To me, the more interesting question is the following. Why does the architecture make it possible for a system to collect user consent and divorce the enforcement of it from the consent collection itself? The proposed process fixes are good and all, but really, the fix IMHO should be structural. Your CI should fail if you don't propagate consent decisions down the stack.

Also worth noting: `Co-Authored-By` implies joint authorship. The Linux kernel uses `Assisted-by:` for AI specifically because the legal weight is different. And git history is permanent. You can revert a default. You can't revert commit history across thousands of repos.