# Branch Protection

Status: VERIFIED BY LOCAL SELF-TEST

## Required Checks

Every generated collaborative repo must keep its gate workflow required on `main`.

Required check names:

- `publication-gate / gate` for `Hecton8-PublicSDK`;
- `contributor-sandbox-gate / gate` for `Hecton8-ContribSandbox`;
- `private-slice-gate / gate` for private contractor slices.

## Required Files

The local export-surface gate verifies that each generated repo includes:

- `CODEOWNERS`;
- `.github/workflows/...`;
- `tools/Test-H8PublicationGate.ps1`;
- matching `profiles/*.deny`;
- `.github/pull_request_template.md`;
- root metadata files: `.editorconfig`, `.gitattributes`, `.gitignore`, `README.md`.
- `tools/Test-H8PayloadPolicy.ps1`.
- `tools/Test-H8SecretPolicy.ps1`.
- `tools/Test-H8ReferencePolicy.ps1`.
- `tools/Test-H8LinkPolicy.ps1`.
- `tools/Test-H8PathPolicy.ps1`.
- `tools/Test-H8GitIndexPolicy.ps1`.
- `tools/Test-H8CiSecurityPolicy.ps1`.

Run:

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\Test-H8ExportSurface.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -Target public-sdk
```

## Blocking Rules

- No direct push to `main`.
- No force push to `main`.
- Required status checks must pass.
- CODEOWNERS review is required.
- The gate workflow file itself is owner-reviewed.
- Gate workflows use read-only token scope and no PR-exposed secrets.
- Remote policy must pass before first push.
- Publish tooling targets `main`.
- `-AllowNonMainBranch` is only for local dry-run plans named `dry-run/<name>`;
  publication tooling refuses to push non-main branches.
- Publish scripts reject unsafe Git remote names and branch refspecs before running
  `git push`.