Merge remote-tracking branch 'origin/develop' into codex/riscv-current-20260521

# Conflicts:
#	packages/chip/scripts/ai_eda/bootstrap_ai_eda_stack.py
#	packages/chip/scripts/ai_eda/parse_openlane_metrics_to_flow_run.py
#	packages/chip/scripts/ai_eda/train_macro_placement_policy.py
#	packages/chip/scripts/check_ai_eda_source_inventory.py
#	packages/chip/scripts/test_generate_e1_phone_cad.py

Author: NubsCarson

.github/CODEOWNERS

@@ -0,0 +1,60 @@
+# CODEOWNERS — elizaOS monorepo
+#
+# Required reviewers for sensitive areas. Used by GitHub branch-protection
+# rules to enforce change management (SOC2 CC8.1 / CC6.1).
+#
+# IMPORTANT — operator action required:
+#   The team handles below (`@elizaos/<role>`) are PLACEHOLDERS. Before enabling
+#   branch protection with "Require review from Code Owners", replace each
+#   handle with a real GitHub team in the elizaos org. The format is
+#   `@org-name/team-slug`. Verify each team exists with
+#   `gh api orgs/elizaos/teams/<slug>`.
+#
+# Order matters: later rules override earlier ones (last match wins).
+
+# Default — at least one core maintainer.
+*                                       @elizaos/core-maintainers
+
+# CI / CD pipeline definitions and reusable actions.
+/.github/                               @elizaos/security-team @elizaos/platform-team
+/.github/workflows/                     @elizaos/security-team
+/.github/actions/                       @elizaos/security-team
+/.github/dependabot.yml                 @elizaos/security-team
+
+# Cloud / backend — billing, auth, hosted APIs.
+/packages/cloud-api/                    @elizaos/backend-leads
+/packages/cloud-shared/                 @elizaos/backend-leads
+/packages/cloud-frontend/               @elizaos/backend-leads
+/packages/cloud-services/               @elizaos/backend-leads
+/packages/cloud-infra/                  @elizaos/backend-leads @elizaos/platform-team
+/packages/cloud-routing/                @elizaos/backend-leads
+/packages/cloud-sdk/                    @elizaos/backend-leads
+
+# Security and crypto-handling code — mandatory security review.
+/packages/security/                     @elizaos/security-team
+/packages/vault/                        @elizaos/security-team
+/packages/contracts/                    @elizaos/security-team @elizaos/backend-leads
+
+# Plugin runtime / sandboxing surface.
+/packages/plugin-host-shim/             @elizaos/runtime-team
+/packages/plugin-host-shim-android/     @elizaos/runtime-team
+/packages/plugin-host-shim-electrobun/  @elizaos/runtime-team
+/packages/plugin-host-shim-ios/         @elizaos/runtime-team
+/packages/plugin-worker-runtime/        @elizaos/runtime-team
+/packages/plugin-sub-agent-claude-code/ @elizaos/runtime-team @elizaos/security-team
+/packages/plugin-remote-manifest/       @elizaos/runtime-team @elizaos/security-team
+
+# ML / training / hardware.
+/packages/training/                     @elizaos/ml-hw-lead
+/packages/chip/                         @elizaos/ml-hw-lead
+/packages/feed/                         @elizaos/ml-hw-lead
+
+# Deployment artifacts.
+/deploy/                                @elizaos/platform-team
+
+# Dependency patches.
+/patches/                               @elizaos/backend-leads @elizaos/security-team
+/plugins/**/patches/                    @elizaos/backend-leads @elizaos/security-team
+
+# Documentation only — lighter review.
+/docs/security/                         @elizaos/security-team

.github/workflows/apple-store-release.yml

@@ -80,6 +80,10 @@ env:
   LANG: en_US.UTF-8
   LC_ALL: en_US.UTF-8
 
+# Default to least privilege. Override per-job where needed.
+permissions:
+  contents: read
+
 jobs:
   prepare:
     name: Prepare

.github/workflows/benchmark-tests.yml

@@ -20,6 +20,10 @@ on:
 env:
   NODE_NO_WARNINGS: "1"
 
+# Default to least privilege. Override per-job where needed.
+permissions:
+  contents: read
+
 jobs:
   benchmark:
     runs-on: ubuntu-24.04

.github/workflows/build-agent-image.yml

@@ -30,6 +30,10 @@ env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
+# Default to least privilege. Override per-job where needed.
+permissions:
+  contents: read
+
 jobs:
   build-and-push:
     runs-on: ubuntu-24.04

.github/workflows/build-android.yml

@@ -18,6 +18,10 @@ env:
   ANDROID_DIR: packages/app-core/platforms/android
   NODE_VERSION: "24.15.0"
 
+# Default to least privilege. Override per-job where needed.
+permissions:
+  contents: read
+
 jobs:
   build-android:
     runs-on: ubuntu-latest

.github/workflows/build-debian-package.yml

@@ -6,6 +6,10 @@ on:
   release:
     types: [created]
 
+# Default to least privilege. Override per-job where needed.
+permissions:
+  contents: read
+
 jobs:
   build-deb:
     runs-on: ubuntu-latest

.github/workflows/build-ios.yml

@@ -17,6 +17,10 @@ env:
   APP_DIR: packages/app
   NODE_VERSION: "24.15.0"
 
+# Default to least privilege. Override per-job where needed.
+permissions:
+  contents: read
+
 jobs:
   build-ios:
     runs-on: macos-15

.github/workflows/build-linux-iso.yml

@@ -25,6 +25,10 @@ on:
   release:
     types: [created]
 
+# Default to least privilege. Override per-job where needed.
+permissions:
+  contents: read
+
 jobs:
   build-iso:
     runs-on: ubuntu-latest
@@ -68,23 +72,23 @@ jobs:
         uses: actions/cache@v5
         with:
           path: ~/.cache/usbeliza-build/models
-          key: elizaos-model-cache-${{ hashFiles('packages/os/linux/variants/milady-tails/Justfile') }}
+          key: elizaos-model-cache-${{ hashFiles('packages/os/linux/variants/eliza-tails/Justfile') }}
           restore-keys: elizaos-model-cache-
 
       - name: Restore CLI cache
         uses: actions/cache@v5
         with:
           path: ~/.cache/usbeliza-build/cli
-          key: elizaos-cli-cache-${{ hashFiles('packages/os/linux/variants/milady-tails/Justfile') }}
+          key: elizaos-cli-cache-${{ hashFiles('packages/os/linux/variants/eliza-tails/Justfile') }}
           restore-keys: elizaos-cli-cache-
 
       - name: Restore live-build chroot/debs cache
         uses: actions/cache@v5
         with:
           path: |
-            packages/os/linux/variants/milady-tails/tails/cache
-            packages/os/linux/variants/milady-tails/tails/.build
-          key: elizaos-iso-livebuild-${{ runner.os }}-${{ hashFiles('packages/os/linux/variants/milady-tails/tails/**/package-lists/**', 'packages/os/linux/variants/milady-tails/tails/**/*.list.chroot', 'packages/os/linux/variants/milady-tails/build-iso.sh', 'packages/os/linux/variants/milady-tails/Dockerfile') }}
+            packages/os/linux/variants/eliza-tails/tails/cache
+            packages/os/linux/variants/eliza-tails/tails/.build
+          key: elizaos-iso-livebuild-${{ runner.os }}-${{ hashFiles('packages/os/linux/variants/eliza-tails/tails/**/package-lists/**', 'packages/os/linux/variants/eliza-tails/tails/**/*.list.chroot', 'packages/os/linux/variants/eliza-tails/build-iso.sh', 'packages/os/linux/variants/eliza-tails/Dockerfile') }}
           restore-keys: elizaos-iso-livebuild-${{ runner.os }}-
 
       - name: Install Rust toolchain
@@ -114,39 +118,39 @@ jobs:
           fi
 
       - name: Stage ISO build
-        working-directory: packages/os/linux/variants/milady-tails
+        working-directory: packages/os/linux/variants/eliza-tails
         env:
-          ELIZAOS_BUILD_MILADY_APP: "1"
+          ELIZAOS_BUILD_ELIZA_APP: "1"
         run: just iso-stage
 
-      # Model/CLI caching is not implemented for the milady-tails variant —
+      # Model/CLI caching is not implemented for the eliza-tails variant —
       # the chroot resolves them inline during live-build. The targets exist
       # as documented no-ops so the workflow contract stays uniform.
       - name: Cache pre-downloaded models (variant no-op)
-        working-directory: packages/os/linux/variants/milady-tails
+        working-directory: packages/os/linux/variants/eliza-tails
         run: just iso-cache-model
 
       - name: Cache pre-downloaded CLIs (variant no-op)
-        working-directory: packages/os/linux/variants/milady-tails
+        working-directory: packages/os/linux/variants/eliza-tails
         run: just iso-cache-cli
 
       - name: Configure live-build
-        working-directory: packages/os/linux/variants/milady-tails
+        working-directory: packages/os/linux/variants/eliza-tails
         run: just iso-config
 
       - name: Validate ISO config
-        working-directory: packages/os/linux/variants/milady-tails
+        working-directory: packages/os/linux/variants/eliza-tails
         run: just iso-check
 
       - name: Build ISO
-        working-directory: packages/os/linux/variants/milady-tails
-        run: sudo --preserve-env=ELIZAOS_BUILD_MILADY_APP just iso-build
+        working-directory: packages/os/linux/variants/eliza-tails
+        run: sudo --preserve-env=ELIZAOS_BUILD_ELIZA_APP just iso-build
         timeout-minutes: 90
 
       - name: Locate and rename ISO
         id: iso
         run: |
-          ISO=$(find packages/os/linux/variants/milady-tails -name "*.iso" | head -1)
+          ISO=$(find packages/os/linux/variants/eliza-tails -name "*.iso" | head -1)
           if [ -z "$ISO" ]; then
             echo "ERROR: ISO not found after build"
             exit 1

.github/workflows/build-vm-image.yml

@@ -21,6 +21,10 @@ on:
         type: boolean
         default: false
 
+# Default to least privilege. Override per-job where needed.
+permissions:
+  contents: read
+
 jobs:
   build-vm:
     runs-on: ubuntu-latest

.github/workflows/ci.yaml

@@ -10,6 +10,10 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+# Default to least privilege. Override per-job where needed.
+permissions:
+  contents: read
+
 jobs:
   # Test job
   test: