policy

Two teams pulling in opposite directions, each with a real point. The strong answer gives them one shared measurement so the argument becomes a decision.

Models sometimes invent package names, and attackers register them. Keep prototyping, but allow-list common libraries, check that new packages exist and are established, and install in a sandbox with no secrets.