diff --git a/.opencode/agents/implementation-worker.md b/.opencode/agents/implementation-worker.md
index ea69a9550..61ddd3e80 100644
--- a/.opencode/agents/implementation-worker.md
+++ b/.opencode/agents/implementation-worker.md
@@ -9,7 +9,15 @@ hidden: true
 temperature: 0.1
 # No model specified — tier is set by the supervisor via tier selectors
 permission:
-  edit: allow
+  "*": deny
+  "doom_loop": deny
+  question: deny
+  "sequential-thinking*": allow
+  edit:
+    "*": deny
+    "/tmp/**": allow
+  external_directory:
+    "/tmp/**": allow
   webfetch: allow
   bash:
     "*": deny
@@ -47,25 +55,26 @@ permission:
     "issue-note-writer": allow
     "new-issue-creator": allow
     "repo-isolator": allow
-  forgejo:
-    "*": deny
-    "forgejo_get_issue_by_index": allow
-    "forgejo_list_issue_comments": allow
-    "forgejo_issue_add_comment": allow
-    "forgejo_get_pull_request_by_index": allow
-    "forgejo_list_pull_request_files": allow
-    "forgejo_get_pull_request_diff": allow
-    "forgejo_list_pull_reviews": allow
-    "forgejo_list_pull_review_comments": allow
-    "forgejo_list_repo_milestones": allow
-    "forgejo_get_file_content": allow
-    # CRITICAL: Label creation is COMPLETELY FORBIDDEN
-    "forgejo_create_label": deny
-    "forgejo_create_org_label": deny
-    "forgejo_create_repo_label": deny
-    # CRITICAL: DO NOT use forgejo_add_issue_labels directly
-    # Always delegate to forgejo-label-manager for label operations
-    "forgejo_add_issue_labels": deny
+  "forgejo_*": deny
+  "forgejo_get_issue_by_index": allow
+  "forgejo_list_issue_comments": allow
+  "forgejo_issue_add_comment": allow
+  "forgejo_get_pull_request_by_index": allow
+  "forgejo_list_pull_request_files": allow
+  "forgejo_get_pull_request_diff": allow
+  "forgejo_list_pull_reviews": allow
+  "forgejo_list_pull_review_comments": allow
+  "forgejo_list_repo_milestones": allow
+  "forgejo_get_file_content": allow
+  # CRITICAL: Never list repo-level labels — use org labels via forgejo-label-manager
+  "forgejo_list_repo_labels": deny
+  # CRITICAL: Label creation is COMPLETELY FORBIDDEN
+  "forgejo_create_label": deny
+  "forgejo_create_org_label": deny
+  "forgejo_create_repo_label": deny
+  # CRITICAL: DO NOT use forgejo_add_issue_labels directly
+  # Always delegate to forgejo-label-manager for label operations
+  "forgejo_add_issue_labels": deny
 ---
 
 # Implementation Worker
@@ -112,7 +121,7 @@ nox -e coverage_report  # Full coverage report
 
 7. **Create a PR** using `pr-creator` and `pr-description-writer`. The PR must include:
    - Closing keyword (e.g., `Closes #42`)
-   - Dependency link (PR blocks the issue)
+   - Dependency link (PR blocks the issue, issue depends on PR)
    - Milestone assignment (same as the issue)
    - Type label matching the issue
 
@@ -126,7 +135,7 @@ nox -e coverage_report  # Full coverage report
 
 When fixing a failing PR:
 
-1. **Read the PR** to understand what it does and what's failing.
+1. **Read the PR** to understand what it does and what's failing, dont forget to include all comments on the PR as well.
 
 2. **Fetch CI logs** using `ci-log-fetcher` to understand the specific failures.
 
@@ -184,7 +193,7 @@ You never merge PRs yourself. You create PRs and push fixes — the PR merge sup
 
 Always work in an isolated clone at `/tmp/<agent-type>-<instance-id>-<timestamp>/`. Never work in `/app`. Push results to remote and delete the clone before exiting.
 
-## Rules
+## **CRITICAL** Rules
 
 1. **One task, then exit.** Do not loop. Do not sleep. Do not look for more work.
 2. **Follow CONTRIBUTING.md exactly.** Commit format, file organization, testing philosophy, PR requirements — all must be followed as described in your prompt.
@@ -198,3 +207,6 @@ Always work in an isolated clone at `/tmp/<agent-type>-<instance-id>-<timestamp>
 **Automated by CleverAgents Bot**
 Supervisor: Implementation Pool | Agent: implementation-worker
 ```
+
+8. **Apply labels via `forgejo-label-manager`.** Never apply labels directly or using the Forgejo MCP/task. All label operations must go through `forgejo-label-manager`.
+9. **Exhaustive pagination for all list results.** Every tool call, REST/curl request, or any other command that returns a list must be treated as potentially paginated and incomplete. Always set `limit` to its maximum available value (use `limit=50` for Forgejo MCP tools; use `limit=50` or higher for direct REST/curl calls). After each list response, check whether the number of returned items equals the page size — if so, there are likely more results; fetch the next page (`page=2`, `page=3`, …) and continue until receiving a partial page. Never assume the first response is the complete result. This rule applies to every list-returning call without exception. *Examples specific to this agent (not exhaustive):* `forgejo_list_issue_comments` (paginate ALL pages — escalation attempt history may span many comments and missing any changes the tier decision); `forgejo_list_pull_reviews` (paginate to read all reviewer feedback rounds); `forgejo_list_pull_review_comments` (same); `forgejo_list_repo_milestones` (paginate to correctly assign the PR milestone).