public, and branch protection live

The repository is public as of 2026-08-11, and branch protection on main was applied in the same sitting and verified by read-back: the eight required checks, zero required approvals, code-owner reviews off, enforce-for-admins on, force-pushes and branch deletion blocked. Applied with .github/apply-branch-protection.sh, which reads back what GitHub stored rather than trusting the write.

Direct pushes to main are now refused for everyone, maintainers included. All changes arrive as pull requests that pass the eight gates.

The flip was made at the maintainer's direction with the note-dump release gate undischarged. The bundles' conversations had not been read through for release. A mechanical scan for emails, phone numbers, API keys and home paths came back clean across all 51 files, but that scan cannot see the two categories only a person can judge — personal-life passages, and candid remarks about named third parties. Recorded here rather than left implicit, because the ledger is where this repository keeps the things it decided to accept.

Required approvals: zero, deliberately. GitHub forbids self-approval, so requiring even one approval would mechanically reinstate a two-human gate on every maintainer pull request — precisely what this ledger decided against earlier today. Enforcement lives in the eight required checks, not in required reviews. For the same reason require_code_owner_reviews is false: with both maintainers listed as code owners, requiring a code-owner review would reinstate the same gate by another route.

Enforce for administrators: on, understood as a latch and not a lock. The repository owner can always disable protection in settings, so this does not stop deliberate bypass and does not pretend to. What it does is convert accidental or lazy bypass into a visible, deliberate settings change. That is the intended amount of self-binding, and it is the most a constitution can honestly claim against someone holding admin rights.

Force-pushes and branch deletion blocked, which is what makes git history immutable in fact rather than by convention — the frozen discipline presumes it.

CI job names are now spec-layer values, because required checks match them by exact string and a rename breaks enforcement silently in either direction.