Read every report.Read every report.Sign every verdict.Sign every verdict.

Yes, for the one pinned target. A TrueForge agent investigates the report in an isolated sandbox and drafts its own outcome, summary and findings. What still won't change: a report with no authorized target, or one whose repository grant has since been revoked, cannot come back reproduced or not reproduced, whatever the agent concluded. That report stays an analysis packet, and a person decides.

The agent's own investigation is the source: it works the report against its authorized target inside a sandbox, using scope-guard and its skills, and reaches its own conclusion. Two things keep that conclusion honest. A person has to approve the exact drafted text before anything reaches the reporter, so nothing ships unseen. And the server re-checks authorization before a reproduced or not-reproduced claim becomes a verdict: a report with no bound target, or one whose grant has been revoked, is refused regardless of what the agent asserts.

The precise bytes of the outbound comment, bound to a content hash. The delivery worker reads the immutable verdict and refuses any payload whose hash differs from the one you approved, so an approval cannot be reused for different words. Approving does not close the issue.

At the capability boundary, not by the agent choosing to behave. Clone, deploy and egress each take the target from a server-held profile, never from a string the model produced. Issue text, attachments and model output can never create a profile, so a report without one is triaged and goes no further.

Metadata read, and Issues read and write. Nothing that can write code, open pull requests or change repository settings. Signing in says who you are; installing the App is what grants access to a repository, and the two are deliberately separate.

Not for intake. Email and file upload are independent channels that need no GitHub connection to create and triage a report. Neither is wired yet: outbound needs a verified recipient and a transport receipt before a delivery may be recorded, so a report from those channels must never reach delivered.