docs: document main merge protections

.coderabbit.yaml

@@ -0,0 +1,3 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+reviews:
+  request_changes_workflow: true

docs/superpowers/plans/2026-07-24-parallel-worktree-execution.md

@@ -170,9 +170,14 @@ suites are added, required checks therefore include:
 - approved visual regression checks
 - serialized Lighthouse CI
 
-GitHub branch protection should require passing checks, one approval from
-someone other than the author, and dismissal of stale approvals. If the
-repository/account cannot enforce one of these settings, document the gap and
+GitHub branch protection requires the `verify` check, verified signatures on
+every commit entering `main`, resolution of every pull-request review
+conversation before merge, one approval from someone other than the author,
+dismissal of stale approvals after new commits, and enforcement for
+administrators. CodeRabbit's request-changes workflow is enabled in
+`.coderabbit.yaml`: its findings request changes, and it approves after its
+review conversations are resolved and its configured pre-merge checks pass. If
+the repository/account cannot enforce a planned setting, document the gap and
 apply the same rule manually; never claim a protection is enabled when it is
 not.
 

docs/superpowers/plans/2026-07-24-ux-portfolio-implementation.md

@@ -2248,11 +2248,16 @@ git commit -m "test: enforce portfolio performance budgets"
 
 Store this exact checklist in `docs/deployment.md`.
 
-Also document the GitHub merge gate: author and approver must differ, stale
-approvals are dismissed after new commits, required CI checks must pass, and
-only the integrator merges the approved head SHA. If repository permissions do
-not support branch protection, the integrator enforces the same checklist
-manually and records that limitation truthfully.
+Also document the GitHub merge gate: required CI checks must pass, and only
+the integrator merges the approved head SHA. The active `main` protection
+requires the author and approver to differ, dismisses stale approvals after new
+commits, and also requires verified signatures on every commit, resolution of
+all pull-request review conversations, the `verify` check, and administrator
+enforcement. CodeRabbit's request-changes workflow is enabled in
+`.coderabbit.yaml`, so its findings block approval until their conversations
+are resolved. If repository permissions do not support branch protection, the
+integrator enforces the same checklist manually and records that limitation
+truthfully.
 
 - [ ] **Step 2: Verify the repository locally before external setup**
 

readme.md

@@ -38,6 +38,16 @@ Node major while allowing Node 22 patch and minor updates. `npm run
 check:dependabot` validates that guard with the declared Node YAML parser, and
 the shared `npm run verify` gate runs that check in CI.
 
+GitHub protects `main` by requiring the existing `verify` check to succeed
+before a change can be accepted. The requirement applies to repository
+administrators. Every commit entering `main` must have a verified signature,
+and every pull-request review conversation must be resolved before merge.
+Branch freshness is not required by this gate. Every pull request must receive
+one fresh approval from someone other than the author; new commits dismiss
+stale approvals. CodeRabbit's request-changes workflow is enabled in
+`.coderabbit.yaml`, so its findings block approval until their review
+conversations are resolved.
+
 ## Portfolio project
 
 The approved design for the code-first UX portfolio is documented in