docs: add area-based CODEOWNERS

.github/CODEOWNERS

@@ -0,0 +1,37 @@
+# Portal application.
+/apps/portal/ @manekinekko
+
+# Core API and orchestration.
+/apps/api/ @cedricvidal @jduffney
+/apps/scheduler/ @cedricvidal @jduffney
+
+# CLI.
+/apps/cli/ @cedricvidal @manekinekko
+
+# Evaluation and agent workers.
+/apps/judge/ @cedricvidal @jduffney
+/apps/workers/ @cedricvidal @jduffney
+/packages/llm-eval/ @cedricvidal @jduffney
+
+# AI gateway.
+/apps/gateway/ @cedricvidal
+
+# Authentication and credentials.
+/apps/token-manager/ @cedricvidal @manekinekko @jduffney
+/apps/key-updaters/ @cedricvidal @manekinekko @jduffney
+/packages/github-auth/ @cedricvidal @manekinekko @jduffney
+
+# Shared platform and data.
+/packages/shared/ @cedricvidal @jduffney
+/packages/db-migrations/ @cedricvidal
+/packages/telemetry/ @cedricvidal @jduffney
+
+# Documentation and configuration.
+/website/ @manekinekko
+/docs/ @cedricvidal @manekinekko
+/config/ @cedricvidal @manekinekko
+
+# CI and infrastructure.
+/.github/ @cedricvidal @jduffney @manekinekko
+/infra/ @cedricvidal
+/scripts/ @cedricvidal @manekinekko

CONTRIBUTING.md

@@ -209,16 +209,15 @@ coordinate the review and follow it through to merge or closure. Confirm that th
 Scope's direction before asking the contributor for substantial revisions. Discuss larger
 features or architectural changes in an issue first.
 
-Reviewer routing is the team's responsibility, not the contributor's. Until automated routing is
-configured, the team designates a triage maintainer to check incoming PRs each business day, assign
-a maintainer as the PR owner, and request reviewers familiar with the affected area.
-
-**Team follow-up:** add a `CODEOWNERS` file with a catch-all maintainers team and area owners for
-high-risk paths, including `.github/workflows/`, `packages/db-migrations/`, `packages/github-auth/`,
-`apps/token-manager/`, auth/RBAC and project-scoping code, and `packages/shared/`. Configure team
-review assignment to distribute requests, and branch protection to require code-owner review and
-dismiss stale approvals. These mechanisms are not configured by this policy change; until they
-are, the PR owner coordinates reviews and the merging maintainer checks the approval requirements.
+Reviewer routing is the team's responsibility, not the contributor's. The repository's
+[`CODEOWNERS`](./.github/CODEOWNERS) file now routes review requests by area. The team should still
+designate a triage maintainer to check incoming PRs each business day, assign a maintainer as the PR
+owner, and request additional reviewers familiar with the affected area when needed.
+
+Keep the [`CODEOWNERS`](./.github/CODEOWNERS) file current as maintainers and area ownership evolve.
+Team review assignment and branch protection still need to be configured to distribute requests,
+require code-owner review, and dismiss stale approvals. Until those settings are enabled, the PR
+owner coordinates reviews and the merging maintainer checks the approval requirements.
 
 ### 2. Check readiness