diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000..f573eac
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,39 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "permissions": {
+    "deny": [
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(**/*.pem)",
+      "Read(**/*secret*)",
+      "Read(**/secrets/**)",
+      "Read(**/.secrets/**)",
+      "Bash(env)",
+      "Bash(env *)",
+      "Bash(printenv*)",
+      "Bash(set)",
+      "Bash(export -p*)"
+    ],
+    "ask": [
+      "Bash(echo $*)",
+      "Bash(cat ./.env*)"
+    ],
+    "allow": [
+      "Bash(python -m venv *)",
+      "Bash(python -m pip *)",
+      "Bash(pip install *)",
+      "Bash(pip freeze*)",
+      "Bash(uvicorn *)",
+      "Bash(python -m uvicorn *)",
+      "Bash(pytest*)",
+      "Bash(python -m pytest*)",
+      "Bash(ruff*)",
+      "Bash(python -m ruff *)",
+      "Read",
+      "Edit",
+      "Write"
+    ]
+  }
+}
diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..ae510fd
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,9 @@
+# 복사해서 .env 로 쓰고 실제 값 채우기 (.env 는 커밋 금지)
+PULP_BASE_URL=http://localhost:8080
+PULP_USERNAME=admin
+PULP_PASSWORD=
+# TLS 검증: 사내 HTTPS Pulp + 사내 CA 면 PULP_CA_FILE 경로 지정.
+# 개발 중 self-signed 라 검증 끄려면 false (운영 금지).
+PULP_VERIFY_TLS=true
+# 사내 CA 인증서(.pem) 경로. 비워두면 시스템 기본 신뢰저장소 사용.
+PULP_CA_FILE=
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e5625b3
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,8 @@
+.env
+__pycache__/
+*.pyc
+.venv/
+venv/
+.pytest_cache/
+.ruff_cache/
+audit-log.jsonl
diff --git a/requirements-dev.txt b/requirements-dev.txt
new file mode 100644
index 0000000..0482e49
--- /dev/null
+++ b/requirements-dev.txt
@@ -0,0 +1,5 @@
+-r requirements.txt
+# 개발/테스트 전용
+pytest==8.3.4
+respx==0.22.0
+ruff==0.9.2
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..2e54687
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,7 @@
+# 런타임 의존성 (폐쇄망 반입 위해 버전 고정)
+fastapi==0.115.6
+uvicorn[standard]==0.34.0
+httpx==0.28.1
+jinja2==3.1.4
+python-multipart==0.0.20
+pydantic-settings==2.7.1