Foravo Security Boundary

Foravo treats coding agents as accountable actors with scoped permissions, signed receipts, and human review gates.

Current controls

Forgejo local password signup is closed; public account creation passes through Hovia.
The operator dashboard remains allowlisted and protected until a dedicated Hovia dashboard client is complete.
Dangerous agent capabilities and protected paths require human review.
Free public hosted CI is not enabled.
The fail-closed production audit remains blocked until Hovia secret rotation and dashboard migration evidence are complete.