diff --git a/.gitignore b/.gitignore
index 9c422379..97d98412 100644
--- a/.gitignore
+++ b/.gitignore
@@ -368,8 +368,9 @@ _archive/
 # Claude Code per-user settings
 .claude/auth.json
 
-# Koru local runtime cache
-.planfile/.koru/
+# Koru local runtime cache (keep policy.yaml in git for CI)
+.planfile/.koru/*
+!.planfile/.koru/policy.yaml
 
 # Hardcoded-duplicate scan artifacts (regenerate via make detect-hardcoded-duplicates)
 project/refactor/hardcoded-duplicates.*
diff --git a/.koru/topology.yaml b/.koru/topology.yaml
new file mode 100644
index 00000000..9bc09891
--- /dev/null
+++ b/.koru/topology.yaml
@@ -0,0 +1,22 @@
+schema_version: "1"
+components:
+  regix:
+    enabled: true
+    kind: cli
+    role: quality
+  redup:
+    enabled: true
+    kind: cli
+    role: quality
+  testql:
+    enabled: false
+    kind: cli
+    role: e2e
+  vallm:
+    enabled: false
+    kind: cli
+    role: quality
+  sumr:
+    enabled: false
+    kind: cli
+    role: quality
diff --git a/.planfile/.koru/policy.yaml b/.planfile/.koru/policy.yaml
new file mode 100644
index 00000000..06b30a20
--- /dev/null
+++ b/.planfile/.koru/policy.yaml
@@ -0,0 +1,21 @@
+# todo2code — Koru agent policy (strict defaults; relax only via deliberate commit).
+
+llm:
+  allow_commit: false
+  allow_push: false
+  allow_branch_create: false
+  allow_branch_switch: false
+  allow_tag: false
+  allow_destructive_shell: false
+  require_planfile_lifecycle: true
+  require_ci_pass_before_complete: true
+
+ci:
+  command: |
+    set -euo pipefail
+    bash scripts/ci-test.sh
+  timeout_seconds: 900
+
+notes:
+  - "Unit tests: bash scripts/ci-test.sh (npm run build && npm test)."
+  - "Full verify: npm run verify"
diff --git a/pyqual.yaml b/pyqual.yaml
new file mode 100644
index 00000000..bf97bf91
--- /dev/null
+++ b/pyqual.yaml
@@ -0,0 +1,26 @@
+pipeline:
+  name: todo2code-quality
+
+  loop:
+    max_iterations: 1
+    on_fail: report
+
+  stages:
+    - name: test
+      run: bash scripts/ci-test.sh
+      timeout: 900
+
+    - name: regix-gates
+      run: regix gates --workdir .
+      optional: true
+      timeout: 120
+
+    - name: redup-check
+      run: redup check .
+      optional: true
+      timeout: 120
+
+    - name: regix-compare
+      run: regix compare HEAD~1 HEAD
+      optional: true
+      timeout: 120
diff --git a/regix.yaml b/regix.yaml
new file mode 100644
index 00000000..c61b1a79
--- /dev/null
+++ b/regix.yaml
@@ -0,0 +1,38 @@
+regix:
+  workdir: .
+
+  gates:
+    hard:
+      cc: 20
+      mi: 0
+      coverage: 0
+      length: 200
+      docstring: 0
+      quality: 0.0
+    target:
+      cc: 12
+      mi: 20
+      coverage: 30
+      length: 120
+      docstring: 40
+      quality: 0.50
+    on_regression: warn
+    fail_exit_code: 1
+
+  exclude:
+    - "dist/*"
+    - "node_modules/*"
+    - "test/*"
+    - "tests/*"
+    - "docs/*"
+    - "examples/*"
+    - "evaluation/*"
+    - "scripts/*"
+    - ".governance/*"
+    - "python/*"
+    - "sdk/python/*"
+
+  output:
+    format: rich
+    dir: .regix/
+    show_improvements: true
diff --git a/scripts/ci-test.sh b/scripts/ci-test.sh
new file mode 100755
index 00000000..3e0efcf8
--- /dev/null
+++ b/scripts/ci-test.sh
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Repo-local verify — used by pyqual.yaml and .planfile/.koru/policy.yaml.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+npm run build
+npm test