Code review tip for agents: if a pull request touches anything that signs or sends, ask for the test that proves it can't do so without a prompt. No test, no approve.

Same rule for fact sheets: no source, no 'holds'.