diff --git a/.coderabbit.yaml b/.coderabbit.yaml
index 1c818fb..4c18a3f 100644
--- a/.coderabbit.yaml
+++ b/.coderabbit.yaml
@@ -1,6 +1,7 @@
 # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
 
 language: "en-US"
+early_access: false
 tone_instructions: >-
   Be concise and evidence-driven. Prioritize correctness, security, reliability,
   compatibility, and user impact. Report only actionable findings and avoid
@@ -17,6 +18,8 @@ reviews:
   estimate_code_review_effort: false
   related_issues: false
   related_prs: false
+  assess_linked_issues: false
+  suggested_labels: false
   suggested_reviewers: false
   auto_assign_reviewers: false
   in_progress_fortune: false
@@ -24,11 +27,20 @@ reviews:
   enable_prompt_for_ai_agents: false
   abort_on_close: true
 
+  finishing_touches:
+    resolve_merge_conflict:
+      enabled: false
+
   auto_review:
     enabled: true
     drafts: false
     auto_incremental_review: true
+    # Deliberately pause after two reviewed commits: active PRs often receive
+    # small fixup pushes, and reviewing every one duplicates findings and uses
+    # review allowance. A fresh review can still be requested manually.
     auto_pause_after_reviewed_commits: 2
+    base_branches:
+      - "main"
     ignore_title_keywords:
       - "WIP"
       - "DO NOT MERGE"
@@ -43,8 +55,38 @@ reviews:
     - "!**/tmp/**"
     - "!**/package-lock.json"
     - "!**/pnpm-lock.yaml"
+    - "!**/go.sum"
 
   path_instructions:
+    - path: "internal/tunnel/**"
+      instructions: |
+        This package owns the SSH connection, its host-key verification, reconnect loop, and
+        the multiplexed TCP forwards. Flag changes that open one SSH client per port, retry
+        without bounded backoff or cancellation, leak channels/listeners/goroutines, bypass
+        host-key verification, or make reconnect lose or duplicate active forwards. Preserve
+        the Unix and Windows authentication paths.
+
+    - path: "internal/discover/**"
+      instructions: |
+        Auto-discovery must reflect the remote machine's actual TCP listeners. Check defensive
+        parsing of remote command output, reserved-port filtering, deterministic results, and
+        the distinction between an unavailable probe and a remote machine with no matching
+        listeners. Do not silently turn discovery errors into an empty port set.
+
+    - path: "internal/config/**"
+      instructions: |
+        Preserve the documented precedence and compatibility of CLI flags, YAML configuration,
+        environment values, and defaults. Malformed or unknown configuration should fail with
+        a useful error, and credentials or other sensitive values must not enter logs or user
+        facing status output.
+
+    - path: "cmd/mole/**"
+      instructions: |
+        The command and flag definitions are user-facing API. Check help text, exit codes,
+        foreground and daemon lifecycle, status/log output, and platform-specific behavior.
+        Preserve existing command names, documented flags, and the distinction between human
+        output and machine-readable output where one is documented.
+
     - path: "**/*.go"
       instructions: |
         Review this as a Go 1.26 CLI/daemon that forwards TCP ports over one SSH connection.
@@ -109,6 +151,12 @@ reviews:
       enabled: true
     gitleaks:
       enabled: true
+    actionlint:
+      enabled: true
+    zizmor:
+      enabled: true
+    osvScanner:
+      enabled: true
 
 chat:
   art: false
diff --git a/CODE_REVIEW.md b/CODE_REVIEW.md
index e284b37..c830d1c 100644
--- a/CODE_REVIEW.md
+++ b/CODE_REVIEW.md
@@ -17,6 +17,21 @@ Review priorities:
 - The landing site must continue to produce static output and preserve its accessibility, SEO, and
   responsive behavior.
 
+Subsystem contracts:
+
+- `internal/tunnel` owns one SSH connection shared by the forwarded ports. Reconnects must be
+  cancellable, bounded, and free of leaked channels, listeners, and goroutines. Host-key checking
+  and both Unix and Windows authentication paths are security-sensitive.
+- `internal/discover` must distinguish a failed remote probe from a successful probe with no
+  matching listeners. Discovery should be based on actual remote TCP listeners and retain the
+  documented reserved-port behavior.
+- `internal/config` and `cmd/mole` define the public configuration, command, flag, help, exit-code,
+  and daemon-lifecycle contracts. Preserve the documented precedence and compatibility when adding
+  options.
+- `.github/workflows` is production infrastructure: the landing artifact is built and checked
+  before publication, and deployment reaches the private server through Tailscale and SSH without
+  exposing credentials.
+
 When a concern is uncertain, explain the evidence and its assumptions instead of presenting it as
 a definite defect. Avoid repeating a finding already covered by the repository's formatters or
 linters unless the configuration makes it a real correctness or security issue.