diff --git a/.config/nextest.toml b/.config/nextest.toml
new file mode 100644
index 0000000..c4083d8
--- /dev/null
+++ b/.config/nextest.toml
@@ -0,0 +1,7 @@
+[profile.ci-test]
+fail-fast = true
+retries = 0
+
+[profile.ci]
+fail-fast = false
+retries = 1
diff --git a/.ontology/workflow.ncl b/.ontology/workflow.ncl
new file mode 100644
index 0000000..8a95129
--- /dev/null
+++ b/.ontology/workflow.ncl
@@ -0,0 +1,43 @@
+let W = import "../reflection/schemas/workflow.ncl" in
+let D = import "../reflection/defaults/workflow.ncl" in
+
+{
+  layers = [
+    {
+      id          = "commit-fast",
+      trigger     = 'OnCommit,
+      validations = [
+        "rust-fmt",
+        "rust-clippy",
+        "nextest-ci-test",
+        "deny-subset",
+        "manifest-coverage",
+      ],
+      builds        = [],
+      distributions = [],
+      providers     = [W.pre_commit "pre-commit"],
+    },
+
+    {
+      id          = "ci-standard",
+      trigger     = 'OnPR,
+      validations = [
+        "rust-clippy-all",
+        "nextest-ci",
+        "deny-subset",
+        "nickel-typecheck",
+        "nushell-check",
+      ],
+      builds        = ["release-native"],
+      distributions = [],
+      providers     = [
+        W.woodpecker ".woodpecker/ci.yml",
+        W.justfile   "ci-standard",
+      ],
+    },
+  ],
+
+  validations   = D.validations,
+  builds        = D.builds,
+  distributions = {},
+}
diff --git a/.ontoref/config.ncl b/.ontoref/config.ncl
index 0832c10..2b89bc6 100644
--- a/.ontoref/config.ncl
+++ b/.ontoref/config.ncl
@@ -6,7 +6,7 @@
 
   log = {
     level     = "info",
-    path      = ".ontoref/logs",
+    path      = ".ontoref/logs/actions.jsonl",
     rotation  = "daily",
     compress  = false,
     archive   = ".ontoref/logs/archive",
diff --git a/.ontoref/logs b/.ontoref/logs/actions.jsonl
similarity index 67%
rename from .ontoref/logs
rename to .ontoref/logs/actions.jsonl
index a0a727f..7cbd0a1 100644
--- a/.ontoref/logs
+++ b/.ontoref/logs/actions.jsonl
@@ -15,3 +15,12 @@
 {"ts":"2026-03-14T18:29:31+0000","author":"unknown","actor":"agent","level":"read","action":"describe capabilities"}
 {"ts":"2026-03-14T18:29:32+0000","author":"unknown","actor":"agent","level":"read","action":"constraint"}
 {"ts":"2026-03-14T23:56:57+0000","author":"unknown","actor":"agent","level":"read","action":"adr list"}
+{"test": 1}
+{"ts":"2026-04-08T22:52:37+0100","author":"unknown","actor":"agent","level":"read","action":"migrate pending"}
+{"ts":"2026-04-08T22:54:36+0100","author":"unknown","actor":"developer","level":"read","action":"migrate pending"}
+{"ts":"2026-04-08T22:55:11+0100","author":"unknown","actor":"agent","level":"read","action":"migrate pending"}
+{"ts":"2026-04-08T22:58:49+0100","author":"unknown","actor":"agent","level":"read","action":"migrate show 0014"}
+{"ts":"2026-04-08T23:00:03+0100","author":"unknown","actor":"agent","level":"read","action":"migrate pending"}
+{"ts":"2026-04-08T23:00:07+0100","author":"unknown","actor":"agent","level":"read","action":"migrate list"}
+{"ts":"2026-04-08T23:00:55+0100","author":"unknown","actor":"agent","level":"write","action":"workflow generate"}
+{"ts":"2026-04-08T23:01:00+0100","author":"unknown","actor":"agent","level":"read","action":"workflow validate"}
diff --git a/.woodpecker/ci.yml b/.woodpecker/ci.yml
index be8aba9..8fa6958 100644
--- a/.woodpecker/ci.yml
+++ b/.woodpecker/ci.yml
@@ -1,84 +1,45 @@
-# Woodpecker CI Pipeline
-# Equivalent to GitHub Actions CI workflow
-# Generated by dev-system/ci
+# Generated by ore workflow generate — layer: ci-standard
+# Source: .ontology/workflow.ncl
+# Do not edit manually — regenerate with: ore workflow generate --layer ci-standard
 
 when:
   event: [push, pull_request, manual]
-  branch:
-    - main
-    - develop
 
 steps:
-  # === LINTING ===
-
-  lint-rust:
+  rust-clippy-all:
     image: rust:latest
     commands:
-      - curl --proto '=https' --tlsv1.2 -sSf https://just.systems/install.sh | bash -s -- --to /usr/local/bin
-      - rustup component add clippy
-      - cargo fmt --all -- --check
-      - cargo clippy --all-targets -- -D warnings
+      - cargo clippy --all-targets --all-features -- -D warnings
 
-  lint-bash:
-    image: koalaman/shellcheck-alpine:stable
-    commands:
-      - apk add --no-cache curl bash
-      - find . -name '*.sh' -type f ! -path './target/*' -exec shellcheck {} +
-
-  lint-nickel:
+  nickel-typecheck:
     image: rust:latest
     commands:
       - cargo install nickel-lang-cli --locked
-      - find . -name '*.ncl' -type f ! -path './target/*' -exec nickel typecheck {} \;
+      - nickel typecheck
 
-  lint-nushell:
+  nushell-check:
     image: rust:latest
     commands:
       - cargo install nu --locked
-      - find . -name '*.nu' -type f ! -path './target/*' -exec nu --ide-check 100 {} \;
+      - find . -name '*.nu' ! -path '*/target/*' -print0 | xargs -0 -I\{\} nu --ide-check 100 \{\}
 
-  lint-markdown:
-    image: node:alpine
-    commands:
-      - npm install -g markdownlint-cli2
-      - markdownlint-cli2 '**/*.md' '#node_modules' '#target'
-
-  # === TESTING ===
-
-  test:
+  nextest-ci:
     image: rust:latest
     commands:
-      - cargo test --workspace --all-features
-    depends_on:
-      - lint-rust
-      - lint-bash
-      - lint-nickel
-      - lint-nushell
-      - lint-markdown
+      - cargo install cargo-nextest --locked
+      - cargo nextest run --all-features --workspace --profile ci --cargo-profile ci
+    depends_on: ["rust-clippy-all", "nickel-typecheck", "nushell-check"]
+    environment:
+      RUST_BACKTRACE: 1
 
-  # === BUILD ===
-
-  build:
-    image: rust:latest
-    commands:
-      - cargo build --release
-    depends_on:
-      - test
-
-  # === SECURITY ===
-
-  security-audit:
-    image: rust:latest
-    commands:
-      - cargo install cargo-audit --locked
-      - cargo audit --deny warnings
-    depends_on:
-      - lint-rust
-
-  license-check:
+  deny-subset:
     image: rust:latest
     commands:
       - cargo install cargo-deny --locked
       - cargo deny check licenses advisories
-    depends_on:
-      - lint-rust
+
+  build-release-native:
+    image: rust:latest
+    commands:
+      - cargo build --release --workspace
+    depends_on: ["rust-clippy-all", "nickel-typecheck", "nushell-check"]
diff --git a/justfiles/workflow.just b/justfiles/workflow.just
new file mode 100644
index 0000000..283a627
--- /dev/null
+++ b/justfiles/workflow.just
@@ -0,0 +1,11 @@
+# Generated by ore workflow generate
+# Source: .ontology/workflow.ncl
+
+# layer: ci-standard
+ci-standard:
+    cargo clippy --all-targets --all-features -- -D warnings
+    cargo nextest run --all-features --workspace --profile ci --cargo-profile ci
+    cargo deny check licenses advisories
+    nickel typecheck
+    nu --ide-check 100
+    cargo build --release --workspace