Who is who is the authority's: a project pins one public key, reads attestations offline, and names who commits in every new SOW

ADR-066 made governed delivery enforcing: a SOW is done only behind a person's out-of-band