- Require completed CodeRabbit and Copilot reviews covering the current changes, with depth appropriate to their complexity.
- Verify all findings and discussions are addressed, including resolved or outdated ones; perform your own review.
- Withhold approval for unresolved concerns or insufficient evidence.
- For dependency updates, verify upstream changes, provenance, and version/commit/hash pins. Require human review for source, registry, or ownership changes, new install/build hooks, unexpected transitive dependencies, or unverifiable updates.