diff --git a/docs/src/content/docs/reference/repository-package-manifest-specification.md b/docs/src/content/docs/reference/repository-package-manifest-specification.md
index 91a820da3bb..3844c9eacee 100644
--- a/docs/src/content/docs/reference/repository-package-manifest-specification.md
+++ b/docs/src/content/docs/reference/repository-package-manifest-specification.md
@@ -46,6 +46,7 @@ The manifest document MUST be a YAML mapping. Unknown top-level fields MUST be r
 | `name` | string | Yes | Human-readable package name. |
 | `emoji` | string | No | Optional package emoji for display in package metadata. |
 | `description` | string | No | Human-readable package description. |
+| `license` | string | No | SPDX license identifier or license name for the package. |
 | `files` | array of strings | No | Explicit installable workflow file list. |
 
 ### 4.2 `manifest-version`
@@ -76,7 +77,11 @@ If present, `description` MUST be a string.
 
 Implementations SHOULD warn if `description` exceeds 255 characters.
 
-### 4.7 `files`
+### 4.7 `license`
+
+If present, `license` MUST be a string. Use an [SPDX license identifier](https://spdx.org/licenses/) such as `MIT` or `Apache-2.0`, or a license name. Non-string values MUST be rejected.
+
+### 4.8 `files`
 
 If present, `files` MUST be an array of strings.
 
diff --git a/docs/src/content/docs/reference/safe-outputs-pull-requests.md b/docs/src/content/docs/reference/safe-outputs-pull-requests.md
index fdcf2c1f519..fa9fb0a38c9 100644
--- a/docs/src/content/docs/reference/safe-outputs-pull-requests.md
+++ b/docs/src/content/docs/reference/safe-outputs-pull-requests.md
@@ -186,6 +186,8 @@ Use `allowed-events` to control review decisions (`APPROVE`, `COMMENT`, `REQUEST
 
 When you intentionally allow `REQUEST_CHANGES`, set `supersede-older-reviews: true` to dismiss older blocking reviews from the same workflow after posting a replacement review. This behavior is best-effort.
 
+When `target: "*"` is configured, the agent must supply `pull_request_number` in each `submit_pull_request_review` tool call to identify which PR to review — omitting it will cause the review to fail. For cross-repository scenarios, the agent can also supply `repo` (in `owner/repo` format) to route the review to a PR in a different repository; the value must match `target-repo` or appear in `allowed-repos`.
+
 ## Reply to PR Review Comment (`reply-to-pull-request-review-comment:`)
 
 Replies to existing review comments on pull requests. Use this to respond to reviewer feedback, answer questions, or acknowledge comments. The `comment_id` must be the numeric ID of an existing review comment.