What

Introduce a review gate for canonical design docs, reorganize docs/, and pull unratified / stale material out of the review-gated design.

1. CODEOWNERS review gate

Adds .github/CODEOWNERS requiring @eskimor's review for any change under docs/design/** (recursive — all files, all subdirs).

⚠️ The file alone is advisory. To enforce it, a repo admin must add a branch-protection rule / ruleset on dev (the default branch, which is where GitHub reads CODEOWNERS from):

• Require a pull request before merging → Require review from Code Owners
• Do not allow bypassing the above settings
• Confirm eskimor has Write access (otherwise the review won't count as code-owner approval).

2. Docs reorg

• docs/design/ now holds only the two canonical, review-gated docs: scalable-web3-storage.md and scalable-web3-storage-implementation.md.
• Moved the other unratified notes to a new docs/drafts/ (rename-tracked): CHECKPOINT_PROTOCOL, CLIENT_SIDE_ENCRYPTION, EXECUTION_FLOWS, marketplace, provider-initiated-checkpoints, S3_METADATA_INDEX, smart-contracts.
• Fixed all cross-references (../design/… → ../drafts/…); no broken links remain.
• Rewrote docs/README.md: added drafts/ to the tree, split Design (canonical) from Drafts (WIP, needing triage), and simplified.

3. Pulled unratified / stale material out of canonical design

• Layer 1 interfaces → docs/drafts/L1_design_implementation.md (split out of the Layer 0 implementation doc).
• Provider-initiated checkpoints → removed the entire surface (config, storage, events, signed payload, on-chain extrinsics, off-chain coordination API) from the implementation doc; design questioned on review → Triage: remove (or justify) provider-initiated checkpoints #306. Client-initiated checkpoint / extend_checkpoint / challenge_checkpoint are unchanged.
• "Capped Split for the general public" → docs/drafts/challenge-economics-extensions.md, which also records that the design's two-tier challenger split isn't implemented in code.
• Added cross-reference notes in the implementation doc for the open signature-scheme (Signature-scheme support: verify provider <-> runtime integration against the design #274) and auth/RBAC (Provider HTTP auth scheme: investigate, capture in design, harden binding, and extract a single source of truth #304) questions.

Follow-up issues

• Triage: remove (or justify) provider-initiated checkpoints #306 — Triage: remove (or justify) provider-initiated checkpoints. Its design was removed from canonical here (recoverable from git); decide remove-entirely vs. review-and-canonicalize.
• Signature-scheme support: verify provider <-> runtime integration against the design #274 — Provider signature scheme matrix. On-chain uses MultiSignature (multi-scheme) but the provider node verifies sr25519 only; a note was added here and a TODO to update the design once the matrix is decided.
• Provider HTTP auth scheme: investigate, capture in design, harden binding, and extract a single source of truth #304 — Authentication & RBAC scheme is under-specified. Wire format defined in two places, undocumented <Bytes>-wrapped form, no body/provider binding (replay window); design cross-referenced here.
• Triage docs/drafts: review & promote shipped-feature docs (marketplace, checkpoint manager, encryption, …) #308 — Triage docs/drafts/. Several drafts moved here actually document shipped features (marketplace, client-side checkpoint manager, client-side encryption, …) and should be reviewed and promoted to design/ or reference/.

Notes

• Drafts are intentionally left outside the CODEOWNERS gate so they stay freely editable; each should be triaged — promoted into design/, folded into an existing doc, or dropped.