Two-factor authentication is required for write access

GOVERNANCE.md

@@ -19,6 +19,12 @@ If any one maintainer becomes unavailable, for any reason, the others hold the a
 keep the project running: each can create and close issues, accept proposed changes, and publish a
 release. Nothing in the ordinary workflow requires a specific individual.
 
+Access is not given informally. Every account with write access to the repository must have
+two-factor authentication enabled, and the organisation enforces that rather than asking for it:
+an account without it loses access instead of being reminded. This is a requirement on the people
+who can change what this project ships, and it is stated here because a project whose maintainers
+can be phished has no supply chain integrity regardless of what the rest of this document says.
+
 The exceptions are named here rather than left to be discovered. Administration of the GitHub
 organisation, the domain, and the security mailbox rest with the author. Restoring those to a
 surviving maintainer is a legal and administrative matter, not a technical one, and it is the first

MAINTAINERS.md

@@ -9,9 +9,9 @@
 
 Three maintainers as of 2026-09-23, up from one. Any of them can accept a proposed change, close
 an issue and cut a release; administration of the GitHub organisation rests with the author.
-Repository access for @mikehostetler was granted on 2026-09-23 and is pending acceptance at the
-time of writing, which is recorded rather than glossed because a maintainers file is the sort of
-document people check against the repository itself.
+
+**Two-factor authentication is required** for everyone with write access to this repository,
+enforced by the organisation rather than asked for in a document.
 
 That asymmetry is written down rather than smoothed over, because "three maintainers" and "three
 people who can do everything" are different claims and only the first is true. `GOVERNANCE.md`