Skip to content

Document the single-maintainer setup for the knowledge gate #226

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tzhouam merged 1 commit into from
Sep 29, 2026
Merged

Document the single-maintainer setup for the knowledge gate #226

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,9 +8,10 @@
# code owner on purpose: they merge through the kb-gate signed verdict. A
# human-approved verdict must be approved by an owner of /.github/kb-gate/.
#
# GitHub does not let an author approve their own PR, and knowledge PRs are
# opened as @tzhouam, so at least one more maintainer must be listed below
# before the human-approved path can be used (owner setup step).
# @tzhouam is the only maintainer. GitHub does not let an author approve their
# own PR, so the human-approved path covers PRs opened by others; the owner's
# own changes here go through the owner's bypass of the code-owner ruleset
# (see doc/features/knowledge-service.md), never through kb-gate's.
Comment on lines +13 to +14

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 29, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Remove the obsolete approval guarantee

When @tzhouam authors a change under .github/**, this newly documented bypass allows it to merge without a Code Owner approval, directly contradicting lines 3–5, which still claim that no such change can land without a maintainer approving the current head. Because this comment describes the gate's security guarantees, update that earlier statement to acknowledge the single-maintainer bypass.

Useful? React with 👍 / 👎.


/.github/ @tzhouam
/knowledge/tools/ @tzhouam
Expand Down
7 changes: 5 additions & 2 deletions doc/features/knowledge-service.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,11 @@ infermatrix-copilot kb holds-server --port 8765 # 只提供 GET /holds.json，

切换前的负责人步骤：提交 `.github/kb-gate.pub`（`kb keygen` 的公钥）；在
`.github/kb-gate/config.json` 填入暂停清单的公开 HTTPS 地址（`$KB_STATE_DIR/public/holds.json`）；
在 `.github/CODEOWNERS` 中再加入至少一名知识维护者；仓库 admin 开启合并队列（merge commit）
与 ruleset（必需检查 `kb-gate` 限定 GitHub Actions 来源、Code Owner 审阅、新推送需重新批准）。
仓库 admin 开启合并队列（merge commit）并配置两个 ruleset：
- `main-gate`（无 bypass）：必须经合并队列合并，必需检查 `kb-gate` 限定 GitHub Actions 来源，禁止删除与强推；
- `main-code-owners`：要求 PR、Code Owner 审阅、新推送后需重新批准；bypass 仅 @tzhouam（唯一维护者，
GitHub 不允许作者批准自己的 PR，其本人对 `.github/**` 等路径的修改经此 bypass 合并，但仍受 `main-gate` 约束）。
唯一维护者意味着 `human-approved` 路径只适用于他人开的 PR；服务自己开的 PR 若转人工，由负责人关闭或修改后重新过门。
在此之前，所有触碰 `knowledge/` 的 PR 都会被 `kb-gate` 拒绝（失败即关闭），代码 PR 不受影响。

## 发布器（GPU 盒）
Expand Down
Loading