diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 70c4b3d..c5d82d9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,10 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   tests:
     runs-on: ubuntu-latest
@@ -51,6 +55,13 @@ jobs:
         uses: actions/setup-node@v4
         with:
           node-version: "20"
+          cache: "npm"
+
+      - name: Cache Playwright browsers
+        uses: actions/cache@v4
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ hashFiles('package-lock.json') }}
 
       - name: Install Playwright
         run: |
diff --git a/AGENTS.md b/AGENTS.md
index c300557..95ffa0b 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -140,6 +140,7 @@ PRs must include:
 - Test evidence (pytest + Playwright output).
 - Pi QA results for Pi-impacting changes.
 - No AI attribution lines.
+- Never merge PRs in any repo (core, inferno, or other org repos) without explicit user approval.
 
 ## Branching & Workflow
 
diff --git a/WORKFLOW.md b/WORKFLOW.md
index 7965941..d9018e9 100644
--- a/WORKFLOW.md
+++ b/WORKFLOW.md
@@ -57,6 +57,16 @@ Before starting new implementation work, first check whether a relevant issue al
 - Required branch naming: `feat/issue-<id>-<short-slug>`, `fix/issue-<id>-<short-slug>`, `chore/issue-<id>-<short-slug>`, `spike/issue-<id>-<short-slug>`, `hotfix/issue-<id>-<short-slug>`.
 - Start every ticket branch from latest `main`: `git checkout main && git pull --ff-only && git checkout -b <branch-name>`.
 
+## Cross-Repo Dependencies (inferno, etc.)
+
+When a ticket requires changes in a dependency repo (e.g., `potato-os/inferno`):
+
+1. Create a branch in the dependency repo, make changes, push, and open a PR.
+2. **Stop and ask the user before merging.** The dependency PR needs the same review as any core PR.
+3. After the user approves and the dependency PR is merged, note the new SHA.
+4. In the core repo branch, bump the pin in `requirements.txt` and run `uv pip install -r requirements.txt`.
+5. The core PR should reference the dependency PR (e.g., `Depends on potato-os/inferno#1`).
+
 ## GitHub PR Linkage Rules (Required)
 
 - Every implementation PR must link to its primary issue in the PR body.