From 860ed0ab0cfc878ff0cca91b466e27827c0f2bfd Mon Sep 17 00:00:00 2001
From: Beatriz Couto <bcouto@redhat.com>
Date: Thu, 20 Aug 2026 13:16:33 +0100
Subject: [PATCH 1/2] feat: add evidence-locker-mvp-reviewers team

Create a closed GitHub team so Evidence Locker MVP reviewer membership
can change in peribolos.yaml without editing CODEOWNERS.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 MAINTAINING.md | 12 ++++++++++++
 peribolos.yaml | 25 +++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/MAINTAINING.md b/MAINTAINING.md
index cdd0b70..e20a6e9 100644
--- a/MAINTAINING.md
+++ b/MAINTAINING.md
@@ -85,6 +85,18 @@ already a member) but it triggers a false-positive drift alert.
 3. Ensure admins are listed as `maintainers`, not `members` (CI validates).
 4. Submit a PR and merge.
 
+### Evidence Locker MVP reviewers
+
+`evidence-locker-mvp-reviewers` is the reviewer pool for issues and pull
+requests whose milestone title is **Evidence Locker MVP** (or **Internal
+Evidence Locker MVP**). Membership is the source of truth: change the
+`members` list in `peribolos.yaml` to add or remove reviewers.
+
+GitHub CODEOWNERS cannot filter on milestones, so assignment is done by
+the org-infra workflow **Assign Evidence Locker MVP Reviewers** (see
+`docs/MILESTONE_REVIEWERS.md` in `complytime/org-infra`). Native GitHub
+code review auto-assignment is not used for this team.
+
 ### Add a New Repository to Safe-settings Management
 
 1. Add the repo to `peribolos.yaml` with `description`, `has_projects`,
diff --git a/peribolos.yaml b/peribolos.yaml
index 2f6ccd4..572d2c3 100644
--- a/peribolos.yaml
+++ b/peribolos.yaml
@@ -238,3 +238,28 @@ orgs:
           homebrew-tap: write
           org-infra: write
           website: write
+      evidence-locker-mvp-reviewers:
+        description: Reviewers automatically assigned to Evidence Locker MVP milestone items
+        privacy: closed
+        maintainers:
+          - gxmiranda
+          - jpower432
+          - marcusburghardt
+        members:
+          - hbraswelrh
+          - sedonnel
+          - trevor-vaughan
+        repos:
+          community: write
+          complyapi: write
+          complyctl: write
+          complypack: write
+          complyscribe: write
+          complytime: write
+          complytime-collector-components: write
+          complytime-demos: write
+          complytime-policies: write
+          complytime-providers: write
+          homebrew-tap: write
+          org-infra: write
+          website: write

From 69c917fde8f0425ab53cabc15c15ec3c3f3065a1 Mon Sep 17 00:00:00 2001
From: Beatriz Couto <bcouto@redhat.com>
Date: Fri, 21 Aug 2026 09:33:06 +0100
Subject: [PATCH 2/2] Grant evidence-locker-mvp-reviewers maintain on nunya.

Evidence Locker MVP work lives in nunya, so reviewers need repo access
to be requested and to create sub-issues.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 peribolos.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/peribolos.yaml b/peribolos.yaml
index 572d2c3..72f5796 100644
--- a/peribolos.yaml
+++ b/peribolos.yaml
@@ -261,5 +261,9 @@ orgs:
           complytime-policies: write
           complytime-providers: write
           homebrew-tap: write
+          # Maintain is required to create sub-issues (GitHub hides the
+          # button for Read). nunya-access is a secret team, so peribolos
+          # cannot manage it (--ignore-secret-teams).
+          nunya: maintain
           org-infra: write
           website: write