DL-324

The forge live-test Linear credential is app-actor ONLY — DL-308’s retain-one-Linear-user-credential carve-out is dropped (Matt’s RIG-3096 pivot): the livegithub oracle’s Linear legs gate on a single env var, LINEAR_FORGE (go/internal/forge/livegithub_test.go:65, consumed by requireLinear :91-99), minted as an app-actor token per CI run by tools/forge-linear-token/index.ts via the client_credentials grant from the LINEAR_FORGE_CLIENT_ID/_SECRET Actions secrets (.github/workflows/ci.yml:1002-1004) — with NO LINEAR_FORGE_USER_TOKEN (zero code hits) and no human→app delegation-setup step in CI. Supersedes DL-308’s Linear-user-cred clause ONLY — DL-308’s GitHub App-installation-token-mint clause stays live, so DL-308 itself remains Active

Status: Active (Matt, 2026-09-02)

Record: ../../server/compass-forge-app-credentials/design.md