Phase 4 verification gate: Cubenest org admins + default branch protection + required-reviews

[harry-harish]

Tracking issue from prds/NAMING.md Phase 4 verification gates (walked 2026-05-28).

Required action

Before first contributor PR is opened against the public repo, confirm:

1. Cubenest org admins — at minimum harry-harish (current owner). Add a second admin per the second-maintainer issue (#TBD — see sustainability tracking issue).
2. Default branch protection on main — enable immediately after the private→public flip (gated on GitHub Free org branch-protection availability; per IMPLEMENTATION_PLAN.md Open items §7, this lands at end of Phase 4 with the public flip). Required status checks: ci, dco.
3. Required-reviews policy — at least 1 review required before merge. Once a second maintainer exists, raise to "review by someone other than the author."

Context

NAMING.md notes this is an "operational checklist, not a 'can we still use this name' gate." Tracked here because it has to clear before external contributor traffic.

Sequencing

This issue completes after the Phase 4 public-flip step (the LAST step of Phase 4, after this verification chunk). Do NOT close until both the public flip + branch-protection gh-api call (per IMPLEMENTATION_PLAN.md Task 0.13 Step 2 reference) have run.

Source gate

prds/NAMING.md § Organization — first bullet ("Confirm Cubenest org admins, default branch protection on main, and required-reviews policy before first contributor PR").

[harry-harish]

Resolved by shipping (2026-05-29). Branch protection ENABLED on Cubenest/rrweb-stack:main — required status checks (ci + dco), required PR review (1), dismiss-stale-reviews, required linear history, required conversation resolution, no force-push, no deletions. Admin bypass enabled so maintainer keeps direct-to-main during pre-1.0; promote to enforce_admins:true at v1.0.