diff --git a/justfile b/justfile
new file mode 100644
index 0000000..c42c0a6
--- /dev/null
+++ b/justfile
@@ -0,0 +1,79 @@
+# Chanora — local task runner.
+#
+# Conforms to docs/governance/repository-bootstrap-plan.md v0.1.0 §3,
+# which requires a `justfile` with stubs for format / lint / test /
+# verify-docs / security-scan. The repository is documentation- and
+# PoC-first; until the product Flutter/Rust workspace exists, most
+# targets are placeholders.
+#
+# Install just: https://github.com/casey/just
+
+default:
+    @just --list
+
+# ---------------------------------------------------------------------------
+# Docs validation
+# ---------------------------------------------------------------------------
+
+# Run the documentation/traceability validator.
+verify-docs:
+    python3 tools/validate_docs.py
+
+# ---------------------------------------------------------------------------
+# Formatting
+# ---------------------------------------------------------------------------
+
+# Format every codebase in the repo that has a formatter wired up.
+format:
+    @echo "[format] Rust PoCs"
+    @for d in poc/*/; do \
+        if [ -f "$$d/Cargo.toml" ]; then \
+            (cd "$$d" && cargo fmt --all) || exit 1; \
+        fi; \
+    done
+    @if [ -d poc/flutter_rust_bridge_hello ]; then \
+        echo "[format] Flutter PoC"; \
+        (cd poc/flutter_rust_bridge_hello && dart format lib test integration_test rust/src) || exit 1; \
+    fi
+
+# ---------------------------------------------------------------------------
+# Lint
+# ---------------------------------------------------------------------------
+
+# Run linters on every codebase that has them wired up.
+lint:
+    @echo "[lint] Rust PoCs"
+    @for d in poc/*/; do \
+        if [ -f "$$d/Cargo.toml" ]; then \
+            (cd "$$d" && cargo clippy --all-targets -- -D warnings) || exit 1; \
+        fi; \
+    done
+    @if [ -d poc/flutter_rust_bridge_hello ]; then \
+        echo "[lint] Flutter PoC"; \
+        (cd poc/flutter_rust_bridge_hello && flutter analyze) || exit 1; \
+    fi
+
+# ---------------------------------------------------------------------------
+# Test
+# ---------------------------------------------------------------------------
+
+# Run all PoC test suites that have one.
+test:
+    @echo "[test] tsclientlib-connect-spike: build only (live-server smoke must be run manually)"
+    @(cd poc/tsclientlib-connect-spike && cargo build --release)
+    @echo "[test] flutter_rust_bridge_hello: headless verification"
+    @(cd poc/flutter_rust_bridge_hello && \
+        flutter build linux --debug && \
+        LD_LIBRARY_PATH="$$PWD/build/linux/x64/debug/bundle/lib:$$LD_LIBRARY_PATH" \
+        flutter test test/poc_verification_test.dart)
+
+# ---------------------------------------------------------------------------
+# Security scan
+# ---------------------------------------------------------------------------
+
+# Placeholder — real security scanning will be wired up when the product
+# workspace exists. See docs/security/dependency-and-supply-chain-report.md
+# and docs/governance/repository-bootstrap-plan.md §5.
+security-scan:
+    @echo "[security-scan] placeholder — no product workspace yet."
+    @echo "[security-scan] documentation gates live under docs/security/"