diff --git a/.gitea/branch-protection/hermes-agent.yml b/.gitea/branch-protection/hermes-agent.yml
new file mode 100644
index 0000000..95ee6cd
--- /dev/null
+++ b/.gitea/branch-protection/hermes-agent.yml
@@ -0,0 +1,8 @@
+branch: main
+rules:
+  require_pull_request: true
+  required_approvals: 1
+  dismiss_stale_approvals: true
+  require_ci_to_merge: true
+  block_force_pushes: true
+  block_deletions: true
diff --git a/.gitea/branch-protection/the-nexus.yml b/.gitea/branch-protection/the-nexus.yml
new file mode 100644
index 0000000..99066a1
--- /dev/null
+++ b/.gitea/branch-protection/the-nexus.yml
@@ -0,0 +1,8 @@
+branch: main
+rules:
+  require_pull_request: true
+  required_approvals: 1
+  dismiss_stale_approvals: true
+  require_ci_to_merge: false # CI runner dead (issue #915)
+  block_force_pushes: true
+  block_deletions: true
diff --git a/.gitea/branch-protection/timmy-config.yml b/.gitea/branch-protection/timmy-config.yml
new file mode 100644
index 0000000..713da2c
--- /dev/null
+++ b/.gitea/branch-protection/timmy-config.yml
@@ -0,0 +1,8 @@
+branch: main
+rules:
+  require_pull_request: true
+  required_approvals: 1
+  dismiss_stale_approvals: true
+  require_ci_to_merge: false # Limited CI
+  block_force_pushes: true
+  block_deletions: true
diff --git a/.gitea/branch-protection/timmy-home.yml b/.gitea/branch-protection/timmy-home.yml
new file mode 100644
index 0000000..7c1faa9
--- /dev/null
+++ b/.gitea/branch-protection/timmy-home.yml
@@ -0,0 +1,8 @@
+branch: main
+rules:
+  require_pull_request: true
+  required_approvals: 1
+  dismiss_stale_approvals: true
+  require_ci_to_merge: false # No CI configured
+  block_force_pushes: true
+  block_deletions: true
diff --git a/CODEOWNERS b/CODEOWNERS
index 28f7bd7..a1ddab7 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -19,5 +19,8 @@ hermes-agent/protocol/ @Timmy
 the-nexus/portals/ @perplexity
 the-nexus/ai/ @Timmy
 
+# Required reviewer for hermes-agent (owner gate)
+hermes-agent/ @Timmy
+
 # Optional: Add repo-specific owners for specialized areas
 # e.g., "hermes-agent/agent-core/ @Rockachopa"