# Branch Ruleset: main-protection

Created via GitHub API. Ruleset ID: 12935219.

## What It Enforces

| Rule | Detail |
|------|--------|
| Pull request required | All changes to main must go through a PR |
| CODEOWNERS review | Code owners must review before merge |
| Stale review dismissal | New pushes dismiss previous approvals |
| Thread resolution | All conversation threads must be resolved |
| Required status checks | `test (3.11)`, `test (3.12)`, `security` must pass |
| Strict status policy | Branch must be up-to-date with main before merge |
| No force-push | `non_fast_forward` rule prevents history rewriting |
| No branch deletion | `deletion` rule protects main from removal |

## Bypass Actors

Only Organization Admins (Steven) can bypass the ruleset.

## Segregation of Duty

- **Master Conductor (Claude Code)**: Creates PRs, pushes branches
- **CI Pipeline**: Independent automated verification
- **GitHub Rulesets**: Policy enforcement (cannot be bypassed by Conductor)
- **Operator (Steven)**: Final merge authority, code owner review

The Conductor cannot merge its own code. Only the Operator
(or CI auto-merge after Operator-approved ruleset) can merge.

## Management

View/edit: https://github.com/Orxaq/orxaq/rules/12935219
