The license bot service (Dcntrlized/license-bot) is authoritative: it amends missing AGPL headers into the PR head commit, including for fork PRs, and reports the license-bot / addlicense commit status. This workflow now only reports an honest advisory signal, holds no secrets and never writes.