diff --git a/.gitignore b/.gitignore
index 2556e45e..769e943d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*
diff --git a/CODEOWNERS b/CODEOWNERS
new file mode 100644
index 00000000..9197a96f
--- /dev/null
+++ b/CODEOWNERS
@@ -0,0 +1,5 @@
+@perplexity
+@Timmy the-nexus/
+@Timmy hermes-agent/
+@perplexity timmy-config/
+@perplexity timmy-home/
diff --git a/GOVERNANCE.md b/GOVERNANCE.md
new file mode 100644
index 00000000..d14a8327
--- /dev/null
+++ b/GOVERNANCE.md
@@ -0,0 +1,31 @@
+# Nexus Repository Governance
+
+## Branch Protection Policy
+
+All repositories must have the following branch protections enabled for the `main` branch in Gitea:
+
+1. Require PR for merge
+2. Require 1 approval
+3. Dismiss stale approvals
+4. Require CI to pass (where applicable)
+5. Block force pushes
+6. Block branch deletion
+
+## Default Reviewers Assignments
+
+- All repositories: `@perplexity` (QA gate)
+- `hermes-agent`: `@Timmy` (owner gate)
+- Specialized areas: repo-specific owners
+
+## CI Requirements
+
+- CI must be enabled for:
+  - the-nexus (CI runner #915)
+  - hermes-agent
+- CI is optional for:
+  - timmy-config
+  - timmy-home
+
+## Compliance
+
+All changes must comply with these rules. See Gitea repo settings for branch protection configuration.