Document Copilot review process and default reviewer ownership

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Request Ben, Utkarsh, and Parsh on future SigningServer PRs; one approval is required.
+* @ben-kaufman @cakesoft-utkarsh @Parsh

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,22 @@
+## Change
+
+<!-- Describe the problem and resulting behavior. -->
+
+## Verification
+
+<!-- Record relevant checks and their outcomes, with any remaining limits. -->
+
+## Review record
+
+<!-- Repository default: Balanced. Follow .github/REVIEW_POLICY.md and classify this change manually. Verify effort before requesting the first review or marking ready. -->
+
+- Selected Copilot effort: Lite / Balanced
+- Reason:
+- Actual Copilot effort and reviewed commit: pending
+- Feedback and disposition: pending
+- Independent human approval: pending (Ben, Utkarsh, or Parsh; one is sufficient)
+
+<!-- A quota response means review unavailable. Record it instead of claiming a completed review. Batch material fixes and stabilize checks before a new review. -->
+
+- [ ] Required checks pass and relevant review concerns are resolved.
+- [ ] One independent developer approval is recorded.

.github/REVIEW_POLICY.md

@@ -0,0 +1,31 @@
+# Pull request review policy
+
+## Choose Copilot effort
+
+Repository default: **Balanced**. Before requesting the first review or marking the PR ready, verify the Copilot effort in the PR's GitHub Reviewers controls and override it for the change. A remembered PR choice can override the repository default. GitHub controls the underlying review model; the chat model selector does not change it. See [GitHub's code review documentation](https://docs.github.com/en/copilot/concepts/agents/code-review).
+
+- **Lite:** routine UI or styling, noncritical copy, documentation, and isolated changes with known low risk.
+- **Balanced:** keys, signing, recovery, backup, authentication, pairing, transactions, migrations, security-critical copy, security dependencies, permissions, complex or cross-service changes, and unknown risk. Use Balanced for mixed changes that include these areas.
+
+Effort is selected explicitly. This document does not implement automatic risk classification or a CI gate for effort selection.
+
+## Review timing and evidence
+
+Finish feasible verification before marking a PR ready. Automatic Copilot review of ready PRs remains enabled; automatic draft reviews and automatic reviews on every push are disabled. Keep work in draft while it is being prepared.
+
+Batch fixes and stabilize checks before requesting another review. Request a new review when changes materially affect correctness or security; avoid repeated reviews for verified routine documentation or metadata changes. Workflow permissions, security dependencies, secrets, and release signing count as material changes.
+
+If a material security change received an automatic Lite review, select Balanced and request one review of the final substantive changes after batching fixes and stabilizing checks. Do not count a Lite review as a Balanced review.
+
+Record these in the PR description:
+
+- Selected effort and the reason for it.
+- Actual effort reported by Copilot and the commit SHA it reviewed; distinguish the selected mode from a completed review.
+- Real findings and their disposition, including any substantive review-overview concerns. Check feedback against the implementation and verification.
+- Pending or unavailable review status when appropriate. A quota response is an unavailable review, not a successful review or evidence of no findings.
+
+## Human approval
+
+Request Ben (`ben-kaufman`), Utkarsh (`cakesoft-utkarsh`), and Parsh (`Parsh`) when they have review access. Record pending invitations accurately; keep review-owner proposals draft until GitHub recognizes the owners and required checks pass.
+
+One independent approval from any one of these developers is required, together with passing required checks and resolution of relevant review concerns. All three approvals are unnecessary. The PR author cannot approve their own change, and Copilot feedback does not satisfy the human approval requirement. Product signoff remains separate. Do not bypass required checks or independent human approval.

AGENTS.md

@@ -0,0 +1,5 @@
+# Repository agent instructions
+
+Read and follow [.github/REVIEW_POLICY.md](.github/REVIEW_POLICY.md) before opening or updating a pull request. Use the PR template, explicitly select the appropriate Copilot effort in GitHub, record actual review evidence, and retain the independent human approval requirement. Do not request repeated reviews of drafts or every push.
+
+Preserve existing repository conventions. Complete feasible agent verification before delivery, scaled to the change; documentation changes need link, formatting, and diff checks. Human live verification remains retrospective after delivery. Retain existing required checks and one independent developer approval before merge.

CONTRIBUTING.md

@@ -5,3 +5,5 @@ Use Node.js 22. Start from a clean checkout and run `npm ci --ignore-scripts`, `
 Keep tests self-contained and use generated, disposable identities. Do not require production infrastructure, cloud credentials, or signing keys in a pull request. Never commit `.env` files, private keys, wallet seeds, database exports, production logs, or deployment access. Add tests for changed behavior, especially authorization and signing paths. Document any new local configuration in `.env.example` using names and safe placeholders only.
 
 Open a focused pull request describing the behavior, risks, and verification. Keep dependency changes in the lockfile. If a security issue or suspected credential exposure is involved, follow [SECURITY.md](SECURITY.md) before opening a public issue.
+
+Follow the [pull request review policy](.github/REVIEW_POLICY.md) and complete the PR template before requesting review.