diff --git a/.github/rulesets/Immutable-Tags.json b/.github/rulesets/Immutable-Tags.json
new file mode 100644
index 0000000..53739af
--- /dev/null
+++ b/.github/rulesets/Immutable-Tags.json
@@ -0,0 +1,19 @@
+{
+  "name": "Immutable-Tags",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~ALL"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {"type": "creation"},
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "update"},
+    {"type": "required_signatures"}
+  ]
+}
diff --git a/.github/rulesets/Optimus-Branch.json b/.github/rulesets/Optimus-Branch.json
new file mode 100644
index 0000000..03ad488
--- /dev/null
+++ b/.github/rulesets/Optimus-Branch.json
@@ -0,0 +1,44 @@
+{
+  "name": "Optimus-Branch",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_signatures"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 2,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_review_thread_resolution": true,
+        "require_extra_approval_for_unattributed_changes": true,
+        "required_reviewers": [],
+        "allowed_merge_methods": []
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": []
+      }
+    }
+  ]
+}
diff --git a/.github/settings.yml b/.github/settings.yml
index 92306c4..5c25a4a 100644
--- a/.github/settings.yml
+++ b/.github/settings.yml
@@ -105,21 +105,3 @@ labels:
 
 # ─── Branch Protection ─────────────────────────────────────────────────────────
 
-branches:
-  - name: "main"
-    protection:
-      required_pull_request_reviews:
-        required_approving_review_count: 1
-        dismiss_stale_reviews: true
-        require_code_owner_reviews: true
-      required_status_checks:
-        strict: true
-        contexts:
-          - "hypatia-scan"
-          - "codeql"
-          - "openssf-compliance"
-      enforce_admins: true
-      required_signatures: true
-      restrictions: null
-      allow_force_pushes: false
-      allow_deletions: false
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index b876db5..ee405e1 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -42,7 +42,7 @@ on:
     types: [opened, reopened, synchronize]
 permissions:
   actions: read
-  contents: write # needed to enable auto-merge
+  contents: read # needed to enable auto-merge
   pull-requests: write # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.
 jobs:
diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml
index 5394d85..8d9a93f 100644
--- a/.github/workflows/rhodibot.yml
+++ b/.github/workflows/rhodibot.yml
@@ -22,7 +22,7 @@ on:
     types: [completed]
 permissions:
   actions: read
-  contents: write
+  contents: read
   pull-requests: write
 jobs:
   rhodibot:
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
deleted file mode 100644
index e8da5a8..0000000
--- a/.github/workflows/rust-ci.yml
+++ /dev/null
@@ -1,56 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# // Copyright (c) Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
-# SPDX-License-Identifier: MPL-2.0
-# Rust CI — thin wrapper calling the shared estate reusable in
-# hyperpolymath/standards. Configure once, propagate everywhere.
-# See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards.
-name: Rust CI
-on:
-  push:
-    branches: [main, master]
-permissions:
-  actions: read
-  contents: read
-jobs:
-  check:
-    name: Cargo check + clippy + fmt
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    if: hashFiles('Cargo.toml') != ''
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
-        with:
-          components: clippy, rustfmt
-      - name: Cache cargo registry and build
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
-      - name: Cargo check
-        run: cargo check --all-targets 2>&1
-      - name: Cargo fmt
-        run: cargo fmt --all -- --check
-      - name: Cargo clippy
-        run: cargo clippy --all-targets -- -D warnings
-  test:
-    name: Cargo test
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    needs: check
-    if: hashFiles('Cargo.toml') != ''
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
-      - name: Cache cargo registry and build
-        uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
-      - name: Run tests
-        run: cargo test --all-targets
-      - name: Write summary
-        if: always()
-        run: |
-          echo "## Rust CI Results" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "- **cargo check**: passed" >> "$GITHUB_STEP_SUMMARY"
-          echo "- **cargo test**: completed" >> "$GITHUB_STEP_SUMMARY"