chore: establish ProdClaw governance

.github/CODEOWNERS

@@ -1,56 +1,62 @@
 # Protect the ownership rules themselves.
-/.github/CODEOWNERS @steipete
+/.github/CODEOWNERS @timeleft--
 
 # WARNING: GitHub CODEOWNERS uses last-match-wins semantics.
-# If you add overlapping rules below the secops block, include @openclaw/openclaw-secops
-# on those entries too or you can silently remove required secops review.
-# Security-sensitive code, config, and docs require secops review.
-/SECURITY.md @openclaw/openclaw-secops
-/.github/dependabot.yml @openclaw/openclaw-secops
-/.github/codeql/ @openclaw/openclaw-secops
-/.github/workflows/codeql.yml @openclaw/openclaw-secops
-/.github/workflows/codeql-android-critical-security.yml @openclaw/openclaw-secops
-/.github/workflows/codeql-critical-quality.yml @openclaw/openclaw-secops
-/src/security/ @openclaw/openclaw-secops
-/src/secrets/ @openclaw/openclaw-secops
-/src/config/*secret*.ts @openclaw/openclaw-secops
-/src/config/**/*secret*.ts @openclaw/openclaw-secops
-/src/gateway/*auth*.ts @openclaw/openclaw-secops
-/src/gateway/**/*auth*.ts @openclaw/openclaw-secops
-/src/gateway/*secret*.ts @openclaw/openclaw-secops
-/src/gateway/**/*secret*.ts @openclaw/openclaw-secops
-/src/gateway/security-path*.ts @openclaw/openclaw-secops
-/src/gateway/resolve-configured-secret-input-string*.ts @openclaw/openclaw-secops
-/src/gateway/protocol/**/*secret*.ts @openclaw/openclaw-secops
-/src/gateway/server-methods/secrets*.ts @openclaw/openclaw-secops
-/src/agents/*auth*.ts @openclaw/openclaw-secops
-/src/agents/**/*auth*.ts @openclaw/openclaw-secops
-/src/agents/auth-profiles*.ts @openclaw/openclaw-secops
-/src/agents/auth-health*.ts @openclaw/openclaw-secops
-/src/agents/auth-profiles/ @openclaw/openclaw-secops
-/src/agents/sandbox.ts @openclaw/openclaw-secops
-/src/agents/sandbox-*.ts @openclaw/openclaw-secops
-/src/agents/sandbox/ @openclaw/openclaw-secops
-/src/infra/secret-file*.ts @openclaw/openclaw-secops
-/src/cron/stagger.ts @openclaw/openclaw-secops
-/src/cron/service/jobs.ts @openclaw/openclaw-secops
-/docs/security/ @openclaw/openclaw-secops
-/docs/gateway/authentication.md @openclaw/openclaw-secops
-/docs/gateway/sandbox-vs-tool-policy-vs-elevated.md @openclaw/openclaw-secops
-/docs/gateway/sandboxing.md @openclaw/openclaw-secops
-/docs/gateway/secrets-plan-contract.md @openclaw/openclaw-secops
-/docs/gateway/secrets.md @openclaw/openclaw-secops
-/docs/gateway/security/ @openclaw/openclaw-secops
-/docs/cli/approvals.md @openclaw/openclaw-secops
-/docs/cli/sandbox.md @openclaw/openclaw-secops
-/docs/cli/security.md @openclaw/openclaw-secops
-/docs/cli/secrets.md @openclaw/openclaw-secops
-/docs/reference/secretref-credential-surface.md @openclaw/openclaw-secops
-/docs/reference/secretref-user-supplied-credentials-matrix.json @openclaw/openclaw-secops
+# This downstream repo can only name collaborators or teams with write access here.
+# Security-sensitive code, config, and docs require owner review.
+/SECURITY.md @timeleft--
+/.github/dependabot.yml @timeleft--
+/.github/codeql/ @timeleft--
+/.github/workflows/codeql.yml @timeleft--
+/.github/workflows/codeql-android-critical-security.yml @timeleft--
+/.github/workflows/codeql-critical-quality.yml @timeleft--
+/src/security/ @timeleft--
+/src/secrets/ @timeleft--
+/src/config/*secret*.ts @timeleft--
+/src/config/**/*secret*.ts @timeleft--
+/src/gateway/*auth*.ts @timeleft--
+/src/gateway/**/*auth*.ts @timeleft--
+/src/gateway/*secret*.ts @timeleft--
+/src/gateway/**/*secret*.ts @timeleft--
+/src/gateway/security-path*.ts @timeleft--
+/src/gateway/resolve-configured-secret-input-string*.ts @timeleft--
+/src/gateway/protocol/**/*secret*.ts @timeleft--
+/src/gateway/server-methods/secrets*.ts @timeleft--
+/src/agents/*auth*.ts @timeleft--
+/src/agents/**/*auth*.ts @timeleft--
+/src/agents/auth-profiles*.ts @timeleft--
+/src/agents/auth-health*.ts @timeleft--
+/src/agents/auth-profiles/ @timeleft--
+/src/agents/sandbox.ts @timeleft--
+/src/agents/sandbox-*.ts @timeleft--
+/src/agents/sandbox/ @timeleft--
+/src/infra/secret-file*.ts @timeleft--
+/src/cron/stagger.ts @timeleft--
+/src/cron/service/jobs.ts @timeleft--
+/docs/security/ @timeleft--
+/docs/gateway/authentication.md @timeleft--
+/docs/gateway/sandbox-vs-tool-policy-vs-elevated.md @timeleft--
+/docs/gateway/sandboxing.md @timeleft--
+/docs/gateway/secrets-plan-contract.md @timeleft--
+/docs/gateway/secrets.md @timeleft--
+/docs/gateway/security/ @timeleft--
+/docs/cli/approvals.md @timeleft--
+/docs/cli/sandbox.md @timeleft--
+/docs/cli/security.md @timeleft--
+/docs/cli/secrets.md @timeleft--
+/docs/reference/secretref-credential-surface.md @timeleft--
+/docs/reference/secretref-user-supplied-credentials-matrix.json @timeleft--
 
 # Release workflow and its supporting release-path checks.
-/.github/workflows/openclaw-npm-release.yml @openclaw/openclaw-release-managers
-/docs/reference/RELEASING.md @openclaw/openclaw-release-managers
-/scripts/openclaw-npm-publish.sh @openclaw/openclaw-release-managers
-/scripts/openclaw-npm-release-check.ts @openclaw/openclaw-release-managers
-/scripts/release-check.ts @openclaw/openclaw-release-managers
+/.github/workflows/openclaw-npm-release.yml @timeleft--
+/docs/reference/RELEASING.md @timeleft--
+/scripts/openclaw-npm-publish.sh @timeleft--
+/scripts/openclaw-npm-release-check.ts @timeleft--
+/scripts/release-check.ts @timeleft--
+
+# ProdClaw downstream governance and release surfaces.
+# Keep these rules last so broader upstream workflow rules cannot override @timeleft--.
+/PRODCLAW.md @timeleft--
+/PRODCLAW_UPSTREAM.json @timeleft--
+/docs/reference/prodclaw-release-policy.md @timeleft--
+/.github/workflows/prodclaw-*.yml @timeleft--

.github/workflows/auto-response.yml

@@ -19,6 +19,9 @@ permissions: {}
 
 jobs:
   auto-response:
+    # ProdClaw does not carry OpenClaw maintainer app secrets. Keep this
+    # inherited automation upstream-only unless ProdClaw deliberately replaces it.
+    if: github.repository == 'openclaw/openclaw' || github.repository == 'openclaw-org/openclaw'
     permissions:
       contents: read
       issues: write

.github/workflows/labeler.yml

@@ -27,6 +27,9 @@ permissions: {}
 
 jobs:
   label:
+    # ProdClaw does not carry OpenClaw maintainer app secrets. Keep this
+    # inherited triage automation upstream-only unless ProdClaw deliberately replaces it.
+    if: github.repository == 'openclaw/openclaw' || github.repository == 'openclaw-org/openclaw'
     permissions:
       contents: read
       pull-requests: write
@@ -441,7 +444,7 @@ jobs:
             }
 
   backfill-pr-labels:
-    if: github.event_name == 'workflow_dispatch'
+    if: github.event_name == 'workflow_dispatch' && (github.repository == 'openclaw/openclaw' || github.repository == 'openclaw-org/openclaw')
     permissions:
       contents: read
       pull-requests: write
@@ -741,6 +744,7 @@ jobs:
             core.info(`Processed ${processed} pull requests.`);
 
   label-issues:
+    if: github.repository == 'openclaw/openclaw' || github.repository == 'openclaw-org/openclaw'
     permissions:
       issues: write
     runs-on: ubuntu-24.04

.github/workflows/prodclaw-governance.yml

@@ -0,0 +1,117 @@
+name: ProdClaw Governance
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  semantic-pr:
+    name: Validate PR
+    if: ${{ github.event_name == 'pull_request' }}
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - name: Check PR title
+        id: lint-pr-title
+        uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Add PR title error comment
+        uses: marocchino/sticky-pull-request-comment@d2ad0de260ae8b0235ce059e63f2949ba9e05943
+        if: always() && (steps.lint-pr-title.outputs.error_message != null)
+        with:
+          header: prodclaw-pr-title-lint-error
+          message: |
+            ProdClaw PR titles must follow Conventional Commits.
+
+            ```
+            ${{ steps.lint-pr-title.outputs.error_message }}
+            ```
+
+      - name: Delete PR title error comment
+        uses: marocchino/sticky-pull-request-comment@d2ad0de260ae8b0235ce059e63f2949ba9e05943
+        if: ${{ steps.lint-pr-title.outputs.error_message == null }}
+        with:
+          header: prodclaw-pr-title-lint-error
+          delete: true
+
+  prodclaw-governance:
+    name: ProdClaw Governance
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        with:
+          persist-credentials: false
+
+      - name: Validate ProdClaw boundary docs
+        shell: bash
+        run: |
+          set -euo pipefail
+          files=(
+            PRODCLAW.md
+            docs/reference/prodclaw-release-policy.md
+            AGENTS.md
+            CONTRIBUTING.md
+            PRODCLAW_UPSTREAM.json
+            .github/workflows/prodclaw-governance.yml
+            .github/workflows/prodclaw-release.yml
+          )
+
+          for f in "${files[@]}"; do
+            test -f "$f"
+          done
+
+          # These checks are lightweight tripwires for accidental boundary-doc deletion.
+          # CODEOWNERS review is still the authoritative governance control.
+          grep -q "\\*\\*GA\\*\\* is the current production-ready channel" PRODCLAW.md
+          grep -q "\\*\\*LTS\\*\\* is the conservative channel" PRODCLAW.md
+          grep -q "at least 10 days old" PRODCLAW.md
+          grep -q "ProdClaw uses SemVer tags" PRODCLAW.md
+
+          private_pattern='MachineWisdomAI/''iris|iris''-[a-z0-9-]+|azureuser''@|/Users''/|/home/''younes|OPENROUTER_''API_KEY|TELEGRAM_''BOT_TOKEN'
+          if grep -RInE "$private_pattern" "${files[@]}"; then
+            echo "ProdClaw governance files must not contain private deployment details." >&2
+            exit 1
+          fi
+
+      - name: Validate ProdClaw tag policy
+        shell: bash
+        run: |
+          set -euo pipefail
+          node --input-type=module <<'NODE'
+          const accepted = [
+            "v1.0.0",
+            "v1.2.3",
+            "v2.0.0-rc.1",
+            "v12.34.56-rc.10",
+            "v1.0.0-rc.10",
+          ];
+          const rejected = [
+            "v2026.4.27",
+            "2026.4.27",
+            "v1.0",
+            "v1.0.0-beta.1",
+            "v0.1.0",
+            "v1.02.3",
+            "v1.2.03",
+            "v1.2.3-rc.01",
+          ];
+          const pattern = /^v(?!\d{4}\.)[1-9]\d*\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)(?:-rc\.[1-9]\d*)?$/;
+          for (const tag of accepted) {
+            if (!pattern.test(tag)) {
+              throw new Error(`expected accepted ProdClaw tag: ${tag}`);
+            }
+          }
+          for (const tag of rejected) {
+            if (pattern.test(tag)) {
+              throw new Error(`expected rejected ProdClaw tag: ${tag}`);
+            }
+          }
+          NODE