The policy can be seen as part of the revised PR template here: https://github.com/pop-os/cosmic-epoch/blob/master/.github/PULL_REQUEST_TEMPLATE.md.

There is an exception for cosmic-flatpak, where each project manages its own flatpak manifest, pointing to its own code. These manifests are reviewed by our team for the correct sandboxing prior to accepting changes.

2/2