[dborgards]

What does this change?

The exported main ruleset required zero approving reviews and had no CODEOWNERS, but still enabled require_code_owner_review and require_extra_approval_for_unattributed_changes. Both flags are now false; required_approving_review_count remains 0. Required checks, thread resolution, the Maintain-role bypass and every other setting are unchanged.

The maintainer explicitly selected this policy on 2026-10-25. The live GitHub ruleset was updated accordingly, then read back and compared with its prior snapshot: exactly these two flags changed. This PR synchronizes the committed export with the verified live setting.

Closes #361. B-2 was resolved by #452; the other listed fixes and verification gaps are already on main, including the SBOM version-floor checks, package registry checks, commit-subject check and forward requirement-id validation. No tools.zip remains in the original workspace.

Type of change

• feat — new behaviour (minor release)
• fix / perf — bug or performance fix (patch release)
• docs / test / refactor / chore / ci — no release
• Breaking change

Checklist

• Build with -p:CI=true, test (net10.0), dotnet format --verify-no-changes, and pack + eng/verify-packages.py all pass locally
• Public API changes are documented with XML comments — no public API change
• New behaviour is covered by a test — the existing verification-script tests cover the ruleset export; live API read-back verifies the approved setting
• The requirement or ADR this relates to is referenced — Build/CI/docs: minor findings (B-2..B-16) from the 2026-10-21 deep review #361 B-10

Validation

• Release build: 0 warnings/errors; full net10.0 suite: 2881/2881 passed.
• Formatting verification passed; fresh pack verified all 9 packages.
• All 50 verification-script tests passed; JSON parses; diff contains only the two approved Boolean changes.
• Live ruleset read-back confirms both false, 0 required reviews, and no unrelated changes.
• No modified executable library lines; no public API or package behavior changes.

[cursor]

PR Summary

Low Risk
CI/ruleset JSON only; branch protection is slightly relaxed on paper but aligned with zero required reviews and no CODEOWNERS.

Overview
Updates the exported main branch ruleset so it matches the live GitHub policy: require_code_owner_review and require_extra_approval_for_unattributed_changes are set to false in .github/rulesets/main.json.

required_approving_review_count stays 0; required status checks, thread resolution, merge methods, and other rules are unchanged. This removes review flags that had no practical effect without CODEOWNERS or extra approval requirements, while keeping the repo’s verification export in sync with the API read-back.

^{Reviewed by Cursor Bugbot for commit b859877. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-10-25T11:31:41.177805Z	b859877	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!