diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 0000000..97f47aa
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,7 @@
+language: en-US
+reviews:
+  profile: chill
+  request_changes_workflow: false
+  high_level_summary: true
+chat:
+  auto_reply: false
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..fae040a
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/review-stack-trufflehog.yml b/.github/workflows/review-stack-trufflehog.yml
new file mode 100644
index 0000000..b2a710d
--- /dev/null
+++ b/.github/workflows/review-stack-trufflehog.yml
@@ -0,0 +1,13 @@
+name: TruffleHog weekly deep scan
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 3 * * 0"
+
+permissions:
+  contents: read
+
+jobs:
+  trufflehog:
+    uses: madmoneymike5/review-stack-runtime/.github/workflows/trufflehog.yml@v1
diff --git a/.github/workflows/review-stack.yml b/.github/workflows/review-stack.yml
new file mode 100644
index 0000000..1e72467
--- /dev/null
+++ b/.github/workflows/review-stack.yml
@@ -0,0 +1,21 @@
+name: Review Stack
+# review-stack-control: runtime mirror rollout verification
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  review-stack:
+    uses: madmoneymike5/review-stack-runtime/.github/workflows/review-stack.yml@v1
+    with:
+      native-command: >-
+        git diff --check
+      central-ref: v1
+      opengrep-excludes: ""
+      gitleaks-excludes: |-
+        
diff --git a/.review-stack/coderabbit-review.sh b/.review-stack/coderabbit-review.sh
new file mode 100644
index 0000000..a00827f
--- /dev/null
+++ b/.review-stack/coderabbit-review.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if command -v cr >/dev/null 2>&1; then
+  cli=cr
+elif command -v coderabbit >/dev/null 2>&1; then
+  cli=coderabbit
+else
+  printf '%s\n' 'CodeRabbit CLI missing. Install it through your organization-approved method, then rerun.' >&2
+  exit 127
+fi
+
+if ! git rev-parse --show-toplevel >/dev/null 2>&1; then
+  printf '%s\n' 'Run this command inside a Git repository.' >&2
+  exit 2
+fi
+
+exec "$cli" review --plain --uncommitted --include-untracked "$@"
diff --git a/REVIEW-STACK.md b/REVIEW-STACK.md
new file mode 100644
index 0000000..46dcf9f
--- /dev/null
+++ b/REVIEW-STACK.md
@@ -0,0 +1,15 @@
+# Review Stack
+
+This repository uses the central review stack at `madmoneymike5/review-stack-control`.
+
+Order:
+
+1. Native type, lint, test, and build gates.
+2. OpenGrep, Gitleaks, and Trivy blocking checks.
+3. Kodus local AI review, advisory.
+4. CodeRabbit CLI or Codex CLI, opt-in and advisory.
+5. Greptile only on request after all earlier checks pass.
+
+Greptile is manual-only to protect the monthly credit budget. Trigger it with `@greptileai` when needed.
+
+The weekly TruffleHog workflow is deliberately separate from normal pull-request checks.
diff --git a/greptile.json b/greptile.json
new file mode 100644
index 0000000..34c493d
--- /dev/null
+++ b/greptile.json
@@ -0,0 +1,3 @@
+{
+  "skipReview": "AUTOMATIC"
+}