diff --git a/.gitignore b/.gitignore
index 2556e45e..769e943d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*
diff --git a/hermes-agent/.github/CODEOWNERS b/hermes-agent/.github/CODEOWNERS
new file mode 100644
index 00000000..a0beba88
--- /dev/null
+++ b/hermes-agent/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+@Timmy
+@perplexity
diff --git a/the-nexus/.github/CODEOWNERS b/the-nexus/.github/CODEOWNERS
new file mode 100644
index 00000000..7dc0771c
--- /dev/null
+++ b/the-nexus/.github/CODEOWNERS
@@ -0,0 +1 @@
+@perplexity
diff --git a/the-nexus/README.md b/the-nexus/README.md
new file mode 100644
index 00000000..ed56124b
--- /dev/null
+++ b/the-nexus/README.md
@@ -0,0 +1,18 @@
+## Contributing
+
+### Branch Protection Policy
+
+All repositories enforce the following branch protection rules on `main`:
+- Require PR for merge
+- Require 1 approval
+- Dismiss stale approvals
+- Require CI to pass
+- Block force pushes
+- Block branch deletion
+
+Default reviewers:
+- @perplexity (QA gate)
+- @Timmy (owner gate for hermes-agent)
+- Repo-specific owners for specialized areas
+
+See full policy in #918
diff --git a/timmy-config/.github/CODEOWNERS b/timmy-config/.github/CODEOWNERS
new file mode 100644
index 00000000..7dc0771c
--- /dev/null
+++ b/timmy-config/.github/CODEOWNERS
@@ -0,0 +1 @@
+@perplexity
diff --git a/timmy-home/.github/CODEOWNERS b/timmy-home/.github/CODEOWNERS
new file mode 100644
index 00000000..7dc0771c
--- /dev/null
+++ b/timmy-home/.github/CODEOWNERS
@@ -0,0 +1 @@
+@perplexity