diff --git a/FUTURE.md b/FUTURE.md
index fd26475..9d50eb2 100644
--- a/FUTURE.md
+++ b/FUTURE.md
@@ -255,7 +255,7 @@ examples, evaluation harnesses, and pre-1.0 API freeze work.
 
 Knolo Agents is deliberately **not** trying to become:
 
-- A LangChain-style provider/orchestration framework with implicit tool discovery
+- A provider/orchestration framework with implicit tool discovery
   or hidden network access.
 - A model provider, vector database, job queue, or application data layer.
 - A place that vendors, re-exports, or ships `@knolo/core` storage
diff --git a/crates/knolo-agent-icp/src/auth.rs b/crates/knolo-agent-icp/src/auth.rs
index c88a635..b7ce3f2 100644
--- a/crates/knolo-agent-icp/src/auth.rs
+++ b/crates/knolo-agent-icp/src/auth.rs
@@ -71,8 +71,10 @@ mod tests {
 
     #[test]
     fn allowlist_enforced() {
-        let mut limits = RuntimeLimitsV1::default();
-        limits.allowed_callers = vec!["aaaaa-aa".into()];
+        let limits = RuntimeLimitsV1 {
+            allowed_callers: vec!["aaaaa-aa".into()],
+            ..RuntimeLimitsV1::default()
+        };
         let anon = Principal::anonymous();
         assert!(require_run_access(anon, false, &limits).is_err());
         assert!(require_run_access(anon, true, &limits).is_ok());
diff --git a/crates/knolo-agent-icp/src/definition.rs b/crates/knolo-agent-icp/src/definition.rs
index bc0c908..8ef4b45 100644
--- a/crates/knolo-agent-icp/src/definition.rs
+++ b/crates/knolo-agent-icp/src/definition.rs
@@ -139,7 +139,7 @@ impl AgentDefinitionBundleV1 {
         let node_implementation_hash =
             format!("{:x}", Sha256::digest(bundle.implementation_id.as_bytes()));
         let policy = match &bundle.pack {
-            Some(pack) => Some(pack.compile().map_err(|e| CoreError::PackLoad(e))?),
+            Some(pack) => Some(pack.compile().map_err(CoreError::PackLoad)?),
             None => None,
         };
         Ok(LoadedDefinition {
diff --git a/crates/knolo-agent-icp/src/stable_store.rs b/crates/knolo-agent-icp/src/stable_store.rs
index ff06fdd..281eeda 100644
--- a/crates/knolo-agent-icp/src/stable_store.rs
+++ b/crates/knolo-agent-icp/src/stable_store.rs
@@ -483,8 +483,10 @@ mod tests {
             ..RuntimeLimitsV1::default()
         };
         persist_limits(&limits).unwrap();
-        let mut budget = HostBudgetSnapshotV1::default();
-        budget.tool_calls = 3;
+        let budget = HostBudgetSnapshotV1 {
+            tool_calls: 3,
+            ..HostBudgetSnapshotV1::default()
+        };
         persist_budget(&budget).unwrap();
         let snap = load_snapshot().unwrap();
         assert_eq!(snap.limits.max_concurrent_executions, 4);
diff --git a/scripts/hygiene.sh b/scripts/hygiene.sh
index 53cfaa4..aee4edb 100755
--- a/scripts/hygiene.sh
+++ b/scripts/hygiene.sh
@@ -2,7 +2,12 @@
 set -euo pipefail
 tracked=$(git ls-files)
 for pattern in '(^|/)(node_modules|target|dist|\.venv|coverage)(/|$)' '(^|/)(requirements[^/]*\.txt|Pipfile|poetry\.lock|pyproject\.toml|setup\.py|setup\.cfg)$' '\.(pem|key|p12|pfx)$' '(^|/)\.env($|\.)'; do
-  if printf '%s\n' "$tracked" | rg -i "$pattern"; then echo "forbidden tracked artifact" >&2; exit 1; fi
+  # Prefer rg when present; fall back to grep so CI runners without ripgrep still work.
+  if command -v rg >/dev/null 2>&1; then
+    if printf '%s\n' "$tracked" | rg -i "$pattern"; then echo "forbidden tracked artifact" >&2; exit 1; fi
+  else
+    if printf '%s\n' "$tracked" | grep -Eie "$pattern"; then echo "forbidden tracked artifact" >&2; exit 1; fi
+  fi
 done
 # Product comparisons are allowed in README prose; legacy integrations,
 # credentials, and source-level identity references remain forbidden.
@@ -12,3 +17,4 @@ if find . -type l -print -quit | grep -q .; then echo "symlinks require explicit
 for dir in node_modules target dist .venv coverage; do
   if find . -type d -name "$dir" -not -path './.git/*' -print -quit | grep -q .; then echo "generated directory present: $dir" >&2; exit 1; fi
 done
+