diff --git a/.github/scripts/apply-repo-settings.sh b/.github/scripts/apply-repo-settings.sh
index c9b209c8..19d35327 100755
--- a/.github/scripts/apply-repo-settings.sh
+++ b/.github/scripts/apply-repo-settings.sh
@@ -5,14 +5,17 @@
 #   https://github.com/petry-projects/.github/blob/main/standards/github-settings.md#repository-settings--standard-defaults
 #
 # Usage:
-#   GH_TOKEN=<admin-token> bash .github/scripts/apply-repo-settings.sh
+#   GH_TOKEN=<admin-token> bash .github/scripts/apply-repo-settings.sh [<owner/repo>]
 #
+# Requirements: gh CLI (https://cli.github.com)
+#
+# The optional <owner/repo> argument overrides the default target repository.
 # The script is safe to run multiple times (idempotent). It applies settings
 # using the GitHub REST API and prints the resulting values for verification.
 
 set -euo pipefail
 
-REPO="petry-projects/markets"
+REPO="${1:-petry-projects/markets}"
 
 if [ -z "${GH_TOKEN:-}" ]; then
   echo "ERROR: GH_TOKEN is required with administration:write scope" >&2
@@ -43,12 +46,13 @@ gh api -X PATCH "repos/$REPO" \
     has_wiki,
     squash_merge_commit_title,
     squash_merge_commit_message
-  }' | jq .
+  }'
 
 echo "Disabling CodeRabbit (347564) and Claude (1236702) check-suite auto-triggers ..."
 
 gh api -X PATCH "repos/$REPO/check-suites/preferences" \
-  --input - <<'JSON' | jq '.preferences.auto_trigger_checks'
+  --input - \
+  --jq '.preferences.auto_trigger_checks' <<'JSON'
 {"auto_trigger_checks": [{"app_id": 347564, "setting": false}, {"app_id": 1236702, "setting": false}]}
 JSON
 
diff --git a/.github/scripts/tests/apply-repo-settings.bats b/.github/scripts/tests/apply-repo-settings.bats
index 23438f50..90901644 100755
--- a/.github/scripts/tests/apply-repo-settings.bats
+++ b/.github/scripts/tests/apply-repo-settings.bats
@@ -25,3 +25,12 @@ SCRIPT="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)/apply-repo-settings.s
 @test "script targets petry-projects/markets repo" {
   grep -q 'petry-projects/markets' "$SCRIPT"
 }
+
+@test "REPO is configurable via argument with petry-projects/markets as default" {
+  grep -qE 'REPO="\$\{1:-petry-projects/markets\}"' "$SCRIPT"
+}
+
+@test "script does not pipe to external jq" {
+  # All JSON processing must use gh api --jq, never an external jq binary
+  ! grep -qE '\|\s*jq\b' "$SCRIPT"
+}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..67545826
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,36 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '17 4 * * 1'
+
+permissions: {}
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ['actions']
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3
+        with:
+          languages: ${{ matrix.language }}
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v3
+        with:
+          category: '/language:${{ matrix.language }}'
diff --git a/.gitignore b/.gitignore
index 70f45178..35b76a18 100644
--- a/.gitignore
+++ b/.gitignore
@@ -30,3 +30,4 @@ build/
 .DS_Store
 Thumbs.db
 .dev-lead/
+.dev-lead/
diff --git a/Agents.md b/Agents.md
index 792781ac..f33b4f0a 100644
--- a/Agents.md
+++ b/Agents.md
@@ -4,6 +4,7 @@
 >
 > For detailed Markets-specific application of each principle (bounded contexts, aggregate roots, repository interfaces, domain events, typed IDs, dependency direction, test-by-layer guidance, coverage thresholds, and CI commands), see `_bmad-output/planning-artifacts/coding-standards.md`.
 
+
 ## Project Overview
 
 **markets** is a real-time coordination platform for local farmers markets. Mobile-first (iOS/Android) with web via React Native for Web. Three user roles: Customer, Vendor, Market Manager.
@@ -152,12 +153,29 @@ theme: {
 
 ## Test-Driven Development
 
+<<<<<<< HEAD
+<<<<<<< HEAD
+=======
+>>>>>>> cd47377 (feat: add Epic 1 sprint planning, coding standards, and test strategy (#22))
 TDD rules are defined in the [org AGENTS.md](https://github.com/petry-projects/.github/blob/main/AGENTS.md). Markets-specific test framework configuration, mocking strategy, coverage thresholds, and per-layer test guidance are in `_bmad-output/planning-artifacts/coding-standards.md`.
 
 - **Go backend:** `*_test.go` co-located with source; `//go:build integration` for integration tests
 - **React Native frontend:** `*.test.tsx` co-located or `__tests__/`; Jest + React Native Testing Library
 - **GraphQL resolvers:** Integration tests for the full resolver → database → response path
 - **Acceptance criteria drive tests:** Each story's Given/When/Then maps directly to test cases
+<<<<<<< HEAD
+=======
+- IMPORTANT: All development MUST follow test-driven development (TDD) practices
+- Write failing tests BEFORE writing implementation code (Red → Green → Refactor)
+- **Go backend:** Write Go test files (`_test.go`) co-located with source files before implementing resolvers, middleware, or services. Use `go test ./...` to verify.
+- **React Native frontend:** Write tests using Jest + React Native Testing Library before implementing components and hooks. Test files co-located as `*.test.tsx` or in `__tests__/` directories.
+- **GraphQL resolvers:** Write integration tests (tagged `//go:build integration`) that test the full resolver → database → response path
+- **Acceptance criteria drive tests:** Each story's Given/When/Then acceptance criteria should map directly to test cases
+- Every PR must include tests that cover the new or changed functionality
+- Do not merge code without passing tests
+>>>>>>> 58c45f4 (chore: add planning artifacts, UX screen prototypes, and Claude config (#6))
+=======
+>>>>>>> cd47377 (feat: add Epic 1 sprint planning, coding standards, and test strategy (#22))
 
 ## Event-Driven Architecture
 
diff --git a/README.md b/README.md
index ddbe69d8..572efab3 100644
--- a/README.md
+++ b/README.md
@@ -11,4 +11,4 @@ For commercial licensing inquiries, contact [licensing@djpetry.com](mailto:licen
 
 ### Contributing
 
-By contributing to this project, you agree to the [Contributor License Agreement](CLA.md).
\ No newline at end of file
+By contributing to this project, you agree to the [Contributor License Agreement](CLA.md).