diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5c25420..05a6df9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,6 +12,9 @@ updates:
     schedule:
       interval: weekly
     groups:
+      major:
+        patterns: ["*"]
+        update-types: ["major"]
       minor-and-patch:
         patterns: ["*"]
         update-types: ["minor", "patch"]
@@ -20,6 +23,9 @@ updates:
     schedule:
       interval: weekly
     groups:
+      major:
+        patterns: ["*"]
+        update-types: ["major"]
       minor-and-patch:
         patterns: ["*"]
         update-types: ["minor", "patch"]
@@ -28,6 +34,9 @@ updates:
     schedule:
       interval: weekly
     groups:
+      major:
+        patterns: ["*"]
+        update-types: ["major"]
       minor-and-patch:
         patterns: ["*"]
         update-types: ["minor", "patch"]
@@ -36,5 +45,8 @@ updates:
     schedule:
       interval: weekly
     groups:
+      major:
+        patterns: ["*"]
+        update-types: ["major"]
       actions:
         patterns: ["*"]
diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index 41fc2b1..b651ecd 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -18,7 +18,7 @@ jobs:
     name: Enable auto-merge
     runs-on: ubuntu-latest
     if: >
-      github.event.pull_request.user.login == 'dependabot[bot]' ||
+      (github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.title, 'minor-and-patch')) ||
       (
         github.event.pull_request.user.login == 'github-actions[bot]' &&
         startsWith(github.event.pull_request.head.ref, 'release-please--')
@@ -26,6 +26,6 @@ jobs:
     steps:
       - name: Enable auto-merge (merge commit)
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ secrets.CI_GITHUB_TOKEN }}
           PR_URL: ${{ github.event.pull_request.html_url }}
         run: gh pr merge --auto --merge "$PR_URL"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c5d8549..24c9f36 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,10 @@ jobs:
   test:
     name: Python ${{ matrix.python-version }}
     runs-on: ubuntu-latest
+    if: >
+      !(github.event_name == 'pull_request' &&
+        ((github.event.pull_request.user.login == 'github-actions[bot]' && startsWith(github.event.pull_request.head.ref, 'release-please--')) ||
+         (github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.title, 'minor-and-patch'))))
     permissions:
       contents: read
     strategy:
@@ -36,6 +40,10 @@ jobs:
   quality:
     name: Quality, Sourcey docs, build
     runs-on: ubuntu-latest
+    if: >
+      !(github.event_name == 'pull_request' &&
+        ((github.event.pull_request.user.login == 'github-actions[bot]' && startsWith(github.event.pull_request.head.ref, 'release-please--')) ||
+         (github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.title, 'minor-and-patch'))))
     permissions:
       contents: read
     steps:
diff --git a/.github/workflows/e2e-ollama.yml b/.github/workflows/e2e-ollama.yml
index f867f2f..9d86c73 100644
--- a/.github/workflows/e2e-ollama.yml
+++ b/.github/workflows/e2e-ollama.yml
@@ -12,6 +12,10 @@ jobs:
   e2e:
     name: E2E tests with local Ollama
     runs-on: ubuntu-latest
+    if: >
+      !(github.event_name == 'pull_request' &&
+        ((github.event.pull_request.user.login == 'github-actions[bot]' && startsWith(github.event.pull_request.head.ref, 'release-please--')) ||
+         (github.event.pull_request.user.login == 'dependabot[bot]' && contains(github.event.pull_request.title, 'minor-and-patch'))))
     timeout-minutes: 15
     env:
       OLLAMA_BASE_URL: http://localhost:11434
diff --git a/context7.json b/context7.json
new file mode 100644
index 0000000..d1d404a
--- /dev/null
+++ b/context7.json
@@ -0,0 +1,15 @@
+{
+  "$schema": "https://context7.com/schema/context7.json",
+  "projectTitle": "Agentic Fabric",
+  "description": "Framework-agnostic discovery, runtime selection, and orchestration for YAML-defined agent fabrics.",
+  "branch": "main",
+  "folders": ["docs", "packages/agentic-fabric", "packages/pytest-agentic-fabric"],
+  "excludeFolders": [".agent-state", "**/tests", "**/__pycache__", "docs/dist", "docs/node_modules"],
+  "excludeFiles": ["CHANGELOG.md"],
+  "rules": [
+    "Keep the ownership chain ExtendedData -> VendorData -> AgenticData; agentic-fabric must not bypass vendor-fabric provider dispatch.",
+    "Keep optional framework imports lazy and registry-backed.",
+    "Route provider-backed tools through vendor-fabric capabilities rather than vendor SDKs or the Go binding directly.",
+    "Keep public documentation, package READMEs, examples, tests, and implementation aligned."
+  ]
+}
diff --git a/packages/agentic-fabric/tests/test_workflow_contracts.py b/packages/agentic-fabric/tests/test_workflow_contracts.py
index 7ee76fa..6609f01 100644
--- a/packages/agentic-fabric/tests/test_workflow_contracts.py
+++ b/packages/agentic-fabric/tests/test_workflow_contracts.py
@@ -27,12 +27,13 @@ def test_automerge_uses_base_context_and_merge_commits() -> None:
     }
     assert workflow["permissions"] == {"contents": "write", "pull-requests": "write"}
     assert "github-actions[bot]" in automerge["if"]
+    assert "minor-and-patch" in automerge["if"]
     assert all("uses" not in step or "actions/checkout" not in step["uses"] for step in steps)
     assert steps == [
         {
             "name": "Enable auto-merge (merge commit)",
             "env": {
-                "GH_TOKEN": "${{ github.token }}",
+                "GH_TOKEN": "${{ secrets.CI_GITHUB_TOKEN }}",
                 "PR_URL": "${{ github.event.pull_request.html_url }}",
             },
             "run": 'gh pr merge --auto --merge "$PR_URL"',
@@ -59,6 +60,8 @@ def test_ci_has_a_sourcey_aware_machine_gate_and_fork_policy() -> None:
     assert workflow["jobs"]["dependency-review"]["name"] == "Dependency Review / gate"
     assert workflow["jobs"]["repository-policy"]["name"] == "Repository Policy / gate"
     assert workflow["jobs"]["gate"]["name"] == "CI / gate"
+    assert "release-please--" in workflow["jobs"]["test"]["if"]
+    assert "minor-and-patch" in workflow["jobs"]["quality"]["if"]
     policy_script = workflow["jobs"]["repository-policy"]["steps"][0]["with"]["script"]
     assert "pull.head.repo.full_name" in policy_script
     assert "docs/sourcey.config.ts" in policy_script