fix(branch-protection): bring PMOVES-OpenRoom under the drift ratchet

[POWERFULMOVES]

The ratchet exists. It wasn't watching this repo.

.github/workflows/branch-protection-drift.yml runs daily at 06:00 UTC on the App token and audits every repo in pmoves_standard.json — 26 of them. PMOVES-OpenRoom was not one, and the tool refused by name:

BranchProtectionError: no per_repo_overrides entry for
POWERFULMOVES/PMOVES-OpenRoom; add one to the spec

So its live protection drifted with nothing objecting:

	live	fork profile
required_approving_review_count	1	0 (deliberate, per #2490 N5 — avoids sync/* deadlock)
required_status_checks.contexts	[]	—

Protection on, strict: true, requiring nothing.

First look, first refusal

With the entry added, the documented audit runs:

"compliant": false,
"drift": [{ "field": "rulesets[[ main ]]", "expected": "present",
            "actual": "missing", "severity": "block" }]

Same shape as PMOVES-OpenRoom#12 turning CI on — the gate's first act is to say no, which is the evidence it was never watching.

No required check in this PR, deliberately

lint-and-build does not exist on hardened until PMOVES-OpenRoom#12 merges. Requiring a context that has never reported would block the six open PRs that predate the trigger — #3, #4, #8, #9, #10 and #11 all report total_count: 0.

Sequence: #12 merges → CI reports lint-and-build → the context is added here. Not before.

One measurement worth having

Not one of the 26 existing entries carries ruleset_overrides.required_status_checks — every row reads checks=-. Requiring a check on a fork will be a first for the fleet's ruleset spec, not just for this repo.

BRANCH_PROTECTION_BASELINE.md describes per-fork checks (pinokio → CodeRabbit, hermes-agent → 9) as classic protection, which is consistent with the ruleset spec being empty. But it means the two mechanisms hold different facts and only one of them is ratcheted.

Not applied

apply --no-dry-run is a governance write. It belongs to the operator or the daily cron, not to this PR.

Refs: PMOVES-OpenRoom#12, #2966, #2976

🤖 Generated with Claude Code

https://claude.ai/code/session_01X9mpK1ZFjexjthZbvcb94f

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• coderabbit

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: b3460d15-ac3c-4da0-9467-3c711226d275

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}