diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..12d0092
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,5 @@
+
+
+# Risk-sensitive changes require the repository owner.
+/.github/CODEOWNERS @Pigbibi
+/.github/workflows/ @Pigbibi
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..37c765f
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,13 @@
+
+
+## AI assistance
+
+Which AI tool and model were used? Write `None` if no AI was used.
+
+## What changed
+
+Describe the change and its purpose.
+
+## How verified
+
+List the checks run and their results. Explain any checks that could not run.
diff --git a/.github/workflows/engineering-governance.yml b/.github/workflows/engineering-governance.yml
new file mode 100644
index 0000000..ae711dc
--- /dev/null
+++ b/.github/workflows/engineering-governance.yml
@@ -0,0 +1,71 @@
+name: Engineering governance
+
+on:
+  pull_request:
+  push:
+    branches: ["main"]
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    name: Gitleaks
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Install verified Gitleaks CLI
+        shell: bash
+        run: |
+          set -euo pipefail
+          archive="$RUNNER_TEMP/gitleaks.tar.gz"
+          curl --fail --silent --show-error --location --retry 2 \
+            https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz \
+            --output "$archive"
+          echo "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb  $archive" | sha256sum --check --status
+          mkdir -p "$RUNNER_TEMP/gitleaks-bin"
+          tar -xzf "$archive" -C "$RUNNER_TEMP/gitleaks-bin" gitleaks
+      - name: Scan added commits with redacted findings
+        shell: bash
+        env:
+          PR_BASE: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD: ${{ github.event.pull_request.head.sha }}
+          PUSH_BASE: ${{ github.event.before }}
+          PUSH_HEAD: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          base="${PR_BASE:-$PUSH_BASE}"
+          head="${PR_HEAD:-$PUSH_HEAD}"
+          if [[ -z "$base" || "$base" =~ ^0+$ ]]; then
+            echo "No base commit is available for this event" >&2
+            exit 1
+          fi
+          "$RUNNER_TEMP/gitleaks-bin/gitleaks" git . --redact --no-banner --log-opts="$base..$head"
+
+  commitlint:
+    name: Commit message convention
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Validate pull request commit messages
+        if: github.event_name == 'pull_request'
+        shell: bash
+        env:
+          PR_BASE: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          tool="$RUNNER_TEMP/governance-commitlint"
+          npm install --prefix "$tool" --ignore-scripts --no-audit --no-fund \
+            @commitlint/cli@21.2.4 @commitlint/config-conventional@21.2.4
+          printf '%s\n' "module.exports = {extends: [require.resolve('@commitlint/config-conventional')]};" > "$tool/commitlint.config.cjs"
+          node "$tool/node_modules/@commitlint/cli/cli.js" \
+            --config "$tool/commitlint.config.cjs" --from "$PR_BASE" --to "$PR_HEAD" --verbose
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 0000000..326a304
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,6 @@
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: 83d9cd684c87d95d656c1458ef04895a7f1cbd8e # v8.30.1
+    hooks:
+      - id: gitleaks
+        args: [--redact]