DL-442

Forge scope enforcement Open Question rulings (Matt, RIG-4436): enforcement is on unless a deployment opts out explicitly, and Dogfood opts out (OQ-1); grants come from the ForgeConfig seed plus store operations, no admin RPC for Beta (OQ-2); grants are owner-level (OQ-3); the git credential covers the workstream repository plus write grants (OQ-7); the workstream repository is a server-side spawn-target record, no provision proto field (OQ-8); the token narrows permissions as well as repositories, to contents: write, pull_requests: write and metadata: read, because agents must be able to open pull requests (OQ-10)

Status: Active (Matt, 2026-10-10)

Record: ../../server/compass-forge-scope-enforcement-rulings-amendment/design.md#rulings