governance: hand maintainer coverage to community maintainers

[imran-siddique]

Moves this repository's review and merge coverage to community maintainers, as set out in the community handover. OPAQUE wound down on 2026-10-12, and its accounts are leaving the organization.

• .github/maintainers.json, CODEOWNERS and the gate's bootstrap policy are regenerated from maintainers/roster.json with scripts/maintainer-roster.mjs, so the daily drift audit stays clean.
• MAINTAINERS.md lists the new appointments and moves departed maintainers to emeritus where this file named them.

🤖 Generated with Claude Code

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[carloshvp]

Reviewed exact head a85e51b85aeb66102b9e7568b7db4afa70a1403a in an isolated checkout.

Required deployment correction: maintainers.json and the embedded bootstrap policy differ from the canonical roster on .github/main. The canonical record still lists the departed maintainers; for integrations it also still names Qiang as backup. Running the existing detectDrift() against this PR reproduces maintainers.json differs from canonical roster and maintainer gate differs from reviewed template. The intended membership follows #60, but please land/link the central roster update and regenerate/recheck these snapshots before merging them. Otherwise the daily coverage audit reports drift and continues to route work using the retired roster. I am not asking to restore the departed accounts to the proposed policy.

Required repository-policy correction: CONTRIBUTING.md, Developer certificate of origin requires a Signed-off-by trailer on every commit. 9cafd1116305fd4063e0fe6690caf68aca05a57e, a85e51b85aeb66102b9e7568b7db4afa70a1403a have none. Please add the author's DCO sign-off to each commit; the Co-Authored-By trailer does not provide that certification.

Validation: 39 positive/negative cases executed against this PR's actual gate script, covering current-head approval, stale/dismissed/requested-changes reviews, bot/outsider rejection, trusted-base policy fallback, API errors, malformed policies and exact-bootstrap restrictions, plus two distinct security approvals, self-approval rejection, renames out of protected paths and incomplete pagination. The script matches the reviewed template when resolved with the proposed policy. Actionlint v1.7.12, diff checks and merge simulation against fetched main passed.

The focused repository OIDC/release-validation checks also passed: 13 tests. No runtime code changes are included in this PR.

Requesting changes for the corrections above; I found no additional failure in the gate behavior exercised.

[rajnisht7]

Overall changes looks good
One note: public maintainers/roster.json still shows the old names for the repo kindly make sure the central roster PR lands so the daily drift audit stays green

[imran-siddique]

@carloshvp the central roster is agentrust-io/.github#61. detectDrift() against this head with that roster reports aligned, as it does for ca2a#252 and integrations#318. The commits are re-signed with Signed-off-by; the tree is byte-identical to the head you reviewed.

[carloshvp]

Re-reviewed exact head 0c925318b369cc76beee13c9d5581385dbf6cc23. Both earlier blockers are resolved: the canonical roster update in agentrust-io/.github#61 is merged, and both PR commits now carry the required Signed-off-by trailer. The complete file tree is identical to the head I previously reviewed.

Against canonical main d392977047dd6f8c6358a223de58e021568a9558, detectDrift() reports no differences in the policy, CODEOWNERS or embedded gate. The two-approval requirement and protected security paths are preserved.

Validation on this head: 49 positive/negative cases against the actual gate script, including rejection of departed maintainers and reviewer-only accounts, stale/dismissed/requested-changes reviews, self-approval, duplicate approvals, security-path renames, incomplete file inventories, trusted-base fallback, API failures and restricted bootstrap behavior. Actionlint 1.7.12, diff checks, and a clean merge simulation against main b3220e468a9a456d1676e25f9b8b1b5785bdd208 passed. The simulated merged snapshots also match the canonical roster.

The 13 existing OIDC/release-workflow tests passed in isolation. Loading the normal unit-test conftest requires the agent_manifest dependency absent from this shell; I did not run the runtime suite for this governance-only change.

Approving this head; this supersedes my earlier changes request.