# Branch protection for `main`

CI defines the checks; **branch protection is a repo setting** (Settings → Branches →
Add rule) and has to be configured once by an admin. This file records the intended
policy so it can be re-applied or audited.

## Rule: `main`

- **Require a pull request before merging.** No direct pushes.
- **Require status checks to pass before merging**, and require branches to be up to date
  first. Required checks:

  | Check (job name in `ci.yml`) | Required from |
  |---|---|
  | `clang-format` | now |
  | `testserver` | now |
  | `bootstrap-script` | now |
  | `build (gcc)` / `build (clang)` | when the first C++ lane merges |
  | `sanitizers (dev)` / `sanitizers (tsan)` | when the first C++ lane merges |
  | `conformance` | **when `tests/conformance/` lands — this is the M0 exit gate** |
  | `extension-lint` | when `extension/` lands |

  `clang-tidy` is intentionally **not** required through M1 (`continue-on-error: true`,
  `.clang-tidy` has `WarningsAsErrors: ''`). Make it required at M2.

- **Require linear history** (matches CLAUDE.md §6: rebase onto `main`, no merge commits).
- **Require conversation resolution before merging.**
- Do **not** allow force pushes or deletions.
- Apply the rule to administrators too, except for the initial scaffolding period.

## Note on the "skipped" job steps

Several jobs (`conformance`, `extension-lint`, `clang-tidy`) short-circuit to a "skipped"
echo when their lane hasn't landed. They still report **success**, so they can be marked
required now without blocking — they start doing real work automatically on the commit
that adds the lane.