feat: [QA][POLICY] Branch Protection + Mandatory Review Policy for All Repos (#918)

Refs #918
Agent: groq

.gitignore

@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*

CONTRIBUTING.md

@@ -13,6 +13,8 @@ Removal is a first-class contribution. Baseline: 4,462 lines (2026-03-25). Goes
 1. **Net diff ≤ 10** (`+12 -8 = net +4 ✅` / `+200 -0 = net +200 ❌`)
 2. **Manual test plan** — specific steps, not "it works"
 3. **Automated test output** — paste it, or write a test (counts toward your 10)
+4. **Branch protection compliance** - PR must have 1+ approvals, passing CI, and no force-pushes
+5. **Default reviewers** - @perplexity must review all PRs, @Timmy for hermes-agent
 
 Applies to every contributor: human, Timmy, Claude, Perplexity, Gemini, Kimi, Grok.
 Exception: initial dependency config files (requirements.txt, package.json).

README.md

@@ -1,5 +1,22 @@
 # ◈ The Nexus — Timmy's Sovereign Home
 
+## Branch Protection & Review Policy
+
+**All repositories enforce:**
+- Require PR for merge (no direct commits)
+- 1+ required approval
+- CI/CD must pass
+- No force pushes
+- No branch deletion
+
+**Default Reviewers:**
+- @perplexity (org-wide QA gate)
+- @Timmy (hermes-agent owner gate)
+
+**Exceptions:**
+- CI not enforced on the-nexus (runner pending)
+- Timmy is required reviewer on hermes-agent
+
 The Nexus is Timmy's canonical 3D/home-world repo.
 
 It is meant to become two things at once: