diff --git a/.github/workflows/conformance.yaml b/.github/workflows/conformance.yaml
index f6cb044..e8f2bfc 100644
--- a/.github/workflows/conformance.yaml
+++ b/.github/workflows/conformance.yaml
@@ -13,7 +13,7 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: true
 
 permissions: {}
 
@@ -31,14 +31,11 @@ jobs:
 
   gateway-api:
     runs-on: ubuntu-24.04
-    timeout-minutes: 45
     permissions:
       contents: read
       packages: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
 
       - name: Login to GHCR
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
diff --git a/.github/workflows/integration.yaml b/.github/workflows/integration.yaml
index f20597d..30d8d44 100644
--- a/.github/workflows/integration.yaml
+++ b/.github/workflows/integration.yaml
@@ -19,7 +19,7 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: true
 
 permissions: {}
 
@@ -38,14 +38,11 @@ jobs:
 
   test:
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
     permissions:
       contents: read
       packages: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
 
       - name: Login to GHCR
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
diff --git a/.github/workflows/issue-triage.yaml b/.github/workflows/issue-triage.yaml
deleted file mode 100644
index 2a52150..0000000
--- a/.github/workflows/issue-triage.yaml
+++ /dev/null
@@ -1,61 +0,0 @@
-name: Issue Triage
-
-# ------------------------------------------------------------------------------
-# Workflow Settings
-# ------------------------------------------------------------------------------
-
-on:
-  issues:
-    types: [opened, milestoned, demilestoned]
-
-permissions: {}
-
-jobs:
-  # ----------------------------------------------------------------------------
-  # Triage Labels
-  # ----------------------------------------------------------------------------
-
-  triage:
-    if: ${{ !github.event.issue.pull_request }}
-    runs-on: ubuntu-24.04
-    permissions:
-      issues: write
-    steps:
-      - name: Generate token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ secrets.PRAXIS_BOT_APP_ID }}
-          private-key: ${{ secrets.PRAXIS_BOT_APP_PRIVATE_KEY }}
-
-      - name: Add triage/needs-triage on new issue
-        if: github.event.action == 'opened' && !github.event.issue.milestone
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          GH_REPO: ${{ github.repository }}
-          ISSUE: ${{ github.event.issue.number }}
-        run: |
-          gh issue edit "$ISSUE" --repo "$GH_REPO" \
-            --add-label "triage/needs-triage"
-
-      - name: Accept triaged issue
-        if: github.event.action == 'milestoned'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          GH_REPO: ${{ github.repository }}
-          ISSUE: ${{ github.event.issue.number }}
-        run: |
-          gh issue edit "$ISSUE" --repo "$GH_REPO" \
-            --remove-label "triage/needs-triage" \
-            --add-label "triage/accepted"
-
-      - name: Revert to needs-triage on demilestone
-        if: github.event.action == 'demilestoned'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          GH_REPO: ${{ github.repository }}
-          ISSUE: ${{ github.event.issue.number }}
-        run: |
-          gh issue edit "$ISSUE" --repo "$GH_REPO" \
-            --remove-label "triage/accepted" \
-            --add-label "triage/needs-triage"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 776242c..09d754b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -31,13 +31,10 @@ jobs:
 
   verify:
     runs-on: ubuntu-24.04
-    timeout-minutes: 10
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
 
       - uses: praxis-proxy/conventions/.github/actions/setup-rust@7e1e8d97c2dc820d24b31f9a65b119c4d0e5342c # v0.1.0
 
@@ -51,14 +48,11 @@ jobs:
   image:
     needs: verify
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
     permissions:
       contents: read
       packages: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
 
       - name: Login to GHCR
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 9398dc6..b39e799 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -19,7 +19,7 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  cancel-in-progress: true
 
 permissions: {}
 
@@ -34,21 +34,13 @@ jobs:
 
   lint:
     runs-on: ubuntu-24.04
-    timeout-minutes: 15
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
 
       - uses: praxis-proxy/conventions/.github/actions/setup-rust-lint@7e1e8d97c2dc820d24b31f9a65b119c4d0e5342c # v0.1.0
 
-      # `make lint` runs `cargo machete`; the setup action only provides
-      # clippy and rustfmt, so install machete before linting.
-      - name: Install cargo-machete
-        run: cargo install cargo-machete --locked
-
       - name: Lint
         run: make lint
 
@@ -61,13 +53,10 @@ jobs:
 
   test:
     runs-on: ubuntu-24.04
-    timeout-minutes: 30
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
 
       - uses: praxis-proxy/conventions/.github/actions/setup-rust@7e1e8d97c2dc820d24b31f9a65b119c4d0e5342c # v0.1.0
 
@@ -83,16 +72,13 @@ jobs:
 
   coverage:
     runs-on: ubuntu-24.04
-    timeout-minutes: 20
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
 
       - name: Check coverage
-        uses: praxis-proxy/conventions/.github/actions/coverage-check@7e1e8d97c2dc820d24b31f9a65b119c4d0e5342c # v0.1.0
+        uses: praxis-proxy/conventions/.github/actions/coverage-check@dc77dbd3a55ce96e8e31a3c8d36cea4952617dd3 # v0.1.0
 
   # ---------------------------------------------------------------------------
   # Supply-chain audit
@@ -100,12 +86,9 @@ jobs:
 
   audit:
     runs-on: ubuntu-24.04
-    timeout-minutes: 15
     permissions:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
 
       - uses: praxis-proxy/conventions/.github/actions/supply-chain-audit@7e1e8d97c2dc820d24b31f9a65b119c4d0e5342c # v0.1.0
diff --git a/Cargo.lock b/Cargo.lock
index 0f04d6d..f22f37d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -24,6 +24,15 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "alloca"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5a7d05ea6aea7e9e64d25b9156ba2fee3fdd659e34e41063cd2fc7cd020d7f4"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "allocator-api2"
 version = "0.2.21"
@@ -287,10 +296,11 @@ dependencies = [
 
 [[package]]
 name = "criterion"
-version = "0.7.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1c047a62b0cc3e145fa84415a3191f628e980b194c2755aa12300a4e6cbd928"
+checksum = "950046b2aa2492f9a536f5f4f9a3de7b9e2476e575e05bd6c333371add4d98f3"
 dependencies = [
+ "alloca",
  "anes",
  "cast",
  "ciborium",
@@ -299,6 +309,7 @@ dependencies = [
  "itertools",
  "num-traits",
  "oorandom",
+ "page_size",
  "plotters",
  "rayon",
  "regex",
@@ -310,9 +321,9 @@ dependencies = [
 
 [[package]]
 name = "criterion-plot"
-version = "0.6.0"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b1bcc0dc7dfae599d84ad0b1a55f80cde8af3725da8313b528da95ef783e338"
+checksum = "d8d80a2f4f5b554395e47b5d8305bc3d27813bacb73493eb1001e8f76dae29ea"
 dependencies = [
  "cast",
  "itertools",
@@ -1391,6 +1402,16 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "page_size"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30d5b2194ed13191c1999ae0704b7839fb18384fa22e49b57eeaa97d79ce40da"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -2623,6 +2644,22 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -2632,6 +2669,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
 [[package]]
 name = "windows-core"
 version = "0.62.2"
diff --git a/Cargo.toml b/Cargo.toml
index 8a62054..92099f5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -29,7 +29,7 @@ harness = false
 
 [dev-dependencies]
 bytes = "1.12.1"
-criterion = "0.7.0"
+criterion = "0.8.2"
 http = "1.4.2"
 http-body-util = "0.1.4"
 tower = { version = "0.5.3", features = ["util"] }
diff --git a/LICENSE b/LICENSE
index 9706849..261eeb9 100644
--- a/LICENSE
+++ b/LICENSE
@@ -186,7 +186,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright 2026 Praxis Contributors
+   Copyright [yyyy] [name of copyright owner]
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
diff --git a/Makefile b/Makefile
index 50dceb9..e7b1e23 100644
--- a/Makefile
+++ b/Makefile
@@ -50,7 +50,6 @@ check:
 lint:
 	cargo clippy --all-targets -- -D warnings
 	cargo +$(NIGHTLY) fmt --all -- --check
-	cargo machete
 
 lint-extra: check-prereqs-extra
 	typos
diff --git a/README.md b/README.md
index e15d8c8..e983533 100644
--- a/README.md
+++ b/README.md
@@ -58,6 +58,6 @@ yourself with the following documentation first:
 For larger changes, open a [discussion] and follow
 the [proposal process](docs/proposals.md).
 
-[Issues]: https://github.com/praxis-proxy/operator/issues/new
-[pull requests]: https://github.com/praxis-proxy/operator/compare
-[discussion]: https://github.com/praxis-proxy/operator/discussions
+[Issues]: https://github.com/praxis-proxy/praxis-operator/issues/new
+[pull requests]: https://github.com/praxis-proxy/praxis-operator/compare
+[discussion]: https://github.com/praxis-proxy/praxis-operator/discussions
diff --git a/docs/development.md b/docs/development.md
index ecee4ba..f55df63 100644
--- a/docs/development.md
+++ b/docs/development.md
@@ -5,7 +5,7 @@ Praxis operator.
 
 ## Prerequisites
 
-- Rust stable 1.96+ (edition 2024)
+- Rust stable 1.94+ (edition 2024)
 - Rust nightly (for `rustfmt`; `group_imports` and
   `imports_granularity` are nightly-only)
 - Docker or Podman (container builds)
diff --git a/docs/proposals.md b/docs/proposals.md
new file mode 100644
index 0000000..7d063d2
--- /dev/null
+++ b/docs/proposals.md
@@ -0,0 +1,109 @@
+# Proposals
+
+Proposals for new capabilities and refinements in the
+Praxis Operator.
+
+Small changes (bug fixes, minor enhancements,
+documentation updates) do not require proposals.
+Proposals are for features that span multiple PRs,
+introduce new architectural patterns, affect the
+project's public interface, or are complex enough
+they warrant more process.
+
+## Lifecycle
+
+### 1. Discussion
+
+Open a [GitHub Discussion] describing the change at a
+high level. Focus on *what* and *why*, not
+implementation details.
+
+Build consensus with community members.
+
+> **Note**: Some implementation details at this stage
+> can be OK, depending on the situation. Just keep in
+> mind the point of the discussion phase is to get
+> consensus that what you're bringing up is a real
+> concern that needs to be addressed, regardless of
+> "How?" it is addressed.
+
+[GitHub Discussion]: https://github.com/praxis-proxy/praxis-operator/discussions
+
+### 2. Sign-off
+
+A reviewer reviews the discussion and marks it as
+approved. This confirms the project is open to the
+proposed direction.
+
+> **Note**: It's fair to directly ping reviewers
+> asking for review and approval consideration when
+> things get stuck.
+
+### 3. Issue
+
+Once the discussion is approved by a reviewer and
+resolved, create an `EPIC` issue from the discussion.
+Include first a link to the originating discussion,
+followed by a high-level summary. This is where all
+implementation work will be organized (as sub-tasks).
+
+> **Note**: Reviewers will assign epic and sub-task
+> owners.
+
+### 4. Proposal PR
+
+Create a proposal file in `docs/proposals/` and
+submit it as a PR. File naming convention:
+
+```console
+<issue_number>_<high-level-slug>.md
+```
+
+The first PR must contain only the **What?** and
+**Why?** sections. The **How?** section is almost
+always contentious and must be added in a follow-up
+PR after the goals and motivation are accepted. See
+the [template] for the full structure.
+
+[template]: proposals/template.md
+
+### 5. Iteration
+
+Iterate on the proposal in subsequent PRs. Add the
+**How?** section with requirements and design details.
+Refine until a reviewer marks the proposal as
+accepted.
+
+### 6. Experimental
+
+Once accepted, someone (perhaps the authors of the
+proposal) will be tasked with implementing the feature
+and ship it as experimental. Experimental features are
+functional but may change based on user feedback, and
+nothing about them is guaranteed.
+
+> **Note**: In particular, updates to experimental
+> features may make breaking, backwards-incompatible
+> changes. An experimental feature may be removed at
+> any time.
+
+### 7. Release
+
+After a soak period determined by reviewers a
+reviewer may promote the feature from experimental
+to released. The proposal status is updated to
+`released`.
+
+## Status Values
+
+| Status | Meaning |
+| --- | --- |
+| `proposed` | Under discussion, not yet accepted |
+| `accepted` | Approved for implementation |
+| `experimental` | Implemented, shipping as experimental |
+| `released` | Stable, fully shipped |
+| `withdrawn` | Not proceeding (includes explanation) |
+
+> **Note**: A proposal with status `withdrawn` must
+> include a clear, detailed explanation of why it was
+> withdrawn.
diff --git a/tests/integration.rs b/tests/integration.rs
index 5c78973..2650e2a 100644
--- a/tests/integration.rs
+++ b/tests/integration.rs
@@ -1545,7 +1545,7 @@ impl TestContext {
     async fn deploy_echo_server(&self, name: &str, namespace: &str, port: i32) {
         use k8s_openapi::{
             api::{
-                apps::v1::DeploymentSpec,
+                apps::v1::{Deployment, DeploymentSpec},
                 core::v1::{Container, ContainerPort, PodSpec, PodTemplateSpec},
             },
             apimachinery::pkg::apis::meta::v1::LabelSelector,