CODEOWNERS

# Code owners for DeepSQL.
#
# GitHub applies LAST MATCH WINS — only the final matching pattern's owners are
# requested. Order therefore matters: the catch-all is first and the narrow
# security paths are last, so a change under backend/.../security/ is routed to
# the two named security reviewers and not merely to the maintainers.
#
# A caveat worth stating in the file itself, because the process document implies
# otherwise: CODEOWNERS cannot require a DIFFERENT NUMBER of approvals for
# particular paths. Branch protection carries one repo-wide approval count. What
# CODEOWNERS does guarantee is WHO must approve. The two-approval rule on the
# vault, auth and SQL-execution paths is therefore a reviewer convention here,
# not a machine-enforced gate — see the note in SECURITY.md.
#
# Teams for the broad surface, named individuals for the security paths. The
# catch-all stays on @DeepSQLAI/maintainers, so a roster change there is one edit
# to the team. The security paths name @geekypunk and @venkateshsakamuri-lab
# directly, so that review on them does not widen automatically with the
# maintainer roster; keep those lines in sync by hand.

*                                                       @DeepSQLAI/maintainers

# ── Build, packaging and self-host surface ──────────────────────────────────
# A broken first run is a severe defect for us: the product is distributed as
# "clone and build", so these files are the install experience.
/Dockerfile                                             @DeepSQLAI/maintainers
/docker/                                                @DeepSQLAI/maintainers
/docker-compose.yml                                     @DeepSQLAI/maintainers
/backend/Dockerfile                                     @DeepSQLAI/maintainers
/backend/pom.xml                                        @DeepSQLAI/maintainers
/backend/mvnw                                           @DeepSQLAI/maintainers
/backend/mvnw.cmd                                       @DeepSQLAI/maintainers
/backend/.mvn/                                          @DeepSQLAI/maintainers
/scripts/self-host/                                     @DeepSQLAI/maintainers
/.github/                                               @DeepSQLAI/maintainers

# Renaming anything here silently breaks every operator's .env on upgrade.
/.env.example                                           @DeepSQLAI/maintainers

# ── Security-critical: convention is two security-reviewer approvals ───────
# Credential vault, encryption key handling, authentication and JWT. The vault
# holds an AES-GCM key whose loss is unrecoverable.
/backend/src/main/java/com/dbaagent/security/           @geekypunk @venkateshsakamuri-lab
/backend/src/main/java/com/dbaagent/service/security/   @geekypunk @venkateshsakamuri-lab

# Read-only SQL execution enforcement. This is the guardrail standing between a
# generated statement and a customer's production database.
/backend/src/main/java/com/dbaagent/service/McpSqlGuardService.java              @geekypunk @venkateshsakamuri-lab
/backend/src/main/java/com/dbaagent/service/QueryExecutionContext.java           @geekypunk @venkateshsakamuri-lab
/backend/src/main/java/com/dbaagent/service/QueryExecutionPolicyService.java     @geekypunk @venkateshsakamuri-lab
/backend/src/main/java/com/dbaagent/service/QueryExecutionPolicyException.java   @geekypunk @venkateshsakamuri-lab
/backend/src/main/java/com/dbaagent/model/McpReadOnlyQueryRequest.java           @geekypunk @venkateshsakamuri-lab
/backend/src/main/java/com/dbaagent/model/McpReadOnlyExplainRequest.java         @geekypunk @venkateshsakamuri-lab
/backend/src/main/java/com/dbaagent/model/QueryExecutionOrigin.java              @geekypunk @venkateshsakamuri-lab
/backend/src/main/java/com/dbaagent/provider/api/QueryExecutionProvider.java     @geekypunk @venkateshsakamuri-lab

# SSH tunnelling: reaches into networks the operator has not otherwise exposed.
/backend/src/main/java/com/dbaagent/service/SshTunnelService.java                @geekypunk @venkateshsakamuri-lab

# The dashboard sandbox and its read-only query bridge. The public controller is
# reachable unauthenticated for as long as a dashboard is shared.
/backend/src/main/java/com/dbaagent/controller/DashboardQueryController.java     @geekypunk @venkateshsakamuri-lab
/backend/src/main/java/com/dbaagent/controller/PublicDashboardController.java    @geekypunk @venkateshsakamuri-lab
/src/components/DashboardArtifact.jsx                                           @geekypunk @venkateshsakamuri-lab

# The MCP tool surface and its authorisation: an agent-facing remote surface.
/mcp/                                                   @geekypunk @venkateshsakamuri-lab