chore: reconcile CODEOWNERS with factory gate risk denylist - #663
Conversation
Closes the gap between .github/CODEOWNERS and the software factory's risk denylist (.factory/gate.json, wired in #654): src/auth/, src/billing/, src/webhooks/, src/rate-limit-do.ts, mta-sts-worker/, and scripts/routine-gate/ were flagged as security/money-sensitive there but CODEOWNERS hadn't caught up. src/account/ was already covered.
Deploying with
|
| Status | Name | Latest Commit | Updated (UTC) |
|---|---|---|---|
| ✅ Deployment successful! View logs |
dmarcheck | 48174de | Aug 06 2026, 11:22 AM |
|
Routine auto-merge: escalating to human review. This PR modifies Separately, noting for transparency: this session did not have the No action taken beyond this comment — awaiting a code-owner review. Generated by Claude Code |
…dy is (#674) Every PR the autonomous single-issue routine opens fails DCO. It authors as `Claude <noreply@anthropic.com>`, which matches none of the three existing exemptions (`[bot]` in the name, `github-actions`, `cursoragent@cursor.com`), and it cannot run `git commit -s` on its own behalf any more than the Cursor agent can. Three PRs are red on this right now — #663, #671, #672 — and it is a deadlock the routine cannot escape by itself: the fix lives in `.github/workflows/`, which is CODEOWNERS-gated, and the routine's own operating rules bar it from modifying CI. So this needs a human-authored PR, which is what this is. Anticipated in the software factory design spec §12.4 ("register the identity in dco.yml's bot allowlist beside cursoragent@cursor.com"); it only became load-bearing now that something is actually generating agent PRs. Verified by replaying the patched conditions against the real commits on #663/#671/ #672 (all three now SKIP) and against the current head of main (schmug, still REQUIRES SIGN-OFF) — the exemption does not widen to human contributors. Also documents what this list is: a PROVENANCE exemption, not a security control. Anyone can set their git author email to one of these strings; what actually gates the push is the token this repo issued. Keeping the list to no-reply addresses on vendor-controlled domains is the invariant worth stating for whoever adds the next entry. Signed-off-by: schmug <38227427+schmug@users.noreply.github.com>
2 participants
Summary
src/auth/,src/billing/,src/webhooks/,src/rate-limit-do.ts,mta-sts-worker/, andscripts/routine-gate/to.github/CODEOWNERS(directory form for directories, matching the existingsrc/analyzers//src/account/precedent).CLAUDE.md's Branch protection bullet.Owner / zone steps
None.
Security notes
This PR itself edits
.github/CODEOWNERS, which falls under the/.github/CODEOWNERS entry — it requires a code-owner approving review before merge and cannot auto-merge (permain-protection'srequire_code_owner_review). Not enabling auto-merge; opening for human review.Testing
npm run lint— clean (188 files checked, no issues)npm run typecheck— cleannpm test— 1500 passing, 1 pre-existing failure (test/integration/mta-sts-runtime.test.ts, a live-network fetch against the real dmarc.mx MTA-STS endpoint). Verified this fails identically on unmodifiedmainviagit stash— unrelated to this change, which touches no source code.Choices made
Issue #659 asked, for each path in the gap table, to either add it to CODEOWNERS or remove it from the factory's risk denylist, and to record the reasoning. For every path the call was unambiguous — all are genuinely security- or money-sensitive (Stripe integration, webhook dispatch including payment events, auth, the Durable Object backing rate-limit state, a separately-deployed Worker, and the routine gate itself) — so all six were added to CODEOWNERS rather than removed from the denylist.
One correction to the issue's premise:
src/account/was already CODEOWNERS-gated (added for #599/#600), so that row in the issue's gap table was stale — no change needed there..factory/gate.jsonand.factory/README.mddon't exist onmainyet — they're only in the still-open PR #654. Rather than block on that PR merging, I resolved every gap by adding to CODEOWNERS, which is a superset match against #654'sgate.jsondenylist as currently drafted. Once #654 merges, the two lists will fully agree with no divergence left to document in.factory/README.md— so that acceptance criterion doesn't require a separate edit.Deferred
mergeStateStatus: BLOCKED" can't be verified before this PR itself merges (it requires a human code-owner approval first, then a real follow-up test PR). Filed as verify: confirm CODEOWNERS gate blocks a test PR on a newly-added #659 path #664.Refs
Closes #659