security: add CODEOWNERS routing payment + submission logic to securi…

[catchmeifyoucaan]

…ty team

Added CODEOWNERS file to specify security review requirements for various directories.

Workstream PR Trust Bundle

This PR template mirrors .agent-loop/templates/PR_TRUST_BUNDLE.md; keep both
in sync when the trust-bundle structure changes.

Chunk

<chunk-id> - <title>

Goal

Human-Approved Intent

Link the initiative and chunk contract:

• Intent:
• Chunk contract:

What Changed

Why It Changed

Design Chosen

Alternatives Rejected

Scope Control

Allowed Files Changed

Files Outside Contract

• None

Product Behavior

• No Workstream product behavior changed.
• Product behavior changed and is explained here:

Evidence

Commands Run

Result Summary

Acceptance Criteria Proof

• [ ]

Test Delta

Tests Added

Tests Modified

Tests Removed Or Skipped

• None

Internal Reviewer Results

Allowed result values: PASS, PASS AFTER FIXES, PASS WITH LOW RISKS, or
N/A - with approved reason. Any N/A - with approved reason row must include
the reason in Notes.

Reviewed code SHA:

Reviewed at:

Reviewer run IDs:

Reviewer	Result	Blocking Findings	Notes
Senior engineering	Pending
QA/test	Pending
Security/auth	Pending
Product/ops	Pending
Architecture	Pending / N/A - with approved reason
CI integrity	Pending / N/A - with approved reason
Docs	Pending / N/A - with approved reason
Reuse/dedup	Pending / N/A - with approved reason
Test delta	Pending / N/A - with approved reason

External Review

External review response file:

• .agent-loop/initiatives/<initiative>/reviews/<chunk-id>-external-review-response.md

Source	Status	Notes
CodeRabbit	Pending
GitHub checks	Pending

CI And Gate Integrity

• No workflow weakening.
• No lint/test/docstring gate weakening.
• No coverage threshold weakening.
• No package script weakening.
• No unpinned new GitHub Action.
• Checkout credential persistence disabled where checkout is used.

Remaining Risks

Follow-Up Work

Human Review Focus

Please inspect:

Human Merge Ownership

• I can explain what changed.
• I can explain why it changed.
• I know what could break.
• I accept the remaining risks.
• The user explicitly approved this specific PR for merge.

Summary by CodeRabbit

• Chores
  • Added ownership and review rules for sensitive areas of the codebase, including payment, submission, authentication, workflow, and environment/secrets changes.
  • Updates in these areas now require security review before merge.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5d5f04c4-b00e-4fb0-81cc-d118f7cc63f5

📥 Commits

Reviewing files that changed from the base of the PR and between 45f0a87 and edbbfa4.

📒 Files selected for processing (1)

• .github/CODEOWNERS

---

📝 Walkthrough

Walkthrough

Adds a new .github/CODEOWNERS file defining ownership rules that require the security team to review changes to payment, submission/checker, workstream API, authentication, CI/CD workflow paths, and environment/secrets files using specific and wildcard path patterns.

Changes

CODEOWNERS Setup

Layer / File(s)	Summary
Add security ownership rules .github/CODEOWNERS	Assigns `@Flow-Research/security` as required reviewer for payment, submission/checker, workstream API, auth, CI/CD workflow, and .env* paths using specific and wildcard patterns.

Estimated code review effort: 1 (Trivial) | ~3 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is mostly template placeholders and lacks the required chunk, goal, changes, rationale, evidence, and review details.	Fill in the PR Trust Bundle sections with the actual chunk, intent, changed files, rationale, design, evidence, tests, risks, and review status.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: adding CODEOWNERS rules for security review routing on payment and submission paths.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch catchmeifyoucaan-patch-1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}