Adopt main-only PR workflow and integrate reviewed dependency updates

.agents/skills/pr-create/SKILL.md

@@ -1,18 +1,18 @@
 ---
 name: pr-create
-description: Prepare an honest Charon pull request using the staged release policy.
+description: Prepare an honest Charon pull request using the main-only PR policy.
 ---
 
 # Create a pull request
 
 1. Read `CONTRIBUTING.md`, `docs/conventions.md`, and the current diff.
-2. Confirm the branch started from `dev`. Ordinary work MUST target `dev`;
-   only `dev` releases and `hotfix/*` repairs target `main`.
+2. Confirm the branch started from `main`. Feature, dependency, and hotfix
+   pull requests MUST target the protected default branch `main`.
 3. Preserve intent, decisions, evidence, caveats, known warts, excluded
    follow-up work, security impact, documentation parity, risk, and rollback.
 4. Run `$doc-code-parity` and `mise run check`.
 5. Review commits and changed files for secrets or unrelated work.
 6. Push and create the PR only when authorized. Never merge it in this skill.
 
-Use `.github/PULL_REQUEST_TEMPLATE.md` for ordinary changes and
-`.github/PULL_REQUEST_TEMPLATE/release.md` for `dev` to `main`.
+Use `.github/pull_request_template.md` for all changes. Successful CI on merged
+`main` commits publishes immutable images; deployment is a separate operator action.

.agents/skills/teach-git/SKILL.md

@@ -1,19 +1,18 @@
 ---
 name: teach-git
-description: Teach Charon's dev-to-main Git workflow and verification habits.
+description: Teach Charon's main-only PR workflow and verification habits.
 ---
 
 # Learn the Git workflow
 
 Explain state before mutation. Use `git status`, `git diff`, and `git log` as
 evidence.
 
-- Feature branches start from `dev`; ordinary PRs target `dev`.
-- Maintainers squash one result or deliberately rebase an independently valid
-  commit series.
-- Release PRs go from `dev` to `main` and MUST use a merge commit.
-- Hotfixes target `main`, then `main` is merged back into `dev`.
-- Shared history is never rewritten.
+- `main` is the only long-lived, protected default branch.
+- Feature branches start from `main`; feature, dependency, and hotfix PRs target it.
+- Maintainers squash one result or preserve useful ancestry with a merge commit.
+- Required checks pass before merge; immutable images come from verified main commits.
+- Deployment is a separate operator decision. Shared history is never rewritten.
 
 Teach the operator to inspect the exact diff, run checks, and approve pushing
 or opening a PR separately. Recover with revert or a corrective commit.

.agents/skills/teach-ship/SKILL.md

@@ -1,20 +1,16 @@
 ---
 name: teach-ship
-description: Teach how verified Charon changes move through dev into production.
+description: Teach how verified Charon changes move through main pull requests into production.
 ---
 
 # Learn to ship
 
-For ordinary work, reconcile intent, diff, tests, documentation, risk,
-rollback, and excluded follow-up work. Run `$doc-code-parity` and
-`mise run check`, then use `$pr-create` for a PR to `dev`.
+Reconcile intent, diff, tests, documentation, risk, rollback, and excluded
+follow-up work. Run `$doc-code-parity` and `mise run check`, then use `$pr-create`
+for a PR from a feature branch into the protected default branch `main`.
+Wait for required checks and merge only with operator authority.
 
-For a release, record the `dev` source SHA, open `dev` to `main`, wait for fresh
-checks, and use a merge commit. After merge, verify:
-
-```sh
-git merge-base --is-ancestor <release-source-sha> main
-```
-
-Production images originate from `main`. Merging, publishing, and deploying
-each require explicit operator authority.
+After merge, verify the resulting main commit and its successful CI run.
+Production images use that exact commit in their immutable tag. There is no
+release-branch promotion PR. Publishing and deploying remain distinct operations;
+CI publishes on successful main pushes, while deployment requires operator authority.

.dockerignore

@@ -2,5 +2,6 @@
 !Cargo.toml
 !Cargo.lock
 !Dockerfile
+!THIRD_PARTY_NOTICES.md
 !src
 !src/**

.github/dependabot.yml

@@ -2,26 +2,26 @@ version: 2
 updates:
   - package-ecosystem: cargo
     directory: /
-    target-branch: dev
+    target-branch: main
     schedule:
       interval: weekly
   - package-ecosystem: github-actions
     directory: /
-    target-branch: dev
+    target-branch: main
     schedule:
       interval: weekly
   - package-ecosystem: docker
     directory: /
-    target-branch: dev
+    target-branch: main
     schedule:
       interval: weekly
   - package-ecosystem: docker
     directory: /integrations/hermes
-    target-branch: dev
+    target-branch: main
     schedule:
       interval: weekly
   - package-ecosystem: pip
     directory: /integrations/hermes
-    target-branch: dev
+    target-branch: main
     schedule:
       interval: weekly

.github/pull_request_template.md

@@ -21,5 +21,5 @@
 - Risk:
 - Rollback:
 
-Ordinary pull requests target `dev`. Use the release template for `dev` to
-`main`.
+All pull requests target the protected default branch `main`. A successful merge
+is eligible for immutable image publication after CI passes.

.github/scripts/check-pr-path.sh

@@ -9,24 +9,12 @@ if [ -z "$base" ] || [ -z "$head" ]; then
   exit 2
 fi
 
-case "$base:$head" in
-  main:dev)
-    printf 'valid release path: dev -> main; use a merge commit\n'
-    ;;
-  main:hotfix/*)
-    printf 'valid hotfix path: %s -> main; use a merge commit and then merge main -> dev\n' "$head"
-    ;;
-  main:*)
-    printf 'error: main accepts only dev releases or hotfix/* emergency repairs\n' >&2
-    exit 1
-    ;;
-  dev:main)
-    printf 'valid hotfix reconciliation path: main -> dev; use a merge commit\n'
-    ;;
-  dev:*)
-    printf 'valid integration path: %s -> dev; use squash or an approved rebase merge\n' "$head"
-    ;;
-  *)
-    printf 'information: no staged-release path rule applies to %s -> %s\n' "$head" "$base"
-    ;;
-esac
+if [ "$base" != main ]; then
+  printf 'error: all pull requests must target main\n' >&2
+  exit 1
+fi
+if [ "$head" = main ]; then
+  printf 'error: pull requests must come from a feature branch\n' >&2
+  exit 1
+fi
+printf 'valid pull request path: %s -> main\n' "$head"

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
-          python-version: "3.12.10"
+          python-version: "3.14.8"
       - name: Check out pinned Hermes interface
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
@@ -61,6 +61,8 @@ jobs:
         run: python -m pip install httpx==0.28.1
       - name: Test Python strict CONNECT certificates
         run: CHARON_STRICT_TLS_PYTHON="$(command -v python)" cargo test --lib gateway::tests::python_313_strict_clients_accept_generated_chain -- --ignored --nocapture
+      - name: Test main-only PR policy
+        run: sh tests/pr_path.sh
       - name: Test deployment contract
         run: sh tests/deploy_redeploy.sh
 

.github/workflows/image.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - id: image
         name: Derive fork-local image name
         run: |
@@ -28,7 +28,7 @@ jobs:
           images: ${{ steps.image.outputs.name }}
           tags: |
             type=sha,format=long
-      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           platforms: linux/amd64
@@ -43,9 +43,8 @@ jobs:
         run: |
           sh -n integrations/vertical/run.sh
           sh -n integrations/vertical/run-in-workload.sh
-          sh -n integrations/vertical/prepare-linux-bw.sh
       - name: Build secretless gh workload fixture
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: integrations/vertical
           file: integrations/vertical/Dockerfile

.github/workflows/release.yml

@@ -55,13 +55,13 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ needs.authorize.outputs.revision }}
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+      - uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           platforms: linux/amd64
@@ -73,7 +73,7 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
       - name: Publish Charon-Hermes integration image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: integrations/hermes
           file: integrations/hermes/Dockerfile

AGENTS.md

@@ -26,11 +26,11 @@ scratch files created by the current task.
 
 Branch workflow:
 
-- Agents MUST create feature branches from `dev` and target ordinary pull
-  requests to `dev`.
-- Only release pull requests from `dev` CAN target `main`.
-- Maintainers MUST merge `dev` into `main` with a merge commit to preserve
-  ancestry.
-- Agents MUST treat `main` as production and release immutable container
-  versions from it.
-- Agents MUST NOT rewrite shared branch history.
+- `main` is the only long-lived branch and the production/default branch.
+- Agents MUST create feature branches from `main` and target pull requests to
+  `main`. Dependency updates follow the same path.
+- `main` MUST remain protected and PR-only, with required checks. Agents MUST
+  NOT push directly to it or rewrite shared branch history.
+- Maintainers SHOULD squash a single-result change and CAN use a merge commit
+  when preserving contributor or integration ancestry matters.
+- Release immutable container versions from the exact verified `main` commit.

CLAUDE.md

@@ -26,11 +26,11 @@ scratch files created by the current task.
 
 Branch workflow:
 
-- Agents MUST create feature branches from `dev` and target ordinary pull
-  requests to `dev`.
-- Only release pull requests from `dev` CAN target `main`.
-- Maintainers MUST merge `dev` into `main` with a merge commit to preserve
-  ancestry.
-- Agents MUST treat `main` as production and release immutable container
-  versions from it.
-- Agents MUST NOT rewrite shared branch history.
+- `main` is the only long-lived branch and the production/default branch.
+- Agents MUST create feature branches from `main` and target pull requests to
+  `main`. Dependency updates follow the same path.
+- `main` MUST remain protected and PR-only, with required checks. Agents MUST
+  NOT push directly to it or rewrite shared branch history.
+- Maintainers SHOULD squash a single-result change and CAN use a merge commit
+  when preserving contributor or integration ancestry matters.
+- Release immutable container versions from the exact verified `main` commit.

CONTRIBUTING.md

@@ -19,7 +19,7 @@ mise run check
 
 ## Pull requests
 
-Create a feature branch from `dev` and open the pull request against `dev`.
+Create a feature branch from `main` and open the pull request against `main`.
 A pull request is a proposal, not an entitlement to merge. Merge-ready work has
 a clear purpose, focused scope, passing checks, documentation parity, and an
 explicit account of security impact.
@@ -37,14 +37,18 @@ implementation rather than retain it, the pull request discussion and release
 notes SHOULD acknowledge the original proposal without claiming false commit
 authorship.
 
-## Releases and hotfixes
+## Merges and releases
 
-Only a release pull request from `dev` targets `main`. Maintainers MUST use a
-merge commit for that pull request so `dev` remains an ancestor of `main`.
-Squash and rebase release merges are prohibited.
+`main` is the only long-lived branch, the default branch, and the source of
+production container images. It remains protected and PR-only. Feature,
+dependency, and hotfix pull requests all target `main` and must pass its required
+checks. Maintainers SHOULD squash a single-result change and CAN use a merge
+commit when preserving contributor or integration ancestry matters. Do not
+rewrite shared history.
 
-Emergency `hotfix/*` branches CAN target `main`. After merging a hotfix,
-maintainers MUST merge `main` back into `dev` before the next release.
+A successful CI run for a push to `main` publishes immutable images tied to that
+exact commit. Merging makes a change releasable; deployment remains a separate
+operator action. There is no separate release-branch promotion step.
 
 ## Security reports