diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 0000000..f15441a
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml
index eda5b3a..af02476 100644
--- a/.github/workflows/pre-commit.yaml
+++ b/.github/workflows/pre-commit.yaml
@@ -17,7 +17,7 @@ jobs:
       - name: Terraform
         uses: hashicorp/setup-terraform@5e8dbf3c6d9deaf4193ca7a8fb23f2ac83bb6c85 # v4
         with:
-          terraform_version: "1.5.7"
+          terraform_version: "1.9.8"
 
       - name: install hcledit
         run: |
diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 0000000..1e055b4
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,72 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+- Focusing on what is best not just for us as individuals, but for the overall
+  community
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or email address,
+  without their explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+conduct@pelo.tech.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.
+
+[homepage]: https://www.contributor-covenant.org
diff --git a/README.md b/README.md
index b1c7fce..7eb1704 100644
--- a/README.md
+++ b/README.md
@@ -20,7 +20,7 @@ module "github" {
 # Or adopt a single submodule.
 module "repos" {
   source  = "pelotech/orgkit/github//modules/repository"
-  version = "~> 0.1"
+  version = "~> 0.2"
 
   teams        = { developers = { id = "123", slug = "developers" } }
   repositories = [/* ... */]
@@ -37,9 +37,9 @@ organization and Actions axes:
   environment secrets, and **organization-level** secrets/variables with
   `all`/`private`/`selected` visibility.
 - **Environments** — reviewers, wait timers, and deployment branch policies.
-- **Organization rulesets** — a baseline branch-protection ruleset and a
-  required-signed-commits ruleset (the modern replacement for per-repo branch
-  protection).
+- **Organization & repository rulesets** — a generic ruleset interface with
+  opt-in presets (PR reviews, signed commits, deletion protection, force-push
+  and linear-history), the modern replacement for per-repo branch protection.
 - **Organization roles** — assign predefined org roles (e.g. `security_manager`) to
   teams.
 - **Opinionated defaults, no hardcoded policy** — every organization-specific choice
@@ -59,9 +59,9 @@ modules/organization  →  modules/teams  →  modules/repository
 
 | Submodule | Manages |
 | --------- | ------- |
-| [`organization`](modules/organization) | Org membership, owner/admin assignment, org rulesets (baseline + signed commits). |
+| [`organization`](modules/organization) | Org membership, owner/admin assignment, org rulesets (generic interface + presets). |
 | [`teams`](modules/teams) | Teams, team memberships, the optional all-members team, org-role assignments. |
-| [`repository`](modules/repository) | Repositories, team↔repo grants, repo/environment Actions variables & secrets, environments. |
+| [`repository`](modules/repository) | Repositories, team↔repo grants, per-repo rulesets, repo/environment Actions variables & secrets, environments. |
 
 The **root** additionally manages organization-level Actions secrets and variables
 (they need both secret values and repository ids, so they live at the composition