diff --git a/README.md b/README.md
index abb5d3d..fdb9a8a 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,13 @@
 # mukoko-dev/.github
 
-Org-wide defaults for `mukoko-dev`: the shared CI wiring, the lint
-configuration every repository inherits, and the notes explaining why both
-are shaped the way they are.
+> Org-wide defaults for `mukoko-dev`: the shared CI wiring, the lint
+> configuration every repository inherits, and the notes explaining why both
+> are shaped the way they are.
+
+[![Lint](https://github.com/mukoko-dev/.github/actions/workflows/lint.yml/badge.svg)](https://github.com/mukoko-dev/.github/actions/workflows/lint.yml)
+
+**Workflow library:** [`nyuchi/.github`](https://github.com/nyuchi/.github/tree/main/.github/workflows)
+| **Active ruleset:** `org-wide-main-protection` | **Merge method:** rebase only
 
 ## CI is not written here
 
@@ -21,6 +26,15 @@ Only add a workflow file here when the behaviour genuinely differs from the
 shared one. If you ever do copy a reusable workflow into this org, say so in
 the PR and record why, so the divergence is deliberate and visible.
 
+What this repository does hold, in `.github/workflows/`, are three thin
+callers that also apply to this repository itself:
+
+| File                | Name       | Trigger                                                       |
+| ------------------- | ---------- | ------------------------------------------------------------- |
+| `lint.yml`          | `Lint`     | Pull requests, and pushes to `main`/`master`/`scaffold`       |
+| `pr-title-lint.yml` | `PR title` | `pull_request_target` — opened, edited, reopened, synchronize |
+| `stale.yml`         | `Stale`    | Daily at 01:23 UTC, and `workflow_dispatch`                   |
+
 [hub]: https://github.com/nyuchi/.github/tree/main/.github/workflows
 
 ## Every repository needs `lint.yml`
@@ -58,8 +72,20 @@ from a workflow in that repository:
 | Next.js app or pnpm/Turborepo monorepo | `reusable-ci-nextjs-monorepo.yml`                       |
 | TypeScript application                 | `reusable-ci-typescript.yml`                            |
 | Published TypeScript package           | `reusable-ci-typescript-lib.yml`                        |
+| Python monorepo                        | `reusable-ci-python-monorepo.yml`                       |
+| Rust monorepo                          | `reusable-ci-rust-monorepo.yml`                         |
+| Docs site with `.mdx`                  | `reusable-ci-docs-mdx.yml`                              |
+| Docker image or container              | `reusable-ci-docker.yml`, `reusable-ci-container.yml`   |
+| Terraform or OpenTofu                  | `reusable-ci-terraform.yml`, `reusable-ci-opentofu.yml` |
+| Solidity                               | `reusable-ci-solidity.yml`                              |
 | any repository                         | `reusable-codeql.yml`, `reusable-dependency-review.yml` |
 
+Also in the library, for repositories that want them: `reusable-release.yml`,
+`reusable-sbom.yml`, `reusable-slsa-provenance.yml`,
+`reusable-openssf-scorecard.yml`, `reusable-pr-title-lint.yml` and
+`reusable-stale.yml`. The list above is not exhaustive — read
+[the directory][hub] rather than trusting this table to stay complete.
+
 ## Lint configuration
 
 `.prettierrc`, `.prettierignore`, `.markdownlint.jsonc`, `.yamllint.yaml` and
@@ -77,10 +103,38 @@ Two adjustments come up often:
   becomes `{/_ … _/}` — corrupting the file. If a repository has `.mdx`
   content, pass a `prettier-glob` that excludes it.
 
-## Merge method
+## Merge method and branch protection
+
+**Rebase only.** `org-wide-main-protection` sets
+`allowed_merge_methods: ["rebase"]`, and the repository settings agree with it:
+every repository in this org has `allow_squash_merge: false`,
+`allow_merge_commit: false`, `allow_rebase_merge: true` and
+`allow_auto_merge: true`. Squash and merge-commit are off in both places.
+
+Alongside the five required checks, the ruleset applies:
+
+| Rule                      | Effect                                                                                                                                                                                |
+| ------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `deletion`                | The default branch cannot be deleted                                                                                                                                                  |
+| `non_fast_forward`        | No force pushes                                                                                                                                                                       |
+| `required_linear_history` | No merge commits reach the default branch                                                                                                                                             |
+| `pull_request`            | Changes land by PR. Stale reviews are dismissed on push, review threads must be resolved, and unattributed changes need an extra approval. `required_approving_review_count` is **0** |
+| `required_status_checks`  | Strict — the branch must be up to date with the base                                                                                                                                  |
+
+It applies to the default branch of every repository except `sandbox-*` and
+`archive-*`.
+
+There is **no `required_signatures` rule.** An earlier version of this
+document said there was; there is not, and commits do not need to be signed
+to merge.
+
+A second ruleset, `enterprise-main-protection`, arrives from the `bundu-labs`
+enterprise. It is in **evaluate** mode — it reports what it would have done
+and blocks nothing.
+
+## Licence
+
+No `LICENSE` file is committed to this repository. Until one is added the
+contents are under exclusive copyright.
 
-The org ruleset allows **squash merges only**, alongside
-`required_linear_history` and `required_signatures`. Note that the
-repository-level settings in this org still leave merge-commit and rebase
-switched on; the ruleset is what actually decides, and it permits squash
-alone.
+© Nyuchi Africa (Pvt) Ltd.