diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2ee7ec5..51e8847 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,13 +1,22 @@
 name: ci
 on:
   pull_request:
+    types: [opened, synchronize, reopened, edited]
   push:
     branches: [dev, master]
+permissions:
+  contents: read
 jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+      - name: term wall
+        uses: minspec/.github/.github/actions/term-wall@a5d88bb5b9bb744cf23c8829436e32f03d58c79d # minspec/.github#10
+        env:
+          TERM_WALL: ${{ vars.TERM_WALL }}
       - name: JSON validity
         run: find . -name '*.json' -not -path './.git/*' -print0 | xargs -0 -r -n1 jq empty
       - name: YAML validity
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
new file mode 100644
index 0000000..ac9f6c7
--- /dev/null
+++ b/.github/workflows/e2e.yml
@@ -0,0 +1,16 @@
+name: e2e
+# Caller of the org's canonical road test (minspec/workbench e2e.yml):
+# this repo's PR rides in its own slot, siblings at dev. One test,
+# no copies to drift.
+on:
+  pull_request:
+  push:
+    branches: [dev, master]
+permissions:
+  contents: read
+jobs:
+  e2e:
+    uses: minspec/workbench/.github/workflows/e2e.yml@a84bc5568a33220fd7b4037345c2b38186cff29d # dev
+    with:
+      recipes_ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      workbench_ref: dev
diff --git a/.mcp.json b/.mcp.json
index e16128b..7a030cd 100644
--- a/.mcp.json
+++ b/.mcp.json
@@ -2,7 +2,16 @@
   "mcpServers": {
     "serena": {
       "command": "uvx",
-      "args": ["serena", "start-mcp-server", "--context", "claude-code", "--project", "."]
+      "args": [
+        "--from",
+        "git+https://github.com/oraios/serena@43ae0211d7f3bba4101cd0552707fa21d37f4c84",
+        "serena",
+        "start-mcp-server",
+        "--context",
+        "claude-code",
+        "--project",
+        "."
+      ]
     }
   }
 }
diff --git a/index.json b/index.json
index 42a0ce9..79fd407 100644
--- a/index.json
+++ b/index.json
@@ -1,10 +1,15 @@
 {
-  "recipes": {},
-  "branch": "main",
-  "is_contrib": true,
+  "recipes": {
+    "minspec/fixture-hello": [
+      "1.0"
+    ]
+  },
+  "branch": "master",
+  "is_contrib": false,
   "_links": {
     "repository": "github.com/minspec/recipes",
-    "origin_template": "{package}:{version}@github.com/minspec/recipes:main",
+    "origin_template": "{package}:{version}@github.com/minspec/recipes:master",
     "recipe_template": "https://api.github.com/repos/minspec/recipes/contents/{package_dotted}.{version}.json"
-  }
+  },
+  "recipe_template": "https://api.github.com/repos/minspec/recipes/contents/{package_dotted}.{version}.json?ref=master"
 }
diff --git a/minspec.fixture-hello.1.0.json b/minspec.fixture-hello.1.0.json
new file mode 100644
index 0000000..746dfd3
--- /dev/null
+++ b/minspec.fixture-hello.1.0.json
@@ -0,0 +1,25 @@
+{
+  "manifests": {
+    "minspec/fixture-hello": {
+      "manifest": {
+        "bundles": {
+          "Minspec\\FixtureHello\\FixtureHelloBundle": ["all"]
+        },
+        "copy-from-recipe": {
+          "config/": "%CONFIG_DIR%/"
+        }
+      },
+      "files": {
+        "config/packages/fixture_hello.yaml": {
+          "contents": [
+            "parameters:",
+            "    fixture_hello.greeting: 'wired-by-recipe'",
+            ""
+          ],
+          "executable": false
+        }
+      },
+      "ref": "e2e-fixture-1.0"
+    }
+  }
+}