diff --git a/scripts/pepsi/todo631-pepsi-kreis.sh b/scripts/pepsi/todo631-pepsi-kreis.sh
new file mode 100755
index 0000000..cb5a2ba
--- /dev/null
+++ b/scripts/pepsi/todo631-pepsi-kreis.sh
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# TODO=631: g0v mon-* Kreis-Test (local circle via pepsi TRUST_LOOPBACK / :25).
+# Inject via koopa container loopback :25. Empfang = Maildir MARK grep.
+# Real OS users (ensure-mon-users.sh): mon-smtp maildir dkim bounce local.
+# No secrets. Freigabe-free (local inject only).
+set -euo pipefail
+
+KOOPA_HOST="${KOOPA_HOST:-koopa}"
+CONTAINER="${PEPSI_CONTAINER:-koopa-pepsi}"
+OUTDIR="${HOME}/git/llm/llm-work-input"
+MARK="${MARK:-$(date +%Y%m%dT%H%M%S%z)-kreis}"
+USERS=(mon-smtp mon-maildir mon-dkim mon-bounce mon-local)
+DRAIN_SEC="${DRAIN_SEC:-6}"
+
+echo "STATUS=start MARK=${MARK} CONTAINER=${CONTAINER} N=${#USERS[@]}"
+
+# --- preflight: users exist ---
+for u in "${USERS[@]}"; do
+  ssh -o BatchMode=yes "${KOOPA_HOST}" \
+    "podman exec ${CONTAINER} getent passwd ${u}" >/dev/null \
+    || { echo "STATUS=fail PREFLIGHT user=${u} missing"; exit 2; }
+done
+echo "STATUS=preflight USERS_OK=${#USERS[@]}"
+
+# --- send circle: each → next ---
+SEND_PY=$(mktemp)
+trap 'rm -f "${SEND_PY}"' EXIT
+{
+  echo 'import smtplib, time, sys'
+  echo 'from email.message import EmailMessage'
+  echo "MARK = ${MARK@Q}"
+  echo -n 'USERS = ['
+  for u in "${USERS[@]}"; do printf '%s,' "${u@Q}"; done
+  echo ']'
+  cat <<'PY'
+ok = fail = 0
+n = len(USERS)
+for i, u in enumerate(USERS):
+    to_u = USERS[(i + 1) % n]
+    frm = f"{u}@g0v.ch"
+    to = f"{to_u}@g0v.ch"
+    msg = EmailMessage()
+    msg["From"] = frm
+    msg["To"] = to
+    msg["Subject"] = f"[pepsi-kreis] TODO631 {i+1}/{n} {MARK}"
+    msg["Message-ID"] = f"<todo631-kreis-{i}.{MARK}@g0v.ch"
+    msg.set_content(
+        f"TODO=631 kreis-test.\nFrom={frm}\nTo={to}\ni={i}\nmark={MARK}\n"
+    )
+    try:
+        with smtplib.SMTP("127.0.0.1", 25, timeout=30) as s:
+            # force MAIL FROM / RCPT explicit for clear errors
+            s.sendmail(frm, [to], msg.as_string())
+        print(f"STATUS=sent i={i} FROM={frm} TO={to}")
+        ok += 1
+    except Exception as e:
+        print(f"STATUS=fail i={i} FROM={frm} TO={to} ERR={type(e).__name__}:{e}")
+        fail += 1
+    time.sleep(1.2)
+print(f"STATUS=send_done OK={ok} FAIL={fail} MARK={MARK}")
+sys.exit(0 if fail == 0 else 1)
+PY
+} >"${SEND_PY}"
+
+ssh -o BatchMode=yes "${KOOPA_HOST}" "podman exec -i ${CONTAINER} python3 -" <"${SEND_PY}"
+echo "MARK=${MARK}" >"${OUTDIR}/todo631-kreis.stamp"
+
+sleep "${DRAIN_SEC}"
+
+# --- Maildir HIT per recipient (next-hop of each sender) ---
+OUT="${OUTDIR}/todo631-kreis-test.txt"
+{
+  echo "STATUS=ok MARK=kreis-test TODO=631 TS=$(date -Iseconds)"
+  echo "MARK_PROBE=${MARK} USERS=$(IFS=,; echo "${USERS[*]}")"
+  echo "SEND=via container :25 loopback"
+  echo "EXPECT=each user MARK_HITS>=1 (circle next-hop)"
+  echo "NOTE_vacation=PONG may also land; SPF-fail path skips vacation"
+} >"${OUT}"
+
+HIT_TOTAL=0
+MISS=0
+for u in "${USERS[@]}"; do
+  hits=$(ssh -o BatchMode=yes "${KOOPA_HOST}" \
+    "podman exec ${CONTAINER} bash -c 'grep -lF ${MARK@Q} /home/${u}/Maildir/new/* /home/${u}/Maildir/cur/* 2>/dev/null | wc -l'" \
+    | tr -d '[:space:]')
+  hits=${hits:-0}
+  echo "HIT_${u}=${hits}" | tee -a "${OUT}"
+  if [[ "${hits}" -ge 1 ]]; then
+    HIT_TOTAL=$((HIT_TOTAL + 1))
+  else
+    MISS=$((MISS + 1))
+  fi
+done
+
+if [[ "${MISS}" -eq 0 ]]; then
+  echo "STATUS=PASS HIT_USERS=${HIT_TOTAL}/5 MARK=${MARK}" | tee -a "${OUT}"
+  exit 0
+fi
+echo "STATUS=PARTIAL HIT_USERS=${HIT_TOTAL}/5 MISS=${MISS} MARK=${MARK}" | tee -a "${OUT}"
+exit 1