DL-629

Agent repository scoping, C (Matt, RIG-5942): an agents_grant_repository tool on the AgentGateway lifecycle family lets an agent give repositories the caller holds (what counts as held is the record’s OQ-1) to a same-owner descendant, all or nothing, and refreshes only that descendant with a targeted secrets signal, never the fleet-wide one; this amends DL-458 OQ-1 and OQ-2 (agents never write rows) for this one case, keeps the snapshot rule, and is not a security boundary

Status: Active (Matt, 2026-10-19)

Record: ../../server/compass-agent-repo-scoping/design.md#c-grant-to-a-descendant