From 41dfface7869585df7300bb6f11b289899b5e4fa Mon Sep 17 00:00:00 2001
From: "claude[bot]" <209825114+claude[bot]@users.noreply.github.com>
Date: Fri, 4 Sep 2026 00:26:10 -0700
Subject: [PATCH] Model the maintainers group as a GitHub team with write on
 spec and read on maintainer-docs (#146)

* Grant maintainers team read access to maintainer-docs

Adds a GitHub team for the existing 'maintainers' role (previously
Discord/Google only, with no parent team so it does not inherit
steering-committee repo permissions) and grants it pull access to the
maintainer-docs repository.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LRucdTmghybeWkeaTtVuS1

* Grant maintainers team write access to the spec repo

Complete the maintainers group model: the parentless maintainers GitHub
team (added in this PR alongside its existing Discord role and Google
group) now gets push on modelcontextprotocol/modelcontextprotocol in
addition to pull on maintainer-docs. Branch protection on the spec repo
still requires changes to land via pull requests.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V6sAnrWknVzWzfuuzomMXk

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 src/config/repoAccess.ts | 2 ++
 src/config/roles.ts      | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/src/config/repoAccess.ts b/src/config/repoAccess.ts
index 8bb61b1..3fe85b4 100644
--- a/src/config/repoAccess.ts
+++ b/src/config/repoAccess.ts
@@ -115,6 +115,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'interest-groups', permission: 'triage' },
       { team: 'java-sdk', permission: 'triage' },
       { team: 'kotlin-sdk', permission: 'triage' },
+      { team: 'maintainers', permission: 'push' },
       { team: 'moderators', permission: 'maintain' },
       { team: 'php-sdk', permission: 'triage' },
       { team: 'python-sdk', permission: 'triage' },
@@ -384,6 +385,7 @@ export const REPOSITORY_ACCESS: RepositoryAccess[] = [
       { team: 'lead-maintainers', permission: 'maintain' },
       { team: 'core-maintainers', permission: 'admin' },
       { team: 'steering-committee', permission: 'maintain' },
+      { team: 'maintainers', permission: 'pull' },
     ],
     users: [{ username: 'sambhav', permission: 'admin' }],
   },
diff --git a/src/config/roles.ts b/src/config/roles.ts
index 6f032cd..d58b650 100644
--- a/src/config/roles.ts
+++ b/src/config/roles.ts
@@ -123,6 +123,8 @@ export const ROLES: readonly Role[] = [
   {
     id: ROLE_IDS.MAINTAINERS,
     description: 'General maintainers',
+    // No parent team: must not inherit steering-committee repo permissions
+    github: { team: 'maintainers' },
     discord: { role: 'maintainers (synced)' },
     // GWS user accounts are opt-in: maintainers add firstName/lastName/googleEmailPrefix
     // to their entry in users.ts via PR to get an @modelcontextprotocol.io account