diff --git a/TODO.md b/TODO.md
index 90396687..ec6212f6 100644
--- a/TODO.md
+++ b/TODO.md
@@ -2,6 +2,7 @@
 
 Running backlog for this repo, kept in a committed file so the guidance survives across environments where agent memory does not.
 
+- Make agent-authored text use representative data rather than data observed in the maintainer's environment, and state it as a rule in [`GOVERNANCE.md`][governance] rather than leaving it to judgment. An agent illustrating a review finding on a downstream pull request quoted real paths from the maintainer's own filesystem, which carried family members' names, into a comment on a **public** repository. Nothing about the finding needed them. The rule to write covers every surface an agent authors, meaning pull request and issue comments, commit messages, code, tests, fixtures, and docs, and it reads roughly: illustrate with data you constructed, never with data you observed here. Three points the wording has to carry. **Synthetic evidence is better evidence**, not a weaker substitute, since a reader can re-run it: a filename constructed to contain a newline demonstrates the newline defect exactly, while a real photo library proves the same thing and can never be re-run by anyone else. **The exposure is one-way**, because a public comment is fetched, cached, and indexed the moment it posts, so an edit afterwards is mitigation rather than a fix, and the maintainer decides what to do about one that has already landed. And **no checker closes this.** A pattern can find an absolute home path or a drive letter, and that subset is worth gating in [`prose_lint.py`][prose-lint] as a floor, but the data that actually leaked here was name-shaped, and a name is not pattern-detectable. A grep over the offending pull request for path-shaped strings returns nothing while the names sit in plain sight, so the gate has to be understood as catching the easy half only. Scope this fleet-wide rather than to the hub, since every repo in the fleet is public and each one is worked by agents that read the same carried rules.
 - Populate [reports/][reports] for the cataloged repos that still have no audit, since a registry `status` of `cataloged` asserts a result that only a committed report evidences. Eight repos have one. This is paced by maintainer capacity rather than blocked on anything, since repos are brought up to spec as they are worked on, so the entry records the outstanding set rather than a defect.
 - Revisit automating the audit, which was explored and deliberately deferred, recorded here so the reasoning is not re-derived from scratch. Three shapes were considered: a scheduled hub-driven audit publishing each report as a workflow artifact, the same thing committing the report back the way the codegen bot updates its own files, and a pull-request hook in each downstream repo that audits itself against the current hub. Three things blocked all of them. Until the fleet reaches stasis with every repo onboarded, a scheduled run reports mostly noise, since a repo mid-onboarding is expected to be non-conformant. The hub has to be stable before downstreams can audit against it, because a hub change lands as fleet-wide findings the same day. And the downstream half is a catch-22, since a self-auditing pull-request hook is CI instrumentation the repos that most need it do not yet carry. The agreed outcome was the on-demand audit that [`AUDIT.md`][audit-doc] describes today. Worth reopening once the fleet is onboarded and the hub goes a stretch without carried-content changes, and the artifact shape is the one to try first, since it produces evidence without committing anything and so cannot generate review load while the noise level is still unknown.
 - Canonicalize Python linter-config placement on `pyproject.toml` (one cataloged repo uses standalone `.ruff.toml` + `pyrightconfig.json`), track as a drift finding, fix downstream.