diff --git a/.governance/manifest.json b/.governance/manifest.json
index 1ccc983..1c6d599 100644
--- a/.governance/manifest.json
+++ b/.governance/manifest.json
@@ -53,7 +53,10 @@
           "git2mcp/**",
           "mcp-gateway/**",
           "mcp-docs/**",
-          "mcp-webui/**"
+          "mcp-webui/**",
+          "llm-agent/**",
+          "mcp-git-proxy/**",
+          "mcp-skills/**"
         ]
       },
       "governance": {
diff --git a/.governance/standard-adoption.json b/.governance/standard-adoption.json
index 28722c0..8d4c062 100644
--- a/.governance/standard-adoption.json
+++ b/.governance/standard-adoption.json
@@ -19,7 +19,7 @@
       "artifacts": [
         {
           "target": ".governance/manifest.json",
-          "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f"
+          "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c"
         }
       ],
       "evidence": [
@@ -54,7 +54,7 @@
       "artifacts": [
         {
           "target": ".governance/manifest.json",
-          "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f"
+          "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c"
         }
       ],
       "evidence": [
@@ -94,7 +94,7 @@
       "artifacts": [
         {
           "target": ".governance/manifest.json",
-          "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f"
+          "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c"
         }
       ],
       "evidence": [
@@ -129,7 +129,7 @@
       "artifacts": [
         {
           "target": ".governance/manifest.json",
-          "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f"
+          "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c"
         }
       ],
       "evidence": [
@@ -169,7 +169,7 @@
       "artifacts": [
         {
           "target": ".governance/manifest.json",
-          "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f"
+          "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c"
         }
       ],
       "evidence": [
@@ -209,7 +209,7 @@
       "artifacts": [
         {
           "target": ".governance/manifest.json",
-          "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f"
+          "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c"
         }
       ],
       "evidence": [
@@ -244,7 +244,7 @@
       "artifacts": [
         {
           "target": ".governance/manifest.json",
-          "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f"
+          "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c"
         }
       ],
       "evidence": [
@@ -284,7 +284,7 @@
       "artifacts": [
         {
           "target": ".governance/manifest.json",
-          "sha256": "2254f0b710fbe784c7e331ceabe37f1371b169b75fddef01e72691a627e2266f"
+          "sha256": "1e1f98ea4ec6d2926a2d9c4d219a1f487238c0ceec39abbf89c77a75e116570c"
         }
       ],
       "evidence": [
diff --git a/project/TICKETS.md b/project/TICKETS.md
index 4196b16..80b6e29 100644
--- a/project/TICKETS.md
+++ b/project/TICKETS.md
@@ -15,4 +15,5 @@ This file indexes governance tickets without taking ownership of
 | **ticket-016** | [`README.md`](./ticket-016/README.md) | - | - | - | - | - |
 | **ticket-019** | [`README.md`](./ticket-019/README.md) | - | - | - | - | - |
 | **ticket-020** | [`README.md`](./ticket-020/README.md) | - | - | - | - | - |
+| **ticket-021** | [`README.md`](./ticket-021/README.md) | - | - | - | - | - |
 <!-- AUTO:TICKET_INDEX:END -->
diff --git a/project/ticket-019/intent.json b/project/ticket-019/intent.json
index 686577b..474caf5 100644
--- a/project/ticket-019/intent.json
+++ b/project/ticket-019/intent.json
@@ -14,7 +14,8 @@
     "project/TICKETS.md",
     ".gitattributes",
     "project.bat",
-    ".governance/manifest.json"
+    ".governance/manifest.json",
+    "tests/test_openwebui_configurator.py"
   ],
   "forbiddenPaths": [
     "project/ticket-*/user-*.md"
diff --git a/project/ticket-021/README.md b/project/ticket-021/README.md
new file mode 100644
index 0000000..7f6a6f9
--- /dev/null
+++ b/project/ticket-021/README.md
@@ -0,0 +1,22 @@
+# Ticket 021: Dependency maintenance: llm-agent and mcp-skills requirement manifests
+
+- **ID**: ticket-021
+- **Owner**: agent:claude
+- **Status**: IN_PROGRESS
+- **Workflow state**: EDIT
+- **Created**: 2026-10-23
+
+## Goal and scope
+
+Own the automated dependency updates for `llm-agent/requirements.txt` and
+`mcp-skills/requirements.txt` (requires the `llm-agent/**` and
+`mcp-skills/**` application ownership declared by ticket-019).
+
+## Acceptance criteria
+
+- [ ] AC-01: the mcp requirement bump resolves to this ticket and passes
+  the governance gate on a current base.
+
+## Tracking boundary
+
+Requirement manifests only; no runtime code changes.
diff --git a/project/ticket-021/intent.json b/project/ticket-021/intent.json
new file mode 100644
index 0000000..93df22d
--- /dev/null
+++ b/project/ticket-021/intent.json
@@ -0,0 +1,29 @@
+{
+  "schema": "new-project.intent/v3",
+  "ticket": "ticket-021",
+  "summary": "Dependency maintenance: llm-agent and mcp-skills requirement manifests",
+  "workstream": "application",
+  "classification": {
+    "kind": "SERVICE",
+    "priority": "P2",
+    "origin": "health"
+  },
+  "allowedPaths": [
+    "project/ticket-021/**",
+    "TODO.md",
+    "project/TICKETS.md",
+    "llm-agent/requirements.txt",
+    "mcp-skills/requirements.txt",
+    "mcp-docs/requirements.txt",
+    "mcp-gateway/requirements.txt",
+    "mcp-git-proxy/requirements.txt",
+    "mcp-webui/requirements.txt"
+  ],
+  "forbiddenPaths": [
+    "project/ticket-*/user-*.md"
+  ],
+  "stacks": [],
+  "dependsOn": [],
+  "conflictsWith": [],
+  "integrationTicket": null
+}
diff --git a/tests/test_openwebui_configurator.py b/tests/test_openwebui_configurator.py
index 6f46ddf..dd383fc 100644
--- a/tests/test_openwebui_configurator.py
+++ b/tests/test_openwebui_configurator.py
@@ -130,3 +130,22 @@ def test_image_override_preserves_authenticated_boundary(override: str) -> None:
         for volume in webui["volumes"]
     )
     assert "@sha256:" in services["redis"]["image"]
+
+
+def test_application_workstream_owns_every_subproject_requirement_manifest():
+    """Governance contract (ticket-019/ticket-021): the application workstream
+    owns all subproject requirement manifests, and ticket-021 resolves
+    automated dependency updates for them to exactly one active ticket."""
+    import json
+
+    manifest = json.loads((ROOT / ".governance" / "manifest.json").read_text(encoding="utf-8"))
+    owned = manifest["coordination"]["workstreams"]["application"]["ownedPaths"]
+    subprojects = ("llm-agent", "mcp-docs", "mcp-gateway", "mcp-git-proxy", "mcp-skills", "mcp-webui")
+    for name in subprojects:
+        assert f"{name}/**" in owned, f"application workstream must own {name}/**"
+
+    intent = json.loads((ROOT / "project" / "ticket-021" / "intent.json").read_text(encoding="utf-8"))
+    allowed = set(intent["allowedPaths"])
+    assert intent["workstream"] == "application"
+    for name in subprojects:
+        assert f"{name}/requirements.txt" in allowed, f"ticket-021 must own {name}/requirements.txt"