# CODEOWNERS — elizaOS monorepo
#
# Required reviewers for sensitive areas. Used by GitHub branch-protection
# rules to enforce change management (SOC2 CC8.1 / CC6.1).
#
# IMPORTANT — operator action required:
#   The team handles below (`@elizaos/<role>`) are PLACEHOLDERS. Before enabling
#   branch protection with "Require review from Code Owners", replace each
#   handle with a real GitHub team in the elizaos org. The format is
#   `@org-name/team-slug`. Verify each team exists with
#   `gh api orgs/elizaos/teams/<slug>`.
#
# Order matters: later rules override earlier ones (last match wins).

# Default — at least one core maintainer.
*                                       @elizaos/core-maintainers

# CI / CD pipeline definitions and reusable actions.
/.github/                               @elizaos/security-team @elizaos/platform-team
/.github/workflows/                     @elizaos/security-team
/.github/actions/                       @elizaos/security-team
/.github/dependabot.yml                 @elizaos/security-team

# Cloud / backend — billing, auth, hosted APIs.
/packages/cloud/api/                    @elizaos/backend-leads
/packages/cloud/shared/                 @elizaos/backend-leads
/packages/cloud/services/               @elizaos/backend-leads
/packages/cloud/infra/                  @elizaos/backend-leads @elizaos/platform-team
/packages/cloud/routing/                @elizaos/backend-leads
/packages/cloud/sdk/                    @elizaos/backend-leads

# Security and crypto-handling code — mandatory security review.
/packages/security/                     @elizaos/security-team
/packages/vault/                        @elizaos/security-team
/packages/contracts/                    @elizaos/security-team @elizaos/backend-leads

# Plugin runtime / sandboxing surface.
# The host-shim cluster (base + android/ios/electrobun) now lives under
# plugin-remote-manifest/src/host-shim/ (subpath exports).
/packages/plugin-worker-runtime/        @elizaos/runtime-team
/packages/plugin-sub-agent-claude-code/ @elizaos/runtime-team @elizaos/security-team
/packages/plugin-remote-manifest/       @elizaos/runtime-team @elizaos/security-team

# ML / training / hardware.
/packages/training/                     @elizaos/ml-hw-lead
/packages/feed/                         @elizaos/ml-hw-lead

# Deployment artifacts.
/deploy/                                @elizaos/platform-team

# Install / bootstrap surface.
/install/                               @elizaos/security-team

# Dependency patches.
/patches/                               @elizaos/backend-leads @elizaos/security-team
/plugins/**/patches/                    @elizaos/backend-leads @elizaos/security-team

# Test-gating baselines and deny-lists (#10104 Tier-3) — these files are the
# knobs that loosen CI: raising a ratchet baseline budgets more debt, and
# adding a spec to the deny-list silently removes it from PR coverage. A
# feature PR must not adjust them without an explicit owner review.
/packages/scripts/type-safety-ratchet-baseline.json    @elizaos/security-team @elizaos/platform-team
/packages/scripts/type-duplication-audit.baseline.json @elizaos/security-team @elizaos/platform-team
/packages/scripts/ui-determinism-baseline.json         @elizaos/security-team @elizaos/platform-team
/packages/app/test/ui-smoke/.pr-deny-list.json         @elizaos/security-team @elizaos/platform-team

# Documentation only — lighter review.
/docs/security/                         @elizaos/security-team
