{
  "_comment": "DECLARED desired state of Gitea branch protection on main. ci/gitea-settings.sh fails the merge gate when the LIVE Gitea diverges from this. Gitea settings live in Gitea database - invisible to Flux, unreadable by every other check - so this file plus that check are the only drift detection that exists for them.",
  "_generated": "2026-09-29 from the live rule, after the session that found protection OFF and zero runners for a month",
  "_amended": "2026-10-01: required_approvals 1 -> 0. See _why_required_approvals_is_zero.",
  "_why_required_approvals_is_zero": "The GATE is the approver (operator intent, 2026-09-29). required_approvals: 1 was never consistent with that intent: ci/approval-policy.sh's header and ci/gate.sh:194 both already described the model as 'required_approvals: 0 and the GATE decides', and infra/gitea/require-gate.sh's own closing note named the consequence of 1 -- 'Gitea will not let an author approve their own PR'. With exactly ONE collaborator (jakman85, owner), that made every PR the operator opened permanently unmergeable. Measured 2026-10-01: PR #35, gate green in 1m41s, zero reviews, no path to a merge. decisions/2026-09-30-flux-deploy-notification-inhibited.md had already flagged the 1-vs-0 disagreement as unresolved; this settles it at 0.",
  "_what_still_holds_at_zero": "This drops the APPROVAL COUNT only. block_admin_merge_override stays TRUE and enable_status_check stays TRUE, so the required gate context still binds absolutely -- nobody, administrator included, can merge a red gate. That distinction is the whole reason this is the chosen fix rather than block_admin_merge_override: false, which would have handed admins a bypass over the gate itself and re-opened what infra/gitea/block-admin-override.sh was written to close (PRs #5-#9, merged with zero approvals). Architecturally and security-relevant paths are still reviewed, by ci/approval-policy.sh rather than by this field.",
  "branch": "main",
  "runners_online_min": 1,
  "protection": {
    "enable_push": false,
    "enable_push_whitelist": false,
    "enable_merge_whitelist": false,
    "enable_status_check": true,
    "status_check_contexts": [
      "gate / gate (pull_request)"
    ],
    "required_approvals": 0,
    "enable_approvals_whitelist": false,
    "block_admin_merge_override": true,
    "block_on_rejected_reviews": true,
    "dismiss_stale_approvals": true
  }
}