ci: add governance workflows and remove CODEOWNERS

.github/workflows/governance.yml

@@ -0,0 +1,35 @@
+---
+name: PR Governance
+
+on:
+  pull_request_target:
+    types: [
+      opened, 
+      synchronize, 
+      reopened, 
+      ready_for_review, 
+      review_requested, 
+      review_request_removed, 
+      assigned, 
+      unassigned
+    ]
+  workflow_run:
+    workflows: ["PR Review Listener"]
+    types: [completed]
+
+jobs:
+  governance:
+    name: Reviews
+    permissions:
+      statuses: write
+      contents: read
+      pull-requests: read
+    # Use the reusable workflow defined in the central governance repository
+    # zizmor: ignore[ref-confusion]
+    uses: Universal-Commerce-Protocol/.github/.github/workflows/reusable-governance.yml@main
+    with:
+      pr-number: ${{ github.event.pull_request.number }}
+      commit-sha: ${{ github.event.pull_request.head.sha || github.event.workflow_run.head_sha }}
+    secrets:
+      # Required: An org-level Read token to read team memberships
+      ORG_READ_TOKEN: ${{ secrets.ORG_READ_TOKEN }}

.github/workflows/pr-review-listener.yml

@@ -0,0 +1,12 @@
+name: PR Review Listener
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+
+jobs:
+  signal:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Signal success
+        run: |
+          echo "PR ${{ github.event.pull_request.number }} review state changed."

org-tools/governance/rules/.github-rules.yml

@@ -0,0 +1,54 @@
+# Target Repository: .github
+# Repository URL: https://github.com/Universal-Commerce-Protocol/.github
+---
+rules:
+  # ---------------------------------------------------------
+  # Governance
+  # ---------------------------------------------------------
+  - name: "governance"
+    patterns:
+      - "GOVERNANCE.md"
+      - "CONTRIBUTING.md"
+      - "CODE_OF_CONDUCT.md"
+      - "SECURITY.md"
+      - "TC_ELECTIONS.md"
+      - "LICENSE"
+      - "DOMAIN_TECH_COUNCIL_CHARTER.md"
+      - "MAINTAINERS.md"
+    requires:
+      # Strictly Governance Council (L4)
+      - team: "governance-council"
+        min_approvals: 2
+
+  # ---------------------------------------------------------
+  # Infrastructure, Tooling & Configuration (including org-tools)
+  # ---------------------------------------------------------
+  - name: "infra_and_tooling"
+    patterns:
+      - ".github/**"
+      - "renovate.json"
+      - ".pre-commit-config.yaml"
+      - ".gitignore"
+      - "org-tools/**"
+      - "pyproject.toml"
+      - "uv.lock"
+      - "README.md"
+    requires:
+      # Grants access to devops (L1) and higher
+      - min_team: "devops-maintainers"
+        min_approvals: 2
+
+fallback:
+  requires:
+    # Default for all files (*).
+    - min_team: "governance-council"
+      min_approvals: 2
+
+proxy_reviewers:
+  - amithanda
+
+team_hierarchy:
+  devops-maintainers: 1
+  maintainers: 2
+  tech-council: 3
+  governance-council: 4

org-tools/governance/rules/meeting-minutes-rules.yml

@@ -47,8 +47,6 @@ rules:
       - "README.md"
       - "CONTRIBUTING.md"
       - "SECURITY.md"
-    excludes:
-      - ".github/CODEOWNERS"
     requires:
       # Grants access to devops (L1), maintainers (L2), tech-council (L3),
       # and governance-council (L4)