AI governance keeps failing in the least dramatic place possible: the repo. Not the policy memo, not the executive risk committee, not the glossy “responsible AI” page. The real failure mode is that a model ships with unclear training-data notes, stale evaluation claims, vague limitations, missing license context, and a