diff --git a/.gitignore b/.gitignore
index 2556e45e..769e943d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*
diff --git a/README.md b/README.md
index a9a791cf..a4054f8f 100644
--- a/README.md
+++ b/README.md
@@ -99,3 +99,28 @@ The browser-facing Nexus must be rebuilt deliberately through the migration back
 ---
 
 *One 3D repo. One migration path. No more ghost worlds.*
+## Branch Protection Policy
+
+We enforce the following rules on all repositories:
+
+### Mandatory for All Repos
+- ✅ Pull Request Required for Merge
+- ✅ Minimum 1 Approval Required
+- ⚠️ Dismiss Stale Approvals
+- 🔒 Block Force-pushing to Main
+- 🚫 Block Branch Deletion
+
+### CI Requirements
+- ✅ CI Must Pass to Merge (where CI exists)
+
+### Default Reviewers Assignments
+- 🤖 @perplexity - All repositories (QA gate)
+- 🤖 @Timmy - hermes-agent (owner gate)
+
+### Implementation Status
+- [r] hermes-agent
+- [x] the-nexus
+- [x] timmy-home
+- [x] timmy-config
+
+See Gitea branch settings for full policy details.