chore(todo2code): wire CI via koru policy and pyqual pipeline

.gitignore

@@ -368,8 +368,9 @@ _archive/
 # Claude Code per-user settings
 .claude/auth.json
 
-# Koru local runtime cache
-.planfile/.koru/
+# Koru local runtime cache (keep policy.yaml in git for CI)
+.planfile/.koru/*
+!.planfile/.koru/policy.yaml
 
 # Hardcoded-duplicate scan artifacts (regenerate via make detect-hardcoded-duplicates)
 project/refactor/hardcoded-duplicates.*

.koru/topology.yaml

@@ -0,0 +1,22 @@
+schema_version: "1"
+components:
+  regix:
+    enabled: true
+    kind: cli
+    role: quality
+  redup:
+    enabled: true
+    kind: cli
+    role: quality
+  testql:
+    enabled: false
+    kind: cli
+    role: e2e
+  vallm:
+    enabled: false
+    kind: cli
+    role: quality
+  sumr:
+    enabled: false
+    kind: cli
+    role: quality

.planfile/.koru/policy.yaml

@@ -0,0 +1,21 @@
+# todo2code — Koru agent policy (strict defaults; relax only via deliberate commit).
+
+llm:
+  allow_commit: false
+  allow_push: false
+  allow_branch_create: false
+  allow_branch_switch: false
+  allow_tag: false
+  allow_destructive_shell: false
+  require_planfile_lifecycle: true
+  require_ci_pass_before_complete: true
+
+ci:
+  command: |
+    set -euo pipefail
+    bash scripts/ci-test.sh
+  timeout_seconds: 900
+
+notes:
+  - "Unit tests: bash scripts/ci-test.sh (npm run build && npm test)."
+  - "Full verify: npm run verify"

pyqual.yaml

@@ -0,0 +1,26 @@
+pipeline:
+  name: todo2code-quality
+
+  loop:
+    max_iterations: 1
+    on_fail: report
+
+  stages:
+    - name: test
+      run: bash scripts/ci-test.sh
+      timeout: 900
+
+    - name: regix-gates
+      run: regix gates --workdir .
+      optional: true
+      timeout: 120
+
+    - name: redup-check
+      run: redup check .
+      optional: true
+      timeout: 120
+
+    - name: regix-compare
+      run: regix compare HEAD~1 HEAD
+      optional: true
+      timeout: 120

regix.yaml

@@ -0,0 +1,38 @@
+regix:
+  workdir: .
+
+  gates:
+    hard:
+      cc: 20
+      mi: 0
+      coverage: 0
+      length: 200
+      docstring: 0
+      quality: 0.0
+    target:
+      cc: 12
+      mi: 20
+      coverage: 30
+      length: 120
+      docstring: 40
+      quality: 0.50
+    on_regression: warn
+    fail_exit_code: 1
+
+  exclude:
+    - "dist/*"
+    - "node_modules/*"
+    - "test/*"
+    - "tests/*"
+    - "docs/*"
+    - "examples/*"
+    - "evaluation/*"
+    - "scripts/*"
+    - ".governance/*"
+    - "python/*"
+    - "sdk/python/*"
+
+  output:
+    format: rich
+    dir: .regix/
+    show_improvements: true

scripts/ci-test.sh

@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+# Repo-local verify — used by pyqual.yaml and .planfile/.koru/policy.yaml.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+npm run build
+npm test