Repository governance — security reporting, branch rules and release promotion

[zenithruneblade]

Purpose

Track the staged GitHub controls around the existing contribution contract without breaking the founder's exact-SHA dev → main promotion path.

CONTRIBUTING owns the human workflow. This issue tracks repository settings and evidence only.

Current branch contract

• Ordinary task branches and contributor pull requests target dev.
• dev is the integration branch.
• main is the last deliberately verified public snapshot.
• Promotion fast-forwards one exact tested dev SHA to main; it does not rebuild, cherry-pick, or create a different result.
• A push to main is not automatically a package release or release candidate.
• Ordinary developers do not need direct main authority.

Phase 1 — immediately, without blocking founder promotion

• Complete and merge chore: establish GitHub governance and security routing #70 after its operator prerequisites are true.
• Enable GitHub private vulnerability reporting.
• Verify security@mechanimous.ai routes to the founder and one trusted backup with MFA.
• Enable Discussions for questions/RFC exploration; accepted decisions still land in ADRs/issues.
• Disable Wiki after confirming it contains no unique material.
• Add a ruleset for dev and main that blocks branch deletion and force-push.
• Keep ordinary update/PR requirements permissive during initial onboarding; do not accidentally block the founder's exact-SHA promotion.
• Confirm the private Project remains the single planning board; do not create a duplicate.

Phase 2 — when two active reviewers can sustain the gate

• Create a narrow release-maintainers team containing the founder and at least one trusted backup.
• Restrict main updates to release maintainers, while preserving an auditable emergency bypass.
• Require pull requests into dev for substantial work.
• Require one approval, Code Owner review where matched, resolved review conversations, and the repository's required CI check on dev.
• Dismiss stale approvals when the reviewed diff changes materially.
• Test the rules with a non-admin account before removing any founder bypass.
• Update CONTRIBUTING in the same change so written procedure and live settings remain identical.

Promotion and release rule

A release maintainer promotes only a tested commit that is already contained in dev:

git merge-base --is-ancestor origin/main SHA
git merge-base --is-ancestor SHA origin/dev
git push origin SHA:refs/heads/main

Create a GitHub pre-release only for a meaningful integrated checkpoint with clean-host/package evidence, exact commit SHA, checksums, and known limitations. Do not tag every main promotion.

Completion

Close this issue when private reporting and the non-destructive Phase 1 rules are verified, the Phase 2 trigger and owner are explicit, and CONTRIBUTING matches the live repository settings.