diff --git a/.gitignore b/.gitignore
index 2556e45e..769e943d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*
diff --git a/README.md b/README.md
index a9a791cf..c0a428ba 100644
--- a/README.md
+++ b/README.md
@@ -57,6 +57,31 @@ The commit the user pointed at:
 
 still contains the old root browser files (`index.html`, `app.js`, `style.css`, `package.json`, tests/), so it is a useful in-repo reference point for what existed before the later deletions.
 
+## Branch Protection & Review Policy
+
+### Enforced Rules
+
+All repositories under `Timmy_Foundation` enforce these protections on `main`:
+- ✅ Require PR for merge
+- ✅ 1+ approved reviewer
+- ✅ CI/CD must pass
+- ✅ No force pushes
+- ✅ No branch deletion
+
+### Default Reviewers
+| Repo | Required Reviewers |
+|---|---|
+| `hermes-agent` | `@Timmy` (owner), `@perplexity` (QA) |
+| `the-nexus` | `@perplexity` (QA), `@Rockachopa` (arch) |
+| `timmy-home` | `@perplexity` (QA) |
+| `timmy-config` | `@perplexity` (QA) |
+
+### CI Status
+- ✅ `hermes-agent` - protected
+- ⚠️ `the-nexus` - pending CI restoration (#915)
+- ✅ `timmy-home` - no CI
+- ✅ `timmy-config` - no CI
+
 ## Active migration backlog
 
 - `#684` sync docs to repo truth