Declare the security-room repository in repoAccess.ts with maxisbey as an
individual admin collaborator, so Max can administer the repo.
Claude-Session: https://claude.ai/code/session_01CEirkudZynjHTs8r1ZSyf1
Co-authored-by: Claude <noreply@anthropic.com>
a-akimov already held ROLE_IDS.DOCS_MAINTAINERS. Add ROLE_IDS.MAINTAINERS
to the entry so they join the maintainers GitHub team, Discord role and
Google group, matching #188 (sarahnovotny) and #187.
Claude-Session: https://claude.ai/code/session_01Di1nHXdz82X7NyZKqW3gvt
Co-authored-by: Claude <noreply@anthropic.com>
* Add monikaicampbell to interceptors WG members
* Update email
* Add other team members
* Add Steven
* Remove email
* Sort alphabetically
---------
Co-authored-by: Den <53200638+localden@users.noreply.github.com>
Takashi Norimatsu (tnorimat) held only ROLE_IDS.CONFORMANCE_AUTH
(push on the conformance repo) and Nate Barbettini (nbarbettini) held
only ROLE_IDS.WG_IG_FACILITATORS (Discord-only). Neither was in the
maintainers GitHub team, so neither could push branches to the spec
repo. Add ROLE_IDS.MAINTAINERS to both entries, matching #178.
Claude-Session: https://claude.ai/code/session_01Y4FEdK9BTa1MLBPhFhsR3d
Co-authored-by: Claude <noreply@anthropic.com>
Add Sarah Novotny (GitHub sarahnovotny, Discord 705092472082137109) to
users.ts with ROLE_IDS.MAINTAINERS, matching the shape of other
maintainer entries. Requested by Den Delimarsky.
Claude-Session: https://claude.ai/code/session_01Df1Y2g35K76EHJxpyTwVoH
Co-authored-by: Claude <noreply@anthropic.com>
e9e9f1b added a one-off 'pulumi state delete' to the Deploy to Production
step to drop the stale RepositoryCollaborators resource for the renamed
experimental-ext-skills repo, with a note to remove it after one green deploy.
Deploys have been green since run #257 (2026-09-10), so the URN no longer
exists in state and the command is a no-op guarded by '|| true'. Remove it so
the deploy step runs 'make up' as before.
Claude-Session: https://claude.ai/code/session_01H4JKj5FVkmj6bRzgh1GPrY
Co-authored-by: Claude <noreply@anthropic.com>
GitHub's list-repository-teams API now also returns teams whose access
comes from an organization role (orgRoles.ts: lead-maintainers and
core-maintainers hold all_repo_admin, security-managers holds
security_manager). During `pulumi up --refresh` the provider reads these
teams as direct collaborators on every repository, then tries to DELETE
the direct team-repo association where repoAccess.ts does not grant it —
and GitHub 404s because no direct association exists. This broke every
deploy starting with run #253 (first failure on experimental-ext-skills,
where refresh picked up lead-maintainers).
The pinned @pulumi/github 6.12.1 provider predates the upstream fix that
skips non-direct teams (integrations/terraform-provider-github#3571), so
work around it by passing ignoreTeams for the org-role-holding teams on
each RepositoryCollaborators resource — except teams the repository's
repoAccess.ts entry grants directly (e.g. lead-maintainers on
maintainer-docs), which must stay managed by Pulumi.
Remove this workaround once a @pulumi/github release including the
upstream fix is adopted.
Claude-Session: https://claude.ai/code/session_01H4JKj5FVkmj6bRzgh1GPrY
Co-authored-by: Claude <noreply@anthropic.com>
Deploys have failed since #178 because experimental-ext-skills was renamed
to ext-skills on GitHub and the stale RepositoryCollaborators state 404s on
update. Point config at the new name and drop the old resource from state
before 'make up' (same approach as #126; remove after one green deploy).
#168 also referenced SKILLS_OVER_MCP_IG, which #170 had renamed to
SKILLS_OVER_MCP_WG, and left tobi-oye out of sort order, breaking tsc and
'npm run check'.
Oluwatobi Oyewole has been contributing to experimental-ext-skills
(PR #116, triage on issues #66/#85).
Signed-off-by: olaservo <olahungerford@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: David Soria Parra <167242713+dsp-ant@users.noreply.github.com>
* Add Filesystems Working Group role, team, and lead memberships
* Add DanielTemesgen as Filesystems WG lead and michaelcheah as member per updated charter
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012ujLL8MSZA6F1apWiwQQ9b
---------
Co-authored-by: Claude <noreply@anthropic.com>
koic (Koichi Ito, Ruby SDK maintainer) only held ROLE_IDS.RUBY_SDK,
which maps to the ruby-sdk GitHub team with triage on the
modelcontextprotocol spec repo. The SDK_MAINTAINERS -> MAINTAINERS
implication is discordImplies-only and does not add members to the
maintainers GitHub team, so he could not push branches or open PRs
in the spec repo. Add ROLE_IDS.MAINTAINERS directly, matching other
maintainer entries.
Claude-Session: https://claude.ai/code/session_01H4JKj5FVkmj6bRzgh1GPrY
Co-authored-by: Claude <noreply@anthropic.com>
* Grant maintainers team read access to maintainer-docs
Adds a GitHub team for the existing 'maintainers' role (previously
Discord/Google only, with no parent team so it does not inherit
steering-committee repo permissions) and grants it pull access to the
maintainer-docs repository.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LRucdTmghybeWkeaTtVuS1
* Grant maintainers team write access to the spec repo
Complete the maintainers group model: the parentless maintainers GitHub
team (added in this PR alongside its existing Discord role and Google
group) now gets push on modelcontextprotocol/modelcontextprotocol in
addition to pull on maintainer-docs. Branch protection on the spec repo
still requires changes to land via pull requests.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V6sAnrWknVzWzfuuzomMXk
---------
Co-authored-by: Claude <noreply@anthropic.com>
Adds tnorimat as a member, creates the conformance-auth GitHub team
(tnorimat + pcarleton), and grants it push on the conformance repo so
the team can be referenced from a CODEOWNERS file there.
Claude-Session: https://claude.ai/code/session_01FDRFtxQbYLnBcpwndGXF7W
Co-authored-by: Claude <noreply@anthropic.com>
Add the enterprise-managed-authorization IG, the two active auth
sub-WGs (tool scopes and fine-grained authorization), an agents WG
Discord role, and auth IG memberships from the charter. Convert
skills-over-mcp from IG to WG and security from WG to IG per their
charters, updating team names and all references. Add ochafik to the
MCP Apps WG and pcarleton to the security IG. Remove the
server-identity-wg and agents-ig roles, whose Discord channels are
archived or gone. Fix the README link to src/config/roles.ts.
Claude-Session: https://claude.ai/code/session_01VRxNJh9HqnkTYdpALP5Vhf
Co-authored-by: Claude <noreply@anthropic.com>
* Add npm/PyPI package publishing access management (config + drift detection)
Declare expected npm org membership, per-package maintainers and trusted
publishers, and PyPI project rosters in src/config/packageAccess.ts, with
npm/pypi identity fields on members in users.ts.
Deliberately outside the Pulumi resource graph: npm governance writes
require an interactive 2FA challenge since August 2026 (read endpoints
still work with a granular access token), and PyPI has no management API
at all. Drift against the live npm registry is detected read-only by
scripts/check-package-drift.ts (weekly via package-drift.yml, no-op when
the NPM_READ_TOKEN secret is absent), which emits a remediation plan of
npm CLI commands for a maintainer to run in one 2FA-approved session.
PyPI procedures are documented as a manual runbook in the README.
* Encode all slashes when escaping package names in registry URLs
Fixes the CodeQL finding: String.replace with a string pattern only
replaces the first occurrence. Use a shared helper with a global regex,
following the npm CLI convention (keep '@' literal, encode every '/').
---------
Co-authored-by: Claude <noreply@anthropic.com>
Restore the googleEmailPrefix dropped in the previous commit and mark the
account existingGWSUser so it is kept but no longer Pulumi-managed, matching
how toby's emeritus account is handled. Before deploying, remove the
gws-user-nick resource from Pulumi state (pulumi state delete, not destroy)
or Pulumi will delete the real account.
No-Verification-Needed: declarative access config, only exercisable via prod deploy
Same approach as pwwpche in #111: keep the member entry, empty memberOf.
The googleEmailPrefix is dropped since no remaining role provisions a
GWS account, so the nick@ account will be deprovisioned on next deploy.
No-Verification-Needed: declarative access config, only exercisable via prod deploy
* Skills Over MCP IG membership housekeeping
Add aditya-scio to the Skills Over MCP Interest Group.
Remove the IG role from BobDickinson; his other roles are unchanged.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* Apply prettier formatting
Bob's memberOf array now fits on one line at printWidth 100.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Adds a 'service-accounts' role that carries no GitHub, Discord, or
Google group config and exists solely to make its members eligible
for GWS user provisioning, plus a member entry that provisions
claude@modelcontextprotocol.io. Claude has no GitHub or Discord
handle, so none of the existing provisionUser roles fit.
Brings the conformance repo under access management. Its only direct
grant today is felixweinberger at maintain (team access comes from
org-level roles), so this entry bumps him to admin.
GWS user accounts were only created for members whose direct roles had
google.provisionUser (lead/core maintainers, moderators, maintainers,
registry-wg). SDK maintainers and working-group members who opted in by
adding firstName/lastName/googleEmailPrefix (e.g. #148, #150, #152)
silently got no account.
- Move provisionUser from GoogleConfig to the Role level, and add it to
the implicit-maintainer containers (sdk-maintainers, working-groups)
plus the standalone maintainer roles (docs, inspector, mcpb,
reference-servers, use-mcp, server-identity-wg, wg/ig facilitators).
- Eligibility now walks github.parent chains (hasProvisionUserRole),
matching GitHub team-nesting semantics, so e.g. python-sdk members
qualify via sdk-maintainers.
- validate-config now errors when a googleEmailPrefix would be a silent
no-op (no eligible role and not an existing GWS user), so opt-in PRs
like #150 fail CI instead of quietly doing nothing.
Newly provisioned on next apply: marcelo@, alexhancock@, liad@.
ochafik is now eligible but already has an account (existingGWSUser).
* Add security-managers org role and assign maxisbey
Model GitHub's pre-defined security_manager organization role in the
IaC: new GitHub-only security-managers team wired to the org role via
ORG_ROLE_ASSIGNMENTS, following the existing all_repo_admin pattern.
Add Max Isbey (maxisbey) as its first member so he can view draft
security advisories for coordinated disclosure work.
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0147Pp292yN9cQKCQBphVyMy
* Add jenn-newton to security-managers team
Paul Carleton asked for Jenn to join the new security-managers team
alongside Max Isbey. Resolved to Jenn Newton (jenn-newton), already a
member of the security working group in this config.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
