Admin remediation: resolve aifinpay-web canonical branch and require protected merges

[coinsecuritiescompany]

2026-08-17 branch-governance finding

GitHub metadata currently reports AiFinPay/aifinpay-web default branch = main, but primary evidence shows the actual backend/payment application and CI live on master / release branches:

• master has .github/workflows/ci.yml and the AIFP backend subsystem.
• main does not contain .github/workflows and lacks multiple backend modules used by PR #17.
• compare main...master shows a large historical divergence (master hundreds of commits ahead and dozens behind).
• an attempted mechanical PR #17 replay onto main failed because many audited PR files do not exist in main; this is not a safe rebase.

Required human/admin decision

For this release, the conservative recommendation is:

1. Treat master as the canonical application branch for the existing backend/payment product and keep PR #17 targeting it.
2. Either change repository default metadata to master, OR create a separately reviewed branch-migration project that reconciles main and master intentionally. Do not mix that migration into payment remediation PRs.
3. After PR #17 is human-reviewed/merged, retarget/rebase PR #22 onto the canonical post-merge branch and rerun the full CI suite.

Branch protection / rulesets required

The available connector exposes branch protection state but not an auditable mutation for configuring it. Require, at minimum, for the canonical aifinpay-web branch and AiFinPay/evm-contract default/canonical branch:

• pull request review before merge
• required CI/status checks
• no direct force pushes / deletion
• ideally CODEOWNERS/security review for payment-critical paths

This issue is an investor-grade evidence gap until an org admin applies and records the ruleset/protection settings.