From 9708cf8717f4f13fb034f333cce3df323fe17a66 Mon Sep 17 00:00:00 2001 From: jbeloved700 Date: Sun, 18 Oct 2026 15:41:21 +0000 Subject: [PATCH] security(codeowners): audit protected surfaces and add missing ownership entries Add ownership entries for all frozen protected surfaces defined in docs/contributing/wave-architecture.md that were missing from .github/CODEOWNERS: - docs/architecture/ and docs/adr/ (full directories, replacing the two individual ADR entries for coverage completeness) - docs/roadmap/v1-readiness.md - src/cli.ts, src/main.ts, src/version.ts (CLI entry-point surface) - src/commands/root.ts (root command contract) - src/config/, src/process/, src/deployment/ (trust boundary modules) - src/generator/validation.ts, src/generator/template-generation.ts, src/generator/template-registry.ts, src/generator/template-sources.ts (generator security-sensitive surfaces) - src/dev/orchestrator.ts, src/dev/environment.ts (dev orchestration) Update docs/contributing/ownership.md to reflect the expanded boundary and explicitly document which paths remain open contributor zones. No contributor-friendly paths (tests/, templates/, general docs/) are locked down. CODEOWNERS syntax remains valid. --- .github/CODEOWNERS | 28 +++++++++++++++++++++++----- docs/contributing/ownership.md | 23 ++++++++++++++++++++--- 2 files changed, 43 insertions(+), 8 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index a678fe0..3a1fb7c 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -19,11 +19,29 @@ /docs/contributing/security-guidelines.md @dDevAhmed /docs/contributing/dependency-policy.md @dDevAhmed /docs/contributing/changesets.md @dDevAhmed -/docs/architecture/threat-model.md @dDevAhmed -/docs/architecture/trust-boundaries.md @dDevAhmed -/docs/adr/ADR-0003-release-and-versioning-strategy.md @dDevAhmed -/docs/adr/ADR-0004-security-baseline.md @dDevAhmed +/docs/architecture/ @dDevAhmed +/docs/adr/ @dDevAhmed +/docs/roadmap/v1-readiness.md @dDevAhmed -# Current CLI failure/output boundaries that protect error and terminal handling +# CLI entry-point and version surface +/src/cli.ts @dDevAhmed +/src/main.ts @dDevAhmed +/src/version.ts @dDevAhmed +/src/commands/root.ts @dDevAhmed + +# Security and trust boundary modules /src/errors/ @dDevAhmed /src/output/ @dDevAhmed +/src/config/ @dDevAhmed +/src/process/ @dDevAhmed +/src/deployment/ @dDevAhmed + +# Generator security-sensitive surfaces +/src/generator/validation.ts @dDevAhmed +/src/generator/template-generation.ts @dDevAhmed +/src/generator/template-registry.ts @dDevAhmed +/src/generator/template-sources.ts @dDevAhmed + +# Dev orchestration and environment handling +/src/dev/orchestrator.ts @dDevAhmed +/src/dev/environment.ts @dDevAhmed diff --git a/docs/contributing/ownership.md b/docs/contributing/ownership.md index a0b2408..a56dc30 100644 --- a/docs/contributing/ownership.md +++ b/docs/contributing/ownership.md @@ -10,15 +10,23 @@ Mandatory code-owner approval must be configured separately through the reposito ## Current Sensitive Areas -The initial ownership boundary covers: +The ownership boundary covers all frozen protected surfaces defined in `docs/contributing/wave-architecture.md`: - GitHub Actions workflows and dependency automation; - CODEOWNERS itself; - Changesets and package/lockfile release metadata; - public security policy and dependency/security engineering guidance; +- the full ADR directory and architecture documents; +- the v1 readiness roadmap; +- CLI entry-point, version, and root command modules; - threat-model and trust-boundary documents; - release/security ADRs; -- the current CLI error boundary and terminal-output layer. +- the CLI error boundary and terminal-output layer; +- project configuration module (`src/config/`); +- process execution module (`src/process/`); +- deployment module (`src/deployment/`); +- generator security-sensitive surfaces: validation, template generation, template registry, and template sources; +- dev orchestration and environment handling. These areas can affect execution trust, supply-chain integrity, secret handling, user-visible failure behavior, or future release authority and therefore receive explicit maintainer review. @@ -26,7 +34,16 @@ These areas can affect execution trust, supply-chain integrity, secret handling, CODEOWNERS does not assign a blanket owner to the whole repository. Ordinary feature modules, tests, general documentation, and contributor-facing work should remain approachable without unnecessary mandatory-owner routing unless their risk profile changes. -As new sensitive modules are introduced—such as deployment, credential handling, remote templates/plugins, filesystem mutation, or package publishing—the CODEOWNERS boundary should be updated in the same pull request or a tightly related security follow-up. +Specifically, the following remain open contributor zones: + +- `tests/` — unit and integration test files; +- `templates/` — starter template contents (excluding introduction/removal/renaming at the top level); +- `docs/` general guides, reference docs, and contributing guides (except the protected surfaces listed above); +- `src/diagnostics/` — diagnostic implementations; +- `src/testing/` — test-support utilities; +- `src/commands/` — individual command implementations (except `root.ts`). + +As new sensitive modules are introduced—such as credential handling, remote templates/plugins, or package publishing—the CODEOWNERS boundary should be updated in the same pull request or a tightly related security follow-up. ## Enforcement