diff --git a/.githooks/pre-commit b/.githooks/pre-commit
new file mode 100755
index 0000000..edeb19b
--- /dev/null
+++ b/.githooks/pre-commit
@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+set -eu
+bun run check
diff --git a/.githooks/pre-push b/.githooks/pre-push
new file mode 100755
index 0000000..edeb19b
--- /dev/null
+++ b/.githooks/pre-push
@@ -0,0 +1,3 @@
+#!/usr/bin/env sh
+set -eu
+bun run check
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
new file mode 100644
index 0000000..7ed1e1a
--- /dev/null
+++ b/.github/workflows/quality.yml
@@ -0,0 +1,28 @@
+name: Quality
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          fetch-depth: 0
+      - name: Secret scan
+        uses: trufflesecurity/trufflehog@20652fbbdefffcdaa493a5bf57ab2ac6b1db715b # v3.97.1
+        with:
+          version: "3.97.1"
+          extra_args: --results=verified,unknown
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+      - run: bun install --frozen-lockfile
+      - run: bun run check
+      - name: Actionlint
+        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2
diff --git a/README.md b/README.md
index 21f547a..0fe78de 100644
--- a/README.md
+++ b/README.md
@@ -9,3 +9,15 @@
 - Source changes and issues: `makekosmos/cortex`
 
 This repository does not accept product source or a duplicate issue tracker.
+
+## Channel contract
+
+[`release-channel.json`](release-channel.json) records the public channel
+boundary and delegates installer integrity verification to
+`cortex/desktop/scripts/verify-release-channel.mjs`. This repository does not
+build, sign, publish, or re-verify installer bytes.
+
+Run `bun run check` before pushing channel-governance changes. Installation
+also configures the repository-owned pre-commit and pre-push hooks. The
+repository has no third-party package dependencies, so dependency audit is not
+applicable; CI instead runs the channel contract, secret scan, and Actionlint.
diff --git a/package.json b/package.json
new file mode 100644
index 0000000..2424c2c
--- /dev/null
+++ b/package.json
@@ -0,0 +1,10 @@
+{
+  "name": "@makekosmos/desktop-release-channel",
+  "private": true,
+  "scripts": {
+    "check:channel": "node scripts/check-channel-contract.mjs",
+    "check": "bun run check:channel",
+    "prepare": "git config core.hooksPath .githooks"
+  },
+  "packageManager": "bun@1.3.14"
+}
diff --git a/release-channel.json b/release-channel.json
new file mode 100644
index 0000000..12476a2
--- /dev/null
+++ b/release-channel.json
@@ -0,0 +1,19 @@
+{
+  "schemaVersion": 1,
+  "lifecycle": "active-release-channel",
+  "owner": "Cortex maintainer",
+  "sourceRepository": "makekosmos/cortex",
+  "channelRepository": "makekosmos/desktop",
+  "artifact": "public Windows installers and updater metadata",
+  "releaseUnit": "one Kosmos Desktop release",
+  "assets": {
+    "installer": "Kosmos-Setup-<version>.exe",
+    "blockmap": "Kosmos-Setup-<version>.exe.blockmap",
+    "updater": "latest.yml"
+  },
+  "verification": {
+    "repository": "makekosmos/cortex",
+    "path": "desktop/scripts/verify-release-channel.mjs",
+    "command": "bun desktop/scripts/verify-release-channel.mjs"
+  }
+}
diff --git a/scripts/check-channel-contract.mjs b/scripts/check-channel-contract.mjs
new file mode 100644
index 0000000..8bfe94b
--- /dev/null
+++ b/scripts/check-channel-contract.mjs
@@ -0,0 +1,40 @@
+import assert from "node:assert/strict";
+import { readFile } from "node:fs/promises";
+
+const manifest = JSON.parse(await readFile("release-channel.json", "utf8"));
+const readme = await readFile("README.md", "utf8");
+
+assert.deepEqual(manifest, {
+  schemaVersion: 1,
+  lifecycle: "active-release-channel",
+  owner: "Cortex maintainer",
+  sourceRepository: "makekosmos/cortex",
+  channelRepository: "makekosmos/desktop",
+  artifact: "public Windows installers and updater metadata",
+  releaseUnit: "one Kosmos Desktop release",
+  assets: {
+    installer: "Kosmos-Setup-<version>.exe",
+    blockmap: "Kosmos-Setup-<version>.exe.blockmap",
+    updater: "latest.yml",
+  },
+  verification: {
+    repository: "makekosmos/cortex",
+    path: "desktop/scripts/verify-release-channel.mjs",
+    command: "bun desktop/scripts/verify-release-channel.mjs",
+  },
+});
+
+for (const marker of [
+  "Lifecycle: active release channel",
+  "makekosmos/cortex",
+  "Owner: Cortex maintainer",
+  "Artifact: public Windows installers and updater metadata",
+  "Release unit: one Kosmos Desktop release",
+  "does not accept product source",
+  "cortex/desktop/scripts/verify-release-channel.mjs",
+  "bun run check",
+]) {
+  assert.ok(readme.includes(marker), `README is missing: ${marker}`);
+}
+
+console.log("Desktop release-channel contract is valid");