security: define sensitive CODEOWNERS boundaries

.github/CODEOWNERS

@@ -0,0 +1,29 @@
+# StellarForge CLI sensitive-area ownership
+#
+# CODEOWNERS requests review from the listed owner when matching files change.
+# Enforcement still requires the repository ruleset to require code-owner review.
+
+# CI, security scanning, dependency automation, and future release workflows
+/.github/workflows/ @dDevAhmed
+/.github/dependabot.yml @dDevAhmed
+/.github/CODEOWNERS @dDevAhmed
+
+# Release/versioning configuration and package supply-chain surface
+/.changeset/ @dDevAhmed
+/package.json @dDevAhmed
+/package-lock.json @dDevAhmed
+/CHANGELOG.md @dDevAhmed
+
+# Public security policy and architecture trust boundaries
+/SECURITY.md @dDevAhmed
+/docs/contributing/security-guidelines.md @dDevAhmed
+/docs/contributing/dependency-policy.md @dDevAhmed
+/docs/contributing/changesets.md @dDevAhmed
+/docs/architecture/threat-model.md @dDevAhmed
+/docs/architecture/trust-boundaries.md @dDevAhmed
+/docs/adr/ADR-0003-release-and-versioning-strategy.md @dDevAhmed
+/docs/adr/ADR-0004-security-baseline.md @dDevAhmed
+
+# Current CLI failure/output boundaries that protect error and terminal handling
+/src/errors/ @dDevAhmed
+/src/output/ @dDevAhmed

CONTRIBUTING.md

@@ -48,7 +48,7 @@ Contributions must follow secure engineering practices. In particular:
 - avoid privileged workflow execution of untrusted pull-request code;
 - include tests for security-sensitive behavior.
 
-Changes involving filesystem mutation, subprocess execution, dependency installation, deployment, credentials, release automation, or workflow permissions receive heightened review.
+Changes involving filesystem mutation, subprocess execution, dependency installation, deployment, credentials, release automation, or workflow permissions receive heightened review. Sensitive ownership boundaries are documented in `docs/contributing/ownership.md`; CODEOWNERS can request review, while mandatory enforcement depends on the repository ruleset.
 
 ## Pull Requests
 

docs/contributing/ownership.md

@@ -0,0 +1,39 @@
+# Code Ownership and Sensitive Review Boundaries
+
+StellarForge CLI uses `.github/CODEOWNERS` to identify maintainers who should review changes to security-, release-, dependency-, and CI-sensitive parts of the repository.
+
+## What CODEOWNERS Does
+
+When GitHub recognizes a changed path covered by CODEOWNERS, it can automatically request review from the listed owner. The file expresses ownership intent; it does not, by itself, make that review mandatory.
+
+Mandatory code-owner approval must be configured separately through the repository's `main` branch ruleset. Do not assume a pull request is protected merely because an owner appears in `.github/CODEOWNERS`.
+
+## Current Sensitive Areas
+
+The initial ownership boundary covers:
+
+- GitHub Actions workflows and dependency automation;
+- CODEOWNERS itself;
+- Changesets and package/lockfile release metadata;
+- public security policy and dependency/security engineering guidance;
+- threat-model and trust-boundary documents;
+- release/security ADRs;
+- the current CLI error boundary and terminal-output layer.
+
+These areas can affect execution trust, supply-chain integrity, secret handling, user-visible failure behavior, or future release authority and therefore receive explicit maintainer review.
+
+## What Is Intentionally Not Globally Owned
+
+CODEOWNERS does not assign a blanket owner to the whole repository. Ordinary feature modules, tests, general documentation, and contributor-facing work should remain approachable without unnecessary mandatory-owner routing unless their risk profile changes.
+
+As new sensitive modules are introduced—such as deployment, credential handling, remote templates/plugins, filesystem mutation, or package publishing—the CODEOWNERS boundary should be updated in the same pull request or a tightly related security follow-up.
+
+## Enforcement
+
+The repository ruleset should eventually require code-owner review for protected changes after the actual CI/security status checks and ownership paths are established. That ruleset is maintained separately so CODEOWNERS does not claim enforcement that GitHub has not been configured to apply.
+
+Emergency bypasses, if enabled later, should be limited to authorized maintainers and remain auditable through GitHub's ruleset history and repository activity.
+
+## Ownership Changes
+
+Changes to `.github/CODEOWNERS` are themselves owned. Do not remove or broaden sensitive-path coverage merely to avoid a review requirement. Ownership changes should explain the operational or architectural reason for the adjustment.