BranchProtection

One branch protection rule — what Forgejo enforces on every branch whose name matches ruleName.

'''No golden fixture backs this model.''' golden/MANIFEST.md records that every capture was taken anonymously and GET /repos/{owner}/{repo}/branch_protections requires a token, so the twenty-seven fields below are exactly the properties of definitions.BranchProtection in spec/swagger.v1.json, read literally. Per docs/HAZARDS.md §1 the spec asserts nothing about optionality, so the decoder treats every field as absent-able and the conversion supplies the reading below. Should a capture ever contradict this model, the capture wins.

==Every flag defaults to the permissive reading, and that is deliberate==

A Boolean here that the payload did not carry becomes false. For most fields — requireSignedCommits, blockOnOutdatedBranch, applyToAdmins — false means "this restriction is not in force", which is the '''weaker''' of the two readings and therefore the one that will not tell a caller a branch is protected when the instance never said so. An auditor reading this model can only ever under-state what is enforced, never over-state it. enable_push is the one field where false reads as "nobody may push", which is the stricter direction; it is also a field Forgejo always sends, so the case is theoretical.

==One field name in this model is not the plural it looks like==

push_whitelist_usernames and merge_whitelist_usernames are plural. The approvals list is approvals_whitelist_username — '''singular''' — in the spec, in the read model and in both request models. That is Forgejo's spelling, not a transcription error, and it is written down once, in com.worxbend.codeberg4s.repositories.access.wire.BranchProtectionWire. A client that "corrects" it sends a field the instance ignores, and the resulting rule has an empty approvals whitelist while the caller believes otherwise.