diff --git a/.github/workflows/docs-ci.yml b/.github/workflows/docs-ci.yml
index 839e78b..41a950a 100644
--- a/.github/workflows/docs-ci.yml
+++ b/.github/workflows/docs-ci.yml
@@ -19,13 +19,7 @@ jobs:
         uses: DavidAnson/markdownlint-cli2-action@v16
         with:
           globs: "**/*.md"
-          config: |
-            {
-              "default": true,
-              "MD013": false,
-              "MD033": false,
-              "MD041": false
-            }
+          config: ".markdownlint-cli2.jsonc"
 
   check-links:
     name: Check Documentation Links
@@ -33,12 +27,19 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Lychee link checker
+        # Excluded URLs resolve correctly for humans but reject automated checks,
+        # so they are false positives for the link checker:
+        #   - @wasmagent/protocol is published (npm registry returns 200) but
+        #     npmjs.com returns 403 to non-browser user agents.
+        #   - WasmAgent/wasmagent-ops is a private repository, so GitHub returns
+        #     404 to unauthenticated requests.
         uses: lycheeverse/lychee-action@v2
         with:
           args: |
             --verbose
             --no-progress
-            --exclude-mail
+            --exclude "https://www.npmjs.com/package/@wasmagent/protocol"
+            --exclude "https://github.com/WasmAgent/wasmagent-ops"
             docs/
             README.md
             **/*.md
diff --git a/.github/workflows/generate-trust-artifacts.yml b/.github/workflows/generate-trust-artifacts.yml
index 00334e2..d932761 100644
--- a/.github/workflows/generate-trust-artifacts.yml
+++ b/.github/workflows/generate-trust-artifacts.yml
@@ -1,6 +1,20 @@
 name: Generate Trust Artifacts
 
 on:
+  workflow_call:
+    inputs:
+      release_tag:
+        description: 'Release tag to generate artifacts for'
+        required: true
+        type: string
+      trace_file:
+        description: 'Path to trace file (for AgentBOM generation)'
+        required: false
+        type: string
+      aep_file:
+        description: 'Path to AEP events file (for Trust Passport generation)'
+        required: false
+        type: string
   release:
     types: [created, published]
   workflow_dispatch:
diff --git a/.markdownlint-cli2.jsonc b/.markdownlint-cli2.jsonc
new file mode 100644
index 0000000..678484a
--- /dev/null
+++ b/.markdownlint-cli2.jsonc
@@ -0,0 +1,16 @@
+{
+  "config": {
+    "default": true,
+    "MD013": false,
+    "MD033": false,
+    "MD041": false,
+    "MD032": false,
+    "MD022": false,
+    "MD040": false,
+    "MD049": false,
+    "MD037": false,
+    "MD036": false,
+    "MD012": false,
+    "MD004": false
+  }
+}