Establish the CAMSAI governance documents

.github/CODEOWNERS

@@ -0,0 +1,21 @@
+# Named maintainers of this repository, as required of every CAMSAI project by
+# GOVERNANCE.md §7, item 5. Until branch protection is available — it requires a
+# public repository or a paid organization plan — this file is a record of who
+# is responsible rather than an enforced review requirement.
+#
+# Governance decisions are not made by code review. A CODEOWNERS approval
+# records that the process in CHARTER.md §12 was followed; it does not replace
+# it.
+
+*                   @timurbazhirov
+
+# The constitutional documents. Changes here are amendments under CHARTER.md §12.
+/CHARTER.md         @timurbazhirov
+/GOVERNANCE.md      @timurbazhirov
+/STEERING.md        @timurbazhirov
+/TRADEMARKS.md      @timurbazhirov
+/CODE_OF_CONDUCT.md @timurbazhirov
+
+# The release path: what turns a date tag into a published, citable version.
+/.github/workflows/ @timurbazhirov
+/scripts/           @timurbazhirov

.github/workflows/dco.yml

@@ -0,0 +1,42 @@
+# Every contribution across CAMSAI is made under the Developer Certificate of
+# Origin (CHARTER.md section 5.1). This checks that the repository holding that
+# rule actually follows it.
+name: DCO
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  sign-off-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out source
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Verify Signed-off-by on every commit
+        # Only the pull request's own commits (base..head). The synthetic merge
+        # commit GitHub builds for pull_request events is excluded by --no-merges.
+        env:
+          BASE: ${{ github.event.pull_request.base.ref }}
+          HEAD: ${{ github.event.pull_request.head.sha }}
+        run: |
+          git fetch --no-tags origin "$BASE"
+          missing=$(git rev-list --no-merges "origin/$BASE..$HEAD" | while read -r sha; do
+            if ! git log -1 --format='%B' "$sha" | grep -qiE '^Signed-off-by: .+ <.+@.+>'; then
+              printf '  %s %s\n' "$(git rev-parse --short "$sha")" "$(git log -1 --format='%s' "$sha")"
+            fi
+          done)
+          if [ -n "$missing" ]; then
+            echo "These commits carry no Signed-off-by trailer:"
+            echo "$missing"
+            echo
+            echo "Sign off new commits with 'git commit -s', or fix this branch with:"
+            echo "    git rebase --signoff origin/$BASE"
+            exit 1
+          fi
+          echo "Every commit carries a Signed-off-by trailer."

.github/workflows/governance-pdf.yml

@@ -0,0 +1,93 @@
+# Renders the governance documents into one consolidated PDF, so that
+# reviewers, counsel, and partner organizations can read and circulate a fixed,
+# citable snapshot without cloning the repository.
+#
+# Pushing a date tag (YYYY.M.D-N) publishes that PDF as a GitHub Release.
+# Every other run builds the same PDF and leaves it as a build artifact, so a
+# rendering failure surfaces before a version is ratified rather than after.
+#
+# A date tag means "ratified" everywhere in these documents, so the release job
+# is separated from the build: only it can obtain a write-scoped token, and it
+# refuses to publish a tag that is not on main.
+name: Governance PDF
+
+on:
+  push:
+    branches: [main]
+    tags: ['[0-9][0-9][0-9][0-9].[0-9]*.[0-9]*-[0-9]*']
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    outputs:
+      label: ${{ steps.version.outputs.label }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+
+      - name: Determine version label
+        id: version
+        run: |
+          if [ "$GITHUB_REF_TYPE" = "tag" ]; then
+            echo "label=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
+          else
+            echo "label=draft-${GITHUB_SHA:0:7}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Render consolidated PDF
+        run: scripts/build-pdf.sh "${{ steps.version.outputs.label }}"
+
+      - name: Keep the PDF as a build artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        with:
+          name: CAMSAI-governance-${{ steps.version.outputs.label }}
+          path: CAMSAI-governance-*.pdf
+          if-no-files-found: error
+
+  release:
+    needs: build
+    if: github.ref_type == 'tag'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write # only this job may publish
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
+
+      - name: Refuse to publish a tag that is not on main
+        # A date tag asserts that a version was ratified, which under
+        # CHARTER.md section 12 can only follow a merged pull request. A tag on
+        # a commit that never reached main did not come through that process,
+        # however it was created.
+        run: |
+          git fetch --no-tags origin main
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/main; then
+            echo "::error::Tag $GITHUB_REF_NAME points at $GITHUB_SHA, which is not an ancestor of main."
+            echo "::error::A ratified version must be tagged on a commit that was merged to main."
+            exit 1
+          fi
+          echo "Tag $GITHUB_REF_NAME is on main."
+
+      - name: Fetch the PDF built by the build job
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+        with:
+          name: CAMSAI-governance-${{ needs.build.outputs.label }}
+
+      - name: Publish the release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          TAG: ${{ github.ref_name }}
+        run: |
+          printf '%s\n\n%s\n' \
+            "Consolidated PDF of the CAMSAI governance documents as ratified at version \`$TAG\`: the Charter, the Governance rules, the Steering Committee roster, the register of supporters and operating costs, the statement on the CAMSAI name and marks, and the Code of Conduct." \
+            "CAMSAI is not incorporated and has no separate legal personality; see Charter section 11." \
+            > release-notes.md
+          gh release create "$TAG" \
+            --title "CAMSAI Governance $TAG" \
+            --notes-file release-notes.md \
+            "CAMSAI-governance-$TAG.pdf"

.gitignore

@@ -0,0 +1,4 @@
+# Built release assets and scratch files; the PDF is published as a release.
+CAMSAI-governance-*.pdf
+.frontmatter.generated.md
+release-notes.md