From a1c2f2379e40848a860d9553ba2c9c3d49539ee1 Mon Sep 17 00:00:00 2001
From: Copilot <223556219+Copilot@users.noreply.github.com>
Date: Sat, 15 Aug 2026 22:27:28 -0400
Subject: [PATCH] docs: record the branch ruleset and close UPD-002

The ruleset "main: require CI and protect history" is now active on the default
branch: the Lint, typecheck, build, snapshot check is required, and main cannot
be force-pushed or deleted.

Repository admins are bypass actors on purpose. A required approval rule would
leave a sole maintainer unable to merge their own work, so the status check is
enforced and the approval requirement is left as a governance decision for when
the reviewer roles in CONTRIBUTING.md section 5 are actually staffed.

This pull request is also the end-to-end test of the gate: it is the first one
that has to pass the required check before it can merge.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 CONTRIBUTING.md   |  4 +++-
 UPDATES-NEEDED.md | 27 +++++++++++++++++++--------
 2 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 055fcbc9..7c3abf03 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -286,7 +286,9 @@ Wait for an appropriate reviewer before merging:
 4. Update the originating issue or backlog item only after the change is live.
 
 If a production change must be undone, use a normal revert pull request or
-revert commit. Do not rewrite shared history or force-push `main`.
+revert commit. Do not rewrite shared history or force-push `main`. A ruleset
+enforces this: `main` cannot be force-pushed or deleted, and a pull request
+cannot be merged while its CI build is failing.
 
 ## Never do these
 
diff --git a/UPDATES-NEEDED.md b/UPDATES-NEEDED.md
index d26ea648..ea745528 100644
--- a/UPDATES-NEEDED.md
+++ b/UPDATES-NEEDED.md
@@ -44,7 +44,7 @@ linting of generated output.
 
 ### UPD-002 - Add pull-request CI and protect `main`
 
-**Priority:** High — **CI added; branch protection still open.**
+**Priority:** High — **done.**
 
 The Pages workflow runs only on pushes to `main`, so an invalid pull request
 received no automated build before merge.
@@ -58,14 +58,25 @@ before merge rather than after.
 The earlier blocker is resolved: the `gh` token in use now carries the
 `workflow` scope, so pushes touching `.github/workflows/*` succeed.
 
-**Still open:** the repository has no branch protection or rulesets, so the new
-check is advisory. Requiring the `Lint, typecheck, build, snapshot` status and
-a pull-request approval through a GitHub ruleset needs an admin action that
-cannot be made from a pull request. Follow
-[SITE-CONTROL-RECOMMENDATIONS.md](SITE-CONTROL-RECOMMENDATIONS.md).
+**Branch protection.** The ruleset *"main: require CI and protect history"* is
+active on the default branch with three rules:
+
+| Rule | Effect |
+|---|---|
+| `required_status_checks` | `Lint, typecheck, build, snapshot` must pass before merge |
+| `non_fast_forward` | `main` cannot be force-pushed |
+| `deletion` | `main` cannot be deleted |
+
+Repository admins are listed as bypass actors, deliberately. This repository is
+maintained by a very small group, and a required *approval* rule would leave a
+sole maintainer unable to merge their own work. The status check is the part
+that carries the value; the approval requirement is a governance decision that
+should be made when the reviewer roles in `CONTRIBUTING.md` section 5 are
+actually staffed.
+
+**Acceptance:** met — a pull request is built automatically, and it cannot be
+merged while that build is failing.
 
-**Acceptance:** partially met — a pull request is now built automatically. Not
-met until a test pull request *cannot merge* while that build is failing.
 
 
 ### UPD-003 - Add ownership and review templates