The merge process produces a structured audit trail as part of ordinary work. Reports record findings and gating decisions, including approvals or denials of overrides. Each entry is timestamped, attributable, and reviewable. These records can support SBOM attestations by documenting that teams evaluated security expectations on each change and recorded acceptance decisions. This extends Section 6.1's principle from tests to process: attestations draw on records created during development.