# DEFERRED: Branch Protection Rulesets

## STATUS
- state: blocked
- created: 2026-02-14
- last-checked: 2026-02-14
- priority: P1
- blocked-by: dependency (P0-github-pro-upgrade)
- estimated-effort-once-unblocked: 5 minutes (fully automated)

## WHAT
Create branch rulesets on the `main` branch to enforce: PR-required merge, CI status checks must pass, no force pushes, no direct pushes to main, dismiss stale reviews.

## WHY BLOCKED
Branch protection and rulesets require GitHub Pro on private repos. Both the modern rulesets API and the legacy branch protection API return HTTP 403 on Free plan.

## UNBLOCK TRIGGER
P0-github-pro-upgrade.md is resolved. AI auto-detects:
```bash
# Try creating a test ruleset -- if 200/201, Pro is active
gh api repos/LookNoHandsMom/LLMHosts.com/rulesets --jq "length" 2>&1
# If no 403 error, we're good
```

## WHAT HUMAN NEEDS TO DO
Nothing beyond upgrading to Pro (handled in P0-github-pro-upgrade).

## WHAT AI DOES ONCE UNBLOCKED
```bash
REPO="LookNoHandsMom/LLMHosts.com"

# Create main branch ruleset
gh api repos/$REPO/rulesets -X POST --input - << 'EOF'
{
  "name": "main-protection",
  "target": "branch",
  "enforcement": "active",
  "conditions": {
    "ref_name": {
      "include": ["refs/heads/main"],
      "exclude": []
    }
  },
  "rules": [
    {
      "type": "pull_request",
      "parameters": {
        "required_approving_review_count": 0,
        "dismiss_stale_reviews_on_push": true,
        "require_code_owner_review": false,
        "require_last_push_approval": false,
        "required_review_thread_resolution": true
      }
    },
    {
      "type": "required_status_checks",
      "parameters": {
        "strict_required_status_checks_policy": true,
        "required_status_checks": [
          {"context": "All Checks Pass"}
        ]
      }
    },
    {
      "type": "non_fast_forward"
    }
  ]
}
EOF

# Verify
gh api repos/$REPO/rulesets --jq ".[].name"
```

Then mark resolved and move to `deferred/resolved/`.

## CROSS-REFERENCES
- prompt: God-Mode L1, Phase 1.7 (Branch Rulesets)
- files: none created (GitHub-side configuration)
- issues: none
- depends-on: P0-github-pro-upgrade
- unlocks: enforced PR workflow, CI gate enforcement, safe main branch
