docs: add governance, LICENSE, and CODEOWNERS for co-maintainer model (#799)

lane711 · claude · web-flow · commit f563255dd39f · 2026-04-17T21:13:21.000-07:00
* chore: suppress naming-convention lint error for JSON body destructuring

The shortcodes create endpoint accepts both snake_case and camelCase
keys from the JSON body for backwards compatibility. The snake_case
destructuring triggered the naming-convention rule, blocking commits
via the pre-commit hook.

Co-Authored-By: Claude Opus 4.7 &lt;noreply@anthropic.com&gt;

* docs: add governance, license, and code owners for co-maintainer model

Formalize project governance as a BDFL model with a co-maintainer. Adds
the missing LICENSE file, defines review requirements via CODEOWNERS,
updates FUNDING.yml to support both maintainers, and documents the DCO
sign-off expectation for contributors.

Co-Authored-By: Claude Opus 4.7 &lt;noreply@anthropic.com&gt;

---------

Co-authored-by: Claude Opus 4.7 &lt;noreply@anthropic.com&gt;
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -0,0 +1,30 @@
+# SonicJS Code Owners
+#
+# This file defines who must review changes to specific parts of the codebase.
+# Order matters — the last matching pattern wins.
+#
+# See: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners
+
+# Default owners for everything in the repo
+*                                   @lane711 @mmcintosh
+
+# Core package — both maintainers must approve
+/packages/core/                     @lane711 @mmcintosh
+
+# Governance, licensing, and contribution docs — project lead sign-off required
+/LICENSE                            @lane711
+/GOVERNANCE.md                      @lane711
+/CONTRIBUTING.md                    @lane711
+/.github/CODEOWNERS                 @lane711
+/.github/FUNDING.yml                @lane711
+
+# Release and publishing workflows — project lead sign-off required
+/PUBLISHING.md                      @lane711
+/.github/workflows/                 @lane711
+/scripts/                           @lane711 @mmcintosh
+
+# Website and marketing site
+/www/                               @lane711
+
+# Example app
+/my-sonicjs-app/                    @lane711 @mmcintosh
diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
@@ -1 +1,3 @@
-github: lane711
+# GitHub Sponsors profiles for SonicJS maintainers.
+# Both maintainers are listed so sponsors can support whichever maintainer they choose.
+github: [lane711, mmcintosh]
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -5,6 +5,7 @@ Thank you for your interest in contributing to SonicJS!
 ## Quick Links
 
 - **[Full Contributing Guide](https://sonicjs.com/contributing)** - Detailed guide on how to contribute
+- **[Project Governance](./GOVERNANCE.md)** - How decisions are made and who the maintainers are
 - **[Good First Issues](https://github.com/lane711/sonicjs/labels/good%20first%20issue)** - Great starting points for new contributors
 - **[Help Wanted](https://github.com/lane711/sonicjs/labels/help%20wanted)** - Issues where we need community help
 
@@ -68,6 +69,19 @@ Before submitting a PR:
 - [ ] Changes are documented if needed
 - [ ] PR description explains the changes
 - [ ] Related issue is referenced
+- [ ] Commits are signed off (see DCO below)
+
+## Developer Certificate of Origin (DCO)
+
+By contributing to SonicJS, you certify that you wrote the code (or otherwise have the right to submit it) and agree to release it under the project's MIT license. This is formalized by the [Developer Certificate of Origin](https://developercertificate.org/).
+
+To signal your agreement, add a `Signed-off-by` line to each commit:
+
+```bash
+git commit -s -m "your commit message"
+```
+
+This appends a line like `Signed-off-by: Your Name <your.email@example.com>` to the commit message using your configured `user.name` and `user.email`.
 
 ## Questions?
 
diff --git a/GOVERNANCE.md b/GOVERNANCE.md
@@ -0,0 +1,98 @@
+# SonicJS Governance
+
+This document describes how decisions are made in the SonicJS project.
+
+## Governance Model
+
+SonicJS follows a **Benevolent Dictator for Life (BDFL)** model with trusted co-maintainers. The project lead has final authority on project direction, but day-to-day development is a shared responsibility among maintainers.
+
+This model is intentionally lightweight. As the project and contributor base grow, we may adopt more formal structures (e.g., a Technical Steering Committee).
+
+## Roles
+
+### Project Lead (BDFL)
+
+- **Current:** [@lane711](https://github.com/lane711) (Lane Campbell)
+- Has final authority on all project decisions
+- Owns the GitHub organization and related infrastructure
+- Sets the project roadmap and long-term vision
+- Can grant or revoke maintainer access
+
+### Maintainers
+
+- **Current:** [@lane711](https://github.com/lane711), [@mmcintosh](https://github.com/mmcintosh)
+- Hold the GitHub "Maintain" role on the repository
+- Can review, approve, and merge pull requests
+- Triage issues and respond to community questions
+- Help cut releases and maintain the changelog
+- Expected to follow the decision-making process below
+
+### Contributors
+
+- Anyone who submits a pull request, opens an issue, or participates in discussions
+- See [CONTRIBUTING.md](./CONTRIBUTING.md) for how to get involved
+
+## Decision-Making Process
+
+### What Maintainers Can Merge Independently
+
+Maintainers may merge PRs without explicit sign-off from the project lead when the change is:
+
+- A bug fix aligned with existing behavior
+- A documentation improvement
+- A test addition or improvement
+- A dependency update (patch or minor version)
+- A feature already discussed and approved in an issue or discussion
+- A refactor that does not change public APIs
+
+### What Requires Project Lead Sign-Off
+
+The following changes require explicit approval from the project lead:
+
+- **Breaking changes** to public APIs or plugin interfaces
+- **New major features** not previously discussed
+- **Licensing or governance changes** (this file, LICENSE, CONTRIBUTING.md)
+- **Dependency additions** that introduce significant new surface area
+- **Security-sensitive changes** (auth, permissions, secrets handling)
+- **Release versioning decisions** (especially major version bumps)
+- **Changes to the project's scope or direction**
+
+### Disagreements
+
+If maintainers disagree on a change:
+
+1. Discuss it openly in the PR or a GitHub discussion
+2. If consensus is not reached, the project lead has final say
+3. The project lead may delegate decisions on specific areas to maintainers over time
+
+## Becoming a Maintainer
+
+Maintainers are invited by the project lead after sustained, high-quality contribution to the project. There is no formal application process.
+
+Signals that someone is ready for maintainer status:
+
+- Consistent, meaningful contributions over a period of months
+- High-quality code review on others' PRs
+- Good judgment on what fits the project's direction
+- Responsiveness and helpfulness in issues and discussions
+- Trust established with the existing maintainer team
+
+## Inactivity
+
+Maintainers who are inactive for **6+ months** without prior notice may have their maintainer role moved to "emeritus" status. This is not punitive — it reflects the reality that priorities change. Emeritus maintainers can rejoin active status at any time by resuming meaningful contributions.
+
+## Funding and Financial Matters
+
+SonicJS accepts funding through [GitHub Sponsors](https://github.com/sponsors/lane711) and other channels listed in [.github/FUNDING.yml](./.github/FUNDING.yml).
+
+Financial arrangements between maintainers (e.g., sponsorship revenue sharing, commercial licensing revenue) are handled privately between the parties involved and are not part of this public governance document.
+
+The project lead retains ownership of the GitHub organization and associated trademarks/brand assets.
+
+## Changes to This Document
+
+Changes to this governance document require approval from the project lead and should be discussed openly with the maintainer team before being merged.
+
+## Questions
+
+For questions about governance, open a [GitHub Discussion](https://github.com/lane711/sonicjs/discussions) or reach out to the project lead.
diff --git a/LICENSE b/LICENSE
@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 Lane Campbell and SonicJS contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
diff --git a/packages/core/src/plugins/core-plugins/shortcodes-plugin/index.ts b/packages/core/src/plugins/core-plugins/shortcodes-plugin/index.ts
@@ -150,6 +150,7 @@ apiRoutes.get('/:id', async (c: any) => {
 apiRoutes.post('/', async (c: any) => {
   try {
     const db = c.env.DB
+    // eslint-disable-next-line @typescript-eslint/naming-convention -- snake_case keys accepted from JSON body for backwards compatibility
     const { name, display_name, displayName, description, handler_key, handlerKey, default_params, defaultParams, example_usage, exampleUsage, category } = await c.req.json()
     const scName = name
     const scHandlerKey = handler_key || handlerKey
