ADR-007: Repository Governance
Status
Accepted — July 2026
Context
Public engineering credibility requires delivery controls, not only attractive READMEs.
Decision
Flagship public repositories and the BBI organization baseline should include, as applicable:
- PR-only protected defaults
- CODEOWNERS
- CI, CodeQL, Dependabot, Scorecard patterns
- Public Proof Gate / privacy scans for claim surfaces
- Honest status labels (Released / Active / Planned)
Consequences
Higher setup cost; stronger recruiter and awards signal; fewer accidental publishes.