... been following along and would like to support us we would appreciate a star of GitHub: https://github.com/ota-run/ota Ota now supports refusal canaries. Repositories declaretasks that must remain unavailable to agents, and CI verifies that the real execution boundary rejects them with `--expect-refusal`. In the AI era, governance cannot stop at documenting what agents may do. Teams also need negative tests proving that forbidden execution remains forbidden. That is execution governance you can test, not merely trust ...