diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..325159d
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  test:
+    name: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo test --workspace
+
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo fmt --check
+      - run: cargo clippy --workspace --tests -- -D warnings
+
+  ci:
+    name: ci
+    needs: [test, lint]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo build --release
diff --git a/configs/safety.toml b/configs/safety.toml
index 95003d1..f423197 100644
--- a/configs/safety.toml
+++ b/configs/safety.toml
@@ -6,7 +6,7 @@ name = "loom"
 ti = "Ti2"      # Optimizer can introduce semantic errors
 td = "Td2"      # Z3 verification + downstream synth checking = medium detection
 is_oss = true
-repository_url = "https://github.com/example/loom"
+repository_url = "https://github.com/pulseengine/loom"
 license = "Apache-2.0"
 
 [tools.classification]
@@ -28,7 +28,7 @@ name = "synth"
 ti = "Ti2"      # Code generator produces final binary
 td = "Td3"      # Last in chain, limited downstream detection
 is_oss = false
-repository_url = "https://github.com/example/synth"
+repository_url = "https://github.com/pulseengine/synth"
 license = "Proprietary"
 
 [tools.classification]
@@ -49,7 +49,7 @@ name = "meld"
 ti = "Ti2"      # Fuser transforms component structure
 td = "Td2"      # loom verification downstream = medium detection
 is_oss = true
-repository_url = "https://github.com/example/meld"
+repository_url = "https://github.com/pulseengine/meld"
 license = "Apache-2.0"
 
 [tools.classification]
diff --git a/crates/thrum-core/src/coordination.rs b/crates/thrum-core/src/coordination.rs
index bf60bae..2f9fa05 100644
--- a/crates/thrum-core/src/coordination.rs
+++ b/crates/thrum-core/src/coordination.rs
@@ -48,20 +48,15 @@ impl SharedMemoryEntry {
 // ---------------------------------------------------------------------------
 
 /// Policy for resolving file conflicts between concurrent agents.
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub enum ConflictPolicy {
     /// Emit an event but let both agents continue (optimistic).
+    #[default]
     WarnAndContinue,
     /// Serialize the later agent's work (acquire a lock, wait for first to finish).
     Serialize,
 }
 
-impl Default for ConflictPolicy {
-    fn default() -> Self {
-        Self::WarnAndContinue
-    }
-}
-
 /// A detected file conflict between two concurrent agents.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct FileConflict {
diff --git a/crates/thrum-db/tests/memory_lifecycle.rs b/crates/thrum-db/tests/memory_lifecycle.rs
index 0a92deb..0725a19 100644
--- a/crates/thrum-db/tests/memory_lifecycle.rs
+++ b/crates/thrum-db/tests/memory_lifecycle.rs
@@ -121,7 +121,7 @@ fn prompt_context_injection_format() {
     );
 
     // Format as the pipeline would for injection
-    let memories = vec![error, pattern];
+    let memories = [error, pattern];
     let ctx: Vec<String> = memories.iter().map(|m| m.to_prompt_context()).collect();
     let injected = format!(
         "\n\n## Relevant context from previous sessions\n{}",