ci(review): move unaccepted PRs back to draft

.github/CODEOWNERS

@@ -31,9 +31,10 @@
 /tasks/scripts/check_maintainer_approval_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
 /tasks/scripts/alert_maintainer_change_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
 
-# PR issue acceptance checks
-/tasks/scripts/check_issue_acceptance.cjs @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
-/tasks/scripts/check_issue_acceptance.test.cjs @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+# Reviewer routing registry and shared acceptance helper
+/REVIEWERS.md @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/tasks/scripts/check_review_readiness.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
+/tasks/scripts/check_review_readiness_test.py @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr
 
 # Auditable SBOM check
 /tasks/scripts/verify-image-sbom.sh @NVIDIA/openshell-codeowners @mrunalp @sjenning @derekwaynecarr

.github/workflows/pr-issue-acceptance.yml

@@ -29,12 +29,15 @@ jobs:
         with:
           ref: ${{ github.sha }}
           persist-credentials: false
-          sparse-checkout: tasks/scripts/check_issue_acceptance.cjs
+          sparse-checkout: tasks/scripts/check_review_readiness.py
           sparse-checkout-cone-mode: false
 
-      - name: Check author access and linked issue acceptance
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
-        with:
-          script: |
-            const check = require('./tasks/scripts/check_issue_acceptance.cjs');
-            await check({ github, context, core });
+      - name: Check PR acceptance
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          python3 tasks/scripts/check_review_readiness.py \
+            --repo "$GH_REPO" --pr "$PR_NUMBER" --acceptance-only \
+            --event-path "$GITHUB_EVENT_PATH"

.github/workflows/review-readiness.yml

@@ -0,0 +1,50 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Review Readiness
+
+on:
+  pull_request_target:
+    types: [opened, ready_for_review, labeled, unlabeled]
+
+permissions:
+  contents: read
+  issues: read
+  pull-requests: write
+
+concurrency:
+  group: review-readiness-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  reviewers:
+    name: OpenShell / Review Readiness
+    if: >-
+      !github.event.pull_request.draft &&
+      (github.event.action == 'opened' ||
+       github.event.action == 'ready_for_review' ||
+       startsWith(github.event.label.name, 'area:') ||
+       startsWith(github.event.label.name, 'topic:'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      # Use the merged roster and helper, never code from the PR head.
+      - name: Check out the reviewer roster and helper
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          sparse-checkout: |
+            REVIEWERS.md
+            tasks/scripts/check_review_readiness.py
+          sparse-checkout-cone-mode: false
+          persist-credentials: false
+
+      - name: Reconcile reviewer requests
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_EVENT: ${{ github.event.action }}
+        run: |
+          python3 tasks/scripts/check_review_readiness.py \
+            --repo "$GH_REPO" --pr "$PR_NUMBER" --event "$PR_EVENT" --apply

CONTRIBUTING.md

@@ -70,9 +70,11 @@ Use agents and the repository skills as needed to understand the affected code,
 
 Every pull request must be approved by someone listed in [MAINTAINERS.md](MAINTAINERS.md) before it can merge. This is enforced by the `OpenShell / Maintainer Approval` status check, which turns green once one of those reviewers approves. Reviews from other contributors are welcome and count toward the general approval requirement, but they do not satisfy this check.
 
-Pull requests that touch the enforcement machinery itself — anything under `.github/workflows/`, `.github/actions/`, `MAINTAINERS.md`, `.github/CODEOWNERS`, or the enforcement scripts in `tasks/scripts/` — additionally require a code owner's approval, listed in [.github/CODEOWNERS](.github/CODEOWNERS). The status check reads its inputs from `main`, but a workflow triggered by a review runs the pull request's own copy of the workflow file, so GitHub's native code owner requirement is what keeps a change from disabling the gate that would have blocked it.
+Pull requests that touch the enforcement machinery or reviewer routing — anything under `.github/workflows/`, `.github/actions/`, `MAINTAINERS.md`, `REVIEWERS.md`, `.github/CODEOWNERS`, or the enforcement and reviewer-routing scripts in `tasks/scripts/` — additionally require a code owner's approval, listed in [.github/CODEOWNERS](.github/CODEOWNERS). The status check reads its inputs from `main`, but a workflow triggered by a review runs the pull request's own copy of the workflow file, so GitHub's native code owner requirement is what keeps a change from disabling the gate that would have blocked it.
 
-Maintainers are not requested automatically. If your pull request has been idle, ask for a reviewer in the pull request or in the CNCF Slack channel rather than waiting.
+Use exactly one `area:` label and any relevant `topic:` labels on your pull request. The [reviewer routing workflow](.github/workflows/review-readiness.yml) requests all matching members of [REVIEWERS.md](REVIEWERS.md) with repository write access, excluding the author, when a PR opens ready for review, leaves draft status, or gains or loses an area/topic label. Manual reviewer choices and people who have commented or reviewed are preserved. Propose roster membership changes through a reviewed PR.
+
+If your pull request has been idle, ask for a reviewer in the pull request or in the CNCF Slack channel rather than waiting.
 
 ## Agent Skills
 
@@ -406,8 +408,6 @@ Every PR except an automated dependency update must close an existing issue. In
 
 Authors without write access to the target repository must link at least one issue with `state:accepted`, and every linked issue must be accepted. This applies to drafts and direct requests to agents. Authors with verified `WRITE`, `MAINTAIN`, or `ADMIN` access may create a PR without the acceptance label; they must still follow the issue-linking requirement above. PR body text, roadmap placement, other labels, and vouch status do not bypass acceptance.
 
-The `PR Issue Acceptance` workflow reports the native `OpenShell / PR Issue Acceptance` job result for the triggering PR when it is opened, edited, reopened, or updated with new commits. It does not publish a shared commit status; lookup and execution errors fail the job. Link accepted issues in this repository using `Fixes #NNN` or `Closes #NNN`; GitHub recognizes closing references when a PR targets the default branch. Rerun the workflow after issue labels change. Making the job required for merging and configuring any required Actions event policy are separate repository settings; merge-queue support is not included.
-
 Automated dependency update PRs, including Dependabot PRs, are exempt from the separate issue and closing-reference requirement. Human-authored dependency updates follow the normal issue requirement. The exception does not bypass `PR Issue Acceptance` for authors without repository write access or change applicable verification, review, or private vulnerability disclosure requirements.
 
 ### Branch Names

REVIEWERS.md

@@ -0,0 +1,237 @@
+# Review areas and topics
+
+## Areas
+
+Areas are OpenShell-specific components or system boundaries. They represent the division of labor across the project. Keep the number of areas small enough to support named leads and reporting during community calls.
+
+### area:build
+
+CI/CD workflows, release pipelines, build targets, packaging, and artifact publication.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Matthew Grossman | [@matthewgrossman](https://github.com/matthewgrossman) | NVIDIA |
+| Simon Scatton | [@SDAChess](https://github.com/SDAChess) | NVIDIA |
+| Jim Meyer | [@purp](https://github.com/purp) | NVIDIA |
+
+### area:drivers
+
+Infrastructure orchestration, including compute scheduling, secret management, runtime integrations (GPU, Docker, virtual machines, Kata Containers, and Kubernetes), deployment topologies, and pause/resume lifecycle operations. Includes host OS and architecture support (including amd64 and arm64), backend-specific isolation (including Windows AppContainer and isolation sessions), and compatibility.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Evan Lezar | [@elezar](https://github.com/elezar) | NVIDIA |
+| Drew Newberry | [@drew](https://github.com/drew) | NVIDIA |
+| Mrunal Patel | [@mrunalp](https://github.com/mrunalp) | Red Hat |
+| Divesh Chowdary | [@FrostGod](https://github.com/FrostGod) | NVIDIA |
+
+### area:runtime
+
+Sandbox execution, isolation, process supervision, policy enforcement, network proxying, middleware, volumes, and (agent) memory. Includes shared isolation primitives such as Linux namespaces, seccomp and Landlock, and process/executable identity.
+
+Provider discovery and configuration, profiles, sandbox attachments, provider-contributed policy, credential resolution and delivery, refresh and rotation, and provider lifecycle management.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Drew Newberry | [@drew](https://github.com/drew) | NVIDIA |
+| Taylor Mutch | [@TaylorMutch](https://github.com/TaylorMutch) | NVIDIA |
+| Shiju | [@shiju-nv](https://github.com/shiju-nv) | NVIDIA |
+| Jim Meyer | [@purp](https://github.com/purp) | NVIDIA |
+
+### area:enterprise
+
+Authentication, multitenancy, gateway interceptors, FIPS compliance, and other enterprise requirements.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Seth Jennings | [@sjenning](https://github.com/sjenning) | Red Hat |
+| Derek Carr | [@derekwaynecarr](https://github.com/derekwaynecarr) | Red Hat |
+
+### area:platform
+
+SDKs, CLIs, API machinery, gateway infrastructure, persistence (eg postgres, sqlite support), configuration (gateway.toml), and gateway-side sandbox and session management.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Piotr Mlocek | [@pimlock](https://github.com/pimlock) | NVIDIA |
+| Taylor Mutch | [@TaylorMutch](https://github.com/TaylorMutch) | NVIDIA |
+| Divesh Chowdary | [@FrostGod](https://github.com/FrostGod) | NVIDIA |
+
+## Topics
+
+Topics connect contributors with work matching their expertise or interests. They describe technical concerns across areas rather than separate component ownership.
+
+### topic:api
+
+Public API contracts, gRPC and protobuf definitions, SDK interfaces, versioning, compatibility, API ergonomics, design patterns, component and communication standards.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Drew Newberry | [@drew](https://github.com/drew) | NVIDIA |
+| Mrunal Patel | [@mrunalp](https://github.com/mrunalp) | Red Hat |
+
+### topic:architecture
+
+Cross-cutting system design, component boundaries, data and control flow, architectural decisions, and RFC-level concerns.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Drew Newberry | [@drew](https://github.com/drew) | NVIDIA |
+| Mrunal Patel | [@mrunalp](https://github.com/mrunalp) | Red Hat |
+
+### topic:authnz
+
+Authentication, authorization, credential protection, policy integrity/signed policiesIncludes identity verification, login and session handling, OIDC integration, bearer-token validation, access permissions, and authorization across tenant and workspace boundaries.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Seth Jennings | [@sjenning](https://github.com/sjenning) | Red Hat |
+| Kris Hicks | [@krishicks](https://github.com/krishicks) | NVIDIA |
+
+### topic:compliance
+
+FIPS, regulatory alignment, auditability, and standardization requirements.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| John T. Myers | [@johntmyers](https://github.com/johntmyers) | NVIDIA |
+| Jim Meyer | [@purp](https://github.com/purp) | NVIDIA |
+
+### topic:documentation
+
+Architecture documentation, README maintenance, project website updates, and automated documentation generation.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Kris Hicks | [@krishicks](https://github.com/krishicks) | NVIDIA |
+| Drew Newberry | [@drew](https://github.com/drew) | NVIDIA |
+
+### topic:dx
+
+Ensure OpenShell is easy to contribute to for humans and agents.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Evan Lezar | [@elezar](https://github.com/elezar) | NVIDIA |
+| John T. Myers | [@johntmyers](https://github.com/johntmyers) | NVIDIA |
+| Jim Meyer | [@purp](https://github.com/purp) | NVIDIA |
+| Kris Hicks | [@krishicks](https://github.com/krishicks) | NVIDIA |
+
+### topic:gpu
+
+GPU scheduling, Kubernetes Dynamic Resource Allocation (DRA), Container Device Interface (CDI) configuration, Multi-Instance GPU (MIG) support, and hardware-accelerated runtime integration.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Evan Lezar | [@elezar](https://github.com/elezar) | NVIDIA |
+| Adrien Langou | [@alangou](https://github.com/alangou) | NVIDIA |
+
+### topic:kubernetes
+
+Kubernetes operator development, custom resource definitions (CRDs), deployment controllers, and native integration with Kubernetes APIs.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Mrunal Patel | [@mrunalp](https://github.com/mrunalp) | Red Hat |
+| Drew Newberry | [@drew](https://github.com/drew) | NVIDIA |
+| Divesh Chowdary | [@FrostGod](https://github.com/FrostGod) | NVIDIA |
+| Kris Hicks | [@krishicks](https://github.com/krishicks) | NVIDIA |
+| Taylor Mutch | [@TaylorMutch](https://github.com/TaylorMutch) | NVIDIA |
+
+### topic:mcp
+
+Model Context Protocol (MCP) support, server and client implementations, and standard integration.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| John T. Myers | [@johntmyers](https://github.com/johntmyers) | NVIDIA |
+| Shiju | [@shiju-nv](https://github.com/shiju-nv) | NVIDIA |
+
+### topic:networking
+
+General network transport, connectivity, and proxy behavior not covered by the more specialized L7 category.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| John T. Myers | [@johntmyers](https://github.com/johntmyers) | NVIDIA |
+| Adrien Langou | [@alangou](https://github.com/alangou) | NVIDIA |
+| Shiju | [@shiju-nv](https://github.com/shiju-nv) | NVIDIA |
+
+### topic:observability
+
+Logging, metrics, tracing, telemetry, dashboards, event correlation, and the collection or export of operational data from gateways and sandboxes.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Kris Hicks | [@krishicks](https://github.com/krishicks) | NVIDIA |
+| Matthew Grossman | [@matthewgrossman](https://github.com/matthewgrossman) | NVIDIA |
+
+### topic:operability
+
+Deployment and configuration of OpenShell installations, upgrades, backup and restore, disaster recovery, operational diagnostics, and maintenance of running installations.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Piotr Mlocek | [@pimlock](https://github.com/pimlock) | NVIDIA |
+| Taylor Mutch | [@TaylorMutch](https://github.com/TaylorMutch) | NVIDIA |
+| Jim Meyer | [@purp](https://github.com/purp) | NVIDIA |
+
+### topic:performance
+
+Startup time, latency, throughput, resource overhead, scalability, and benchmarking. Includes rate limiting.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Matthew Grossman | [@matthewgrossman](https://github.com/matthewgrossman) | NVIDIA |
+| Drew Newberry | [@drew](https://github.com/drew) | NVIDIA |
+| Jim Meyer | [@purp](https://github.com/purp) | NVIDIA |
+
+### topic:policy
+
+Policy authoring, validation, proving, distribution, enforcement, and policy ergonomics across runtimes and APIs. Includes policy hardening.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Adrien Langou | [@alangou](https://github.com/alangou) | NVIDIA |
+| Piotr Mlocek | [@pimlock](https://github.com/pimlock) | NVIDIA |
+| Shiju | [@shiju-nv](https://github.com/shiju-nv) | NVIDIA |
+
+### topic:reliability
+
+High availability, failure recovery, retries, graceful degradation, fault tolerance, and operational resilience. Includes correctness across restarts.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Taylor Mutch | [@TaylorMutch](https://github.com/TaylorMutch) | NVIDIA |
+| Piotr Mlocek | [@pimlock](https://github.com/pimlock) | NVIDIA |
+| Jim Meyer | [@purp](https://github.com/purp) | NVIDIA |
+| Divesh Chowdary | [@FrostGod](https://github.com/FrostGod) | NVIDIA |
+
+### topic:sdk
+
+Software Development Kit (SDK) creation, maintenance, language bindings, and distribution.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Taylor Mutch | [@TaylorMutch](https://github.com/TaylorMutch) | NVIDIA |
+| Simon Scatton | [@SDAChess](https://github.com/SDAChess) | NVIDIA |
+| Max Dubrinsky | [@maxdubrinsky](https://github.com/maxdubrinsky) | Gretel |
+
+### topic:security
+
+Vulnerability management, static/dynamic analysis, FSR (Functional Security Requirement) implementation, and security auditing. Includes bypass detection, abuse prevention, and vulnerability remediation.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Adrien Langou | [@alangou](https://github.com/alangou) | NVIDIA |
+| John T. Myers | [@johntmyers](https://github.com/johntmyers) | NVIDIA |
+| Jim Meyer | [@purp](https://github.com/purp) | NVIDIA |
+
+### topic:testing
+
+Unit, integration, regression, conformance, and end-to-end testing, including test infrastructure, coverage gaps, flaky tests, and environment-specific test failures.
+
+| Name | GitHub ID | Company/Organization |
+| --- | --- | --- |
+| Matthew Grossman | [@matthewgrossman](https://github.com/matthewgrossman) | NVIDIA |
+| Simon Scatton | [@SDAChess](https://github.com/SDAChess) | NVIDIA |