Enabling CODEOWNERS gating

Last verified against GitHub UI as of 2026-04-28.

What this configures

The CODEOWNERS file maps repo paths to required reviewers. Combined with the Require review from Code Owners branch-protection toggle, it ensures PRs that touch regulated paths (requirements, change records, regulated tooling, the auto-stamp workflow itself) cannot merge without approval from the qualified reviewer.

Where the file lives

.github/CODEOWNERS — lives at the repo root, in the .github directory.

The current contents on main:

# CODEOWNERS for BioFlow Pro
#
# Pull requests touching the paths listed below require approval from a
# qualified medical-device reviewer before they can merge to main. The
# approver's identity is what the auto-stamp Action records as
# REVIEWED_BY in the corresponding .sdoc files — see
# .claude/skills/strictdoc-requirements/SKILL.md §8 and the foundation
# plan item 06 for the regulatory background.
#
# Last match per file wins.

# Regulated artefacts — qualified medical-device review required
regulatory-docs/**                                @DougYoungberg
changes/**                             @DougYoungberg

# Regulated tooling — interprets and produces the review trail
tools/post_processor/**                @DougYoungberg
tools/auto_stamp/**                    @DougYoungberg

# Policy + enforcement — self-protect so this file and the auto-stamp
# workflow can't be silently weakened
.github/CODEOWNERS                     @DougYoungberg
.github/workflows/auto-stamp.yml       @DougYoungberg

Path-by-path rationale

Path	Why it’s owned
regulatory-docs/**	The regulated requirements + test specifications themselves
changes/**	Change records authorise edits to baselined requirements; tampering would break the change-control story
tools/post_processor/**	The interpretation engine; bugs here would mis-render the audit trail
tools/auto_stamp/**	Writes the regulated REVIEWED_HASH records; bugs here corrupt the audit trail
.github/CODEOWNERS	Self-protection — without this, anyone could remove other reviewers from the policy by editing the file
.github/workflows/auto-stamp.yml	The workflow that pushes to main with elevated permissions; protects against silently weakened gating

What’s deliberately not owned

Path	Why not
.claude/skills/strictdoc-requirements/**	AI-prompt guidance, not a regulated artefact directly. Changes here affect how an AI agent drafts requirements but not the requirements themselves. Could be added if the team wants tighter control.
.github/workflows/pr_branch_tests.yml	The PR pipeline. Changes here could weaken pre-merge gating but are reviewed routinely. Heavy review burden if every CI tweak needs the qualified reviewer.

Enabling the gate

CODEOWNERS by itself only causes GitHub to auto-request reviews from the listed owners — it does not block merges. The blocking comes from the branch-protection toggle:

Settings → Branches (or Rules → Rulesets) → main → Require review from Code Owners → ON

This is the toggle the auto-stamp App playbook Step 6 turns on. Until it’s enabled, the file is informational only.

Updating the reviewer list

When the qualified reviewer changes (e.g. someone joins as backup, or @DougYoungberg rotates off), edit .github/CODEOWNERS and open a PR.

Because the file owns itself (.github/CODEOWNERS @DougYoungberg), changing it requires approval from the current owner — preventing a malicious actor from silently lowering the review bar.

For a backup reviewer pattern:

regulatory-docs/**                                @DougYoungberg @<backup-handle>

Either reviewer’s approval satisfies the gate. List a team for further flexibility:

regulatory-docs/**                                @Corona-Project-Life/qa-leads

Any team member can approve.

Validation

GitHub validates CODEOWNERS at parse time. After merging a CODEOWNERS change, the org’s settings show a validation status — any non-existent users, malformed patterns, or syntax errors are flagged. Run gh api repos/Corona-Project-Life/Bioflow-Pro/codeowners/errors to see issues programmatically.

If a CODEOWNERS rule references a user who has lost repo access, the rule silently doesn’t apply. Periodic re-validation is part of the regulated maintenance procedure.