Governance

How decisions get made in this repository: who merges, on what criteria, and how listings come and go.

Roles

Maintainers — the AtomCode team members listed in CODEOWNERS. They review PRs, merge, and can delist plugins.
Contributors — anyone opening a PR to add or update a plugin.

Review criteria

Every PR is judged on:

Validator passes. scripts/validate.py is green in CI. Non- negotiable.
It does what it says. The plugin's behavior matches its description; the README is enough to use it.
It's safe. No obvious data exfiltration, destructive defaults, or obfuscation. Hooks/commands that run shell are read with extra care.
It's useful and distinct. Not a near-duplicate of an existing listing; solves a real need.
Tier is correct. Verified ⇒ source in-tree. Community ⇒ external + pinned. (See SECURITY.md.)

Merge rules

Verified plugins (plugins/**, .atomcode-plugin/**): require a code-owner approval. CODEOWNERS enforces this.
Community-only catalog entries: require a maintainer approval; the reviewer must have looked at the pinned upstream revision.
A maintainer may not merge their own plugin without a second maintainer's approval.

Updates

Verified: normal PRs against the in-tree source.
Community: a PR that changes the tag/commit pin. Re-reviewed at the new pin. Maintainers do not bump pins on an author's behalf.

Removal & delisting

A plugin is removed when:

a security report is substantiated (SECURITY.md),
it breaks and the author is unresponsive,
it violates licensing or conduct norms, or
the author requests removal.

Removal is itself a PR: delete the plugins/<name>/ tree (verified) and/or the catalog entry (either tier). Urgent security delistings may be merged by a single maintainer and ratified afterward.

Changing this process

Governance changes are PRs to this file, requiring two maintainer approvals.