diff --git a/.gitignore b/.gitignore
index 2556e45e..769e943d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*
diff --git a/nexus/.gitea/main-branch-protection.yml b/nexus/.gitea/main-branch-protection.yml
new file mode 100644
index 00000000..18771753
--- /dev/null
+++ b/nexus/.gitea/main-branch-protection.yml
@@ -0,0 +1,25 @@
+branch: main
+protection:
+  required_pull_request_reviews:
+    required_approving_review_count: 1 
+    dismiss_stale_reviews: true
+    require_code_owner_reviews: true
+    required_reviewers:
+      - perplexity
+      - Timmy
+  required_status_checks:
+    strict: true
+    contexts:
+      - ci/test
+      - ci/lint
+      - ci/build
+  enforce_admins: true
+  restrictions:
+    team_whitelist:
+      - perplexity
+      - Timmy
+    block_force_pushes: true
+    block_deletions: true
+  required_linear_history: true
+  required_signatures: false
+  required_conversation_resolution: true
diff --git a/nexus/.github/CODEOWNERS b/nexus/.github/CODEOWNERS
new file mode 100644
index 00000000..550a6186
--- /dev/null
+++ b/nexus/.github/CODEOWNERS
@@ -0,0 +1,7 @@
+# CODEOWNERS - Default reviewers for branch protection
+
+* @perplexity
+/docs @Timmy
+/src/hermes @Timmy
+/test @perplexity
+/config @Timmy