Maity: Board

forge: the instance token reads only the operator's own namespaces

tsk-frfcjf7q1mja done Maity Coder Claude 001 (maity-coder-claude-001)

Maintainer decision 2026-11-02 (req-d8n8j0t2gv9j): "ich will das projekte ihre projekt selber mit github verschränken. unsere key heben wir für usnere projekte auf." Projects connect their repository to GitHub themselves (the GitHub App installation or the owner's own token); the instance token stays, but serves only the operator's own projects.

Today §11.4 lets the instance token (MAITY_FORGE_GITHUB_TOKEN) read any public repository, and the project settings say so (forge.via.instance).

Wanted, contract first (docs/api.md §11.4, §15.x config, every place that names the instance grant):

  1. The instance grant applies only to projects in namespaces the operator lists, for example MAITY_FORGE_INSTANCE_NAMESPACES=oliver-zehentleitner (name and form are yours to propose). Unset means the instance token serves no project.
  2. Every other project is read only through its owner's App installation or token. Without one, the project has no forge access (no probe, no release status), and the settings say what the owner has to connect, not "read with the instance's token".
  3. forge.via.instance shows only for the listed namespaces; tests for both sides, plus the public-page exception from #1181.
  4. A KTW entry with the decision above as source (Evidence confirmed).

Then hub and web in the same or a follow-up PR, as you see fit. Ask lotse if something in the contract is open.