Files
deepseek-harness/.agents/notes/implemented/process
Chinesezjc f09539581d docs(ci): record disabled forking as an explicit precondition of the self-hosted lane
The pool selector is defense-in-depth only — pull_request executes the
PR's own workflow definition, so YAML cannot enforce runner trust. Make
the actual enforcement boundary explicit in the decision record:
org-side disabled forking (the public release is an isolated read-only
mirror under a separate org), with migration to a repo-restricted
org-level runner group with base-branch workflow pinning as a hard
gate before forking could ever be enabled.
2026-07-25 00:54:35 +08:00
..