diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..8640359
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,17 @@
+# API config / startup surfaces
+/src/config.ts @metanallok
+/src/main.ts @metanallok
+/src/app.ts @metanallok
+
+# Solana / Futarchy / external data surfaces
+/src/services/solanaService.ts @metanallok
+/src/services/futarchyService.ts @metanallok
+/src/services/launchpadService.ts @metanallok
+/src/services/meteoraService.ts @metanallok
+/src/services/databaseService.ts @metanallok
+/src/services/externalDatabaseService.ts @metanallok
+
+# Operational scripts
+/scripts/safe-update.ts @metanallok
+/scripts/backfill.ts @metanallok
+/scripts/backfillV06.ts @metanallok
diff --git a/.github/branch-protection.md b/.github/branch-protection.md
new file mode 100644
index 0000000..be48888
--- /dev/null
+++ b/.github/branch-protection.md
@@ -0,0 +1,28 @@
+# GitHub protection for `master`
+
+## What the package-protection check does
+
+**Merge-blocking:**
+- **Lockfile drift** — `bun.lock` must match `package.json`.
+- **Socket package scan** — runs through Bun's security scanner on every install.
+- **Exact dependency pinning** — package manifests must use exact versions or `workspace:*`.
+- **Minimum dependency age** — newly introduced external npm packages must be at least 14 days old.
+- **Phantom deps** — imported packages must be declared in `package.json`.
+
+**Review hint:**
+- **Sensitive wallet / program diff** — warns on Solana address literals, program IDs, wallet-routing identifiers, signing paths, and `new PublicKey(` changes. CODEOWNERS is the merge gate for sensitive paths.
+
+## Recommended branch protection for `master`
+
+1. Require a pull request before merging.
+2. Require at least 1 approval.
+3. Dismiss stale approvals when new commits are pushed.
+4. Require conversation resolution before merging.
+5. Require status checks to pass before merging.
+6. Require the `package-protection` job from the `Package Protection` workflow.
+7. Require code owner review so `.github/CODEOWNERS` gates sensitive API, Solana, and operational-script paths.
+
+## Emergency bypass
+
+- Label: `emergency-override` downgrades repo-guard and phantom-dep failures to warnings.
+- Lockfile drift / install failures are never bypassed.
diff --git a/.github/workflows/package-protection.yml b/.github/workflows/package-protection.yml
new file mode 100644
index 0000000..a43cc70
--- /dev/null
+++ b/.github/workflows/package-protection.yml
@@ -0,0 +1,179 @@
+name: Package Protection
+
+on:
+ pull_request:
+
+permissions:
+ contents: read
+ pull-requests: write
+
+jobs:
+ package-protection:
+ runs-on: ubuntu-latest
+ env:
+ EMERGENCY_BYPASS: ${{ contains(github.event.pull_request.labels.*.name, 'emergency-override') }}
+
+ steps:
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+ with:
+ fetch-depth: 0
+
+ - name: Fetch PR base branch
+ run: git fetch origin "${{ github.base_ref }}" --depth=1
+
+ - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+ with:
+ bun-version: 1.3.14
+
+ - name: Verify lockfile and scan packages
+ id: lockfile
+ continue-on-error: true
+ run: bun install --frozen-lockfile
+
+ - name: Run repository guard checks
+ id: guard
+ continue-on-error: true
+ env:
+ GITHUB_BASE_REF: ${{ github.base_ref }}
+ PACKAGE_MIN_AGE_DAYS: 14
+ REPO_GUARD_SUMMARY_PATH: repo-guard-summary.md
+ run: bun run repo:guard
+
+ - name: Check for undeclared dependencies (phantom deps)
+ id: knip
+ if: steps.lockfile.outcome == 'success'
+ continue-on-error: true
+ run: |
+ set +e
+ bun run deps:check > knip-raw.txt 2>&1
+ knip_exit=$?
+ grep -E '^[^:[:space:]]+\.(ts|tsx|js|mjs|cjs|jsx): [^[:space:]]' knip-raw.txt > knip-output.txt || true
+ echo "--- knip-raw.txt (full) ---"
+ cat knip-raw.txt
+ echo "--- knip-output.txt (filtered findings) ---"
+ cat knip-output.txt
+ if [ "$knip_exit" -ne 0 ] && [ -s knip-output.txt ]; then
+ while IFS= read -r line; do
+ file="${line%%:*}"
+ pkgs="${line#*: }"
+ echo "::error file=${file}::Undeclared import(s): ${pkgs}. Declare them in package.json — hoisting works locally but breaks in production Docker."
+ done < knip-output.txt
+ fi
+ exit $knip_exit
+
+ - name: Build PR comment
+ id: comment
+ env:
+ LOCKFILE_OUTCOME: ${{ steps.lockfile.outcome }}
+ GUARD_OUTCOME: ${{ steps.guard.outcome }}
+ KNIP_OUTCOME: ${{ steps.knip.outcome }}
+ run: |
+ {
+ echo ""
+ echo "**Package Protection**"
+ echo
+
+ if [ "$LOCKFILE_OUTCOME" = "success" ]; then
+ echo "- Lockfile + Socket scan: pass"
+ else
+ echo "- Lockfile + Socket scan: fail"
+ echo " - Run \\`bun install\\` and commit the updated lockfile."
+ fi
+
+ if [ "$GUARD_OUTCOME" = "success" ]; then
+ echo "- Repo guard: pass"
+ else
+ if [ "$EMERGENCY_BYPASS" = "true" ]; then
+ echo "- Repo guard: bypassed with \\`emergency-override\\`"
+ else
+ echo "- Repo guard: fail"
+ fi
+ fi
+
+ if [ "$KNIP_OUTCOME" = "success" ]; then
+ echo "- Phantom deps: pass"
+ elif [ "$KNIP_OUTCOME" = "skipped" ]; then
+ echo "- Phantom deps: skipped (lockfile check failed — fix that first)"
+ elif [ -s knip-output.txt ]; then
+ count=$(wc -l < knip-output.txt | tr -d ' ')
+ echo "- Phantom deps: fail — ${count} file(s) import packages not declared in package.json."
+ echo
+ echo "Undeclared imports (${count})
"
+ echo
+ echo '```'
+ cat knip-output.txt
+ echo '```'
+ echo
+ echo "