chore(branch-protection): enable 1-review + admin-bypass on main across 5 repos (CICD_AUDIT T3.1.d)

[ahmetabdullahgultekin]

Summary

Closes CICD audit recommendation T3.1.d ("enable branch protection on all 5 repos"). This PR is docs only — the branch-protection changes themselves have already been applied via gh api PUT (no code change needed). Appends a new section to CICD_AUDIT_2026-05-04.md capturing the change.

Branches protected (6 total)

Repo	Branch
Rollingcat-Software/FIVUCSAS	main
Rollingcat-Software/FIVUCSAS	master (integration branch per reference_fivucsas_branch_model.md)
Rollingcat-Software/identity-core-api	main
Rollingcat-Software/biometric-processor	main
Rollingcat-Software/web-app	main
Rollingcat-Software/client-apps	main

Settings (identical on all 6)

• required_pull_request_reviews.required_approving_review_count = 1
• enforce_admins = false — admin bypass allowed for emergency hotfixes only, must be documented in PR description (per memory note feedback_pr_review_workflow.md)
• required_status_checks = null (not enforced yet; CI still rolling — will be added in T3.1.e)
• required_linear_history = false (merge commits allowed — needed for master integration pattern)
• required_conversation_resolution = true
• allow_force_pushes = false
• allow_deletions = false

Verification

gh api repos/<owner>/<repo>/branches/<branch>/protection returned a 200 with the expected fields for every branch:

FIVUCSAS/main                       reviews=1 enforce_admins=false force_push=false del=false conv=true
FIVUCSAS/master                     reviews=1 enforce_admins=false force_push=false del=false conv=true
identity-core-api/main              reviews=1 enforce_admins=false force_push=false del=false conv=true
biometric-processor/main            reviews=1 enforce_admins=false force_push=false del=false conv=true
web-app/main                        reviews=1 enforce_admins=false force_push=false del=false conv=true
client-apps/main                    reviews=1 enforce_admins=false force_push=false del=false conv=true

Full evidence JSON for FIVUCSAS/main is embedded in the appended audit-doc section.

Admin-bypass policy (documented in this PR)

• Use only for emergency production hotfixes when no second reviewer is available, or for operator-only mechanical chores (submodule pointer bumps, dependency-lock updates, doc-only changes already reviewed elsewhere).
• Every admin-bypass merge must include the reason in the PR description.
• PRs that bypass review without justification will be flagged in the next CICD audit.

Test plan

• All 6 gh api PUT .../protection calls returned a 200 with a protection JSON body.
• All 6 follow-up gh api GET .../protection calls confirmed required_approving_review_count=1, enforce_admins=false, allow_force_pushes=false, allow_deletions=false, required_conversation_resolution=true.
• This PR exercises the protection: feature branch pushed, PR opened against protected main. Merging will require 1 approving review (admin bypass available if needed).

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

Generated with Claude Code

[Copilot]

Pull request overview

Updates the CI/CD audit documentation to record that branch protection has been enabled (T3.1.d) across the org’s repos/branches, including the chosen review/admin-bypass policy and verification evidence.

Changes:

• Appends a new dated section documenting branch protection scope (5 repos / 6 branches) and settings.
• Adds an admin-bypass policy description for enforce_admins=false.
• Includes a gh api verification command plus an evidence JSON block and a summary table.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.