docs(copilot): record why no signed artifact is emitted, and file the spec gap

README.md

@@ -40,10 +40,20 @@ which owns fingerprinting, comparison, baseline sealing and the report honesty r
 
 **Note on the Copilot entry.** It is a pull-request status check rather than a
 session hook, because Copilot's composition lives in the repository. It emits no
-TRACE record and no Agent Manifest yet, so it claims neither: `integrates_with` in
-the manifest schema offers only `cmcp`, `trace` and `agent-manifest`, and asserting
-one of those today would be an unverifiable claim. Emitting a TRACE record per
-checked pull request is the intended next step and is what would make one true.
+TRACE record and no Agent Manifest, so it claims neither: `integrates_with` offers
+only `cmcp`, `trace` and `agent-manifest`, and asserting one today would be an
+unverifiable claim.
+
+That is currently blocked on a spec question rather than on implementation, tracked
+in [agent-manifest#256](https://github.com/agentrust-io/agent-manifest/issues/256).
+TRACE describes an execution and this check describes a composition, so a TRACE
+record is the wrong artifact. Agent Manifest is the right one, but every level
+requires `artifacts.model_identity`, and a repository cannot know the model: Copilot
+picks it at session time from the user's plan and settings. The same repository
+serves every model, with an identical contributed composition. Manufacturing a
+model to satisfy the field would be exactly the kind of unverifiable claim
+`CONTRIBUTING.md` rules out, so the integration ships without one until the spec
+has a way to express a composition whose model is unknowable at authoring time.
 
 ## Community
 

copilot/README.md

@@ -95,6 +95,23 @@ two other engines in this repo, so the shared core covers the tree.
   outside the repository and are invisible to a check that runs inside it. If your
   organisation sets Copilot instructions centrally, this check does not see them.
 - **It is not a sandbox.** It reports composition, it does not constrain execution.
+- **It emits no signed record**, unlike the other integrations here, and that is a
+  spec question rather than a missing feature. See
+  [agent-manifest#256](https://github.com/agentrust-io/agent-manifest/issues/256).
+
+  A TRACE record is the wrong artifact: TRACE describes an execution, and this check
+  describes a composition. Agent Manifest is the right one, and every level requires
+  `artifacts.model_identity`. A repository cannot know the model. Copilot chooses it
+  at session time from the user's plan and settings, so the same repository serves
+  every model with an identical contributed composition.
+
+  `provider: github, model_id: copilot` would describe a product rather than a
+  model, and `model_id: unknown` would assert a binding to a thing called "unknown".
+  Either is the sort of unverifiable claim this repository's contributing rules
+  exclude, so the check ships without a record until the spec can express a
+  composition whose model is unknowable when it is authored. Notably the verifier
+  vocabulary already has `NOT_BOUND` for every artifact, and no conformant manifest
+  can currently produce it.
 
 ## Inputs