diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..de7fb78
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1 @@
+* @Azayzel
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3982ed5..c651026 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -74,7 +74,7 @@ jobs:
         if: steps.version.outputs.released != 'true'
         run: |
           unzip -p dist/comparelab.vsix extension/package.json |
-            node -e 'const fs = require("node:fs"); const assert = require("node:assert/strict"); const manifest = JSON.parse(fs.readFileSync(0, "utf8")); assert.equal(manifest.version, process.env.RELEASE_VERSION); assert.equal(manifest.publisher, "azayzel"); assert.equal(manifest.name, "comparelab");'
+            node -e 'const fs = require("node:fs"); const assert = require("node:assert/strict"); const expected = require("./package.json"); const manifest = JSON.parse(fs.readFileSync(0, "utf8")); assert.equal(manifest.version, process.env.RELEASE_VERSION); assert.equal(manifest.publisher, expected.publisher); assert.equal(manifest.name, expected.name);'
           if [ "$RESUMING" = "true" ]; then
             echo "Resuming the saved artifact; an already-published version is accepted."
             npm exec -- vsce publish --packagePath dist/comparelab.vsix --oidc --skip-duplicate
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index effa1d2..f07c891 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -36,7 +36,7 @@ The `.vscodeignore` allowlist includes only the manifest, README, license, runti
 
 ### One-time maintainer setup
 
-1. Create or obtain access to the **azayzel** publisher at [Marketplace publisher management](https://marketplace.visualstudio.com/manage). The extension identity is `azayzel.comparelab`.
+1. Create or obtain access to the **azayzel-comparelab** publisher at [Marketplace publisher management](https://marketplace.visualstudio.com/manage). Use the Publisher ID, not its display name or your GitHub username. The extension identity is `azayzel-comparelab.comparelab`.
 2. Create a GitHub environment named **marketplace** in this repository. Restrict its deployment branches to **main**. Add reviewers only if you want a manual approval before each release.
 3. In the publisher's **Trusted Publishing** settings, create a policy with these exact values:
    - Repository owner: `Azayzel`
@@ -91,4 +91,11 @@ Marketplace icons must be PNG, so [media/comparelab-icon.png](media/comparelab-i
 
 ## Pull requests
 
+`main` is protected by two active GitHub rulesets:
+
+- **Main - required tests** requires the GitHub Actions `test` check to pass against an up-to-date base, blocks force pushes and deletion, and has no bypass actors, including the owner.
+- **Main - pull request review** requires a PR and one code-owner approval, with stale approvals dismissed after new pushes. [CODEOWNERS](.github/CODEOWNERS) assigns all files to `@Azayzel`.
+
+Only `@Azayzel` may bypass the review ruleset when merging a PR, allowing owner-authored PRs without a second reviewer. This is a merger-based exemption, not an author-based one: the owner can also explicitly bypass review on another contributor's PR. It never bypasses required tests or permits direct pushes.
+
 Describe what changed, which tests passed, and whether you performed live provider or VS Code interaction tests. Provide sanitized screenshots for UI changes. Do not include real secrets or proprietary model prompts in issues, fixtures, or logs.
diff --git a/README.md b/README.md
index 92a5360..064842e 100644
--- a/README.md
+++ b/README.md
@@ -84,7 +84,7 @@ See [CONTRIBUTING](CONTRIBUTING.md) for the development workflow.
 ## Releases
 
 After [publishing setup](CONTRIBUTING.md#automated-releases), each merge to `main`
-bumps the release patch version and publishes to the [Marketplace](https://marketplace.visualstudio.com/items?itemName=azayzel.comparelab)
+bumps the release patch version and publishes to the [Marketplace](https://marketplace.visualstudio.com/items?itemName=azayzel-comparelab.comparelab)
 and [GitHub Releases](https://github.com/Azayzel/CompareLab/releases). Nothing publishes from pull requests.
 
 ## Documentation
diff --git a/package.json b/package.json
index a09e368..739d6ef 100644
--- a/package.json
+++ b/package.json
@@ -4,7 +4,7 @@
   "icon": "media/comparelab-icon.png",
   "description": "Compare AI models and prompt variants in VS Code with inline diffs, controlled evaluations, and local-first Ollama/OpenAI-compatible runners.",
   "version": "0.2.0",
-  "publisher": "azayzel",
+  "publisher": "azayzel-comparelab",
   "private": false,
   "license": "MIT",
   "repository": {