DL-444

Workstream repository source rulings (Matt, RIG-4997): an agent’s workstream repositories are durable agent rows in account_forge_scopes, so the brokered token and the forge write gate read one allowlist (F1 A, F2); there is no deployment seed, because the agents a server will run are not known at boot; rows come only from a runtime per-agent write, and the store changes land in one stack with that writer (F3)

Status: Active (Matt, 2026-10-10)

Record: ../../server/compass-workstream-repository-source/design.md#rulings