/maintainer package

Package maintainer models an AI agent stewarding a versioned on-chain package — without ever letting it deploy on its own authority.

The agent can do the tedious, valuable parts: open a version proposal, collect reviews, record CI test attestations, write release notes, deprecate a vulnerable version, keep a compatibility matrix. What it cannot do is ship. Approval is gated by an explicit, machine-checked policy:

1tests pass  AND  ≥ MinReviewers independent reviews  AND
2every review scores ≥ MinScore  AND  the challenge window has elapsed

This is the difference between "an agent with commit access" and "an agent that drives a process a human (or a DAO, or a policy) still gates." The realm records *approved* releases; the actual package publish is a separate, deliberately human/authority step.