An agent adds one approved direct package. Which evidence best checks what will actually …

An agent adds one approved direct package. Which evidence best checks what will actually be installed and distributed?

1. Reconcile the manifest, frozen lockfile graph, package contents, install scripts, and artifact-linked SBOM
2. Read only the new manifest line because transitive packages were not requested directly
3. Accept the package when its README displays an approved badge
4. Trust the agent summary if it names the direct package version