diff --git a/packages/omo-codex/plugin/components/rules/.github/CODEOWNERS b/packages/omo-codex/plugin/components/rules/.github/CODEOWNERS
new file mode 100644
index 000000000..ef9dbe9d5
--- /dev/null
+++ b/packages/omo-codex/plugin/components/rules/.github/CODEOWNERS
@@ -0,0 +1,12 @@
+* @code-yeongyu
+
+.github/workflows/* @code-yeongyu
+.github/dependabot.yml @code-yeongyu
+package.json @code-yeongyu
+package-lock.json @code-yeongyu
+LICENSE @code-yeongyu
+NOTICE @code-yeongyu
+README.md @code-yeongyu
+CHANGELOG.md @code-yeongyu
+.codex-plugin/plugin.json @code-yeongyu
+hooks/hooks.json @code-yeongyu
diff --git a/packages/omo-codex/plugin/components/rules/.github/branch-ruleset.json b/packages/omo-codex/plugin/components/rules/.github/branch-ruleset.json
new file mode 100644
index 000000000..1f482bb66
--- /dev/null
+++ b/packages/omo-codex/plugin/components/rules/.github/branch-ruleset.json
@@ -0,0 +1,45 @@
+{
+	"name": "main protection",
+	"target": "branch",
+	"enforcement": "active",
+	"conditions": {
+		"ref_name": {
+			"include": ["~DEFAULT_BRANCH"],
+			"exclude": []
+		}
+	},
+	"rules": [
+		{ "type": "deletion" },
+		{ "type": "non_fast_forward" },
+		{ "type": "required_linear_history" },
+		{
+			"type": "pull_request",
+			"parameters": {
+				"required_approving_review_count": 1,
+				"dismiss_stale_reviews_on_push": true,
+				"require_code_owner_review": true,
+				"require_last_push_approval": false,
+				"required_review_thread_resolution": true
+			}
+		},
+		{
+			"type": "required_status_checks",
+			"parameters": {
+				"strict_required_status_checks_policy": true,
+				"required_status_checks": [
+					{ "context": "test (ubuntu-latest · node 20)" },
+					{ "context": "test (ubuntu-latest · node 22)" },
+					{ "context": "test (macos-latest · node 20)" },
+					{ "context": "test (macos-latest · node 22)" }
+				]
+			}
+		}
+	],
+	"bypass_actors": [
+		{
+			"actor_id": 5,
+			"actor_type": "RepositoryRole",
+			"bypass_mode": "always"
+		}
+	]
+}
diff --git a/packages/omo-codex/plugin/components/rules/.github/dependabot.yml b/packages/omo-codex/plugin/components/rules/.github/dependabot.yml
new file mode 100644
index 000000000..1941ade14
--- /dev/null
+++ b/packages/omo-codex/plugin/components/rules/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    groups:
+      dev-dependencies:
+        dependency-type: development
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
diff --git a/packages/omo-codex/plugin/components/rules/.github/pull_request_template.md b/packages/omo-codex/plugin/components/rules/.github/pull_request_template.md
new file mode 100644
index 000000000..4530c7f0a
--- /dev/null
+++ b/packages/omo-codex/plugin/components/rules/.github/pull_request_template.md
@@ -0,0 +1,20 @@
+## Summary
+
+<!-- Brief description, 1-3 bullets -->
+
+-
+
+## Verification
+
+- [ ] `npm run check` (typecheck + biome + build)
+- [ ] `npm test` (unit tests)
+- [ ] `npm pack --dry-run` (release sanity)
+- [ ] Hook smoke-tested locally with `node dist/cli.js hook session-start`
+- [ ] Hook smoke-tested locally with `node dist/cli.js hook post-tool-use`
+
+## Codex plugin impact
+
+- [ ] `.codex-plugin/plugin.json` remains valid
+- [ ] `hooks/hooks.json` still uses stable Codex hook JSON
+- [ ] Session deduplication behavior is covered by tests
+- [ ] CHANGELOG entry added for user-facing changes