistency — PROTECTED_PATHS.md still matches the YAML.
• invariant-fitness-tests — the invariant scanners pass.
• changelog-updated — HARD RULE 8.
• sidebar-no-removal — HARD RULE 7-bis.
• canonical-containers — no unlisted compose service (HARD RULE 12).
• operator-authority-tests and others — the gate and shim keep working.

CODEOWNERS supplies the human judgement; the CI checks supply the mechanical ones. Together they are the merge-time mirror of the write-time enforcement an agent met hours earlier.

See also

• Protected paths — the same paths, guarded at write time.
• Architecture invariants — the fitness tests in CI.
• Hard rules — rules 4, 7-bis, 8, 12, and 14 land here.
• The gate — the write-time counterpart.