diff --git a/.github/rulesets/Immutable-Tags.json b/.github/rulesets/Immutable-Tags.json
new file mode 100644
index 0000000..768af96
--- /dev/null
+++ b/.github/rulesets/Immutable-Tags.json
@@ -0,0 +1,18 @@
+{
+  "name": "Immutable-Tags",
+  "target": "tag",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~ALL"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {"type": "deletion"},
+    {"type": "non_fast_forward"},
+    {"type": "update"},
+    {"type": "required_signatures"}
+  ]
+}
diff --git a/.github/rulesets/Optimus-Branch.json b/.github/rulesets/Optimus-Branch.json
new file mode 100644
index 0000000..66abf25
--- /dev/null
+++ b/.github/rulesets/Optimus-Branch.json
@@ -0,0 +1,48 @@
+{
+  "name": "Optimus-Branch",
+  "target": "branch",
+  "enforcement": "active",
+  "conditions": {
+    "ref_name": {
+      "include": ["~DEFAULT_BRANCH"],
+      "exclude": []
+    }
+  },
+  "bypass_actors": [],
+  "rules": [
+    {
+      "type": "deletion"
+    },
+    {
+      "type": "non_fast_forward"
+    },
+    {
+      "type": "required_signatures"
+    },
+    {
+      "type": "pull_request",
+      "parameters": {
+        "required_approving_review_count": 2,
+        "dismiss_stale_reviews_on_push": true,
+        "require_code_owner_review": true,
+        "require_last_push_approval": true,
+        "required_review_thread_resolution": true,
+        "require_extra_approval_for_unattributed_changes": true,
+        "required_reviewers": [],
+        "allowed_merge_methods": ["squash"]
+      }
+    },
+    {
+      "type": "required_status_checks",
+      "parameters": {
+        "strict_required_status_checks_policy": true,
+        "do_not_enforce_on_create": false,
+        "required_status_checks": [
+          {
+            "context": "panic-attack assail"
+          }
+        ]
+      }
+    }
+  ]
+}
diff --git a/.github/settings.yml b/.github/settings.yml
index 3015897..74f290c 100644
--- a/.github/settings.yml
+++ b/.github/settings.yml
@@ -105,21 +105,3 @@ labels:
 
 # ─── Branch Protection ─────────────────────────────────────────────────────────
 
-branches:
-  - name: "main"
-    protection:
-      required_pull_request_reviews:
-        required_approving_review_count: 1
-        dismiss_stale_reviews: true
-        require_code_owner_reviews: true
-      required_status_checks:
-        strict: true
-        contexts:
-          - "hypatia-scan"
-          - "codeql"
-          - "openssf-compliance"
-      enforce_admins: true
-      required_signatures: true
-      restrictions: null
-      allow_force_pushes: false
-      allow_deletions: false
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 0689291..60ebb44 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -30,6 +30,7 @@ concurrency:
   group: push-email-${{ github.run_id }}
   cancel-in-progress: false
 permissions:
+  actions: read
   contents: read
 jobs:
   notify:
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
deleted file mode 100644
index 00ea463..0000000
--- a/.github/workflows/rust-ci.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# Rust CI — thin wrapper calling the shared estate reusable in
-# hyperpolymath/standards. Configure once, propagate everywhere.
-# See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards.
-name: Rust CI
-
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
diff --git a/.machine_readable/svc/k9/methodology-guard.k9.ncl b/.machine_readable/svc/k9/methodology-guard.k9.ncl
index 8c32614..2ac9462 100644
--- a/.machine_readable/svc/k9/methodology-guard.k9.ncl
+++ b/.machine_readable/svc/k9/methodology-guard.k9.ncl
@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
@@ -8,6 +9,23 @@
 # Usage: k9 validate methodology-guard
 
 let methodology_guard = {
+  pedigree = {
+    schema_version = "1.0.0",
+    component_type = "methodology-validator",
+    security = {
+      leash = 'Yard,
+      trust_level = "validated-config",
+      allow_network = false,
+      allow_filesystem_write = false,
+      allow_subprocess = false,
+    },
+    metadata = {
+      name = "methodology-guard",
+      version = "1.0.0",
+      description = "Validates agent work against declared methodology constraints",
+    },
+  },
+
   name = "methodology-guard",
   version = "1.0.0",
   description = "Validates that agent work respects declared methodology constraints",
diff --git a/container/deploy.k9.ncl b/container/deploy.k9.ncl
index ed9c20b..fbc7996 100644
--- a/container/deploy.k9.ncl
+++ b/container/deploy.k9.ncl
@@ -1,3 +1,4 @@
+K9!
 # SPDX-License-Identifier: MPL-2.0
 # deploy.k9.ncl — Nesy Solver deployment component (Hunt level)
 #
@@ -143,7 +144,12 @@ echo "K9: Rollback complete."
 
 # Export the component
 {
-  pedigree = component_pedigree,
+  pedigree = component_pedigree & {
+    name = component_pedigree.metadata.name,
+    schema_version = component_pedigree.validation.pedigree_version,
+    leash = 'Hunt,
+    signature = component_pedigree.security.signature,
+  },
   deployment = deployment,
   scripts = scripts,
 
diff --git a/docs/governance/MAINTENANCE-CHECKLIST.a2ml b/docs/governance/MAINTENANCE-CHECKLIST.a2ml
index eaee720..f46eece 100644
--- a/docs/governance/MAINTENANCE-CHECKLIST.a2ml
+++ b/docs/governance/MAINTENANCE-CHECKLIST.a2ml
@@ -2,6 +2,7 @@
 # Cross-repo maintenance baseline (machine-readable canonical)
 
 [metadata]
+name = "maintenance-checklist"
 version = "1.1.0"
 last-updated = "2026-02-24"
 scope = "cross-repo"