From 92abe99b91eb9e6dd71f3a35f0d583ec1d706a1a Mon Sep 17 00:00:00 2001 From: Injun Lee <2006ijlee@gmail.com> Date: Mon, 17 Aug 2026 18:16:18 -0500 Subject: [PATCH] Record branch protection as enabled on main Protection was applied to main on 2026-08-17 with the six required checks, strict mode, and administrator enforcement. The document still described enablement as pending owner approval, which is no longer true. Also renames the ruleset heading, which described a future action, and records that PR #4 merged before protection existed, so the ruleset was never exercised against the change that created it. Co-Authored-By: Claude Opus 5 Signed-off-by: Injun Lee <2006ijlee@gmail.com> --- .github/branch-protection.md | 32 +++++++++++++++++++++----------- 1 file changed, 21 insertions(+), 11 deletions(-) diff --git a/.github/branch-protection.md b/.github/branch-protection.md index 942c12c..5ca32c9 100644 --- a/.github/branch-protection.md +++ b/.github/branch-protection.md @@ -1,24 +1,34 @@ # Branch protection -> **Status:** The required checks below are now real and verified green. -> Enablement to GitHub is pending explicit approval from the repository owner. +> **Status:** ENABLED on `main` as of 2026-08-17. The ruleset below is in +> force, and the required checks named further down are the six that gate +> every pull request into `main`. -## Enablement is pending repository owner approval +## How this came to be enabled Originally, protection was deferred because a protection rule cannot require status checks that do not exist, and the CI workflow did not exist yet. That prerequisite has been satisfied: the required checks are now defined, verified green, and documented in the section below. -The remaining gate is explicit approval from the repository owner to enable -GitHub branch protection. Until that approval is given, `main` remains -protected by process: `CONTRIBUTING.md` states that direct implementation -commits to `main` are not allowed. That rule is currently enforced by policy -and code review, not by GitHub. Independent review is performed locally with -`codex exec` after implementation and before integration, and this remains -the operative control. +The repository owner approved enablement on 2026-08-17, and the ruleset below +was applied to `main`. The rule that `CONTRIBUTING.md` publishes — that direct +implementation commits to `main` are not allowed — is therefore now enforced by +GitHub rather than by policy alone. -## Ruleset to enable in Wave C +Independent review with `codex exec` before integration remains the operative +review control. GitHub enforces that checks pass and that changes arrive by +pull request; it does not assess whether a change is correct. Required +approving reviews are set to zero because a sole maintainer cannot approve +their own pull request, so `codex exec` output recorded in the pull-request +evidence is what stands in for a human reviewer. + +One limitation worth recording rather than discovering later: Wave C's own +pull request (#4) merged before protection was enabled, so the ruleset was +never exercised against the change that created it. The first pull request it +actually gates is the next one. + +## The enforced ruleset Applied to `main`: