DL-508

The push guard blocks any write (push, PR or issue create, gh api mutation, MCP write) to a forge owner or host outside the agent allowlist, and every write when the allowlist is empty or absent; a gh write with no explicit repo is checked against every remote of the clone

Status: Active (compass-agent proposal, pending Matt, 2026-10-12)

Record: ../../agent/compass-push-guard/design.md#d4-allowlist-from-the-agents-forge-grants-assumes-oq-1-option-a