diff --git a/.gitignore b/.gitignore
index 2556e45e..769e943d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,3 +2,4 @@ node_modules/
 test-results/
 nexus/__pycache__/
 tests/__pycache__/
+.aider*
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d50e88fb..ebcc0ef1 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -17,3 +17,35 @@ Removal is a first-class contribution. Baseline: 4,462 lines (2026-03-25). Goes
 Applies to every contributor: human, Timmy, Claude, Perplexity, Gemini, Kimi, Grok.
 Exception: initial dependency config files (requirements.txt, package.json).
 No other exceptions. Too big? Break it up.
+# Contribution & Review Policy
+
+## Branch Protection Rules
+
+All repositories must enforce:
+- Pull Request Required for Merge
+- Minimum 1 Approval Required
+- CI/CD Must Pass
+- No Force Pushes
+- No Direct Main Commits
+
+## Review Requirements
+
+All PRs must be reviewed by:
+- @perplexity (mandatory on all repos)
+- @Timmy (mandatory on hermes-agent)
+- Repo-specific owners for specialized areas
+
+## CI/CD Requirements
+
+- hermes-agent: Full CI/CD pipeline required
+- the-nexus: CI/CD pending runner restoration
+- timmy-home: No CI/CD (manual review required)
+- timmy-config: No CI/CD (manual review required)
+
+## Enforcement
+
+Branch protection rules are configured in Gitea under:
+Settings > Branches > Branch Protection
+
+For detailed implementation see:
+- https://forge.alexanderwhitestone.com/Timmy_Foundation/the-nexus/issues/918
diff --git a/hermes-agent/CODEOWNERS b/hermes-agent/CODEOWNERS
new file mode 100644
index 00000000..e08aa93f
--- /dev/null
+++ b/hermes-agent/CODEOWNERS
@@ -0,0 +1,2 @@
+@perplexity
+@Timmy
diff --git a/package.json b/package.json
new file mode 100644
index 00000000..b36e4c30
--- /dev/null
+++ b/package.json
@@ -0,0 +1,14 @@
+{
+  "name": "the-nexus",
+  "version": "1.0.0",
+  "private": true,
+  "config": {
+    "branchProtection": {
+      "requiredApprovals": 1,
+      "requiredStatusChecks": ["ci/cd"],
+      "restrictions": {
+        "blockedActions": ["forcePush", "directCommit"]
+      }
+    }
+  }
+}
diff --git a/the-nexus/CODEOWNERS b/the-nexus/CODEOWNERS
new file mode 100644
index 00000000..7dc0771c
--- /dev/null
+++ b/the-nexus/CODEOWNERS
@@ -0,0 +1 @@
+@perplexity
diff --git a/timmy-config/CODEOWNERS b/timmy-config/CODEOWNERS
new file mode 100644
index 00000000..7dc0771c
--- /dev/null
+++ b/timmy-config/CODEOWNERS
@@ -0,0 +1 @@
+@perplexity
diff --git a/timmy-home/CODEOWNERS b/timmy-home/CODEOWNERS
new file mode 100644
index 00000000..7dc0771c
--- /dev/null
+++ b/timmy-home/CODEOWNERS
@@ -0,0 +1 @@
+@perplexity