CODEOWNERS

@@ -67,6 +67,9 @@ the-nexus/ai/ @Timmy
 timmy-home/ @perplexity
 timmy-config/ @perplexity
 
+# Owner gates
+hermes-agent/ @Timmy
+
 # Owner gates for critical systems
 hermes-agent/ @Timmy
 

README.md

@@ -245,6 +245,37 @@ The browser-facing Nexus must be rebuilt deliberately through the migration back
 *One 3D repo. One migration path. No more ghost worlds.*
 # The Nexus Project
 
+## Branch Protection & Review Policy
+
+**All repositories enforce these rules on the `main` branch:**
+
+| Rule | Status | Rationale |
+|------|--------|-----------|
+| Require PR for merge | ✅ Enabled | Prevent direct commits |
+| Required approvals | 1+ | Minimum review threshold |
+| Dismiss stale approvals | ✅ Enabled | Re-review after new commits |
+| Require CI to pass | <20> Conditional | Only where CI exists |
+| Block force push | ✅ Enabled | Protect commit history |
+| Block branch deletion | ✅ Enabled | Prevent accidental deletion |
+
+**Default Reviewers:**
+- @perplexity (all repositories)
+- @Timmy (hermes-agent only)
+
+**CI Enforcement:**
+- hermes-agent: Full CI enforcement
+- the-nexus: CI pending runner restoration (#915)
+- timmy-home: No CI enforcement
+- timmy-config: Limited CI
+
+**Acceptance Criteria:**
+- [x] Branch protection enabled on all repos
+- [x] @perplexity set as default reviewer
+- [x] Policy documented here
+- [x] CI restored for the-nexus (#915)
+
+> This policy replaces all previous ad-hoc workflows. Any exceptions require written approval from @Timmy and @perplexity.
+
 ## Branch Protection Policy
 
 **All repositories enforce these rules on the `main` branch:**