diff --git a/AGENTS.md b/AGENTS.md
index e7f4b77..bb642da 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -65,6 +65,9 @@ path, account mirror, or parallel source of truth.
   tests and the documentation it changes. Change the version only in a
   separate release commit; a product pull request leaves the version files
   untouched.
+- The maintainer is the only commit author on `main`. Do not add a
+  `Co-authored-by` or other attribution trailer for a tool or bot to a commit
+  or squash message, and do not merge a bot-authored commit as is.
 
 ## Documentation routing
 
diff --git a/docs/testing.md b/docs/testing.md
index 938291e..16d277b 100644
--- a/docs/testing.md
+++ b/docs/testing.md
@@ -87,6 +87,11 @@ routine update creates a branch only after dashboard approval. Renovate opens
 security remediation PRs immediately, without automerge; GitHub Dependabot
 Alerts remain a signal but Dependabot Security Updates PRs are disabled.
 
+A Renovate pull request is a proposal, not a merge candidate. Merging it
+directly records the bot as a commit author and lists it as a contributor.
+Recreate its change in a maintainer-authored commit and pull request, run the
+checks for the changed paths there, then close Renovate's pull request.
+
 GitHub CodeQL default setup, rather than a repository workflow, scans Actions,
 JavaScript/TypeScript, and Rust. Its effective language list and the
 repository's SHA-pinning policy must be read from GitHub when making a claim