# Repository Protection

Recommended settings for the public repository. Pragmatic, not ceremonial. Apply them in GitHub under Settings, Rules, Rulesets (or the classic branch protection screen).

## Status

This section states what is actually applied, so that nobody has to infer it. It is updated whenever a setting changes.

| Item | Status as of 2026-09-13 |
| --- | --- |
| Rulesets on `main` | None applied. The rulesets API returns an empty list and the branch reports `protected: false`. |
| Required pull requests and reviews | Not enforced. Changes so far were pushed directly by the founding steward. |
| Required status checks | Not configured. The build check (`npm run build`, which includes the checksum verification) runs in the website repository, not here. |
| Tag protection | Not applied. No tag has been moved or deleted; that is a promise, not yet a setting. |
| Signed commits or tags | Not active. Both existing tags and all commits are unsigned. |
| CI on this repository | None. |

The first independent reviews (`evaluation/REVIEWS.md`) found the gap between this file's recommendations and the repository's state. The recommendations stand; the status table is the truth until they are applied. Applying them is on the steward's list and each change will be recorded here and in `CHANGELOG.md`.

## `main`

- Require a pull request before merging. No direct pushes, including by admins.
- Require at least one approving review; for files owned in `CODEOWNERS`, require code-owner approval.
- Dismiss stale approvals when new commits are pushed.
- Require all conversations resolved before merge.
- Require status checks: `build` (which includes the checksum check and the compliance gate), `endpoints` (the verification script against the preview).
- Block force pushes. Block branch deletion.
- Require linear history (squash or rebase merges), so each change is one readable commit.
- Require signed commits once stewards have keys set up; until then, sign tags at minimum.

## Tags and releases

- Every version is a tag `vX.Y.Z[-draft]` created from `main` after the changelog entry lands.
- Tags are protected: no deletion, no moving.
- Create a GitHub Release per tag with the changelog entry as the body and the checksum file attached.

## Reviews

- Class C: one maintainer approval.
- Class B: the LIP is the pull request description; merge only after the comment period ends and the decision section is filled in. Two steward approvals once three stewards exist.

## Access

- Stewards: admin. Maintainers: write. Everyone else: fork and open pull requests.
- Enable "Restrict who can push to matching branches" to stewards and maintainers only (they still go through pull requests).

## Automation

- Issue templates and the pull request template live in `.github/`.
- A CI job runs `npm run build` (includes `constitution:check`) and `node scripts/verify-constitution.mjs <preview-url>` on every pull request.
- Dependabot or equivalent for the website tooling only. The canonical documents have no dependencies.