It's funny because I am working on repos that only I see and use, and I tell it to open a PR automatically after running all the various checks, and 6.1-sol invariably fails to do so unless I explicitly tell it that it's ok to run the tests (remote ci from local worktree) because it won't "send the contents of the repo to a remote server without explicit permission", and then it also refuses to open a PR until I explicitly bless it. In AGENTS.md it says, verbatim, that both of those things are explicitly permitted, indeed, required, but hey...