[antuz123]

Cloud review now depends on actual severity, uncertainty, scope and cost; human developer review stays optional. Verified routine documentation, noncritical copy or pure style may skip a separate provider review with reason/evidence, but policy/security/agent/workflow documents cannot Skip. Bounded normal changes use Lite; signing, keys, authentication, recovery/backup, pairing, transactions, migrations, workflows, permissions, security dependencies/copy, cross-service/complex changes and unknown risk use Balanced.

Use the least-cost adequate authorized route, reuse valid exact-head/base coverage, make one initial review after stable checks and batch material fixes before necessary re-review. Independent coverage is needed only when an actual risk/finding requires it and an installed, authorized route/scope/budget exists. If scope, quota, cap or activation is unavailable, record unavailable and use another already-authorized adequate route or hold the applicable gate. Do not downgrade critical review, add paid retries/fallbacks or infer fresh allowance. Existing caps and historical balances do not activate a reviewer or grant budget; ordinary within-scope/allowance review does not need repeated permission.

Actual findings/dispositions, reviewed SHA/base/coverage and skipped/pending/unavailable results must be recorded. Required CI/status checks, substantive security concerns, native/device validation, product signoff and operation-specific signing/deployment/release authorization remain intact. Existing comment-only human CODEOWNERS suggestions remain optional and require no access grants.

Policy/docs/templates/agent instructions only: no runtime, workflow, R5 implementation, permission, secret, budget, merge or deployment change. No new provider request or paid review is claimed. Current recorded Copilot ready-PR automation, plus mobile every-push review, does not implement conditional triage; Markdown does not fix settings or install mobile reviewer #7049. Keep source preparation and installed automation status separate.

Historical receipts remain tied to exact original commits. Record current-head validation separately; skipped/unavailable review is not a clean review.

Current conditional-policy head: b948b8149b01172f488f53b3aadae657b884b886. An existing cloud agent who did not author these policy edits independently reviewed the exact prepared patch (manifest SHA-256 a0bf37b7be612932af8911e329899178f7db123c6b66aa0cd2a492df108b6a5a); no blocking finding. This is cloud-agent source evidence, not a completed Copilot/Claude provider review or formal GitHub approval. Fresh exact-head CI evidence follows. Policies remain draft/unmerged and live GitHub rules are unchanged: administrator access is still needed to remove enforced human approval and implement conditional triggering. No ready transition or new provider/paid review was requested.

Fresh exact-head CI: Fresh exact-head source-readiness39733657072 passed both secret scans. Build/test39733657063 failed the intact runtime dependency audit: twoHigh follow-redirects advisories,450packages,exit8; test step was skipped, so no fresh compile/test pass is claimed. The separate locally validated1.16.1 lock correction remains unpublished; this public-source failure does not reopen the accepted private production Relay deployment.

[Copilot]

Copilot review overview

🔵 Needs a closer look

The PR must remain draft until Ben’s repository access is explicitly approved and verified.

Review effort: Balanced
Findings: None

What changed in this PR

Adds Ben and Utkarsh as default code owners for future Relay PRs into main.

Changes:

• Adds a catch-all ownership rule for both developers.
• Documents the separately enforced one-approval requirement.

File	Description
.github/​CODEOWNERS	Assigns both developers as owners of all files.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[antuz123]

Cloud review-policy dependency check — 12 October 2026

Current source head 93d56a43029e1886ea8239f65734debe48d3a190 is unchanged; exact-head hosted CI is successful. Public GitHub permission read reports Ben=read, Parsh=read, Utkarsh=admin. Read access does not establish accepted CODEOWNERS write access. Keep this unapproved PR draft while the documented access dependency remains open; verify all intended owners before ready/merge. No invitation, role, review effort/quota, permission or branch-protection setting was changed. No fresh Copilot review was requested. Documentation review does not need native Mac testing, and no source-policy approval substitutes for app/Desktop/backend or release acceptance.