diff --git a/.gitea/branch_protection.yml b/.gitea/branch_protection.yml
index e2ff224..739d559 100644
--- a/.gitea/branch_protection.yml
+++ b/.gitea/branch_protection.yml
@@ -1,11 +1,17 @@
 branch_protection:
   main:
-    require_pull_request: true
-    required_approvals: 1
-    dismiss_stale_reviews: true
-    require_ci_to_pass: true
-    block_force_pushes: true
-    block_deletions: true
+    required_pull_request_reviews: true
+    required_status_checks:
+      - ci/circleci
+      - security-scan
+    required_linear_history: false
+    allow_force_pushes: false
+    allow_deletions: false
+    required_pull_request_reviews:
+      required_approving_review_count: 1
+      dismiss_stale_reviews: true
+      require_last_push_approval: true
+      require_code_owner_reviews: true
     required_owners: 
       - perplexity
       - Timmy
diff --git a/CODEOWNERS b/CODEOWNERS
index 4c176e6..8849587 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -1,18 +1,25 @@
-# CODEOWNERS file for repository review policies
-# Format: <path> <reviewer>
+# CODEOWNERS - Mandatory Review Policy
 
 # Default reviewer for all repositories
 * @perplexity
 
 # Special reviewers for specific repos
 hermes-agent/ @Timmy
+hermes-agent/agent-core/ @Rockachopa
 the-nexus/ @perplexity
+the-nexus/ai/ @Timmy
 timmy-home/ @perplexity
 timmy-config/ @perplexity
 
 # QA reviewer for all PRs
 * @perplexity
 
+# Owner gates
+hermes-agent/ @Timmy
+
+# QA reviewer for all PRs
+* @perplexity
+
 # Specialized component owners
 # Required reviewer for hermes-agent (owner gate)
 hermes-agent/ @Timmy