diff --git a/.attest.json b/.attest.json
new file mode 100644
index 0000000..ba4a063
--- /dev/null
+++ b/.attest.json
@@ -0,0 +1,4 @@
+{
+  "requireAttestation": true,
+  "requireTestsPassed": true
+}
diff --git a/.augur.toml b/.augur.toml
new file mode 100644
index 0000000..031b459
--- /dev/null
+++ b/.augur.toml
@@ -0,0 +1,3 @@
+[thresholds]
+review = 35
+block = 65
diff --git a/.github/workflows/trust.yml b/.github/workflows/trust.yml
new file mode 100644
index 0000000..bd55597
--- /dev/null
+++ b/.github/workflows/trust.yml
@@ -0,0 +1,20 @@
+name: trust
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  trust:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - uses: CorvidLabs/trust@v1.2.0
+        id: trust
diff --git a/.specsync/config.toml b/.specsync/config.toml
new file mode 100644
index 0000000..c0f66ac
--- /dev/null
+++ b/.specsync/config.toml
@@ -0,0 +1,8 @@
+specs_dir = "specs"
+source_dirs = ["bin"]
+exclude_dirs = []
+required_sections = ["Purpose", "Public API", "Invariants", "Behavioral Examples", "Error Cases", "Dependencies", "Change Log"]
+enforcement = "strict"
+
+[lifecycle]
+track_history = false
diff --git a/.trust.toml b/.trust.toml
new file mode 100644
index 0000000..eabab42
--- /dev/null
+++ b/.trust.toml
@@ -0,0 +1,22 @@
+schema_version = 1
+profile = "standard"
+
+[lifecycle]
+command = ["fledge", "lanes", "run", "verify"]
+
+[contract]
+enabled = false
+require_coverage = 0
+skip_reason = "SpecSync cannot measure the extensionless Bash executables in bin/, so a contract layer would gate nothing; ShellCheck, bash -n, and --help smoke are the blocking checks"
+
+[risk]
+threshold = "block"
+
+[provenance]
+mode = "soft"
+policy = ".attest.json"
+skip_reason = ""
+
+[atlas]
+enabled = false
+skip_reason = "Atlas publication was not enabled during adoption"
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000..3da08a2
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,12 @@
+<!-- CorvidLabs trust toolchain: BEGIN (managed, do not edit inside) -->
+## CorvidLabs trust toolchain
+
+This repository uses one trust gate. Every session must use it and must not bypass or weaken it.
+
+- Run `fledge trust verify` before calling a change complete.
+- Keep module specs synchronized with implementation changes.
+- Treat an Augur block verdict as a hard stop that must be surfaced and de-risked.
+- Record and verify provenance with Attest after the repository's verification lane passes.
+- Keep generated trust configuration and this managed block in place.
+
+<!-- CorvidLabs trust toolchain: END -->
diff --git a/fledge.toml b/fledge.toml
new file mode 100644
index 0000000..d527500
--- /dev/null
+++ b/fledge.toml
@@ -0,0 +1,10 @@
+# fledge.toml: project task definitions
+# Mirrors the three CI jobs in .github/workflows/ci.yml (ShellCheck, bash -n, --help smoke).
+[tasks]
+lint = "shellcheck --severity=warning bin/fledge-github bin/fledge-github-checks bin/fledge-github-issues bin/fledge-github-poll bin/fledge-github-prs bin/fledge-github-repo"
+syntax = "bash -n bin/fledge-github && bash -n bin/fledge-github-checks && bash -n bin/fledge-github-issues && bash -n bin/fledge-github-poll && bash -n bin/fledge-github-prs && bash -n bin/fledge-github-repo"
+smoke = "bin/fledge-github --help && bin/fledge-github-checks --help && bin/fledge-github-issues --help && bin/fledge-github-poll --help && bin/fledge-github-prs --help && bin/fledge-github-repo --help"
+
+[lanes.verify]
+description = "ShellCheck, bash syntax check, and --help smoke test every GitHub plugin executable"
+steps = ["lint", "syntax", "smoke"]