docs(steering): add ownership rules — external repos are read-only, no code changes or MRs

.kiro/steering/workspace-notes.md

@@ -28,11 +28,28 @@ On this machine, PowerShell is the shell. Use `;` to chain commands, NOT `&&` (w
 ## Key Decisions
 
 - **Bahn repos stay untouched** as independent remotes. The monorepo organizes them but doesn't own them.
+- **External repos are READ-ONLY in the monorepo.** Never modify code, add tests, or create MRs for: aisupport, Confluence_Bot, O2C-Harness, db-planet-mcp-server, wissensdatenbank. Only COMPONENT.md (monorepo wrapper metadata) is allowed.
 - **Jury-Voting** is dhive (not privat). Will be transferred to dhive GitLab later.
 - **NoteGraph** needs a complete redo — superseded by the monorepo knowledge store.
 - **symphony** is a read-only reference (pinned).
 - Secrets go in `.secrets` (gitignored) or encrypted via git-crypt per context.
 
+## Ownership Rules
+
+| Repo | Owner | Editable? |
+|------|-------|-----------|
+| bahn/aisupport | DB GitLab (Team) | ❌ read-only |
+| bahn/Analyse-O2C-C2S | Andre (DB GitLab) | ✅ |
+| bahn/awesome-bahn-mcp-servers | monorepo-internal | ✅ |
+| bahn/Confluence_Bot | DB GitLab (Team) | ❌ read-only |
+| bahn/db-planet-mcp-server | DB GitLab (Team) | ❌ read-only |
+| bahn/O2C-Harness | DB GitLab (Team) | ❌ read-only |
+| bahn/project-audit | Andre (DB GitLab) | ✅ |
+| bahn/wissensdatenbank | DB GitLab (Team) | ❌ read-only (subtree) |
+| dhive/* | Andre (GitHub) | ✅ |
+| privat/* | Andre (GitHub) | ✅ |
+| shared/* | Andre (GitHub/internal) | ✅ |
+
 ## Python Environment
 
 The monorepo CLI tool is at `shared/tools/monorepo-cli/`. Tests run with: