CODEOWNERS

# AetherSDR CODEOWNERS
#
# Three tiers, last-matching-pattern wins. Numbered by exclusivity, not by
# file position — Tier 1 is the smallest, most-exclusive owner set; Tier 3
# is the broadest. The file is laid out broad → specific so the more
# restrictive tiers override the broader defaults via CODEOWNERS'
# last-match-wins semantics:
#
#   Tier 3 (source code, broad default)       — top of file (the `*` line)
#   Tier 2 (project infrastructure)           — middle (specific paths)
#   Tier 1 (governance, security, bot policy) — bottom (most specific paths)
#
# Tier 1 — @aethersdr/maintainers (currently: @ten9876).
#         Project governance and direction (CONSTITUTION, GOVERNANCE,
#         CONTRIBUTING, CODE_OF_CONDUCT, LICENSE, ROADMAP), security
#         controls (SECURITY*, signing keys, CODEOWNERS itself, CodeQL
#         config, and the security-sensitive workflows — release
#         signing/publish + the CodeQL scan invocation), and bot/agent
#         instruction (AGENTS.md, CLAUDE.md, GEMINI.md, .claude/commands/).
# Tier 2 — @aethersdr/infrastructure (currently: @ten9876, @jensenpat).
#         Project infrastructure: CI/CD configuration — the ROUTINE
#         workflow definitions (.github/workflows/ except the sensitive
#         ones carved to Tier 1), dependabot, docker, issue templates —
#         plus documentation (docs/, *.md catchall, including
#         README/CHANGELOG/SUPPORT which fall through here from the *.md
#         glob), tests, build configuration (CMakeLists.txt), and
#         legal/compliance tracking (THIRD_PARTY_LICENSES).
#         Narrower owner set than Tier 3 because infrastructure changes
#         need deeper repo context than routine source review.
# Tier 3 — @aethersdr/reviewers (currently: @ten9876, @jensenpat, @NF0T, @rfoust, @chibondking).
#         AetherSDR source code and anything else not enumerated
#         above (src/ — including the whole of MainWindow —
#         third_party/, plugins/, hal-plugin/, resources/, packaging/,
#         scripts/). Broadest collaborator roster because routine
#         source review benefits from more eyes.
#
# Team rosters are managed in the GitHub org settings:
#   https://github.com/orgs/aethersdr/teams
# Adding or removing a code owner is a single team-membership change
# rather than an edit to this file. The roster lists above are
# documentation only — the live source of truth is the org team.
#
# All approvals are human-only. @AetherClaude (the project's machine
# user) is intentionally NOT a member of any team — bot-generated PRs
# still need a human reviewer regardless of which paths they touch.
#
# CODEOWNERS has no permission hierarchy — each path matches exactly one
# line (last wins) and that line's owners completely replace any earlier
# match. The numbering above is documentary; the operative semantics
# come from the file's pattern order plus last-match-wins.
#
# Self-approval is hard-blocked by GitHub regardless of CODEOWNERS
# membership, so a contributor cannot approve their own PR even on
# paths they own.

# ── Tier 3: source code, broad default — catches anything not enumerated ───
*                            @aethersdr/reviewers

# ── Tier 2: project infrastructure — narrower owner set than Tier 3 ────────
# CI/CD configuration (workflows + tooling), documentation, tests, build config.
# (The CodeQL config stays Tier 1 under Security below — a security control.)

# Documentation & tests
tests/                       @aethersdr/infrastructure
docs/                        @aethersdr/infrastructure
*.md                         @aethersdr/infrastructure

# GitHub-specific tooling
# Routine CI workflow definitions live at Tier 2 to unblock day-to-day CI
# iteration. NOTE the residual risk: a workflow runs with repo secrets /
# GITHUB_TOKEN scopes, so a Tier-2 owner can approve a change that exfiltrates a
# secret or alters CI behaviour. The SECURITY-SENSITIVE workflows — the release
# signing/publish pipeline and the CodeQL scan invocation — are carved back to
# Tier 1 individually in the Security section below (last-match-wins), because
# CodeQL is NOT a required status check (a Tier-2 edit could silently disable it)
# and the release workflows consume the signing secret at run time. Everything
# else here (ci, engine-boundary, a11y-check, sanitizers, …) stays Tier 2.
.github/workflows/           @aethersdr/infrastructure
.github/dependabot.yml       @aethersdr/infrastructure
.github/docker/              @aethersdr/infrastructure
.github/ISSUE_TEMPLATE/      @aethersdr/infrastructure

# Build configuration
CMakeLists.txt               @aethersdr/infrastructure
THIRD_PARTY_LICENSES         @aethersdr/infrastructure

# ── Tier 1: governance, security, bot policy — maintainer-only ────────────
# Project governance & direction
AGENTS.md                    @aethersdr/maintainers
CLAUDE.md                    @aethersdr/maintainers
CODE_OF_CONDUCT.md           @aethersdr/maintainers
CONSTITUTION.md              @aethersdr/maintainers
CONTRIBUTING.md              @aethersdr/maintainers
GEMINI.md                    @aethersdr/maintainers
GOVERNANCE.md                @aethersdr/maintainers
LICENSE                      @aethersdr/maintainers
ROADMAP.md                   @aethersdr/maintainers

# Security & compliance
SECURITY.md                  @aethersdr/maintainers
SECURITY-AUDIT.md            @aethersdr/maintainers
.github/CODEOWNERS           @aethersdr/maintainers
.github/codeql/              @aethersdr/maintainers
docs/RELEASE-SIGNING-KEY.pub.asc  @aethersdr/maintainers

# Security-sensitive workflows — carved back to Tier 1 (last-match-wins) out of
# the Tier-2 .github/workflows/ default above. The release signing/publish
# pipeline runs with the signing secret, and codeql.yml invokes the security
# scan (which is NOT a required status check, so a Tier-2 edit could disable it
# undetected). Routine CI workflows stay Tier 2. Keep the list below in sync
# with .github/workflows/ as workflows are added/renamed.
#
# The criterion is "produces or feeds a signed/official release artifact." That
# includes producer workflows whose output a Tier-1 release step consumes, even
# if the producer itself doesn't hold a secret — poisoning the input defeats the
# consumer's gate. Specifically:
#   - streamdeck-plugins.yml uploads *.zip artifacts onto the v* release, which
#     sign-release.yml (Tier 1) then GPG-signs with the release key.
# It was left at Tier 2 in the initial carve-out; a Tier-2 edit reaches around
# the release gate, so it is carved to Tier 1 as well.
#
# build-macos-qt.yml was listed here for the same reason — it published the
# deps-qt-* Qt tarball that macos-dmg.yml baked into the signed DMG. That
# workflow is retired: both macOS legs now take Qt from aqtinstall, as Windows
# and both AppImages already did. Worth naming what that does to the supply
# chain rather than treating it as a pure win — it drops a build input we
# produced ourselves and could audit, in favour of prebuilt binaries from Qt's
# CDN. The trade is deliberate: it is the same trust boundary every other
# release artifact already sits behind, and it retires a ~2 h from-source build
# nobody was reviewing the output of.
.github/workflows/codeql.yml             @aethersdr/maintainers
.github/workflows/sign-release.yml       @aethersdr/maintainers
.github/workflows/macos-dmg.yml          @aethersdr/maintainers
.github/workflows/windows-installer.yml  @aethersdr/maintainers
.github/workflows/appimage.yml           @aethersdr/maintainers
.github/workflows/docker-ci-image.yml    @aethersdr/maintainers
.github/workflows/streamdeck-plugins.yml @aethersdr/maintainers

# Bot / agent instruction (source of truth for AI tool behaviour)
.claude/commands/            @aethersdr/maintainers

# NOTE: MainWindow.cpp/.h are intentionally NOT gated here — they sit on the
# Tier 3 reviewer default (the `*` line), same as the #3351 decomposition's
# MainWindow_*.cpp sibling TUs. The core files were formerly Tier 1, but that
# gate turned every MainWindow change into a maintainer-only (in practice,
# single-owner) review; with the decomposition complete the whole MainWindow
# surface now shares the broad reviewer roster. Do NOT re-add a
# `src/gui/MainWindow*` gate. See docs/architecture/mainwindow-decomposition.md.